Analysis
- max time kernel
96s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/08/2026, 23:07
Behavioral task
behavioral1
Sample
2026-08-14_b939dc2b97e7a75ba3f9ee45f53b61a2_cobalt-strike_elex_hijackloader_rhadamanthys_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-14_b939dc2b97e7a75ba3f9ee45f53b61a2_cobalt-strike_elex_hijackloader_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-14_b939dc2b97e7a75ba3f9ee45f53b61a2_cobalt-strike_elex_hijackloader_rhadamanthys_stop.exe
- Size 555KB
- Sample260814-24e66stdkc
- SHA256 88ef01ec11914647f2d3089c46ec185a7cf4243f479f31ff8f286657326cbfda
- MD5 b939dc2b97e7a75ba3f9ee45f53b61a2
- SHA1 f2873f12118530dae442b6bc7fe674cc35d091c2
- SHA512 31eb2f99346be218fbe6553c3e6ffe95e1912f304c313bb462d5aaac3ac0686534622c369a141d496190b79366dd1113ae64760dd76d6af59d820a0a4a816a78
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsTu:bgHg1JZlT/wHuHNgHMIu
- TLSH T198C48E52AB5144E3E4E245F099FA8B0BD979FA11036592CFD3E8456B2E32BD1373331A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 45 IoCs
resource yara_rule behavioral2/memory/4756-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c557-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b313-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c9f-57.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019ca0-70.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4756-168-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4428-169-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-356.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019900-441.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-490.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-497.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-558.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-601.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-621.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-641.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-720.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-739.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-746.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-789.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-802.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-827.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-858.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019910-871.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019912-890.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-897.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-899.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0007000000019e9b-937.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000001a10a-1004.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a10e-1023.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a57b-1054.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a57d-1122.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019de8-1141.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001ac36-1279.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001ac34-1346.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001ac2f-1372.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018925-1488.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018927-1531.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001892d-1550.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018921-1569.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000018934-1819.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0007000000018a18-1880.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000189b6-1935.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0006000000018a52-2008.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001893c-2021.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018944-2030.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c557-6.dat aspack_v212_v242 behavioral2/files/0x000200000001b313-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019c9f-57.dat aspack_v212_v242 behavioral2/files/0x0003000000019ca0-70.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-356.dat aspack_v212_v242 behavioral2/files/0x0004000000019900-441.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-490.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-497.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-558.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-601.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-621.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-641.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-720.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-739.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-746.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-789.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-802.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-827.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-858.dat aspack_v212_v242 behavioral2/files/0x0003000000019910-871.dat aspack_v212_v242 behavioral2/files/0x0003000000019912-890.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-897.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-899.dat aspack_v212_v242 behavioral2/files/0x0007000000019e9b-937.dat aspack_v212_v242 behavioral2/files/0x000500000001a10a-1004.dat aspack_v212_v242 behavioral2/files/0x000300000001a10e-1023.dat aspack_v212_v242 behavioral2/files/0x000300000001a57b-1054.dat aspack_v212_v242 behavioral2/files/0x000300000001a57d-1122.dat aspack_v212_v242 behavioral2/files/0x0003000000019de8-1141.dat aspack_v212_v242 behavioral2/files/0x000300000001ac36-1279.dat aspack_v212_v242 behavioral2/files/0x000300000001ac34-1346.dat aspack_v212_v242 behavioral2/files/0x000400000001ac2f-1372.dat aspack_v212_v242 behavioral2/files/0x0008000000018925-1488.dat aspack_v212_v242 behavioral2/files/0x0008000000018927-1531.dat aspack_v212_v242 behavioral2/files/0x000800000001892d-1550.dat aspack_v212_v242 behavioral2/files/0x0008000000018921-1569.dat aspack_v212_v242 behavioral2/files/0x0003000000018934-1819.dat aspack_v212_v242 behavioral2/files/0x0007000000018a18-1880.dat aspack_v212_v242 behavioral2/files/0x00030000000189b6-1935.dat aspack_v212_v242 behavioral2/files/0x0006000000018a52-2008.dat aspack_v212_v242 behavioral2/files/0x000800000001893c-2021.dat aspack_v212_v242 behavioral2/files/0x0008000000018944-2030.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4428 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-14_b939dc2b97e7a75ba3f9ee45f53b61a2_cobalt-strike_elex_hijackloader_rhadamanthys_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-14_b939dc2b97e7a75ba3f9ee45f53b61a2_cobalt-strike_elex_hijackloader_rhadamanthys_stop.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ patcher.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ 2026-08-14_b939dc2b97e7a75ba3f9ee45f53b61a2_cobalt-strike_elex_hijackloader_rhadamanthys_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-08-14_b939dc2b97e7a75ba3f9ee45f53b61a2_cobalt-strike_elex_hijackloader_rhadamanthys_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe 2026-08-14_b939dc2b97e7a75ba3f9ee45f53b61a2_cobalt-strike_elex_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-08-14_b939dc2b97e7a75ba3f9ee45f53b61a2_cobalt-strike_elex_hijackloader_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-08-14_b939dc2b97e7a75ba3f9ee45f53b61a2_cobalt-strike_elex_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-08-14_b939dc2b97e7a75ba3f9ee45f53b61a2_cobalt-strike_elex_hijackloader_rhadamanthys_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe - Drops file in Windows directory 26 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-14_b939dc2b97e7a75ba3f9ee45f53b61a2_cobalt-strike_elex_hijackloader_rhadamanthys_stop.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-14_b939dc2b97e7a75ba3f9ee45f53b61a2_cobalt-strike_elex_hijackloader_rhadamanthys_stop.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-14_b939dc2b97e7a75ba3f9ee45f53b61a2_cobalt-strike_elex_hijackloader_rhadamanthys_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-14_b939dc2b97e7a75ba3f9ee45f53b61a2_cobalt-strike_elex_hijackloader_rhadamanthys_stop.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4756 2026-08-14_b939dc2b97e7a75ba3f9ee45f53b61a2_cobalt-strike_elex_hijackloader_rhadamanthys_stop.exe 4428 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_b939dc2b97e7a75ba3f9ee45f53b61a2_cobalt-strike_elex_hijackloader_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_b939dc2b97e7a75ba3f9ee45f53b61a2_cobalt-strike_elex_hijackloader_rhadamanthys_stop.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4756
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4428
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 555KB
- SHA256 88ef01ec11914647f2d3089c46ec185a7cf4243f479f31ff8f286657326cbfda
- MD5 b939dc2b97e7a75ba3f9ee45f53b61a2
- SHA1 f2873f12118530dae442b6bc7fe674cc35d091c2
- SHA512 31eb2f99346be218fbe6553c3e6ffe95e1912f304c313bb462d5aaac3ac0686534622c369a141d496190b79366dd1113ae64760dd76d6af59d820a0a4a816a78
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsTu:bgHg1JZlT/wHuHNgHMIu
- TLSH T198C48E52AB5144E3E4E245F099FA8B0BD979FA11036592CFD3E8456B2E32BD1373331A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe
- Size 690KB
- SHA256 9036e2b320e8560862758030f62f708e3ae20c48df2a65f9e88a9fa659bb22f6
- MD5 d918bc08426f4b7db6cff2f0953981f3
- SHA1 42e1d8248383bc50757a53ee4a0696efedd789fc
- SHA512 9156a628da4be0119f3e5c9b5079ce838555c24266d8845f9f0a37e9a58e5376c2603c715095d28ce872e832b5fe9acefc445c77996bb23ddb9a0e0dac44d534
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsTumsjF4N5QVrZZ7Lxe:bgHg1JZlT/wHuHNgHMIumEZrZq
- TLSH T1F5E48D12BB9040E3E5E201B1AEFA5A9BC9B5BD31076551CFE3A8456B1E367D0273331B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
- Size 843KB
- SHA256 b58b74ced310ace50bca5114a7038bd22372ce685e277e60b5de52a846562282
- MD5 ade99275cf6c9b2b8b81ec6086b8b7ab
- SHA1 ccc86b680a9b1547ba340c0b7db0223d6e5a56a3
- SHA512 e4a09c39bcbd2874446009990429800d612aa81b5a431c530056ecee789fcb820303ca26b501e23369707c0b9d7dd340c699a13b906f3662d34be618194fc13f
- SSDEEP 12288:bgHg1JZlT/wHuHNgHMIDZ4Q5VYf6exwI1oB86:bgHg1flT/wHuHNgHMIX9exZCB86
- TLSH T1AB059E017B5049F7F4E280B59DBA971F9939FE120710D2CBA3A4562E5E327C16B3B31A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 584KB
- SHA256 0a83477f4ba9c57737c75b15264f6774d0ea1e5cb002eb3aa046fd82390acca2
- MD5 1dd2327add1fa43c4988c83171266d91
- SHA1 dd1f531c8b1b827e7de26dd26149d480c0862279
- SHA512 503542e05c37fa232656caa383da460a8b9edd4d94eeb545fc09f6b805e7260e7a70e976ce4a3ba16f4321324b8c2516052186dac4c48c53f72c7f17ecce48c7
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsT1Bwr7:bgHg1JZlT/wHuHNgHMIoP
- TLSH T180D48E52AB5144E3E4E245F099FA8B1BD979FA11036582CFE3A8456B1E32BD1373331E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 601KB
- SHA256 dff6b304862defad2e90a1d7b77ec5eb0aa04d50c342019587b0a9df21deb157
- MD5 1da6d3d3c59bec81d8823d4f2dbdfc1c
- SHA1 328e1128ddf1cd260cb11a5333af200a9366ad81
- SHA512 ed20a12dd26149bc6dd10ca74b4e2a376c1076eab4ce4231d865ee1f80d5e87210918cc54195cb1a5c46ad5071f2a949e60fc10a29ca8314a7cff9eb95f06d84
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsTPA86/:bgHg1JZlT/wHuHNgHMIP0
- TLSH T1B3D49E52AB5144E3E4E245F099FA9B0BC979FA11036592CF93E8456B2E32BD1373331E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe
- Size 646KB
- SHA256 fa1e6e7ed5b5dda58a2715590cf03c21edac1e8dc48fe5ea6ccf2f633df68289
- MD5 ddec8ee44a2da980d1e0d4021c242605
- SHA1 3cca72cee0a875f2ad01ce0df81642a3c00bd89a
- SHA512 fb59c8dc594dc86cab21ddfd0e5df8dc49c89a7c7558cbda0ceb589f0ad68ed035cd7edd61055270708e7a6cbfab151a352896bad464ac52715b9833ebf80610
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsTDvldRgLd:bgHg1JZlT/wHuHNgHMIM
- TLSH T17BE49E53BB9044E3E5E205B09DBA9B5BC579FA21076582CFA398062F1E717D13B3331A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
- Size 768KB
- SHA256 9c511edd37b3a2e1dd5fe4c0b5698970d7cffeb4ebe09343a89076442faa6881
- MD5 4d713e93c9cdca8f9035e3b94c736ab0
- SHA1 b96ae376f163e5de79fcc701a363f119604afdf7
- SHA512 9ec5715d07e4730fe00aa783bed731879f754656fa28b8cb3481ed0e31662d9820b0f240bb2faa99f5973a66148da4c08f0e8d547b619ea128009d8620f5ef3f
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsTtcT93PiY+Fa7BdvGX:bgHg1JZlT/wHuHNgHMI2aY+FUB2
- TLSH T153F48D31BB5584B7E5A201B08DF99B6FD439FA110B6541CBE3A8472A1E717D23B3331A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe
- Size 900KB
- SHA256 2b460eac53abf592a0e2eec94530de794eb39ffb443fe7ba11ed2360c4b1c749
- MD5 67e9a310827974ac61a55caec0b63e89
- SHA1 3566aeb4c6aa0a479da51328e7a977d4aadf628a
- SHA512 993aa33f8f772f6767d57da4941218fb1de1cb887d2f8e9113fe1de74bcd47c09e3f799756486e05876c39ff67c78b3653ce61e4887bfdcdc84d940aab987fa9
- SSDEEP 12288:bgHg1JZlT/wHuHNgHMIeqwKhHSDeWTRW8fdebE:bgHg1flT/wHuHNgHMIuKhyDZTRW8fdeg
- TLSH T154159F11EB5584F3E8A201B189EA971FC57DF9210B2582CBE3E84A2E1E717D1773335A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
- Size 639KB
- SHA256 45f8afdcbd05d7c0e8d8f64407c92ec8ddc98ff960e337426d8008ba5e95ecba
- MD5 53d971b265242e525408938fd92d466a
- SHA1 909d0a6fc8b657e87fef510823e649109b1194d2
- SHA512 a47f3afd94f2801e6b887f2e3c56979fecd6be97b7952b067fabf34ad832b556940f6b4254738d3b2a110cddda818fcd8da2f3f178f7568300a2045531d5eade
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsTNzkmIL3E7QPQLk:bgHg1JZlT/wHuHNgHMINYmIjE72
- TLSH T195D49E52AB5044F3E4E245B089BA8B5BC979FA21036581CFE3E8466B1E71BD1773331E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 607KB
- SHA256 e026fae2d8b34fe3b2fdd9c908e2a90c62fb64731165f815ae0766792adf2660
- MD5 6cce01cc8214e54b28b61a64b7bfdc49
- SHA1 bea25704133acf11ee0f00b33a002b1d6cb43644
- SHA512 cbd6b0d5327248add7663f452fad600b357014508304d04434ad8353db587e02ee98108522f5362ebbb0cb0f63ad536ccbb830e12710690aaeb6b14199827374
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsTrFQw9J:bgHg1JZlT/wHuHNgHMIrFfj
- TLSH T133D49D12AB5144E3E4E245F089FA8B5BD979FA11076592CFA3A8452B1E72BC1373331F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
- Size 662KB
- SHA256 a04febd89155f4de47f12a61df8954682e81eb637597c445c8ab1f7726c63c09
- MD5 1fae7335c77c9530424b7907a3443260
- SHA1 6aed0f2cf74515dca9a0fc23defff84e05c8b00f
- SHA512 3e459dbcdd3a896cce4a33d24ab75508dec04fd2a15715b3d0770b700b5cc9e34953845e83b4ff37bbd7a61ffd0c4339374dc188c740e65058d09e358c6e429a
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsThp3VL4kv6l8aGok:bgHg1JZlT/wHuHNgHMIhzQl8Hok
- TLSH T1F8E49E52AB9104F7E4E245B089B68B0BDB75F921076592CF93A8456B2F327D13F3331A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.1MB
- SHA256 3356309bd88a410dad309a92bba66c6a31c9e2596a82bc9555e274de3385e176
- MD5 f80f509d252c1fe2bcf01252501225d7
- SHA1 2cf06851291dd7c8953372de28f02252223778ec
- SHA512 720980c4b19c8c470157ec8318150fe10dc578ffd546cfd622485f342869a7ef5f6a41b5d8f6f052daddee1995a3f660e7a27de3251fa22516c96a85666f29dc
- SSDEEP 24576:bgHg1flT/wHuHNgHMIe0Le5ji0hmxNrM:MgnTo2aMPji0Aj
- TLSH T117355B22F6744372D0B3C0B9C9E69B8BE9717542073086CB5295867D2F27BE29637336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 602KB
- SHA256 9379e1654d110f197eee98c3b921cb0c75e83b9909370f2df420c1b8ae79d8c1
- MD5 532c4db10381223f3e6f87c9eec3690d
- SHA1 c726bfb63cb70bda4a81debbf35f503e4bd6463f
- SHA512 3483fdb7107c82c7a82fcd3920cf470eb15919b5d43caa47f63b47cc3ef1835f02687a24d47c17657fcfcfecb5f7138200ec0fa54e62ca6630c32c536ded670f
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsTTcr0X9:bgHg1JZlT/wHuHNgHMITb
- TLSH T136D48E52AB5044E3E4E245F099FA8B1BD979FA12076582CF93A8456B2E327D1373331F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 914KB
- SHA256 3aa71fdd4f55b087aea81d802785f5c140a67348fb3c908b87d5d4edcae9cea9
- MD5 e94395e57279ebff095d095b06a12565
- SHA1 c935d25855db6c823bb067f7533db0508df03d07
- SHA512 561a5aa53ceedb717884722d1ed60d9b5974c52978a4c0352bfadf5ec47be2565b1fde1748eb37dbe12adf82e3fd182feb39be2db2abb5d3e753b5b54f261a10
- SSDEEP 12288:bgHg1JZlT/wHuHNgHMIWAwSfxL/2Dc3jDLLmt0LDQewsAjRE:bgHg1flT/wHuHNgHMIraewsAju
- TLSH T17B158D21EB70C473D5B709B15ABACB0B9839BA110B6156CBE3E8496E1E317D1273371B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 578KB
- SHA256 c7a234e402ce7b7c6fbab9ba39ba4d2043367747cb48e2a685d8360a6ab1c162
- MD5 d26a4a3bbdb8ca7e54ca356e39a3dcc9
- SHA1 a9136938f70abe2909a50872fcb937c232da53e2
- SHA512 7d2a51997e964d57baade405dcd3c4d59cab4bd88733dcba5d5d78f130b25483f40c64c64878763b35c5026158c77cb48a600d6b9569a4ad34b774b91ca826ac
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsT+J70:bgHg1JZlT/wHuHNgHMIw70
- TLSH T1A9C49E52AB5144E3E4E245F099FA8B0BD979FA11036582CFA3A8456B2F327D1373335E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 578KB
- SHA256 30f5702af9d64632c00ab79e60e90a313d5f2a27199fd97c7a00fa736576475b
- MD5 3774950ff94428453f066f21e8736149
- SHA1 a6ae81f5895a4a06c05c4982f1fff74d1a71ba27
- SHA512 190b4ed70b79a18a9f9e382c575dbc693b44d927a24257a3de3bc8adb4926a09e4f81045a035908d223d53a166e38ba0ef1a880b5c7185a77a4d3c33ac031bd6
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsTe4r:bgHg1JZlT/wHuHNgHMIFr
- TLSH T11BC49E52AB5144E3E4E245F099FA8B0BD979FA11036582CFA3A8452B2F327D1373335E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 578KB
- SHA256 9946ac4e524408245672dfb23caa5b2315012b2cfb8eeb9ca8de2db1bb1ea8a2
- MD5 d731283f12783e2ea735133cbd0f16ad
- SHA1 a6ae70dff8b8083dc1944d037c02b5dd11de0721
- SHA512 ca6ea89e11b1b394d87aa0f66dfbf6ffe0d5d8fcdc291d8f4de7b0301ac0d9b1a163cbaa328784ff74c355b0a90cf0cf1538e75aa9862071e68a7ce0a1fe43ef
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsT1hn:bgHg1JZlT/wHuHNgHMIPn
- TLSH T14CC49E52AB5144E3E4E245F099FA8B1BD979FA11036582CFA3A8452B2F327D1373335E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 578KB
- SHA256 ec8ceec4891f4194ad47fd0479e9bce07bf0a3d665b97da29dd15080dd3fd746
- MD5 1aa019eead6a667c0effbddb50827420
- SHA1 7350677de4b49a322b0dcf182b58eca9645123ab
- SHA512 6beff35f84913f776e470c0a7f30384628fd6b5fa3d8c163af9042e521de6fdd6fd8a266a4006c0bfdd88cfb9d46b59708647ddb36c714f9b6b97325c87b3ac5
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsTIix:bgHg1JZlT/wHuHNgHMI7x
- TLSH T16FC49E52AB5144E3E4E245F099FA8B1BD979FA11036582CFA3A8452B2F327D1373335E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 578KB
- SHA256 2f87f19c731f1f73680a02b032d0c303d7f927b08db9bb5abdbccb93c07714e4
- MD5 41d95db919201b9de1ea61fbb867ad51
- SHA1 72b569f9a4cf4da0fd0a061993414376a2b3a186
- SHA512 1efb63cfa06f4364e56bf44256b35d526d695b75e26a2b84a55641b73b451c1946a572ea5b6bb3c230bc4688cbfe8d55799dd00315955fab117ba558b504678f
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsTYwA:bgHg1JZlT/wHuHNgHMIpA
- TLSH T19BC49E52AB5144E3E4E245F099FA8B0BD979FA11036582CFA3A8456B2F327D1373335E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 578KB
- SHA256 5b7c72e3daf7c0343490f9b307a3c22321bb86fccff08225a0a13ce902ad0468
- MD5 8f960979e6e3dce05e94ebdfb669589b
- SHA1 02c1bc21a7b15803d5001510c62e21ecfcec21ad
- SHA512 8f97132c61eeabd2e253a02860abc1ba9e111f8228a6a9513ed5d143224d3df93dca02e3888fa3b447d24a63b2db1116b061fc9b9b078dcea633f1b2b88fdbbd
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsTBc9Q:bgHg1JZlT/wHuHNgHMIi9Q
- TLSH T14AC49E52AB5144E3E4E245F099FA8B1BD979FA11036582CFA3A8456B2F327D1373331E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 578KB
- SHA256 566933bf2ddd6f4bd115c2fb186d8e126dd15feed2a97b07afcb572e99e83178
- MD5 405e406160c0e3f4bbb037957d8fc43e
- SHA1 358935e2f938d2979a24084a6c7905274129322a
- SHA512 6e80d631eabcb16aa9a33b9e6ee047797a066fd18c94498da8cd6ca1a046b3d435969f77710bf0e84550db007e7a0eed3d29c7099bf6437c22a9b1b60dd36893
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsT1R4:bgHg1JZlT/wHuHNgHMIH4
- TLSH T1AFC49E52AB5144E3E4E245F099FA8B1BD979FA11036582CFA3A8452B2F327D1373335E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 578KB
- SHA256 ae2481c47d0746ecaae4d765f70950f6d39b6f72f58d24a1e1a557bccc28d00a
- MD5 aa00e83dfae5f46075092e088f151aa6
- SHA1 1ed9489dbce4d9794623f0f76e02e6891e7148ba
- SHA512 90523be040bd77b98df1acdda56782044185e329fce62d5b602cd240352668fea60c577748ebc85671eafd1531adb2fd6f99d892c10a8aa6e00116c82115571f
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsTtAu:bgHg1JZlT/wHuHNgHMImu
- TLSH T1CEC49E52AB5144E3E4E245F099FA8B1BD979FA11036582CFA3A8452B2F327D1373335E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 578KB
- SHA256 bae2cc49e02bf2bc3aeae1215dfb2f4f8e46a5adf23a567eb745fa4d058ede9d
- MD5 6ea7c3a80b34911adf0f1ff3d83617e6
- SHA1 3f3b3faba3497c75db3950ba72cd5cf17e307e30
- SHA512 4604534e8d9935767ccebcb6d074e56822b4459ad6495e40f2ad707365f2b703f9ffb20ccdecaf258e950661a63a0043aa45efe59678c82aadc5a4050ee1f350
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsTW8j:bgHg1JZlT/wHuHNgHMIXj
- TLSH T1C0C49E52AB5144E3E4E245F099FA8B0BD979FA11036582CFA3A8456B2F327D1373335E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 578KB
- SHA256 bfa7f48d68e5c11aec551debdba83aebff45f899c282569d9f70efa5559f1830
- MD5 332dcde09ea39c6d7dfb694c9411b0cd
- SHA1 f47a2b048781ec9a071642ed6f79cb02335fa33c
- SHA512 3bfd705f3a743a3b3ed5a040da344900308f3c48b955ad12eacf66f92fceec72470a0576fd369da50559ad458c388aebc6aed78cd8dc6431e8db46259958f1b2
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsTAzg:bgHg1JZlT/wHuHNgHMICg
- TLSH T137C48E52AB5144E3E4E245F099FA8B1BD979FA11036582CFA3A8452B2F327D1373335E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 578KB
- SHA256 bb6d0cf10537f9de6833fe38b34efddb704c23a5f4d7aa1a88b6fa6c58bda44d
- MD5 2d2e57134c7b0665f97eefdb4ccea701
- SHA1 9b5954d250a3c109381594676122d537e8301516
- SHA512 d997e0297e7efb4ec538c864f4afebe94ddace4087037bbc1bdec762f5c63e29ad18c574c2751c947767aa3875eaaa0ed58ba3ea3e7fbe822cc1c365f8fc5b7e
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsT7xI:bgHg1JZlT/wHuHNgHMI9I
- TLSH T1B8C49E52AB5144E3E4E245F099FA8B0BD979FA11036592CFA3A8452B2F327D1373335E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 578KB
- SHA256 86e1ac600c7f20abdaf059e2495d4342afff434f78013647959b1213453ad3f8
- MD5 4017c071ecfb1b475b2334a2de83f90b
- SHA1 3072b9dd7456398a1f1b9215ce31415664d95507
- SHA512 439e84a6f2761dee20254a2e71967df8a06b951993ddad1651f6a6135f4fa77eb855cafb3d6bd89f94aa1786ab256bfeedbc5acf70b98c3e8f61987ae1ce9745
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsTldo:bgHg1JZlT/wHuHNgHMIvo
- TLSH T11DC49E52AB5144E3E4E245F099FA8B1BD979FA11036582CFA3A8452B2F327D1373335E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 578KB
- SHA256 b0605a079a56b3ceafe3048607c67cf456eee442c279e384ded78921c46b3eb7
- MD5 851bd723b45fddaffc2a437294ac68a5
- SHA1 e4bd1a0a3aa16ce876459b37b044ce3b8d601e6f
- SHA512 d35ce263a0c76038fbc550f5d3c0dbf1e07514ea9bc0a1767c6038952d658dffcdb340a0f24fb8bc644b48d9966e43916694f750646babb203f592498e8e567e
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsTLo+:bgHg1JZlT/wHuHNgHMI0+
- TLSH T19BC49E52AB5144E3E4E245F099FA8B0BD979FA11036582CFA3A8456B2F327D1373335E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 578KB
- SHA256 f0f417d2bf700d562ff374684374324e0d9f12dd4629c747a48b9881c4abdeca
- MD5 b8ea01bad4e12c67fa8251116dcbf6ff
- SHA1 d42cf3c36b78a9bc57547e29eb84e0baba2b5113
- SHA512 2ce9d211c5aa9e03738ffbe1e1469c3e28154f029a4ce6cd595bf35eb87c1f6a24003cf553ed001a3e0c26164dedf7ca1bf818e44f43c27489d9fbb8ed8f2be1
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsTHcQ:bgHg1JZlT/wHuHNgHMI8Q
- TLSH T16EC49E52AB5144E3E4E245F099FA8B0BD979FA11036582CFA3A8456B2F327D1373335E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 578KB
- SHA256 5624880e12122ecf92c24d0e45ed2fd1ea31aa35baec35d58a54a6ef64486d55
- MD5 11c593bcfbcab7a1a8fc7d88376e4aa7
- SHA1 d4224bd07541525d8c9ae60d54abdfcbe9f8f898
- SHA512 d95fdf85ba47afb500c8a96775979aa4a694f49a410c0cf8aa4b4081007b22326995824ff5c11b1dee4fb6f8f40ecdc66be5cdc38cea86599ae3cd3a4671b21c
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsTtDX:bgHg1JZlT/wHuHNgHMIlX
- TLSH T1EAC49E52AB5144E3E4E245F099FA8B0BD979FA11036592CFA3A8456B2F327D1373331E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
- Size 775KB
- SHA256 df796e884dbbd1bf2f06f6c928a545b045f23dcb4ca15dd912ea1f5b9f375d2b
- MD5 b047b1d2e59a608684172b7bf93b1763
- SHA1 be540ae16de039fb2b24e196ddeaf350ea243cc1
- SHA512 a7eb94a085aaf7f83ef7d77f73191b35880d92ce5749d27c05e34415eaea11725493edae0b13a5bd9823b0513ee31d2b014d677954960e50b52c9ae98927e21f
- SSDEEP 12288:bgHg1JZlT/wHuHNgHMIRQ0dWCXSyCq7IwZ:bgHg1flT/wHuHNgHMIqjCXF7IwZ
- TLSH T1CDF49D626B5044E3E4F241B499E78B1BD575BA21036592CF92E8466B2F33BD0373339E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 578KB
- SHA256 e57c904392ac783ac644738bbcb16836f7d67dd72fb887ac8f1368ce86f82c3e
- MD5 bd3c275fd48cd43b99586ee136fe2505
- SHA1 2cd6ad7a5c3f4fa4761d0a893e00dfeef515b1ad
- SHA512 1ed6c17d101167dee02ba277436f8040476cdcec7f7e7164ecddc59a2b318cec0d52a1681628407a9040577621b99968fa2bae6635f75f5e0ac6314073c5b914
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsT2eL:bgHg1JZlT/wHuHNgHMIHL
- TLSH T15EC49E52AB5144E3E4E245F099FA8B0BD979FA11036582CFA3A8456B2F327D1373335E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 578KB
- SHA256 21a3f09ad583eadb42f701a61391ae71da4e1822cb8bfa7bbc9039274adcc018
- MD5 ba703db0eb1c15fc7d8c5f14c2973a54
- SHA1 44fe76e14f3250e1d375b8d755c664c124b556b5
- SHA512 c12ccc4f6a18e3a90ac1119361c808e3dbc3da963ae7c21635e744089c40dddcddd29ec40e0e2b61cb21d85f192fd4706c5a2f1c5835c44b6729382c20d1b867
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsTUoFC:bgHg1JZlT/wHuHNgHMI9FC
- TLSH T13AC49E52AB5144E3E4E245F099FA8B1BD979FA11036582CFA3A8452B2F327D1373335E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 578KB
- SHA256 2fcab4610a0e3811ea915cb6ada1d1f1db890ff4540c717e519269b211d74a26
- MD5 21ae50402849ad78d78f2914b4c86215
- SHA1 bbdba4270d04d1c0add6f95f86071bd0b0763e59
- SHA512 29581a9439d0b78a8917a74642e59a1e48b9e89206413bb89d0652f9ec48155550b1204c4400ee8728e642f8c6c73159fa4a802a04d13b75746d8272a8d72cfe
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsTgRh:bgHg1JZlT/wHuHNgHMIuh
- TLSH T165C49E52AB5144E3E4E245F099FA8B0BD979FA11036592CFA3A8452B2F327D1373335E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE
- Size 736KB
- SHA256 b1e5252f15ccabe4966aaf62d6a865d22eaa44a02b21e098c06c091aa23e0f26
- MD5 b11caf4383d2aba3918c718c01105c48
- SHA1 6af748a153b014a375bb8effe257fcc55e2e42c5
- SHA512 196cdcb4ec33610d285977dde5ca8887b2f01acddd3fe47af01cdce71c870fd9d36cce1336cfafca175acf9fdc29140428fc3b8c9f3d563d6114a998d033e378
- SSDEEP 12288:bgHg1JZlT/wHuHNgHMIqI13t7ru1CGebG:bgHg1flT/wHuHNgHMIl3t7C8GebG
- TLSH T11FF47C22576840E3D4A902F48BB6CA5BD975BE11071496CF92E4B6FE1E367C03B3731A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE
- Size 670KB
- SHA256 54f66b987dd94575b8e9f0824f8b6c0f7432d0555d44ccd3a0b495b9352c8300
- MD5 95216cbb1517e09045aa1b9940cd5e9a
- SHA1 1639bed329e36f68300fd0bd567b12fab8efd948
- SHA512 f4285c905520f9ddfabd489c86cfbc46f2029cb281a4c75225071b9b765db272b5d81037ace11e8bd9ae0345a3337a9d64b9c7ba4b130e0451c61cfdfdfde322
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsTdFjrZx36wKsf2OMr:bgHg1JZlT/wHuHNgHMIdFRx36wKse
- TLSH T121E49E62A75044E3E4A245B099BA8B2BD679FA11076453CFD3A4C66B1F327D13F3331A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe
- Size 710KB
- SHA256 3e1466e0e349e5f5334efddabfd987fd4d33f71afa9e40c09aabfa288ec6bf29
- MD5 23ec492cc91e1d99ba34b1f9542dfbb3
- SHA1 c78d403f59423a765c29d6b256e05f0b12f2b745
- SHA512 76edf99575f338a740d929783a53543c2fd5c74aa3aafd54ec98c4dbc63089dee4a18e60c78beff7c8ab209def0dc4847ba1562bf208332fa2a81196c5e4df1b
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsTqSeHNq/DSSMjelZdGaFo:bgHg1JZlT/wHuHNgHMIqSeHNXSKelZ3
- TLSH T120F47D52BB9044E7E4A245B089AA8B6BD775FA21072153CF93A4C52E1F327D13F3731A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe
- Size 588KB
- SHA256 64ebbaef4474a114034b9ec9d94cb0196e7e746a6595510ad3f658d0ce49686b
- MD5 e7524facef0caaaf34e82335edf858fe
- SHA1 a48bbf22ede5d11e5db24c013db0412fc648e69f
- SHA512 bb6449d71bb914c1a77382ed3931998b8c45e5fdd434c4bcd8583712c984d979c019a9274385353e4a1c622145f7b3b00214ad9faa751affad0143c66622e885
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsTLIbC:bgHg1JZlT/wHuHNgHMIL1
- TLSH T132D49E52AB5044E3E4E245F099FA9B1BD939FA12036582CFD3A8456B2E727D1373331E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE
- Size 631KB
- SHA256 d7c9d4b2cd5c717be2793365feae96bb2b586264f059e807c57b4edbfa3ce79e
- MD5 bb1d16202d23dee5904ccadbf761056b
- SHA1 79d74d93266df24320ab51c174dd76a0af303611
- SHA512 92be627242873877e3d6c0f587a0c35cb3e2d234f9e68ef9855ff26de0f83434dc72545b840dd314a4573d82060689e23a5e226d2e9065b69adbec2775cd1fd6
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsToKHk3klOz:bgHg1JZlT/wHuHNgHMIoKHkUl
- TLSH T1F0D49F51AB5045E7E8E244B0C9B69B6BD935FE11076491CFA3A8B52F1E32BC1373331A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
- Size 599KB
- SHA256 38c6aa9d51ebc4ed514a041a1543eccab26e0f7d931f543e26d14a3c1aa43c75
- MD5 9f4548448237418c58a5e659c96e8d9b
- SHA1 f86e0f99f3133b08884a881a47d277732462cf92
- SHA512 3cb248dc4bfbc74bc3b7b554bbd238ffca1ec90009ede1b3bfe5d2fe47fff69c1e3b7a181fe69f23c2695a0a5ccce769bf32cc8a4c8c60cd60195e94e3d31191
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsT8yF2LfFfi:bgHg1JZlT/wHuHNgHMIPwZi
- TLSH T128D49E52AB5044E3E4E245F089FA9B1BD979FA12036592CF93A8456B2F327D1373331E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
- Size 610KB
- SHA256 7c9507dfe09e89e7176257bac4e7efef760e1e93c76f560d38785b7ed15698b2
- MD5 8f327fc532cc510f1216bc2eea934135
- SHA1 85293cf410d2f74cd8970f81ff1de2a6bef559c1
- SHA512 5c6de4b0159501767a2079c5bde68eb6c915951614efc7acf0edb88d19839edc8e24c6b2950f51d826f52c65a52e2011c936cbb4ea2bba8c99a6c47536d50235
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsTc2CBnT0E:bgHg1JZlT/wHuHNgHMIc2+
- TLSH T1EFD48E52AB5044E3E4E245F089FA8B5BD93AFA12072592CFD3A8457B1E327D1373331A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe
- Size 616KB
- SHA256 550c6f0e03123857c9ee86b7f3ddd539800d440cfa7f29a684a62a08536d02c5
- MD5 072b3d9406becdb39a49cf48a2e56763
- SHA1 334d50e84421bd59bfad3e36abd9bd176d64402a
- SHA512 d2cd96bd0c625abe602e2bd2e9ef8421ad51d5fbcabaee24bd0453fbb62ce00eb5219dd8aa5bfb75bdec97bccd0e98a94ba0843920ec012dc5710418615545d0
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsTqF4:bgHg1JZlT/wHuHNgHMIq6
- TLSH T19AD45C63AB5448A3D49125B089AE8B07D535F91D075442CBA6BC8E362E35BF1373F32E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe
- Size 634KB
- SHA256 c76eb2d7c52150b015226a563fdb77d3590ec04a776a4f721f3de34100e2144e
- MD5 adcbce7785030dfc8902f82d759ddea4
- SHA1 39a770508e261272109f510de8cac2693dee43dd
- SHA512 3b19f2f62543525077087d2c9399cd1adab2e635153bf2c9c09dd12c50967dc47b12e6709437bd6838a5c1fd7c6a6b35b5357dc98f69a867fd772cef45a05088
- SSDEEP 6144:bgQJQGRR15LIL9N4QL/aTB5wQJQGrQJQGe3gQJQGfhsTZsFLZL:bgHg1JZlT/wHuHNgHMI8F
- TLSH T1EDD46C51EB9105A3DAD205B0CDAA8B4BD839FF91072145EF92A8777A5E327D0373331A
- MD5 SHA1 SHA512 SSDEEP TLSH