1b951c4262733dce483d5f66464cf7b1a80799585aa81d29b2f390411c4ecc4b

Analysis

max time kernel
116s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 16:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_3e9bc5c27c169be11d8908be0df64f20_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 922KB
Sample260809-vgxpdascpa
SHA256 1b951c4262733dce483d5f66464cf7b1a80799585aa81d29b2f390411c4ecc4b
MD5 3e9bc5c27c169be11d8908be0df64f20
SHA1 cacc1b368027a994a2472ab483bf52ade10819d6
SHA512 e75f75dc1f570ffcbed8a1ace207187d2267d230fc0fef7787b8520706d9cca9fcc0faecc0eb4d5aa65a2442fd4f6d62069772f4f7e82a3c252c667f106a2e48
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3a:A3k03kHRJ
TLSH
T1F015AE03EB9400E8E14AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 47 IoCs

resource	yara_rule
behavioral2/memory/3200-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c537-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2b0-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3200-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/7112-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d1-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c71-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c0000000175fd-159.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018965-213.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018963-268.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a41-359.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a42-486.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198be-512.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bf-610.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3f-641.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c3-732.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-757.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-800.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-837.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c7-868.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-906.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-921.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-934.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-947.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-966.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-1021.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-1064.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-1107.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-1150.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1196.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1221.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1336.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1355.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1387.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1407.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1409.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1411.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-1412.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1413.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-1414.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1415.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1416.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1417.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 44 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c537-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2b0-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d1-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c71-60.dat	aspack_v212_v242
behavioral2/files/0x000c0000000175fd-159.dat	aspack_v212_v242
behavioral2/files/0x0004000000018965-213.dat	aspack_v212_v242
behavioral2/files/0x0005000000018963-268.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a41-359.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a42-486.dat	aspack_v212_v242
behavioral2/files/0x00030000000198be-512.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bf-610.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a3f-641.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c3-732.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c4-757.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c5-800.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c6-837.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c7-868.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-906.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-921.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-934.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-947.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-966.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-1021.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-1064.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-1107.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-1150.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-1182.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-1196.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-1221.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-1336.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-1355.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-1380.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-1387.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1400.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1407.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1409.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1411.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-1412.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-1413.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-1414.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1415.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1416.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1417.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
7112	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-09_3e9bc5c27c169be11d8908be0df64f20_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_3e9bc5c27c169be11d8908be0df64f20_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-09_3e9bc5c27c169be11d8908be0df64f20_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	2026-08-09_3e9bc5c27c169be11d8908be0df64f20_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	2026-08-09_3e9bc5c27c169be11d8908be0df64f20_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$	2026-08-09_3e9bc5c27c169be11d8908be0df64f20_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-08-09_3e9bc5c27c169be11d8908be0df64f20_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	2026-08-09_3e9bc5c27c169be11d8908be0df64f20_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-09_3e9bc5c27c169be11d8908be0df64f20_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-09_3e9bc5c27c169be11d8908be0df64f20_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	2026-08-09_3e9bc5c27c169be11d8908be0df64f20_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-09_3e9bc5c27c169be11d8908be0df64f20_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-09_3e9bc5c27c169be11d8908be0df64f20_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe$	2026-08-09_3e9bc5c27c169be11d8908be0df64f20_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	patcher.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_3e9bc5c27c169be11d8908be0df64f20_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_3e9bc5c27c169be11d8908be0df64f20_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3200	2026-08-09_3e9bc5c27c169be11d8908be0df64f20_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
7112	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-09_3e9bc5c27c169be11d8908be0df64f20_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_3e9bc5c27c169be11d8908be0df64f20_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3200

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:7112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 922KB
SHA256 1b951c4262733dce483d5f66464cf7b1a80799585aa81d29b2f390411c4ecc4b
MD5 3e9bc5c27c169be11d8908be0df64f20
SHA1 cacc1b368027a994a2472ab483bf52ade10819d6
SHA512 e75f75dc1f570ffcbed8a1ace207187d2267d230fc0fef7787b8520706d9cca9fcc0faecc0eb4d5aa65a2442fd4f6d62069772f4f7e82a3c252c667f106a2e48
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3a:A3k03kHRJ
TLSH
T1F015AE03EB9400E8E14AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 d47c7001e3f8d05f4306277b1c06f1c84549db0d742efeec4f71b3b9c19a35a3
MD5 940451dd709c389af9120dd2c1bf054f
SHA1 78c4664a68af496e4ef26ed6a8fe580fc44502cb
SHA512 49a75edec23a7952aeac3779b3fd6875a043cb8a3b7f83b802d4854579eb997b5f2d3d61af62a20fcfa65a8637c3d701fee756a5d861e9bbf815587c127635da
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3aP0Le5ji0hmxNrM:A3k03kHRJNPji0Aj
TLSH
T109658C17F6A402B5D067C1B8CAE29A5AFA71384217309ACF1354D7283F67BD19B3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 936KB
SHA256 9da0756585d2c4494b0cab859ecc9728ceb8060ca366f8246f84264a31a9fcd1
MD5 e59c2eb13319868cb6ecb91ee265737d
SHA1 10ffc4b6777152131b523389be18780de9fcd2a8
SHA512 748fa6c7dc91fe02c4fa31656cbb018f22e0217b9ab01c8136a1c5daf258c7855f0e629b3fc53196c34e0a459dd5e4b98934b20031112cf3c3075f138cb1d778
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3aRa:A3k03kHRJ
TLSH
T1E815AE03E79400E4E25AC1749AE69A23FB75BC12176097CF1368D6152F72BD0AF3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 970KB
SHA256 02ef564aaf767a99a77a5de09ce316df6511a54d83a31d3fd89681fd79b48f13
MD5 c5bc6febf557444a268a3a0deca6944c
SHA1 44fd2736e97a3e3f232c183dd5f44d23b49d6d47
SHA512 ab596901262a227b7295eb4fd56dcd4cba0ca1a0333b657ffccbe43381b30135ad4cfc68a8919d3a571e96e6ec960f3591eb626e3b7336aff0a188f94f3a75aa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3ayb:A3k03kHRJMb
TLSH
T1FA259E03E79400E9E15AC2749AE69A23FB75BC52172097CF1368D6152F72BC0AF3E365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 1.0MB
SHA256 0e0faad904a4b0943ef9e11a70489a98547ab5cf6d67c3adcf51b13181707dcc
MD5 adbf2767ee684844262105bff4b2017e
SHA1 11b1849a9df3f9e504ffc385be3cd1666f96bf9f
SHA512 ec0cd2519a0644a1f01c400755e78cc1041baff3d788994c558847788807b4fed02fc8b072a89ed7870ef70891c3f23b2563fd2826a12b421725e74a06e296a2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3akD:A3k03kHRJO
TLSH
T15C354803E69400E8D15E8174DBA64A22FA777C1117E096CB13D4E63D2F72BD0AAFA357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 945KB
SHA256 84b519120a7e46c33207bce088b84f2405413523b5705f04b655dd46d49b1bbe
MD5 a645f179bb00ad4c5beab15c7d7bff2e
SHA1 15b55397606cfb03976419b27883f8364acd1ef8
SHA512 3bea460a39799ce6dd2322c49fc944bce88816615344c8cda2fd5be6c458c5dd0015af6a8adc828d0f28dd195244dc43ab12b3e1faefd249a5f7e0ab7257cf22
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3apZ:A3k03kHRJh
TLSH
T12D25AF03EB9400E8E14AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 945KB
SHA256 1971b7477348e76ea90a8d657cbdb8e5f7be891056932930344ca6ec241e6a53
MD5 904cfbd64b16e18537e650e0b3685d0c
SHA1 cbcc2ceeb3adc82d3c66e97a1945648a7b3b5514
SHA512 0ac46268122171b0ec659b130bed0283d59102bfb43d4125a5f91e26de269e6fb0a19611f74b4fec00dfefa7fa7099d15620bad36a6f1517e92c9e21a2ac39ef
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3aC1:A3k03kHRJu
TLSH
T16B25AF03EB9400E5E10AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 945KB
SHA256 5e562d5d1e794976394f100432a19d5fd3a167468e21f31413b9bdd68608bcd1
MD5 2da75a6549974ac487067fca7f26348e
SHA1 c0be8345386fdc1e66dce5d3f12497ecaf7524e5
SHA512 b0840937878af83fd2d5e4f5fb550e64b713cc7e5b07ca3930e6c032a744fc4c061e53579312b9c6a2bf3267c2fa6ec42e252587b8f502eb7590e4ea1bb825d5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3ao6:A3k03kHRJp
TLSH
T13825AF03EB9400E5E10AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 945KB
SHA256 79411d18d35c95d9f1a7334bd9dbc5af61934c2f525decdb10f8d46e043ee5e9
MD5 692f62851030bf01c6c64730edaf6b78
SHA1 e89050714e5ed1c1768e1866474347b4a4f427e7
SHA512 80d9e6434acecabdd848a68254273b29d1c04fab4b87091c3d06fb6c605000c82bfbbfc49af8177cf7fdc1c28a52476eee9a051642d7e6416623835050a2dedf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3asN:A3k03kHRJQ
TLSH
T1B225AF03EB9400E8E14AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 945KB
SHA256 3e952c1bb3bfd881ee97662be2b3ee9ca6773225bf92e3dbbd5d2bdad7aa7443
MD5 1b1277a67c1b0a3d0ddc1d8b299a0a06
SHA1 a49df85731cce215326cc341ae1225de227b8a92
SHA512 95b446173e349347f266c45749e0985bf5426d293174a7d804cc9e43a0dd3f040593043685ee7efe0092cf25c9c7c2a4978030afb286bab730115de97e90cf46
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3aif:A3k03kHRJI
TLSH
T15825AF03E79400E9E10AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 945KB
SHA256 808bbea63639e51eafd6110fc436568e3642d739f9286ab35a9a36ec37370452
MD5 a13d0703338450b333b88560ea34da06
SHA1 218598d04bf116dad88201290474b3a4d96c0839
SHA512 acef43dd9d5004f17544e17a9004c1cc2bfa6c5125fd718d8dce0386ce9ec1eea7d636d6b6cdff96dc449decb7b83b2818c6aaa7c93aee48c8ce1879edc3b3d3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3a8o:A3k03kHRJ1
TLSH
T19425AF03EB9400E4E14AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 945KB
SHA256 20b32d01840bb263aaef74454e19640d6db692cdaf95d952cf26c91ff50fe994
MD5 4ef8eef71b886f3bf64fc431f29e7928
SHA1 4daecb23e0ba63e55ac33c4d923208cd6d0799bc
SHA512 e955b84d9fce78a1d5f29ca811aee27f1921e3ef860864c91335151e4737507c688c414ef30d4f99440d272f693d7574d2e08c4b717df2c2d935322077e4adc4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3acu:A3k03kHRJ3
TLSH
T13E25AF03E79400E8E14AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 945KB
SHA256 eb1f8c433c85fd1c5ca2f53cb30af9a3a621ca4ac687e7dfb463e59adfe7438b
MD5 f13230705d505b56125ef4634fac34b4
SHA1 6d979ead5d443afa49e796ed51407c6f87b685f1
SHA512 bf61d827bb24d62b4f213a22c013657044883301fa5576e5ba0d655ed534eb36bfb462a297f588df5baa4a3bd336afc39b4e9021f5ae6bc5f3f9b79b3b42342d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3ag9:A3k03kHRJW
TLSH
T11E25AF03EB9400E8E14AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 945KB
SHA256 10bdb602e79fe56d9ccb080334d75ad04c26b7842f521892d2cb79df07b63b20
MD5 250c8ee27c3356e2a077e59c4edfa0e9
SHA1 427a1660fce5eec8c3cf2041b855ee1136a12630
SHA512 3f03ea157481ee2bf7e1c47337104c7ce4d58ee63d4375ca7ff89c0e693d1276dddeb907f6c0542d5a2ea9cb606e74176c0335a9ba0ccde2f250090beece63c3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3aoc:A3k03kHRJ7
TLSH
T1E525AF03EB9400E4E14AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 945KB
SHA256 72d2b9c8394ed72c6a98af1bece94b34b861b51d6f900bd2273fa000be0f3850
MD5 a23e6239271f973dffa2cba3fd52416f
SHA1 11a59a543532e059beacead25e92af128a215de2
SHA512 15f69db9cf1f9346e26796203041723fa2975de8de2b5ee450fae8af10b4ea99cdfa6a2bcb880ba57e1b5cf10a9c95cbeeb204a7e57d825b5a73967ec5aff9f7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3aBp:A3k03kHRJ5
TLSH
T1F525AF03E79400E8E14AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 945KB
SHA256 643081c17ca7fd87e8146c798eb92aeb36d0410bda0d06af009f30c955f9e5e5
MD5 581c3882fabc28641509f6a2c8dc2ece
SHA1 d09e331759104070c3e30f2ec062fb56a58f2d8d
SHA512 945cf57b3873503f5b6d0a2b8c0b8f8bd4f32e1496209aac336e8e8f60c7b51fd289f98134bef6c8ab47a22a0d1c1cff7c5d80be4a930a83476059f3a9aef016
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3aWN:A3k03kHRJi
TLSH
T13D25AF03EB9400E8E14AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 945KB
SHA256 38a8321b00e2da2d0bdfa7b3c73d6d8b793665fc0690d2fe5687e27457823c65
MD5 0f212ddacf756c6e1571ac80feba8190
SHA1 d5cbf4a243d4bc430d06e5e3f0d6abe1cdfe155d
SHA512 0c2be9cf09de2d28812123d0b5d95a03f46f1ecfaa7041bf9049690dfaf15e1766a92cfbe2f871f211f762ccee678df10329462d555395e0d8e318b35bf43986
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3aaF:A3k03kHRJI
TLSH
T15825AF03EB9400E9E10AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 945KB
SHA256 ffe93485671866a417af97a8f25ef4c73ea70768ad19dfeba83269d6d285ae5b
MD5 3398542db7882f761273c23bf4828280
SHA1 46e4befef305c3c0637f91f015856f6874171ad5
SHA512 1ff0d649a31bd943b66d3d91900ffeb179112d795b2329952233e91f6fbc81268129a87962d270a84578c11a1ff2a7754ded576b162003d18dca7a670fe9a0af
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3avC:A3k03kHRJc
TLSH
T1B025AF03EB9400E8E14AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 945KB
SHA256 d441b330c8942cffe65bf1dc519640665763776ae0773e5392c4d599d33cb52e
MD5 0c547f8fd1ad1b18c1e3d6cd678aa837
SHA1 3455bdae4127afbde73f00e4e8fa8938960c9e5e
SHA512 89136d36d0b8df77f101ddde5b79e59ae8985bf3b337be569dfd0593a940236e898d94fde8dfc43adccd523a3afd9a856e18fb88e78457d680e271e2e5714eaa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3aQw:A3k03kHRJR
TLSH
T13F25AF03EB9400E8E14AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 945KB
SHA256 fcff94e6738b7e17d3819234713af0f38113c8017d93aab76e7c7fa69607ac23
MD5 84673486a40e7c54bab49f6580674834
SHA1 b561d2213aec92b329086c5ad32a561d51c4c6d6
SHA512 e33622a3639a1cd801d98d5c4b5cb31a87e0a1214891ef7e8fb60501968c2d9da16bfda6ed7698f4345adcc3d99fbc057a8ab69abcc7158783e149c01ee18d20
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3avT:A3k03kHRJF
TLSH
T13425AF03EB9400E4E14AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 945KB
SHA256 4064bc94dcf838e9a392db0323bbe4c2e952c6407edb2ade59dc0238a2b040d4
MD5 7e36d2a54942ff2e0eaab4a1a088813f
SHA1 3892cf0cb86850333c916c32091c7e6c7b3c67eb
SHA512 a652a635c5f848f19d136ab7115270fedef23d77e48a1cebcc27a3cd3e0a205a7404f4c14d2809a332ba7254a84887f9e593dd363d20ad397eb5f17d1b32430e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3apu:A3k03kHRJ6
TLSH
T14B25AF03EB9400E8E14AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 945KB
SHA256 4750d59a90a962f5864e115d8272ee2d112ff57ea19172fea2e2893b62bd40a3
MD5 606c63abf86ed8320ad3291e96c704b1
SHA1 b9285b7c25cc0b1ad56dedaa42238e8d92b86f35
SHA512 70382312951b277c0c6ed1dca5bf9d306fe81c0ee387fd5ed468824261ce5629e0741aadf6f9a16a3a4786123611830c65a09b8206ef0529b3537bf843d6a9e5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3ahb:A3k03kHRJb
TLSH
T12925AF03EB9400E8E10AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 945KB
SHA256 7fae4b4cb539022f74ea8c637000e0011326939bbccea1520a1939cabce9fde7
MD5 df3d345352a9fcc2aa427661399ddd02
SHA1 dcf675d98ab5ca040d81896907f3a97b1b30a14d
SHA512 3d6c10c7148befd10f5641368563f308a9db459921a114ba8ae7f67d25b117b9ea992f8044f054048f9ebed4566e2db6917cf01f8690a8d23f362877b9955db3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3apf:A3k03kHRJj
TLSH
T12325AF03EB9400E5E10AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 945KB
SHA256 dbab13a9e8a65d3e25a958f1392c3719c7d0f764d216693f457e23329de51357
MD5 1c98b2fb2756cf0d56865df55e5a1ffe
SHA1 be2ede5923f949ff6d68891a548c58c580549e1c
SHA512 d1f37cd2fbd161bf93c9a204d25fc142173c2b8d03d312e3183a8beddc8c2296a74d43e5bb02aa9187172667b869915c83504dff779fd1c22b56bd5d158663a4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3aSK:A3k03kHRJT
TLSH
T1EB25AF03EB9400E4E14AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 945KB
SHA256 0a9f99ce32d06b39e24d61bdc383db3d915889257d83d7849e276cbb835fd56c
MD5 e83c6f300a35328f482ef52a1ee3b2f1
SHA1 7a6a6d3188b4a090bdb04934ac97f172d601fbc1
SHA512 c1ff3f5d459593d1c85da6633a884ad7838805a6dacad87472bc873d5d1fd50641e66d86442fa86ccb6031812a4e185932c346e8e4b610608ff0d1b946688432
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3a3k:A3k03kHRJ+
TLSH
T15525AF03EB9400E8E14AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 945KB
SHA256 4861de0dee5ff7c6de89870501497a57fcf59e4385da9587b68cc93f711a3ab5
MD5 89689e7b8fe5ed9b567a590dc372c2b8
SHA1 d1d398b716cac67e4a60e66cee9cb12f0d8b6d96
SHA512 693bcca0e8877b7ca55c0d66dca93e500fe0000fe7c35e9cee8f37b8c87be7a41e48f44ffa302c61825ebf5fa39498607567e2174b8bcc4c214facd5de2b9e99
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3aA0:A3k03kHRJj
TLSH
T1B425AF03EB9400E5E10AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 945KB
SHA256 3bf6a479ec2f35306edba4839c67efe5b0f5154199c2579924fcb1cfc8b0ad3c
MD5 5ae1950a051cc22f8767afbf8559ef93
SHA1 1496ca684eb89b7fca6181643b0e11bf0d4f5aa7
SHA512 6df97fab79c0f7e6bee034c45d09e5a30152eedf73d3acdab64f5da4bd1858496075378f16ef53869cf09e95ad43330e3025e6ad74de9deb0241e14bea983632
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3abg:A3k03kHRJG
TLSH
T1E525AF03EB9400E4E14AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 945KB
SHA256 b8aa281eea784b15d22dcb23e43b41c1c20ba9f1333f8a7c74cd1eb226715807
MD5 3d408a6953aa993613a7931be538c79a
SHA1 3aa187f847e5b57c6ab7407edb26a9bf062639ae
SHA512 0698fb3bc21fa1d8535c1771d1ca8ceacb3769e5d6c3fe1cb341510749d75cb1594f0156ed8e297df230e0423bf952340fdb27e17edff7f79e380acf6b13d85a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3aWr:A3k03kHRJI
TLSH
T1D025AF03EB9400E8E14AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 945KB
SHA256 a37ce90a624acc0b552b1910eea3011ece0800b1416ba0a4417c1e779f026ebd
MD5 087f216aff759fa217f9b40f91589cfb
SHA1 df7e52427c04a9e34d20f99e1bbcfec92b1d4986
SHA512 c9b62583361e10d9995ef19203700f7087b6c7ebb846c4c41c90b39aa5d231662de9c6019557d1bcc32ba6430b68d102ca1727024e40aa22eb705530d500555a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3a8n:A3k03kHRJq
TLSH
T1C225AF03EB9400E4E14AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 945KB
SHA256 683354720bfc7a792ae6df53e6aca2168757ca6a3623ce57d7940a371627354a
MD5 8161d49c04ac16c7325491471468102f
SHA1 f1cf97469682d740f8cff03c61d1f50790432676
SHA512 1b3c94f62131a40f33a0141e8d1ba7b35f6e08f2f048c057bdc48bf96711dedc570c6d24a09579d21b1796e6a5eccde43668799dd53fa81c7ecb34d3c2e59853
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3a6x:A3k03kHRJI
TLSH
T12125AF03EB9400E8E14AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 945KB
SHA256 ebf8d230adce3cc769b2a8095a9cc343683ca11ce2543e189f07618ee07892cc
MD5 91ca38c412e8090649ae172e7d2a5205
SHA1 aac53de662ad268346a39c9eeaf6043e6a63f869
SHA512 a63276b7656f16cdef3081162cd673ea135b5ccdd1e4f6ef233037dc537763c1a28219762f14fc6d99d16cd955dbc01453776e9b19c1e984b82f8bd860138e76
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3a8A:A3k03kHRJL
TLSH
T1F525AF03EB9400E4E14AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 945KB
SHA256 7a7b452fd958e5f9b56aa51eefec099ff6abd4c7258147d95c65396b4e883cd1
MD5 8afd3be21a0e629b79d2a1f764476489
SHA1 d4d196f04757a84136d60a6f0bacee8ec64cdb9d
SHA512 8e98228f23d43622d9cc0fbb2e6d3827528044b44db634f3bd209ca52fb71db760148b6b973c3f76bdcd84f0f91dbf10a2fb7d32b47efe89ab028cbfdcbcba57
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3al9Q:A3k03kHRJG
TLSH
T19925AF03EB9400E9E10AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 945KB
SHA256 65ab2ce0d4d434a573a0469f8a2b30446295bba5138d7b206f7abda1c7d7646e
MD5 c40c2578cf5d5b9596b801a1c2b1e462
SHA1 37bdd20cb83e5e5974fded97a1be6d9d02e64941
SHA512 45986a6b97865ba431083f9f6541bfd3622392131bf49f1639a5ab657bb923f69088cb1b07c4b2ffce63f15181e78de39ae1a55afc31634c6ddf3d376c808307
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3aQ4:A3k03kHRJV
TLSH
T19925AF03EB9400E5E10AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 945KB
SHA256 4249b02551a23946058b36bb53cf992cb4659019bc76c367b1b4e1e29228645a
MD5 c85140154f57d3c98b2c474300982688
SHA1 a66fbc57ba8d44e7d26b378c3febd908076f7350
SHA512 f57bfab8e896b0982add2e4b1a3541a134a15c7379973c63f6c5bc998aa133ae106f8ae6fddb4896ee3b99bc57e3a7821798ad09d9bfbdd3cbddec83ac41f236
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3aTu:A3k03kHRJA
TLSH
T12925AF03EB9400E8E14AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 945KB
SHA256 d5a0ee8468f137c1a0b9bb719181d4f8c4a3d44380f22eeb4a85ee4271f39505
MD5 c023aa09cba80a196457cc671e260352
SHA1 386e4f44b6d082b60efd065afc7686d42d62418a
SHA512 0edf457b1655938bbeea9712a946f4afb44f37c53bf4f4d9ae7c434914f2114dad321f5e309b4042c0827ea7825466e66cb779b375148f3edcaf1f2962c34439
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3aOj:A3k03kHRJa
TLSH
T17E25AF03EB9400E8E14AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 945KB
SHA256 4d6f41044a7bff84fab79e577c29e6cc9999fe65144cc60673773a911335dd56
MD5 01f0c526ebe197b912e5606c7423edfc
SHA1 d93852f0b4f5f7319f1ddc6c1cd6e2298e6601c6
SHA512 7b03cc5a40be4cacaadd2465df89f06548d4fb797a141ee5140da912e76c8f8da82055a7560aa2510ef8da72eec9567054b8e0586a94e810dea336b75fdd0faf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3a7g:A3k03kHRJu
TLSH
T14825AF03EB9400E8E14AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 945KB
SHA256 175969efd76eb258c7151f0ae29e1fd91e4a57d3dae1f02d8ef67233201cccf2
MD5 78032003eaf1656a4cf08a24060e3c10
SHA1 7bbab33e1bd8ac796627af4cbdbca0bcc13de468
SHA512 13ba282a5e93427ab55759f0dde8ae2c5e469059061f2eeb739c950664ee0e65235e8212ce155fc6112b6fee87195afadbcb8e62371f00e68e7401f7d0cbf278
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3amI:A3k03kHRJn
TLSH
T17425AF03EB9400E8E14AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 945KB
SHA256 62f193ff6eeabc18b7130d40c0fcb3a598a2aee61387b4da72853592aed54cc1
MD5 39fefe1f274c7e4a2cdb86ce9c0b0aef
SHA1 0ee35ce888feb1f4d92e7b86884280b1f006eb73
SHA512 28d6c8af8aa45b3bb054fd8479a835ee802f64186722c4a3902ccdf724adfb8c1c4194d78986e4ae1da2c1d5f62de7671a29f6290506b868aa3f518a4db74207
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3aUo:A3k03kHRJh
TLSH
T18C25AF03E79400E9E10AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 945KB
SHA256 3d2bed46b58c407595c954df46d3c76026cfd2b2058a27aacdb0bd0c23e39f07
MD5 62ec5ceb1f49c0f974cac339317a5093
SHA1 7218b3abc538879730b85832a9b0b73b58d558e5
SHA512 83ae9de7ef5d75c2062ec05993d8ca221dc4ee4aa8e4b8b6f921ac0f42d12f28b0213186d0968397d5cc8461d853b1028760ac49e467817dd3ffd0df4bad1126
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3a3+:A3k03kHRJk
TLSH
T16425AF03EB9400E9E10AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 945KB
SHA256 9f5e9802fe50d194fad0ed449d592e14cb63cba98970d1e66cf8e09bbdf73862
MD5 63e9cf3ed4a5102dd0989269b7870b7f
SHA1 3b0e3c2c14d82aede34f7c7a36021da0df2c2025
SHA512 66166ec5e42f4fa3d2d88b38478825f125991d3283b95e0605f612bb4a426900361e1fff6e19546f3d015346f72df7e6e43366b82b5016022f5d29df6732dbe5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3aNQ:A3k03kHRJs
TLSH
T1AD25AF03EB9400E9E10AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 945KB
SHA256 6347418c7990990c5dab29ba04729339cf77ba7f9b285105c549dd53690dea08
MD5 ec180f4fe253c8ef980102ad7899da95
SHA1 0f0876e00b62ca77ae55f26b1f288d7279404a17
SHA512 18b3b6e33584508d8a6f0e0dc7e21328787921b1a933bc6ce4905ede42115aad782ac702b0679b4e43481386d7a3f9ac50a315952e19acdf4a421c1945eea157
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3aCX:A3k03kHRJs
TLSH
T1DB25AF03EB9400E4E10AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 945KB
SHA256 9b668b1a31c9f7cf331268bcc096d628f57efeced70ec01d7f12b72fa73857e4
MD5 67bcc89ee2489914df0d04aca82fa617
SHA1 733daf9fad3c6c56a6f748e85f24cd105154772a
SHA512 8989f79c34ef65bb6f0d9a19fd90b19c54774f56b3ada16359dccc707b9520c954fb310b37337d39627d8b5c557c7d4adab68eada29aa25e92c77bb9c3ed3fae
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3akL:A3k03kHRJW
TLSH
T1CB25AF03EB9400E8E14AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 945KB
SHA256 016c6ad2715197b9e4c4cb4d847939be8fbcf9bd70a0f4f6c9d16333fefee23c
MD5 7f2ec4c1dd0b3fe6cca8bbee35813a93
SHA1 94053881a1c097a8177a38967787cb300b73c4de
SHA512 8d558bb2bf5cc666970adf3ef0b9850f7477f752af38ac06d9fa13cdd5997d9683ca55e755bcb7a669df4ca60f8d1bcecba9f9617ce756f405a271a308214b2a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3aAM:A3k03kHRJT
TLSH
T14E25AF03EB9400E5E10AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 945KB
SHA256 f0fd118d48f3373532b8bd3303d7ab4756c5657e183afdb482d395a65a067686
MD5 f2389498ceafc9c86e258414f0d27468
SHA1 bd73b2ae147101ba7032ae18f624fa7fee23716c
SHA512 0ca1aeccdf814f243d4ee4f14d766cffda83fe35091e850b01a0a1402f19b682627518cb668492b50b3be3c292bd1531a5babc91e33b648b1e343203eb2a2eb6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFB3ahh:A3k03kHRJN
TLSH
T11525AF03EB9400E8E14AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3200-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3200-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/7112-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads