683b97b620fdf956b4107323556fc4fcfb76ea150bcaab10dfbdebd78091ba89

Analysis

max time kernel
100s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 05:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_ab68dc8d1111e78ada37b28c85f82bd1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 946KB
Sample260810-gpdpksed73
SHA256 683b97b620fdf956b4107323556fc4fcfb76ea150bcaab10dfbdebd78091ba89
MD5 ab68dc8d1111e78ada37b28c85f82bd1
SHA1 02e9bb3d6d7b68c1eec944066ae0691738c7b75a
SHA512 0a90bcb14fc686b8dc4fde2696595d4d26a653dfebc18ef6351b4948c5a5fbce3b5954314833babd471d83786a18e8c8fd65cd2bc7d3efe47a2fccf8c1bc2897
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKj:A3k03kHRJARJ
TLSH
T1A0259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 42 IoCs

resource	yara_rule
behavioral2/memory/1960-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c561-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1960-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2344-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-223.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-260.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-447.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-496.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-587.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-625.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-717.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-785.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-822.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-872.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-904.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-924.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-999.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1042.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1079.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1128.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1147.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1172.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1288.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1333.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1364.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1401.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 39 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c561-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-223.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-260.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-447.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-496.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-587.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-625.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-717.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-742.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-785.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-822.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-853.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-872.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-891.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-904.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-924.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-950.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-999.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1042.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1079.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1128.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1147.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1172.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1179.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1288.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1333.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1364.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1371.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1378.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1391.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1397.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1400.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1401.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2344	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-10_ab68dc8d1111e78ada37b28c85f82bd1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_ab68dc8d1111e78ada37b28c85f82bd1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File created	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File created	C:\Program Files\7-Zip\Uninstall.exe	2026-08-10_ab68dc8d1111e78ada37b28c85f82bd1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	2026-08-10_ab68dc8d1111e78ada37b28c85f82bd1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-08-10_ab68dc8d1111e78ada37b28c85f82bd1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-10_ab68dc8d1111e78ada37b28c85f82bd1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	2026-08-10_ab68dc8d1111e78ada37b28c85f82bd1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-10_ab68dc8d1111e78ada37b28c85f82bd1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_ab68dc8d1111e78ada37b28c85f82bd1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_ab68dc8d1111e78ada37b28c85f82bd1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1960	2026-08-10_ab68dc8d1111e78ada37b28c85f82bd1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
2344	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-10_ab68dc8d1111e78ada37b28c85f82bd1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_ab68dc8d1111e78ada37b28c85f82bd1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1960

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 946KB
SHA256 683b97b620fdf956b4107323556fc4fcfb76ea150bcaab10dfbdebd78091ba89
MD5 ab68dc8d1111e78ada37b28c85f82bd1
SHA1 02e9bb3d6d7b68c1eec944066ae0691738c7b75a
SHA512 0a90bcb14fc686b8dc4fde2696595d4d26a653dfebc18ef6351b4948c5a5fbce3b5954314833babd471d83786a18e8c8fd65cd2bc7d3efe47a2fccf8c1bc2897
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKj:A3k03kHRJARJ
TLSH
T1A0259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 f72ff3b0fbc9751e262f28db5f7930b1a367795ec50cf83cfefe7767f7424f07
MD5 775fbbc6f178c7174368472077286412
SHA1 515d9f9fb68989928e207a37338928be9f56e949
SHA512 2ffc71732c56256acb54a275ad4313b0ec71785ef1a68b9a1ea84d518cb88773a59d771dfa5e1d710766bbef6e23a2bb8b903ecb6615dc6ca29de9008ab6ce51
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKjP0Le5ji0hmxNrM:A3k03kHRJARJ0Pji0Aj
TLSH
T1FE657C17F6A802B5D067C178C5D29A5AEA72384217309BCF1394C7292F67BE19F3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 970KB
SHA256 d66997070abeb926cbad52d33a1f3865c634d3c47be4c3237a638dc51b16a585
MD5 5830fe8a62da77dae72df9c07e917ff0
SHA1 71dbf48613931a24f9cece28ce3c34bf7344207a
SHA512 c90c43730e49cf176cf302db92fba61a6a8ccad08dfc3c7140e6d2a5498731c39a7a7298c6e17607020ecdc8e3a6d77e919285bd7983f478bcc7b1c5e843523d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKjo6:A3k03kHRJARJi
TLSH
T189259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 970KB
SHA256 a9a0a5e7f857765f1af1cdc5097e36cf4b48401f1248f91754c1ef3974e716dd
MD5 c8252eeaeb5d57ee0a27b58f1f6a8c06
SHA1 7bee106753bcefe015e57a7a315d56b2a3e51211
SHA512 97d4f9ca94c0a00d9322cb64a674cd2f39ad33ecd38e699cb480fca0a7631b9f85674e6fc4b9f805c425b2f9d5ed58a2241c0e4dc6c7eff9d7cd86394920a267
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKjsN:A3k03kHRJARJL
TLSH
T11D259D03F79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 970KB
SHA256 622f1620c6d314c59b79fe117b258e18a850d2e007c766eadcd436a72c0b7ce3
MD5 9d1b07706a97c5909dcdd61c90a95610
SHA1 61f50a9529a56f0b2dedddfacc9ac3f465234085
SHA512 bcab561fcaae9759d4e10c59cbcd13c8602ee3f5ad79a483410e8482bddca625b6d3437ac123c1c8c2ae14342c2034ca696cb9b1e2e0cc68cc0310762c6c0723
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKjif:A3k03kHRJARJP
TLSH
T162259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 970KB
SHA256 1c9b68d5f2d3660225d979845e4ed2f3d62c309974e09dd49491b020fa24b968
MD5 5474e5915b4edcad96db673fb04202f8
SHA1 50391ae619e3ee73e18277ae554219989daedcc9
SHA512 a4fed04e8b83d436c93fc3a0c34a245ee26a6800651da0eceb9d2aa5ceda2489af6807312bc20c69874580ae99f536e9a930bcef2405d0c23855485ba9a970fb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKj8o:A3k03kHRJARJG
TLSH
T1F0259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 970KB
SHA256 61828590d653c90fa115b18b68e1c070788f10175ea328eae81b88ba49ca85e7
MD5 dfeaec1fc53965ec1f0f8592fb154062
SHA1 750164bfc8fc6ef1d8c03205688564a67baad75d
SHA512 2a49aef9ac103d08be35778c73430cd610a7c8e166217e1cc20433ff3eb61330d68c2ce9012fde344b4e02f5a91bb2d9606af677d243eeb5cb97f57065e4029f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKjcu:A3k03kHRJARJQ
TLSH
T163259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 970KB
SHA256 9f3b876e1d9c901a60d7d6d8521f46c15384fe41156d5ccdc2cf9f8cb9b469e7
MD5 36a2e9b4ab7f51e36749bc00129bfda7
SHA1 7cc330ed4e59ef3e32a2a6daafda2b7e45b9565c
SHA512 a78ae5cfa32fde83e33526ee1e9471c4513b111718cd0122b603c30d21a23a1d5acbf961e49b82f4c6bdd0114d89891d85332dbbf8ccdf8477d973ac648c6b23
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKjg9:A3k03kHRJARJl
TLSH
T19B259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 970KB
SHA256 8e7a30e8a29f028c8029ffebace96c943ea3def4e9a4b5cb0888351be23c05b2
MD5 5592b36ec10c052ecc76e6a5d964318e
SHA1 d4f57f8f84c050314f8e91ba3fad5ec16feae061
SHA512 d2d889d2130d70202687b3678b3be9858d40e45225c38c3435d45468fcb1a43888ced915f69c8f839fdd924ff27c73064e0afc56f0da5ae1607e456d98ec18c6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKjoc:A3k03kHRJARJg
TLSH
T119259D03E79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 970KB
SHA256 b7509ccd7ca3d12faf684873dc6f6129a172431c3a4ff164a17725de982b8d8e
MD5 f6dafa2980b0601713490500e22c228c
SHA1 dad5988f1e7b4db96a03cb32e76269fb3a6e8597
SHA512 7a1d5ef99f9e4239ae79ce795f7d7c82e85bbfa87ad27cb9b8e339c5dc52797ceb7a485193a23e010abb78e94513ba9cdd6fa25b7dce51eaeafdf7d140336875
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKjBp:A3k03kHRJARJ2
TLSH
T1EC259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 970KB
SHA256 151d3cfedb6a9fcb128923f958addc07908e24910717ccf66be2d6c3f647ee8b
MD5 d86cda063baae4ecb3cf14c5f27cdbb4
SHA1 a6d95a2e9e8bdbd4098e00beb63ff3f02f7f4a65
SHA512 293e94fbd8c7a6e496297f3adc945413b5766046e01b8cebf982e918e526f7cd8e420b5ce474a36518889919ba781033eaa6c147b56d368656fdd47c9edc99a7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKjWN:A3k03kHRJARJ5
TLSH
T181259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 970KB
SHA256 eaaccd4291bb92f07e06e09e0c610779024824ff45f758c5713375cba0655c39
MD5 28c23c96f7cb1ca1bd170fbd2f6d3635
SHA1 3ab6a86c48c6fbebd4d91bc04a038c6d63cfc594
SHA512 1bbc131e63e168358180c2c6621fba5d0f97b57e42850780fd1716187d88336fa0080363b47777234483a872640496e73ad467d1fe87cd8c2c35d2dcfdc38d72
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKjaF:A3k03kHRJARJr
TLSH
T123259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 970KB
SHA256 00b339e9aabaff1d5eba8a01878a15a9dd3f445285dca804a255230729b35d17
MD5 3254fc8f2b26fe5236ae3544a00fb369
SHA1 7ca55008eb61f3e5fc6a6979f7c10611e5370515
SHA512 029895d3c495c4527ed6c0b27f0664a6917924a952d3605be691c81cbb058179665bd13232fd88c5693ee28bcc779d7a22be8bfa81ed858c0132a5b366267b6e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKjvC:A3k03kHRJARJH
TLSH
T1EC259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 970KB
SHA256 f83c456250e18042e13a2635f1d39c631ee189d188e344f93292c89c04989a95
MD5 507c87497be560a8a4dd662e8145a053
SHA1 63c706ea752bb94c367deaaef2022e46cace42f4
SHA512 dac6c7e32a1be435bf85f0bb7739b5c7c06fb25bb08e41580cb617c92b2dd9e9f3f8afffbdb3b47891321960d0ae4ddd0affbf8c5f31c8fad4a5d297f109f749
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKjQw:A3k03kHRJARJi
TLSH
T1BF259D03F79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 970KB
SHA256 df74ddcfa9219ba7be0648791ad792316fabc98d997cfb105fa0cd1ca32e3848
MD5 2df529f39c184071c9c4074eb3a513c3
SHA1 8e0282597a7c475fd32acd02a5cbc78a699ca855
SHA512 b1b86c9e213043abc7a3b93ba75428e55b63a1b84ccab5837ecc54bf3d214986c4696f76c81a3679ebf735c02993563e5220d1a284ff5ce09056e7c943654076
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKjvT:A3k03kHRJARJS
TLSH
T1E5259D03F79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 970KB
SHA256 37f0ac8826944bf0652cf82fc50e51f59a86eac7cc17046340978950782f96f6
MD5 006b9425a71bfa14c795433b6de51bb0
SHA1 9b6d7eeee8c941facb4fcbdeb61b4756c37b3eb7
SHA512 59f702fdc7a7ba6e1c579561d260141826c08f1deb43871cce8050dd008603544de6f35f303801b82a7634a73e9ffc5781ed36fc4f4a8695483f7817bec7e47c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKjpu:A3k03kHRJARJd
TLSH
T1AA259D03F79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 970KB
SHA256 865118084493e3b571bbbc0d7d3142703654d98d3821341ff3427ec9cd4b02f9
MD5 92072e82879aca633f79e4748318820f
SHA1 053869ee3001f818b2d3002a1d1744c1908e4a82
SHA512 26ed36f6f848a789786d6d51c18b18da46c67d062a62beb555684f62c0bfd17cd179331529f5134836b0798e612dc463981f3677ae9b5693c51fb70fdff8e589
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKjhb:A3k03kHRJARJs
TLSH
T111259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 970KB
SHA256 c7aa2d3bf52b0fb0aee746860df311c0068c6cdbe40235952828bf24d2a8a21d
MD5 28986a4ac5bb41ab189c453e91c0549b
SHA1 4c28e94829612aa0fc6e28cd95b7e1825cf7388c
SHA512 8d805956dbaff900bcae375fb818cd6d8454bcc8300ff7e1d155334c58e01d6c998636eb2bafe89a299b130f65009872f36b5f6ef67002e2a30602c07eb6c333
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKjpf:A3k03kHRJARJs
TLSH
T186259D03F79800E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 970KB
SHA256 225c3617d2fc86ed45f491a0f15d157f8195bdd385478c8cc7b8c90f166591b2
MD5 414007972d446ab7f5c2a6a110baf689
SHA1 dcf2af253666ebb7136c9c9cb5da1cd4a874f653
SHA512 3f0611354e760ff90ab28a8353e29579f358b11b7f445c11b9cdc4411f73fb18d249ee3d32aeec3a65b1a41b935220e3dc03ba24907317347cb4b9d32dee4756
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKjSK:A3k03kHRJARJc
TLSH
T16E259D03F79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 970KB
SHA256 987fa2cf56d2f67ceb27593f3b7e79b5eb6b034d58d4e45d55d285a6360934d0
MD5 835622953bbce3f344a349f083d84b0d
SHA1 6b76fa7c8d7b240f94732e298adbc385c29c7354
SHA512 255071a15adc78f829a8354115bbdb5350248421f635a4c4838c074ec645eaaf469b7470d27bce64c1e149a98ea7b10988a2483eff47b4bfd155399ac025b562
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKj3k:A3k03kHRJARJl
TLSH
T189259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 970KB
SHA256 add2026bee3558f804acb9e51483dedfade5042b24559eadafdd3d5c46e415b4
MD5 9ce0b949c0748c6560665dc6e6b8788c
SHA1 5faa7b0b34df0534f89b25846ea1681391a02f5c
SHA512 f436703eed9469e26b0513bda212286b3a762d1b9b8982c78214f923cc3bd241332988da858975f0a1603b7ba311c11f73e262d016138f4981dfc55e9fb48cd5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKjA0:A3k03kHRJARJY
TLSH
T142259D03F79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 970KB
SHA256 833ab92f035392c45dd79c7de855de7bd0fafdeeaa4806062e8ee36e64336061
MD5 bcd440fcda6af07a4dddc8e48085fea3
SHA1 868d73d736aba55056703cb5a713ca6fb3c02470
SHA512 754cfba14b1e4886e8f7c625d749f0ab1e4267f03184451bfe8f34b4f806d89f31100b0578b79546a5f91ae6e2d7cb90e90cf3384e4ac9a26b9b1c87c3bcce38
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKjbg:A3k03kHRJARJ9
TLSH
T10A259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 970KB
SHA256 df5958d1d4aca400cd7afc338270ee61b469926b8fbabfd0f2eb2d79de1c11a9
MD5 62469ba44e8d8e5bf729ff40f22c1a2f
SHA1 f20578f55214bd04d2fc1dce0b316fb65979fbc0
SHA512 641c8b8e338fd33f5ed2658fbd375626751f3e3ebeda81532ba4ab98ca65d3609ed8d82c3beae7a156f60355b4e2cdae8f0003ccb2cf37a4550933703d522f68
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKjWr:A3k03kHRJARJ/
TLSH
T12D259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 970KB
SHA256 f14eafe8aeaa695b9302ac7eb1a744240677db9532e7c188ee6699cd34d86131
MD5 bced56fa278e322d4b1ba68fe9f05579
SHA1 9d932b5fc849da9958a3f5b4573b2fd4b129b66d
SHA512 69a1b9afa660af2d434b69710c48b312981f02dc3a128bdbc5ca532e9d2e7b4e6c0f7def34fcf1bb37f6e89bcfdcfcf3601d090c5d5cd83378d63fdc2a06bfb1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKj8n:A3k03kHRJARJ5
TLSH
T13C259D03E79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 970KB
SHA256 744c00eab247ffbd460f4826312374ff2b3d4d1a4682ce3707de3fc1443580a2
MD5 df38e7829859cf96e5dda2d8ad229e2d
SHA1 8ad811f6aca0e5782e2443cdf2c93ac67c33a63d
SHA512 cca324124b4c6657a499a3a8336e483b8b1aaa1184ad97391b35251ee05935686c7a3161df47096208318e679a74075f0480945bed7cf56d0608fd7871d051ab
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKj6x:A3k03kHRJARJX
TLSH
T1CB259D03E79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 970KB
SHA256 9011fa25fb96c4ada31d7a14cc006bff02a6343aa091dc53465f9253d45105a7
MD5 b9b996ade099634ccea1b79451186dab
SHA1 00d7b652277521687b561ad35deeb93127ea11fd
SHA512 4e7dfa7f82dae8a6b0f02e5157560abdf97cbdc56aaa4483f6f81793be1cf1ce553e89af020329be8c6755db9b164e7ac1d8337ea376825f6586d98e5a292b97
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKj8A:A3k03kHRJARJY
TLSH
T134259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 970KB
SHA256 566efffbf9c094e1ed7657d7a77f095aaf8ab04f8d03cf26c2ce417df673ce07
MD5 00f160f2d0c15f706ec42eef21c95f57
SHA1 1a818b65fa98a9a828b9b1bd2f6d270a8d0fd01c
SHA512 36d38107a95e399d4e10fdc457db94ec4e915706c393d116a808b99272ff73f4dc93b9a60041b24bef672230214271254e012802ddd35bb702f6e8bf12608ff4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKjl9Q:A3k03kHRJARJB
TLSH
T1F6259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 970KB
SHA256 c7ce2179c990204b3693974230093151e168f10b96e8394ea1093963fe5ba7b7
MD5 27f8d1401f78d320cfab449dbc8ff27b
SHA1 80b07c92c5742fa8ef52aff2c9ce84d5251da28c
SHA512 ecf5bcf560916d17d9b473b5228c7e66df4b4d8b8c8e40825f4060f46327d91a97febca51556dd0ad68db8e0d043ae1be32ab669057f63b587360a5610399698
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKjQ4:A3k03kHRJARJm
TLSH
T10A259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 970KB
SHA256 7d4594ddc1eabe3c244b0ca6a8df4923b4557ddf38306c53b70d6761f43454eb
MD5 87bf471d02895694a12c746993c2fd74
SHA1 b804e4053b321b14db3e1dc6c8d914ad70f2b558
SHA512 3f9e182bab7afb669905a6587f021138d0c7c2672e7331b6c73124ca16c49e6bb984f8097568c6754f53604025bf5dcbbefb0fb24f07b0625490d145af677266
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKjTu:A3k03kHRJARJ3
TLSH
T181259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 970KB
SHA256 d54fb63243a5b218fa12a489917fcfc3b81aaf4ab89b555d16eeffc4e27a0ad0
MD5 54cc84ac15faebedd0855d265aa8e5e0
SHA1 6a7718c9e5385bb079cefe8311dce35bfe1cadef
SHA512 1efe6e57effd88a3142d4e0a5a0f0e0deb9db599c752928bc5731e5130e49daafca0500b555d64c79f2c5ab8f27dd9f548e7544dd8b33475ac84af2520a91979
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKjOj:A3k03kHRJARJ5
TLSH
T1E3259D03F79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 970KB
SHA256 7b6a968512ebd7399cb15d355ddd6007393370d1a464136a425343773b85fa72
MD5 dbc86e9747731eea0578f4f337a9f540
SHA1 3d2d80a900c3e4f062cf94369e9aa0ab1d8280a9
SHA512 e22631793f973b646613d9619770e42f1a5b53cd992ebb135c54e73954071edcfd9c853a7228a9400be3b244cdf08e2a4f810fbafee0e5650268a211eedfa2eb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKj7g:A3k03kHRJARJN
TLSH
T15E259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 970KB
SHA256 9bfc5938309f6e8705fc7286660e06f585dc4a52436d533de0320ddfbb5c4fe4
MD5 b27e8c372f817c22eaf77fe3fa12e0fb
SHA1 66ef2113e82849cc8a93488d63ab116afb89fedc
SHA512 9d6bb8e8b577c58df9af03cd001141627ce7ddf0a8155f2a57e1935a67286dd725b9b8884e1000f9631dd8d774da8df4986ca3b7e8306b2a53bab1ed3ebf19c7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKjmI:A3k03kHRJARJE
TLSH
T14D259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 970KB
SHA256 31d9ec54b748db369984e974e00eea5df6034424c11d808dc5dd57207e9e82db
MD5 c0045259face72f70444a3061229d7e0
SHA1 edcfa538d6e6d5d43194d93a83d3d9d267b4fcbf
SHA512 01f0cfbf2c402dc5445a25d48bc4d14504507891d45872b373a4ce624ee2f32d59beca37a02f91f5f122ebd3612fbb3ed2e6c2e02078f8e235ea4cb2a578051c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKjUo:A3k03kHRJARJ2
TLSH
T123259D03F79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 970KB
SHA256 875ca65a47206733e0d165ccef027949a08603d7f7c67ff5f1960e2a08397434
MD5 02fa977a9a414fc1c5a1a179976a18d3
SHA1 4c9b7af6c5741d77b06bc6c00b4f6e41bc5e00f3
SHA512 559dfaede456fc2692f36f65e50b56e54461d9f16a3dfffb582a59db593e7bf7b0fd289687bc44f433cc0db6ade403035bc1661753b5d5eb99e3cb8efad60378
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKj3+:A3k03kHRJARJj
TLSH
T1F3259D03E79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 970KB
SHA256 8a68b8c80e99bec0594857ddb33a1eef5220ca5931af9cec38dc440a6a8fba79
MD5 573b3e65c0fbea979ee487d1bc133bb5
SHA1 e964009e98459ae1ff91d6d56cd316a3903c8220
SHA512 bbd56635502e6953023886f9137cd741138f606185a152608c6062cd179485416990f1ead969d1c68dfcba8e8e19741a86cd3d43441fb634b5b156058bbc51e4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKjNQ:A3k03kHRJARJ3
TLSH
T195259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 970KB
SHA256 744e1473632e036bc52a8003306f895266bb727713d39aae359b46c893647d50
MD5 c0e76bc8f521e89ceb535e4baf9a3943
SHA1 705a2154d7bd19b239b7c8cee1d230f99e53bc5b
SHA512 5b08eec23e7d4610e685cce1fafdb1d95399c3a11b27a5d8e38f45c674bcd1fdeb185ee9deb22f5974762088e48edc8fcec6110a29be83f08065523d20baa276
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKjCX:A3k03kHRJARJr
TLSH
T15E259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 970KB
SHA256 15a88b540a8ce3ca91d9f1b7fa5c82e253b91c9b8c311df163f15f030ffa25a7
MD5 31e0df909d4b0d9e63e3b24fbca53c92
SHA1 ae75eda40bd732185a772160f26c5159c329ccf6
SHA512 692ac0dfb7a498428b149a4aa3dea063b191b363511ef005921d678ec4b3cca15553373db4c61c05e570e30a7134b4b3998e06d235e93cac689e4a538d5154a8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKjkL:A3k03kHRJARJl
TLSH
T10A259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 970KB
SHA256 c2950712abac4f01e04b6a6ec7e91f3609cfc49fc549eab3e00633690664f748
MD5 b74cdde500d4dc19fd238d77d5f5f456
SHA1 69ac74c67882b65ad0d32739e329d648769d8599
SHA512 abe245fac87861a151c67d2fc4fec2f6ff7f3f76db8157021767b292c57aec9325a2b253a6f78388981abd62e499ceb20cd34acbd02c3be933d2aec4a95d4ad5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKjAM:A3k03kHRJARJc
TLSH
T1EF259D03F79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 970KB
SHA256 4f1826238b42f38a7c9f1a29796ff9961eb9b3522f5fa53bc4f975617f244314
MD5 b705e8b51935b2b660f74c6242f154f0
SHA1 8c5442e249e409ac04a015005e0d5ff5be9d786a
SHA512 a7a957ebc63575bd9b07359634fa18a5702c3310cfcc78703644e5b229e6db3263867c58d2d4fca9143aa54931cbdb3af888e6a7108a043349b92d85c93908c5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gELasKjhh:A3k03kHRJARJW
TLSH
T1AC259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1960-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1960-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2344-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads