e7a935c384d5dffd170fe84b26c01dab1eee3d5100aaf830961f9f0cf56dbdee

Analysis

max time kernel
105s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_3cf35883bb94c8f8aa2bf61bfc68708f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 924KB
Sample260810-mpk2jsxanb
SHA256 e7a935c384d5dffd170fe84b26c01dab1eee3d5100aaf830961f9f0cf56dbdee
MD5 3cf35883bb94c8f8aa2bf61bfc68708f
SHA1 19999127c0a3623c22eef5112b22fc7c1cc439d8
SHA512 892c37b25c05469bd27aa639daa3e6451d9a569a23e535bbc107240271a900567c61cf4136a36cd62a5821aaba82044f2487b7df0b7386ed2c37ed4cfa6190c2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtbf:A3k03kHRJZ
TLSH
T13815AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/3008-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c525-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-12.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3008-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/260-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019cb5-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-226.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-444.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-493.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-572.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-621.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-677.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-733.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-776.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-801.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-856.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-875.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-888.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-895.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-920.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-934.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-954.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1009.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1052.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1095.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1138.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1169.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1219.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1324.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1343.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1368.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1404.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c525-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-12.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019cb5-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-226.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-263.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-444.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-493.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-572.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-621.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-677.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-733.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-776.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-801.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-856.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-875.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-888.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-895.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-920.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-934.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-954.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1009.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1052.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1095.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1138.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1169.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1182.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1219.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1324.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1343.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1368.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1375.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1388.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1401.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1402.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1403.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1404.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
260	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-10_3cf35883bb94c8f8aa2bf61bfc68708f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_3cf35883bb94c8f8aa2bf61bfc68708f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$	patcher.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-10_3cf35883bb94c8f8aa2bf61bfc68708f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{442E2BAB-89E2-4A69-94D2-35EFF397FE54}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-10_3cf35883bb94c8f8aa2bf61bfc68708f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-10_3cf35883bb94c8f8aa2bf61bfc68708f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-10_3cf35883bb94c8f8aa2bf61bfc68708f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$	patcher.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_3cf35883bb94c8f8aa2bf61bfc68708f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_3cf35883bb94c8f8aa2bf61bfc68708f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3008	2026-08-10_3cf35883bb94c8f8aa2bf61bfc68708f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
260	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-10_3cf35883bb94c8f8aa2bf61bfc68708f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_3cf35883bb94c8f8aa2bf61bfc68708f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3008

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 924KB
SHA256 e7a935c384d5dffd170fe84b26c01dab1eee3d5100aaf830961f9f0cf56dbdee
MD5 3cf35883bb94c8f8aa2bf61bfc68708f
SHA1 19999127c0a3623c22eef5112b22fc7c1cc439d8
SHA512 892c37b25c05469bd27aa639daa3e6451d9a569a23e535bbc107240271a900567c61cf4136a36cd62a5821aaba82044f2487b7df0b7386ed2c37ed4cfa6190c2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtbf:A3k03kHRJZ
TLSH
T13815AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 94d19cdeb7cd84b8658c95d95ddd6e2a20913308b27c6992ba694bc5c65a60a4
MD5 58dc1ac41aa06591fb6b4061d733303c
SHA1 b33907283fb1081f77293fdfed974e3edd5406eb
SHA512 fef771db079447e9bc63952af0cf7a6c14aaa166dd75b3d6fa183528edee76ed6cd82e62f11d614d51b4a6df54de1a1541fa6f0a83df4cfd815f1673966bae27
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtbL0Le5ji0hmxNrM:A3k03kHRJFPji0Aj
TLSH
T16C658C17F6A402B5D067C0B9C5D6AA5AFA713842173086CF1398C7283F67BE19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 938KB
SHA256 7d0985157a92a093b4ab6f3f9878c20ca862a0a8c29ff6b7bd993f63f475722a
MD5 e6eb883304b8f4329c34f10c849985b1
SHA1 f728213ac7ac6745c9799107deca7502f1ec69f7
SHA512 8db37c2496bf43be7b716cbefda68cf4006c8269472966ea5c6f05bdd76e6399c16b47eeee73dbe9d8408f463a9de29aefd00f6e8236532e6b490c676d235573
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtbNa:A3k03kHRJ
TLSH
T15A15AE03E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 971KB
SHA256 f170fd3466a02ca32d1b5d065e8b67aa96b0b512bdc9a06322dde5ab90e3c5bd
MD5 537beccdaeeb434c44c4c43fc8614b79
SHA1 f7ee6cab1a6737649d79ca891968447770daa52c
SHA512 9fa540f999a0ccd46ec366a3bd45f62f767e798072339e149d2c09fca5890c3aa28854486df0b49ab28f9d296f8c5aa9c6f4d3ca85f56ef286c753c67cefe7a0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtbub:A3k03kHRJkb
TLSH
T1B5259E03E79400E9E10AC1749AE69A23FB75BC52176093DF2358D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 947KB
SHA256 6f108bc5a216e0f46855c9d8d2555042a4b089e04da432e9213659706f63f9be
MD5 1c9da103df2f7d4c3e89ed9c48647578
SHA1 2b3e6562f7f6b98f44fe4fa688fcc323891d5589
SHA512 6b0eb0293ee120df9bff6ca4b1c5131c50301d6930e652b74a8dcc65c8640815d07cf8e5c422b56f6e988270aa5a19f028cd81c6751d72ddf03ac1ac83e163c2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtbE6:A3k03kHRJB
TLSH
T11625AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 947KB
SHA256 ceff96027f1c71057dfc85f85387d19aa5a374505f4fb23b61e2c07e8e34f09b
MD5 f8b2f7865a8f76431da15f28ba1ea3d2
SHA1 a6cead453bebdff47436d804067893eb304bda10
SHA512 cf9dfc4cdacb126f8dd5eb6f4343cc805ad0194c588b3771207feffce51715afa223d278515fd4ca762feb1bf051ff2729f97e383db1593f5c00a6a277c3b66a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtbgN:A3k03kHRJY
TLSH
T14025AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 947KB
SHA256 0afd7d92040b587a2ea445df6f31263869474ca17180489734cf53b6224b576e
MD5 3f1f93491994277f8342000a0c0a3be2
SHA1 94340e2e7fd7b4b8bf62fec84225771a4074bb9a
SHA512 7f669b93d18b698e473e66119b480d7ecdb1bcd4c116d841cb1be3cae5dec1ed5963dedd03d92e2ed89feaddd4dcea7113406d222842e5ec2e3e305f3ebfae7d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtbOf:A3k03kHRJQ
TLSH
T16F25AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 947KB
SHA256 2543e1e56a687f82927178e1d37b5795307d4c3e85f09a41cb14b896f0d580ce
MD5 abeff319634cf5084542830d69da4b42
SHA1 6e608144d9f7fb4e7f97787081f4f5e63a7c0c69
SHA512 10e4246548d3832103738cd1987daca0af85fd5b9db4e9ce007826fd9decb01f28772a1ebc98df0e551e2a4150716557877d3f92ceb869899d0a29429cf6e30f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtb4o:A3k03kHRJd
TLSH
T13025AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 947KB
SHA256 887fb9066470b2e76040e411a3596f850c58887773d43218315b14ffd21ed5bc
MD5 91204990eaab3c9965473807066eab5e
SHA1 384eff46996f52612506461bee727de90b0c758c
SHA512 d911295aa91102ccde1f82050a2c226bf89fd71c14b1f503f94d73e478de8c2d13a323a427568cb96ac5e45ae50cd39b33c4082039098e26e7ec8df91401b6bc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtbIu:A3k03kHRJv
TLSH
T1C625AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 947KB
SHA256 40d08fbac891ba1a3bbeeddea5b3e98671b7709b759ab42dabd5c3d695abbf51
MD5 20a2fd4913bb802268ecc04698112281
SHA1 cb514a88765e1086a8a29d6878c43478e28755b0
SHA512 e54d041eb553d44c1f7b36d086e07307a17b71e9e8c8223c1f42036fe7960c8c414e9091e100f745e5adeccdd85ec1d03d0e050d2b2f9cba1527b9af4f29bcba
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtbc9:A3k03kHRJO
TLSH
T1AF25AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 947KB
SHA256 cfdeba3a642481f7e5260dba91c75fa4148aed793bce312598dfb94aa6be042a
MD5 e30ad358a6a723ce89e6ffa4ba838afc
SHA1 47983ccceec7af3575c81f552e706353f759a7b0
SHA512 d8b9c5bdccba8fa7f5e310baa1cdb26807d641aa5d009d7981b5acf183bcedc20435302f2d5ab59902a202d5748314f29cc83fa991311f99599038804d215a4e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtbEc:A3k03kHRJj
TLSH
T18D25AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 947KB
SHA256 b8add60cc7236cddd1c58eaffa2f76b44fbd0505773bb95886d3d0367d47ca04
MD5 45358da780f2b06ea2779e9e6504b90d
SHA1 8c11106a47f8e45e63a71e3cb8b6f99d664b90de
SHA512 f762e4c6b897cc2e5937c41f1a4c3977acc33e8ddce51adaac6400d900c3140e388abf011345e40f5cdccaa14a910a56d2a3e0ec39c1e84ddad5d61e59f6ff49
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtbdp:A3k03kHRJh
TLSH
T12825AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 947KB
SHA256 f19e354d421b39ff64485aeb4f2f36a170a4b37053ca3b3f28d755ffba5f16f1
MD5 8e12ec73ea2f687734ba34885a26b4ec
SHA1 0036a5492eda03e23ea1f3b4314ebd9d4d7be0fd
SHA512 adf7e6f997a8fb9bfdd10dd67ab19147180ff27496061b5eedba83b21fb1d8a1b013da1c957e05f7c295fcd9718272bd4afd89b915fa2c319fb98ae424d7082b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtbiN:A3k03kHRJ6
TLSH
T1CF25AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 947KB
SHA256 89841a526d4ebcf0b5c1fcb23f8b47675453cf4210d1e79773f8ed07d394af42
MD5 5162210130ba5851640b9491d192ab2a
SHA1 1734d7f34e0b84e9b6070c1a66fee04d8cf3efb4
SHA512 71c751541c9ab384351474ef33a86e6ea9cf7278fc6e1f2f8d177d9f3c46f2649dcf88e06ec09e6d48b2434f0911a48c103b65ee904694b0efe801be0c205f8e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtbGF:A3k03kHRJA
TLSH
T16E25AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 947KB
SHA256 fbefe8b9e86ac4cacb1c5724bf9ec80e8141272a95026687c7c3552e5ef09238
MD5 2b8930ff235f21f42b19772e67ede91c
SHA1 fd41fd65e8a5254ae575fd6246a4fcb3a081e19d
SHA512 b3eb02b3df690d49fbb998759eb3ceed3de26b9d25aaf1a517b5fd4ef161155581091e699071836704c056dadcf2934a12dc64ca6f2c7e592a5f3e7d8702424d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtbTC:A3k03kHRJU
TLSH
T11D25AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 947KB
SHA256 97cb01c67a33e604b62a12ab79f974daa97a60618bdf48632a3377e69a9496fb
MD5 5a180e6d146ce1d11e553f197636b911
SHA1 88b2c75941feef570ae88fea67611ec979cb2100
SHA512 8be2648ff32133c06107b9e08beffd5d16bf9d804ffa4bbb42523832125e84f7a147a0a292a84c4fb4ba52a5cc773a42023791de1e8a8c5d8c9c9a18f4c1a626
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtbcw:A3k03kHRJp
TLSH
T16925AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 947KB
SHA256 fe4253aa33c40dd61fc489ec1b5750cac3a88426c1cd2af3bdad289fdb33015e
MD5 2eb5151b307a678bb6f8bd90802fe75d
SHA1 815acda432ce3853b4fb1779dcc2be7261d23ce8
SHA512 fef3dac2b1f4bb35c5be201f6e88a2b08a5352f3a121db2bb704503b905176982247661c17b8aa8af373696a103e71228f6544b96855304188efbce03eeeb203
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtbTT:A3k03kHRJd
TLSH
T18425AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 947KB
SHA256 9b211da6f9edb767c9cc3bc6ecfaa7925966a453dfca4a8cdc0c9ad7b1409321
MD5 48b347bb9d91f9eef3c13972cad1340b
SHA1 cc3023e4cc824b66ed6accda8ee09c3480701f89
SHA512 03759f6803b991dc1d6afa6232607e36e2bfa35bd23f66fdd222ed485d7b8b9342c9f8681ca073daa7ccbb1be24125ee2a6dcc68ec1979d71fae0014169ffff5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtblu:A3k03kHRJi
TLSH
T17125AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 947KB
SHA256 4f561d5b1597257a61435650d596ac0d852282ea1a088c4ac054ceda84047b50
MD5 d574f9d40c57c2da20417ddb7cb39f1f
SHA1 b18aa7c37bdfb973f33f536468b84cc267185f48
SHA512 199e98316ac7c2a2364c59564dfc07ded295669b11e2afa127b579b8931d1ba687664ae5acfebd09ca770e86fd21519a82994502350e75491c810211aba2e0de
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtbtb:A3k03kHRJT
TLSH
T1FD25AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 947KB
SHA256 02edd675fe8199e0af1d21c662855392a40adcf3629a08389ca17c891fd9848f
MD5 b4604b7b27c3563b86cb6df07fad5e78
SHA1 02d267862f61a90341ba41b5aa0265db9bfb0ba3
SHA512 bb470244f269a0e82103acc79b5ba788837859fc58c84264b61ceb82cf32f1263350e1a57ca0e13d6a426b158a1a84c45a88ecf5fd4d4b55aa06feef874c42e8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtbdf:A3k03kHRJL
TLSH
T18925AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 947KB
SHA256 538109602c890410b21a22a5d237575b10fec136a483238caccba48790842cc3
MD5 f83fddfc0f7477aed04e3f46ef1d13cc
SHA1 9a1b138f6d9c27d65a961bf6148af6c6c5dc3c59
SHA512 567c58724c54d049713c4f71f0aa5d7815a7e2a0e998275a3522ec8aa8b87d323fe3829a054bc2cc280c0ffb44d672db51c2bf25823159e5338ecda37687bb2d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtbGK:A3k03kHRJ7
TLSH
T14325AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 947KB
SHA256 95e506d826aa2cb84ead57bf8d11a5b7511c8a7c7dce441ea2a0d98ca6c0a636
MD5 b024ddbba7611ad46a6700831d9e6c8d
SHA1 759ec63285b12f756111d4b665ff30cff39afb59
SHA512 f02d5206f995eddd5191cf88cb5c41feb2a64799a4e706fdd2bf3e0460f9b29714ed26900f2fe7f93e697bf258f5f55eeca98cf70836a533ce3cb364a40bd699
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtbzk:A3k03kHRJ2
TLSH
T10D25AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 947KB
SHA256 c64fe739bd952cb4cd3e7657b9feb5f0f6e9b1b7a74bbb6926df7efb3e015298
MD5 8f7433c2b996f420be1b7199668da446
SHA1 9669f5b4446297d006f1cd8bf76e8ccd99f2d46c
SHA512 2fb00a92c6d90c25913fc10a62e35d142b9ffb41f8ede1f0eac15aadb86525dc4ca001f6d1c6e9c2b2cc405e21bcb3e8797763cd43b15b53ef61761ef010f644
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtbE0:A3k03kHRJL
TLSH
T16725AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 947KB
SHA256 62b2ea91060330dfc5ab7e83f339175ab22904cae2a733ec3686c54bd31551fb
MD5 09376ec48b2e644f196dcc640fdffa7a
SHA1 1008c26615ca7b654533c572eb95c9becc45006d
SHA512 a9b71dcc1097d1d251cd05ad1062d89a569789fc3dd4d28661186f1ddf72c46ca2fd9bf610c020d3514e0994293b2994dc9379a3b6d1889f2fb775e03eaec35d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtb/g:A3k03kHRJ+
TLSH
T19025AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 947KB
SHA256 dfd430b9e18429fcd91d24d315d4076deb560178780e5a4ec867e278fd6f7acc
MD5 5dc2010959ef40d177d27208f5dc7598
SHA1 2b9ce52f9363302585e7300a7ebb04021b15d2b7
SHA512 b576c074c15f2c242037cc2f127ca8bffbdeb764b4e9dabb9b7c961dee0d0e359c9f92e62fa0fc7638ca319e2526a33bf32ee54af20bb2e0f464cc78d7a03cd3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtbSr:A3k03kHRJA
TLSH
T1E425AE03E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 947KB
SHA256 9e4af45bef21023acbec4c14ff4d93163648babc4bc3394d777688a3e6384798
MD5 fdd6fd04c82ae004a150d0b0cdff2074
SHA1 7d357f9af267ce50da35753a994a9d517df6864d
SHA512 463707ad4b147d2ab37ff79b0cdfe39e3f84eab60deb5a0cae7debde3f36e1f9b39799fa9dd4ab545ef6b3a6679cccbb62f1fc6cb634a9f5c90c2a5488c1a61c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtbwn:A3k03kHRJS
TLSH
T18725AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 947KB
SHA256 0ed7a92bd2221017282d349c33854fe470d1d74fe32e279dc1a744c95716750a
MD5 3456d60468a497c08cede50accc2d1e2
SHA1 92891010a098b1f838211fbd917cfde4099f8f9b
SHA512 3bfb6219bad5f6bb41d3905ed9cc25d266a78698e92ef4ce36dd2dc0fbe821de3774502ceb8a6b5998a71b70a16f7c244b7fd9de28e54bcfb662681c025d5caa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtbOx:A3k03kHRJg
TLSH
T13F25AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 947KB
SHA256 d82361e0aa5f65bd50bfe853a2c2e664953e99559f0124a25ed4cf7f92de0bf5
MD5 91a048743e45520b9902ccedd83e0f03
SHA1 b2f2b2f556f786b99f0c2b6fdc3cf40329c89527
SHA512 1be035109b42981b69f952faf6b2905e13f1c04d39dff74cc026219650dab4286f55102f16e234d4d983af96c298ae20d58d97800c94bc280f4af2e128ac6024
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtboA:A3k03kHRJD
TLSH
T16625AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 947KB
SHA256 5ad0606ff6232e9c0812313d668ebe64ed4a41966d8d9e8038f19ab5a07e0842
MD5 edadfcee47b3f0af86c8bb6199c9a06f
SHA1 669426b1ae88ef18d1b3ac5985aed813f4178a39
SHA512 b72d89631811fa37ac4f97e99465650f767d848f05df91aa31dccf6596dd936ae093185a4efbe0a6b4927a2e7bd3d12a7f657457d38222946f68056457aa3f28
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtbB9Q:A3k03kHRJO
TLSH
T1C825AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 947KB
SHA256 a6f6da8734537f74335a787206ce0427a60bcba6e522a0de4be3aee330c641e1
MD5 cb3e761039f20f8f13ce0e53a436e3e3
SHA1 1d8a3b62044d5e928c9373969c35433afc9d88e9
SHA512 5146a85049437d4b41e12b2a49e8ae04aeca51c896a10e8660ac5746068a970050fab3e2d53b8f69e3e28bb0c5397ca602a07e75facdc717fd5dacc4d5f82081
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtb04:A3k03kHRJt
TLSH
T12125AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 947KB
SHA256 ed5df7d0b69de4515bbc6983e80a2ff5d65a49239483a48e64c84494f2f7cad8
MD5 3489756e10a9eb9849dcf221f02b21eb
SHA1 6b3fea0149c7c14b3b75750a2266cf9751ddc92b
SHA512 3beda3566ae9e4850f3eae398ef2d6888bfb2f11fd7804dfd77c76af77dd6245c66548c9ddba55a0801cc1a011122ab6e6555dec171785ac6f273f0771dacb5e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtbfu:A3k03kHRJI
TLSH
T1D325AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 947KB
SHA256 147dd7e8bfeb9f57f11aab8d41b4b86faf18a4881e77a6f661496cde8b3d62c9
MD5 7977c7b342a2df917656e1399e47caf1
SHA1 1092251935f0426979b412ee98cc45c9fcffcf2e
SHA512 ffb75043ccaf7c06188c023d697e6d2dec51b15767bab25aa49b114f464a4737cd2cbf08a371ad8f7f6346173ca193a9d5be3faaf35761c78e01f0b10b40d458
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtb6j:A3k03kHRJC
TLSH
T14025AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 947KB
SHA256 fdd1c5d600261a0441fe5da6f36b7a1806c3e1a98febb216ce3b6e07d034bc1d
MD5 9927eabeeca6042b3fb70f333b866b48
SHA1 a141309edbea8b2536e5ebdbf48bd76b8f929e9e
SHA512 c436b5f81c97370a09bf8e8cc5e30baa4ae9ea30d3b8d8fbdf86ab2bbcefdba406f4c2983830b05a71aaa6167bb827898cdca1da6daa313a85fd4d1c808d5370
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtbng:A3k03kHRJG
TLSH
T1EB25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 947KB
SHA256 cc305789281cd85906eda44f4972d866ba4336fb0b4e13313267b9b497e3e947
MD5 ed71b1c57010eede708ae6cadef0c7c4
SHA1 737f23db4b3982f2991a2c583b2686d045102b9f
SHA512 7f63a3ea4d2d290202f5bb9ec7e27a0c5bc91a5183344d24671c7ed825c0e642ccd802b2e51f14675a3d8e4ee0bac94f4df73663ad20c09d6730b88dd84182e9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtb6I:A3k03kHRJP
TLSH
T11625AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 947KB
SHA256 1bd559492ffa98c624e6f7629e4d3f9efaa0e4910fc7f2a2a0ee9a4dec8f29e9
MD5 04bef6e187928a75875172b9f7df4cc1
SHA1 c31ecd7fbcd056522a4f414f99d70dbb7f30fa53
SHA512 ba35f2879b348aa5ca607953ae552c07dca545de5cd2779f4e80f76fdab728649745911e4f484cec04dcff6ebdf0401fe9d647e23c19ba7a5da1916134c04062
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtb4o:A3k03kHRJ5
TLSH
T1E625AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 947KB
SHA256 69518a071a119fe5877c658d710b0e88937ad44368ae73cb33076fd63b5fd7dc
MD5 183c683ef1b5ab78361d3227daf35633
SHA1 cc06861d5b0699d59e821fe30fb028464615241d
SHA512 1fea00a1e23f7f7e5c04e64e4a5acd72769e94db8012cc3b2288e7131bf313aa3f950e17c07cab5841fd2dc4c8895c97126bf03423a27de0bf94e2693ffa11b7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtbL+:A3k03kHRJ8
TLSH
T13B25AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 947KB
SHA256 ea65bcb9c80edea46ba1cdd3e3863273ee12df287528e8e2739410f04b580b0c
MD5 87f3ceade50015b3643165f440baa69c
SHA1 c5c2782af3fc88e7164b493054fbc3136fa940c4
SHA512 76ddd38313e86ac3347eb66e5210cae6fb130aaad91ab51d0c00af328f5ae18c28781c854f40f5f8dc4a8b55a0f7eabdfad3f9e71a04043668d7b2546f6580a6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtbBQ:A3k03kHRJU
TLSH
T18325AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 947KB
SHA256 f1f4ca614e23b6907b104225588dc10d88786c978759c298bb4a01b0cb6ffea4
MD5 8dc04352f99432c1f0ba9141f398e717
SHA1 c80888aaa1d0022c5dc994ce666a36234bfbfe6c
SHA512 52eeeb4f15110703df9c521e1cd539333399a7f58f7601841cf4cb8309048a9d7ade5a32d1302a858e91a07c020ed5eec524787a106e04fab146ee02bc565c68
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtbGX:A3k03kHRJU
TLSH
T1E125AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 947KB
SHA256 07fee23779e5a734b006e2720a7b110be34fb8f92caec2b9fcda8616adb61b38
MD5 ef99c5ef79632edd8cdc0627c92e7009
SHA1 7e3b2a814300be683a94518138a22dc080e452e2
SHA512 d65b32cf2526b342e52c742c0f43279e4aef77ae38dfdbe64f0c0f9eb8eeefc445229e251e2223704cbf4a971489ba0d5ebce02ce3d83896c71d982d273f19e1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtbAL:A3k03kHRJu
TLSH
T11F25AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 947KB
SHA256 9c789d5058ad8e540684604b7a8f5779716ae4deafd1c56d1da1a3f4aca921f3
MD5 0d61b6adc0faf711ad657ff5e28fad48
SHA1 20385e38f6df2d0aee9b958763e54db13dc11d1d
SHA512 aa954993f1881a4cf3b00f6e2bd3f573d8743647f19b44b4cd7af194f04d45e8349b9930ea12c37c14a8f989da25ecbf959be1cee0ce1d8b78945b0e63f72493
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtbsM:A3k03kHRJb
TLSH
T14525AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 947KB
SHA256 be9910e94210100b3818c3c1572d4358687632e79fdd4171c746145264c0f626
MD5 93fe753dcd0656b7d6c011147411192a
SHA1 ced46747b5017583201091e83d338c27000bac52
SHA512 1e61945706b3ab1f3c45be54cf5e2a748e961dd8cb590457c72fd2a194c47da93987cd6c940d42c1efe5387b2a7c38a2e750dc556b6284d720bd1683f1a4967b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCtb1h:A3k03kHRJV
TLSH
T13025AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3008-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3008-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads