Analysis
- max time kernel
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 13:55
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe
- Size 765KB
- Sample260802-q73k4atgrf
- SHA256 998065edb22246dd377839f749bd43d5dcd24246c0cd9ea7890dca92831a563d
- MD5 a96a5dbc355564874930eb93b5345ccd
- SHA1 affe6eb56377509e85be3e01194ed1fa5abd48c0
- SHA512 12c55ec90b58b8465b58c20b5aaf46df997da119b593e274e9966b6f33ab56a8abe631a1b827aae813342723925ab7d0229dca49c54accee0a0cdcca33ef8fdb
- SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQMf6:KIifqFu1//IifqFuyDA54GX79lSzQMf6
- TLSH T194F48E07E6E244FCD517C17089E69372EA71FC225620AB7F2768E6213F60F906F2A754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 51 IoCs
resource yara_rule behavioral2/memory/4360-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c3d5-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2cc-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2f6-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c85-58.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018978-197.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a52-204.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019844-223.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-230.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-243.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-244.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-263.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-366.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a54-475.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-500.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-537.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-598.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-623.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-642.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-727.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-740.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-771.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-790.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-803.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-846.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-859.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-878.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-891.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-898.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-911.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-924.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-937.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-956.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-976.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1012.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1049.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-1056.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1093.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1106.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1143.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1156.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1175.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1182.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1189.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1226.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1329.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b8ba-1372.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b314-1397.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4360-1398-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4216-1399-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c3f9-1730.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 4216 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$ 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe$ 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe$ 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$ 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe - Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4360 2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe 4216 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4360
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4216
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 765KB
- SHA256 998065edb22246dd377839f749bd43d5dcd24246c0cd9ea7890dca92831a563d
- MD5 a96a5dbc355564874930eb93b5345ccd
- SHA1 affe6eb56377509e85be3e01194ed1fa5abd48c0
- SHA512 12c55ec90b58b8465b58c20b5aaf46df997da119b593e274e9966b6f33ab56a8abe631a1b827aae813342723925ab7d0229dca49c54accee0a0cdcca33ef8fdb
- SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQMf6:KIifqFu1//IifqFuyDA54GX79lSzQMf6
- TLSH T194F48E07E6E244FCD517C17089E69372EA71FC225620AB7F2768E6213F60F906F2A754
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe
- Size 882KB
- SHA256 af25d267968313e093733bc39d92ff2f32edacc3fa13d2d6a0b727017f8c377e
- MD5 6b870063be46a2909bf454c8d98b8a79
- SHA1 94e3396f650cf3eaf8fac8f8635df47f09dcdf5d
- SHA512 a14d5fc1c9793a55e4a40c51ecb71926288a5ce303748ee5a15f1da0fa2e499b3656bc4e4e1ec199007e838921e758eb0dc6408b46779bbf55ebae0ceb904939
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfmv7MFi:WqFgqFUHr7gi
- TLSH T1DA158E17F6A204FCD557C13089E69372EB71FC225620ABBF2358E6212F21B946F3A754
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.3MB
- SHA256 60ab40fb69f5d78591ebe526bbff147a5765cb39f0c30254edbca52beb86d409
- MD5 3871b388a5341a3de7eef172868baf4e
- SHA1 8bfc14c816d2b686363197e1bb379fe2229f6325
- SHA512 15988c2af1d555270b7c163a223c8dc4786da87957dd2bc96ed18813ef306d8001eb79586cd9ff8d83b7291acd61f9a185fb605d8ce80767136536ee06a06564
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfK0Le5ji0hmxNrM:WqFgqFUH5Pji0Aj
- TLSH T152556A16F6B04679D023C075C5E2A3B6EA71784217309BDF1399D7383F22BE59A3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 780KB
- SHA256 1056d2edd5ccece6ce3cde0dc26174089294022b58c619ec4924ef27ada9fc07
- MD5 2a542740b87ed5488b47bacb137e20af
- SHA1 e293b1e96913b8ec51bd8014c03b410a09bd7618
- SHA512 1fed7e993a7a317885bfa78b3047bc94a1f4a197ee0d3e271cca336bb6b0014016976dbf2253a8c28d61d12a859d7eec73f82ff5f3948432fc26e1f97d9fdfdf
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfEa:WqFgqFUH
- TLSH T16E059E07E6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F20F906F3A755
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 813KB
- SHA256 b1ba37cfe85bdb003538bb2e8a1278bca3cec598d47233b17590c2aa25573a5c
- MD5 e52a69548ce56ab9f3927c3acf9731a8
- SHA1 7f61b5e13cccd7ffa14334cf3bdc7a5cd3902437
- SHA512 45d8223cb709663d3ca38736db5e409e82bfc70399173d11cf1f4b57c29e483bb37ac6ec1ba5f2feb1967420cb3d7385448cf6e64e50b7b417ff3ef4796cf20e
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfPb:WqFgqFUHob
- TLSH T152059E07F6E244BCD517C13089E69372AE71FC225620AB7F2758E6213F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 789KB
- SHA256 e70e6c3ac8f991d74594d9ee95d71abdb5f5ffdaf709fe7cf017def7982b1a57
- MD5 09a7b0c49a76870b6392229248f2df46
- SHA1 1b28a696d9a59ddd9924c645ca29ee27716518c2
- SHA512 da77cd4874105d49ae76916f77d94974a08c58074586120750799b61978ed38f2f15d9ead96b0662949e3c48a27c706a6899f303da6a0c3bcf5651e7b22b81b2
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfeZ:WqFgqFUHN
- TLSH T1E2058E07E6E244FCD517C17089E69372EA71FC225620A7BF2358E6213F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 789KB
- SHA256 d9faa0ba398305601e81161c72dc0ff87440f86a3de21523a40ec9365dd759cf
- MD5 1daac2e154dc43c71c1ad96a80a37d00
- SHA1 4a3411e185d686fe06135e7d71a33141973a579f
- SHA512 514fe593c9f437ba623002790cd3b2777726135f7152c0809944896b6b93fee940af98c581559872e379fea1f3e48da71af6ab43576f704febc10e4fdc9d0411
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMf51:WqFgqFUHq
- TLSH T196059E07E6E244FCD517C17089E69372EA71FC225620A7BF2358E6213F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 789KB
- SHA256 e6e5c550291528c5fed9ce1b2aeb8a5d8860fb4fb8ec892064326da1c00ebf52
- MD5 5ba39e8f284289174de7329687da5373
- SHA1 62186f818070a16049f3934434396080280d9f37
- SHA512 63188558abbf90f43c35ddb473c9ed28632cf33d708e1555fa04c391d704b82f1c0aef261bdc1b7180ac546d1544347872ef40ff9c9a1dac9af34074fe752755
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMf96:WqFgqFUHF
- TLSH T1E0059E17E6E244FCD517C17089E69372EA71FC225620A7BF2358E6213F60F906F2A754
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 789KB
- SHA256 1617acf7079282ac4ee2f2293c1e4f49b92e9abcb01ab25db99d82ac4fb25e8f
- MD5 38fa94d45ed40b249861928c3461a636
- SHA1 050c6fb592ddd994ba6db98a882cce97a86c4ed3
- SHA512 188cb8a3a9704aa77e9f2d93dd3a3a6604a170e0d07b16cad8839c3b7ec1fb905fbda43923290da7de4f7fb190c0ae7e9d6cae85338a814d33032185d460b4ef
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfTN:WqFgqFUHU
- TLSH T1AF058E07E6E244FCD517C17089E69372EA71FC265620A7BF2358E6213F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 789KB
- SHA256 0b783570d5de18d877e890be768d6c9d706c4cf0f4d9ce4b847ab4bc667ced2b
- MD5 f28602ae710d02538308055bc5c3aeee
- SHA1 1948a3204cd10afb5b9e719008ebd972a6e01360
- SHA512 802c48964d1be11fd01e709b342f2ad063dce8f36f7dd04225834bf87850e1c603fdfe5b792ede646161e86059d2f5a94c099b6ba38df0916fd0dfb466f7a16e
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfhf:WqFgqFUH0
- TLSH T1FE059E17E6E244FCD517C17089E69372EA71FC225620A7BF2368E6213F60F906F2A754
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 927KB
- SHA256 6b4e809abb8ff32ac213f2a71eec6531ba7c966ff216b9b72287f1aa7577c66b
- MD5 a4f99f8a57050aef9467841825a7db06
- SHA1 240d19c7e6917b91f1fe7ab1ecb0aac6eacaff82
- SHA512 c3a8dfb883ad6a25ba2349315f342221fee479076ad6d96c731162490e0064a5ddb6446c734484d00756857193f244487c9d41db2d59283b1a6fe8d293daa4d0
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfszy7:WqFgqFUH7s
- TLSH T1D3158E07E6A214FDD517813089E65372EB71FC2257209BBF2368E6352F21B906F3A764
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 789KB
- SHA256 d5436463fd2bd90075240ce04faf312e0b50a44bfa92552d6e9a1b95aa689ad9
- MD5 a0ec47a149e7191d555cc972b445f5d7
- SHA1 073391e196e89f1f7348567252ae6dbeaef980c9
- SHA512 0696764a833948dd24ca407e6929d7f0720aeba7cdb96d4f17858848f774d2ce0d37ed7f327587d553728082589a1dc12f6fdd10aba0c1e804bf8a48fcc7167e
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfDo:WqFgqFUHJ
- TLSH T120059E07E6E244FCD517C17089E69372EA71FC265620ABBF2358E6213F60F906F2A754
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 789KB
- SHA256 55dcabb570506e3aebbc5f323b658d51fed4aaa4d53f9f8b66ca587e46576e35
- MD5 7d8142521ab1ef835837ab1a35b0d2cf
- SHA1 a95fba3a5e1e4f38fded8a2983e4104be0ea74c0
- SHA512 bef3673b9209d2039fb640f83600d9cb0e36e6fba68e3e1ced44ceb60b6360ffbae60e93e73feef964069a8b2b9d1c3faa8ec82b80df2238a30b05b3fe52fd0c
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMf3u:WqFgqFUHr
- TLSH T115059E17E6E244FCD517C17089E69372EA71FC225620A7BF2358E6213F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 927KB
- SHA256 bf97e8365930bb958092e473b70f167e367e7c05fe303aba8bddc10d3c4e3195
- MD5 bd181b0a3ba8c6b80c4817986a22c9b7
- SHA1 896de196c2a59653de32dfa44e2a90672e95479c
- SHA512 2d33f87b345d3a9b90e36401a22dbc527f2b2589e0437b7251a0e439c902ec799392b2b7532b47ff360c88903f85ff479b3fab7fc57fefda432784a16958cc9b
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMf9zy8:WqFgqFUHuT
- TLSH T198158E07E6A214FDD517813089E65372EB71FC225720ABBF2368E6352F21B906F3A754
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 789KB
- SHA256 3b7cc6fcb1fee4076e35e778e06103103f128cfa1d2604f72b9c998133ebe897
- MD5 2a7ca6be9af33b5b8908d0efaab85349
- SHA1 32b65107c12db799ca1412308ab7d198b1428888
- SHA512 97e22229f5ea57321b555179be2be6ac7e7e9251a4d728227b06fe9faf4d574fdfea3718e10bfe15470db853b56688967aa8a6ea7a3a535ba857b12bbd557749
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfF9:WqFgqFUHK
- TLSH T136058E17E6E244FCD517C17089E69372EA71FC225620A7BF2358E6213F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 789KB
- SHA256 0dfd7f58ed4a2794b57d0ea39ae1b9f6e6353a6db5d554b84009e05961b78761
- MD5 9cea723ea603d0328db1558f71fd022a
- SHA1 756c301a94c54e28e843fa64798100a140303af6
- SHA512 62bb061efe7b9f5e901961ffe94ee0f867326eb088b9db2f535fc7140a2d47e463e105e098189ca8615865d308f99cec0238630acb10074f3c97a59416f6f517
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfhc:WqFgqFUHn
- TLSH T1D9058E17E6E244FCD517C17089E69372EA71FC225620ABBF2358E6212F60F906F2A754
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 789KB
- SHA256 2a71b44c93da45908c8b18aeac304dab5c63e0e85fa21f7276a8d71f7358305e
- MD5 abbb9b28a51c5c08cf2bb16a0f912cf1
- SHA1 08fe060d2edd64f2307070854a07cf78cb406c3c
- SHA512 cacfc9ac772d51cd7de1977a177b48fb763a015274a4b6cd1e29c6080f6e76731c5571fd7b4ab517eea80f42218dc00d37a2c5ef4ace0c2de905cfe8cfd8ea9a
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfKp:WqFgqFUH9
- TLSH T100058E17E6E244FCD517C17089E69372EA71FC225620A7BF2358E6213F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 789KB
- SHA256 bf56fb9caa70662e7fbc21914a823c03634601152dbf8576c80967df68389329
- MD5 f3efaaaa5abc838eb48017eb940afd26
- SHA1 f14950bd3cc2bc783ad3ebbbf0f0a0927b4257d1
- SHA512 2e38e5bd47cad54ae935e57bc1d367d2aa9b99d378a696e31b8200a2bfb351ab0aa14f863983311ee4acaca7761da30bc7a2cff1a3681b9efe42cb7576896a12
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMftN:WqFgqFUHG
- TLSH T1C1059E17E6E244FCD517C17089E69372EA71FC225620A7BF2358E6213F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 789KB
- SHA256 c7246b8be1d203cf9771556e2c8513455a2011a0fbbc74398fde48c8f2750404
- MD5 b7a36272ee64750c492aaad13c15c2c1
- SHA1 0a1546a3ee815a4737144538e342b6bc8fd0cec0
- SHA512 6faf5cf169ad147baf589f9a26520d097ba630e8739ef06f598f97b3d4970bf53cfece99517ac3406e4cd1ecad4a8612f0b2f5bc5d9b46b8e3667e7ef37446f2
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMffF:WqFgqFUHk
- TLSH T154058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6213F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 789KB
- SHA256 feeaa867cf6ce5ad3c4b1d6b51dc8becaeab026ad51ba017960f6cc900db5e2e
- MD5 9eb32a163a85016c15284ede5861aaa5
- SHA1 95c48b780253a87d390da138148e06f7c11e6aec
- SHA512 cbe8b5f2d9f6a7df744c20e1270d2aab061389bd001a2422da13a3d24a79796e36e0630d61b3b331e599dcb9ea0673aaf272c9d918f17547e89116e6ec0762c9
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfAC:WqFgqFUHQ
- TLSH T14A058E17E6E244FCD517C17089E69372EA71FC225620A7BF2358E6213F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 789KB
- SHA256 d654e7ef9b3499d8183d8d6c902eb94586665a61317fbb05d69068ff1738966e
- MD5 cc0cb724951f414e71282190b797d603
- SHA1 2a0ee92bf1211ab17317ced7e872ce4bb6764eee
- SHA512 76c866e705f2d2d7f97bb28f535d3de57acc08d7ca0e063cb603027ea39854e49a0c0bd27a744462fcd45c77ecebfa3414396735896da4d6684dd57dffeca210
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfTw:WqFgqFUHt
- TLSH T16B058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6212F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 789KB
- SHA256 0a7c895d325d1036f3db7738ee4e17251ba8da210adc79596ba7b311db0d68eb
- MD5 d157d8d5e73a1a5f02968e188348414e
- SHA1 017545e8ab7d4bea865ed7b87fcde3d38b465620
- SHA512 7b677fe51aad5a68ef4166bd7a75de4a3fdb1c0c956f4d61e66811984b6cb6423db702df687b54c6026a9d36d0ca84e0dde5d0763ce79f559da93214f535e9f9
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfaT:WqFgqFUHh
- TLSH T1E0058E17E6E244FCD517C17089E69372EE71FC225620A7BF2358E6212F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 789KB
- SHA256 ffc67944a51b64ce3a46190b8905fa47ae37d00bce7c3c64e8d07e99b406d975
- MD5 94ffb292132005c4309154e4a296a75c
- SHA1 7b7a311ebcfad678047a21f9e7e2ba6abc287203
- SHA512 2dc26d6bbfc34c605a6192744e8ae2335742ab155dc9dfe198c7e511ef916c855fb6c755603e2936e846cfd53e8aaca4ebb21bfcd1340974432cfd2271498bd8
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMf6u:WqFgqFUHW
- TLSH T1C7058E17E6E244FCD517C17089E69372EA71FC225620A7BF2358E6213F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 789KB
- SHA256 b19a2aa994ebd1cd0cbb0f16b1fd03092de6f467f18ff644a8367ffcdfdd2268
- MD5 995b9fa01b9d2671af1f1b7e290199d1
- SHA1 473b5e5dc18093736674c054a1e133c2941ae683
- SHA512 a45654f19f4f2da515f63e527a0c42876c631c5d2c594e63661547c38bbfb0fcfa867acc561321b1e860b64137cb6ad028c72bcc6abab0f697daa61e66559e32
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfEb:WqFgqFUHn
- TLSH T1A5059E17E6E244FCD517C17089E69372EA71FC225620A7BF2358E6213F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 789KB
- SHA256 61ab7206ebb4fc99090badb776bc3ced004ee2bd8cd1c9e6cfec84d4b9a325ef
- MD5 abfdcfb137b0b508706ab0c42e7682be
- SHA1 d57a5ca5d04289ec471c6e54e068d32cd05e1d2d
- SHA512 d7e221b697538c6642bd9dc92739e7dd13a8b39a9cf155b7bf089e55480d685b26dbc90dd50cb27cd58f7ea7d07724b7a515f10f36dd4b2f0e003a957ec10138
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfKf:WqFgqFUHP
- TLSH T122059E17E6E244FCD517C17089E69372EA71FC225620A7BF2358E6213F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 789KB
- SHA256 ce6184612bd9d9b48feb50f31d5137272c57a1a2c85b41d1d4b6f0256fdeea80
- MD5 d93f1b60ad924d569d93c1aba5f63df9
- SHA1 366460af880b1a1a09446380e842b07bb803af0b
- SHA512 f6f7a60ad7a7cb1118af7da0b6e32c7b4d19c1681059a00d57fbaebc640372d46437c193a79fd63bead4e971cadebb31eff628436bdba3fe824915179ae9e827
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfXK:WqFgqFUHv
- TLSH T1A3058E17E6E244FCD517C17089E69372EE71FC225620A7BF2358E6212F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 789KB
- SHA256 d6e252c29adc6603983c0a9366256a7de460feb910c0a8671d51bca4e21ccbb4
- MD5 b567da0bf1517a768696a378408f4260
- SHA1 09d77c1800a2ce8cc1a10f8397faf4b2f50de8cc
- SHA512 183602888ba9904582627464365ba3597318cfbd47a773294d79638569aa3c3f76f8da5534471f6a5121775532b6fc73e04cb700447abb06edac4f4df34849ab
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfgk:WqFgqFUH6
- TLSH T1E4058E17E6E244FCD517C17089E69372EA71FC225620A7BF2358E6213F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 789KB
- SHA256 121a013331141112f384d2b81d627cb676fa8f3ceb96aee95fe82b24c3eeaadd
- MD5 7ce29873476f8a44791c5f8ead3033ec
- SHA1 5dc6edd32979666a9f0b1441077319000e95af36
- SHA512 48be3a9415d8be049bd5bd95ef3b7095b979424e32de6ead1002fa0816cbe531bfb6136e1f54874af978534418a45866d210e84b418a395d1a03e97ceae2977e
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfR0:WqFgqFUHP
- TLSH T1F7058E17E6E244FCD517C17089E69372EA71FC225620A7BF2358E6213F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 789KB
- SHA256 994f0688b95316bc6e39ba551bf04acc9da07f5dd59db644f3a9fd8c2c167462
- MD5 be4d5163fffba364e9ab4c746d486df8
- SHA1 9031f72458e7d98d2b627bb0efcc4fc848e7cb38
- SHA512 c4fb852a0a0ebbd787798cd886c914532adfa6e42da5062a31b9ac9e09926f5dd7079aa1b3de43060f421ae5aa2500173d34932972fa81e95e5a31cd15431930
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfEg:WqFgqFUHS
- TLSH T1F7058E17E6E244FCD517C17089E69372EA71FC225620A7BF2358E6213F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 789KB
- SHA256 9353bc91f503364290f4a10f253a21cd022b1f2add9ce9ed96f5c869674fd6d8
- MD5 5a7c3670dd00cb05716ea8361d4cccdd
- SHA1 31f39f98ba98ba2b30ceff2d2d4207d0f36d6ea2
- SHA512 5cdf9479c263dd907d7348ba6c960f763690106c0653a569460eddf6299a44f108b2ff6cc405bebc83e41154f449c28b93b92485a0b5b0936563dbe431e7e54d
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfhr:WqFgqFUHc
- TLSH T17D058E07E6E244FCD517C17089E69372EA71FC265620A7BF2358E6213F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 789KB
- SHA256 c0def00f1926e54d6d89bdac042610e97546bdab114b8f3e547bbff86321570f
- MD5 0285f9d4d657e9057d5d10ab3462cb3f
- SHA1 f6ac1fbbf23924808f69d099a3e1947188e75d8d
- SHA512 e4a2a25c21b2cf89a63489abe71ecf578b4939240c0721df1ba73a36776ebcfa7373f0e3938ac3fd86d3bbd14ba3f90648cd39c11bc861e50f7a965822b3211b
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfjn:WqFgqFUHm
- TLSH T1BD058E07E6E244FCD517C17089E69372EA71FC265620A7BF2358E6213F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 789KB
- SHA256 3997269881319cffd7ae7a94f623bb90b679a04f6504950bdbabf92c76184307
- MD5 42c8e99a7489d7d9049449565cbd4d0b
- SHA1 ed52e6426b9dec916f828bd1a338863ae3e0b0af
- SHA512 a7e226e973800b85fcb5b7f11d5b52729a497d47d9e23eb8a90e0f14bf6a6280db087e15ff391e66628c8e579fd5df0299c0ee2a78d9ad0e7fc5856eab0764aa
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMf/x:WqFgqFUH8
- TLSH T150059E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6213F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 789KB
- SHA256 da3b214142de3054c818161d9b32cac6cd736afb86a5bfac1f05ed7592219c08
- MD5 aa7e3e835208b769ac7e13f1164c57ae
- SHA1 d2eaa1e4450867ce256df989ab52ba06520b2862
- SHA512 21280fcfc118c4c43dbf6b9e172d43c10ed7a096ede55d818187f82f354efc07b569289f8f025d77427cc02019dbf1680ceb44b2dde2b97f680f327f620e8950
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMflA:WqFgqFUHH
- TLSH T12A058E17E6E244FCD517C17089E69372EA71FC225620A7BF2358E6213F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 789KB
- SHA256 9f0d9ef332cc0d4e5fb28eae7d387de2ec9f9d6eaa158b637e34baca8d8828be
- MD5 7eca853171075ea273e2ad62724bf230
- SHA1 58675b67c89a80a12ee4cf18a43c37d7e563d73f
- SHA512 863dbafd7befc213aadccf601054d5bac674e27e5585a9f0ad0de05880062956e205e25fed2467c6c690bf09c0bb641eb01f9c928fdd1509875a0d604ebdc966
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfe9Q:WqFgqFUHq
- TLSH T151058E17E6E244FCD517C17089E69372EA71FC225620A7BF2358E6213F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 789KB
- SHA256 02c0487c721c974242bd82e109e625029e29bf4b6c2be0105ec9a1d4f05863a5
- MD5 033258d44dae93118408734b9c6ba3df
- SHA1 d7ca26fa53752164a9ef2a78bcace445180f90dd
- SHA512 b2404d713f511ad25ef381b5d3f0b48468f30cbc6fb4b99b5b04069df0fd61f7dbfeb7c58cd9ce9f74374443ae72386d36c03fc97d219c4d7f83146f8c091265
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfL4:WqFgqFUHp
- TLSH T197059E17E6E244FCD517C17089E69372EA71FC225620A7BF2358E6213F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 789KB
- SHA256 5ec2d3703dc96d264f96f261e007d11eb375ba95d034d68860be3c7ba958230b
- MD5 ac7ba8c06fad11d01ef7450337674339
- SHA1 d16512b58c7718c6bcd520d5b6cd734efc5e53f8
- SHA512 95af7fe9595d520347b61433390013fc3a2ce45d7df55923e36a3501c83595633cf15ae8a7732928fa42942eb9a1cdd16685bd9d6c9423193ac109b24d3b3c31
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfCu:WqFgqFUH0
- TLSH T1E2058E17E6E244FCD517C17089E69372EA71FC225620A7BF2358E6213F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 789KB
- SHA256 aa63db4116f2da4a4ab6bbab8c3bc69a947e3c8ba032dfb28703a1766b9af427
- MD5 2622ce22247fa72ee13bdbf230de2583
- SHA1 f2536215385614f7190b4d1ecaa0f83f99c0d9f8
- SHA512 f950560c7cd57aaeeba999746314f902fcec4796424a1a9fdb272b3c8b4dc68956ee83642c8bf534bbcba13bc502a5585ea89eaa153cab898b82d2e6091d58f8
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfTj:WqFgqFUHW
- TLSH T16C058E17E6E244FCD517C17089E69372EA71FC225620A7BF2358E6213F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 789KB
- SHA256 024defc1ab36deca958bd9057f111d80d9a05463d4436b2a26b8a58670bfb6c0
- MD5 8b8e695c954192b716e69cca6e0a927a
- SHA1 80a910e54509039569a4f1c963b6952b3a322d7f
- SHA512 3460b9d2c5714677cacc748b798ac8cadba1049c379d9d72cdf73125a94e47faf0e8184fbd040d5a0a3f3626976284f0f91466b1452542f74ba9d98546444a29
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfeg:WqFgqFUH6
- TLSH T174058E07E6E244FCD517C17089E69372EA71FC265620A7BF2358E6213F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 789KB
- SHA256 fa90af157b258a909350ad6fd6c17311dde2caec03a4db956d71df7ca893ec48
- MD5 21f145f57d5f2a6a1d551b30f251a47b
- SHA1 844fc11ed66b261025d95e5698b5a788f37ab9c0
- SHA512 68caa13313aa423829356a423902f50dc564563d42df9a4acedb74eda7c6a83089abf7ff226b52d8d96cc73e45ea9edd0945f1b22ebb2ac13d2ec72c3b7eb6a1
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfRI:WqFgqFUH7
- TLSH T17E058E07E6E244FDD517C17089E69372EA71FC225620A7BF2358E6213F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 789KB
- SHA256 588ada0023dcbe92bd1e28f1ad7e85d3b35690ee503ace3a8e59f8acc1859720
- MD5 0271254c3204a40baeb46a2fe726aff1
- SHA1 d5eee36507c3487f4868c585ff6a4fea7a850549
- SHA512 b7304f9dbfc1679e41c9a375e679d1e918672955da489b7864c1334d1a0c8bfec5f1c01636bced6aa4462e69dfed77ae4ca4badafc5e6272e98496698e0ec882
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfTo:WqFgqFUHF
- TLSH T16A059E17E6E244FCD517C17089E69372EA71FC225620A7BF2358E6213F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 789KB
- SHA256 3870340322ce820a103ea0b69ac684dbaf3b7e4f5a6e4c3b1b0e7a019d9a7764
- MD5 46a942d29a32718b7f68dc266abbc995
- SHA1 45e9a409feac4930d3182d14e002071272a0bcc8
- SHA512 23dd0f0b7279303a90cf19d0e3bca8f6c54b56630b9cfd77868f8d37de9745090dad00648e2b23c880938b1070368fc32a6650a04d803d598a1f5c97dea4cf02
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfY+:WqFgqFUHA
- TLSH T171059E17E6E244FCD517C17089E69372EA71FC225620A7BF2358E6213F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 789KB
- SHA256 23fc70fdc862f7ab3f097378a084fefbe56ad7e466b8c2ee25739e6543485869
- MD5 1fd387c54c8e5aa76a9757f205125aab
- SHA1 ff6df8c0f1847eba575cdf7448f89f2b7ba8d377
- SHA512 edbfb2dd8f92ac615849477209ea3b9736ff8d736b68e90da22728c66c34a52286ef4e5367b9895e78d98da67e56abb10b146658d3fa77d2af5ac3f4b20a463c
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfwQ:WqFgqFUHQ
- TLSH T12C058E17E6E244FCD517C17089E69372EA71FC225620AB7F2358E6213F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 789KB
- SHA256 54b3b8363a7f2985c96f3b1d1cf99b7eb20873a74d5e24f6631ffacf46526ac4
- MD5 2ea414d8f69f80a0e30e737bb5347da3
- SHA1 927841eeb6f2f66a33090292942eb6bdf3fe7de6
- SHA512 a4449c28b35cae47f0218f61e7902e29e1e437795d62bb9c6f4bc22aee79703560fe0efc3b6d819a1cf68c964f8c242eb4fbe84c829fe4ae0a248a4a742ed0ba
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfZX:WqFgqFUHg
- TLSH T152058E17E6E244FCD517C17089E69372EA71FC225620A7BF2358E6213F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 789KB
- SHA256 1657b3174e456b1352ee4fdb44439399783d85cdce370bc0a089dffb3b193dd6
- MD5 dc81b11207cb22756d593e8a6eb0bcad
- SHA1 b3b3c73b10f34d9f126263d58f0a2e9bc4123617
- SHA512 42eaa588dd61588959a5eaa1f48f25c6bba2488e49b0384d2e8fc46ce513abc33cbe18b9ce41936a91c6b0a4309a960787192a857f7542066fe5ff78afa2f467
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfzL:WqFgqFUHC
- TLSH T155058E17E6E244FCD517C17089E69372EA71FC225620A7BF2358E6213F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 789KB
- SHA256 447c7ee071691715b399db4959075b2ec302e0ef50fb037e63ca8b6532988717
- MD5 35b89fd236a3f8f8ac5242ea39a2ff52
- SHA1 666268ca04aa4ff213b6e88c38a18d1e03ba4306
- SHA512 87d292b4a693f89d0f1e6d366602e573d55fd372ff4e7e8599879dee187b87337c0a2f7f7453535f8cb847e53e6f0a2afd580e144c3f89c7e180a029ed3fb6b0
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfZM:WqFgqFUHP
- TLSH T1DE059E17E6E244FCD517C17089E69372EA71FC225620A7BF2358E6213F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 789KB
- SHA256 06a054febf8ca9305d76744690df08366c92f9ab6e356edf108bfd231dd8c0bd
- MD5 ca7b88b3193b56fcf1c50d2fd20c8278
- SHA1 afc7c1222f24b6e86b6ebef320a9020c07b4fa93
- SHA512 4d9a8d64f0678727ff1ef263892c336efbfebf6d66842591684c31b96034222d5f49a7a5460df925a05cf635f55d68104c867045fff8633f0ffe783cbf98db8b
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfih:WqFgqFUHB
- TLSH T152058E17E6E244FCD517C17089E69372EA71FC225620A7BF2358E6213F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\private_browsing.exe
- Size 830KB
- SHA256 ef28f7f55141cedc08ad645997de2266de40f2a087c562bf84de92194805026c
- MD5 f8a5b0d34439bb5fcc8a2896b11bfa26
- SHA1 9eb165d98af5c5bb987c6974d0f9632bdc190276
- SHA512 c3b605148aecd3f86fbe701dea0d8cf5a02fda7e76d19fbffc5b656714dc240edd89989dd7deb9d9b9619b0fabb682c782bebf41a22edc2778ace48353ef2341
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfxp:WqFgqFUH4p
- TLSH T183058E07E6A204BCD517913045E66372AA71FC115A20A7EF23E9F7392F30B916B3A774
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe
- Size 906KB
- SHA256 73733d3c2df9a50a46f7f042dc884c45a8ff79c9a8d8ed6d308bec7a5c8a0ef6
- MD5 7e3e302bab9688c260b4bc7b32e0b1cf
- SHA1 cc8f3f4b76b4ffacd9e5286d1967c9fc55a49d15
- SHA512 7b4464e4c2e0a9dda2d9d8ac689339d51a9bc9295a89e0b3beb27d9d6fe54422f0e2abd85d95cb09fc2f06dbb8e8502ed2a6b4de9c4112dd8089a9585976962b
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMfMu9:WqFgqFUH89
- TLSH T14A159E17E6A244FCC517C17485E69372EA71FC225620AB7F2368E6313F60F906F2A758
- MD5 SHA1 SHA512 SSDEEP TLSH