Analysis
- max time kernel
95s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 22:31
Behavioral task
behavioral1
Sample
2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe
- Size 90KB
- Sample261027-2fe69svy5l
- SHA256 68b83697aae7c22eadbe3d912f3fd6815665dc7295cfebdd5c1d854858a43a71
- MD5 efa85e3eeb4a9cb477ea46889235a82b
- SHA1 ecd4d0581d8b4bedc4ca0c363b5f1317fc71649c
- SHA512 06a798701626870b705385815ff89ffd52dbe775f2894d7de570e677d5dbd94c573ce91296185fa047049e5560e5112c4d0330cdbd31c35c32538f50fba78e7e
- SSDEEP 768:/6X77r2+xuha5IP7GxIy3MS+CprKccKKKKKKKKKKcqXW66X77r2+xuha5IP7GxIH:/Q74pP7GxdMjCAW6Q74pP7GxdMjCAWm
- TLSH T172934B9AA756E0F8C083803512FD6E3F75377C1362B7A36E52D0E1D51A34958A37AB31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 62 IoCs
resource yara_rule behavioral2/memory/616-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c45b-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2a4-47.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019c8a-78.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019849-229.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-248.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-261.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-268.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-269.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-282.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/616-313-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a59-380.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-447.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2896-484-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-485.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-504.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-511.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-512.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-525.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-586.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-605.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-612.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-619.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-632.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-639.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-646.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-647.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-660.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-685.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-728.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-741.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-748.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-755.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-762.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-769.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-770.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-771.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-790.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-815.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-816.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-823.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-824.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-831.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-856.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-857.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-876.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-889.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-890.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a5bc-921.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a79e-929.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a799-949.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a47e-956.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a514-969.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a7a2-970.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a7a3-989.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a96e-1014.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000001a0aa-1125.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a0b3-1132.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a506-1163.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019e4e-1177.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a011-1178.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019e4f-1216.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c45b-6.dat aspack_v212_v242 behavioral2/files/0x000300000001b2a4-47.dat aspack_v212_v242 behavioral2/files/0x0004000000019c8a-78.dat aspack_v212_v242 behavioral2/files/0x0004000000019849-229.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-248.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-261.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-268.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-269.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-282.dat aspack_v212_v242 behavioral2/files/0x0013000000018a59-380.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-447.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-485.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-504.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-511.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-512.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-525.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-586.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-605.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-612.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-619.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-632.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-639.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-646.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-647.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-660.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-685.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-728.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-741.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-748.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-755.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-762.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-769.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-770.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-771.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-790.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-815.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-816.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-823.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-824.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-831.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-856.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-857.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-876.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-889.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-890.dat aspack_v212_v242 behavioral2/files/0x000300000001a5bc-921.dat aspack_v212_v242 behavioral2/files/0x000300000001a79e-929.dat aspack_v212_v242 behavioral2/files/0x000300000001a799-949.dat aspack_v212_v242 behavioral2/files/0x000300000001a47e-956.dat aspack_v212_v242 behavioral2/files/0x000300000001a514-969.dat aspack_v212_v242 behavioral2/files/0x000300000001a7a2-970.dat aspack_v212_v242 behavioral2/files/0x000300000001a7a3-989.dat aspack_v212_v242 behavioral2/files/0x000300000001a96e-1014.dat aspack_v212_v242 behavioral2/files/0x000500000001a0aa-1125.dat aspack_v212_v242 behavioral2/files/0x000300000001a0b3-1132.dat aspack_v212_v242 behavioral2/files/0x000300000001a506-1163.dat aspack_v212_v242 behavioral2/files/0x0004000000019e4e-1177.dat aspack_v212_v242 behavioral2/files/0x000300000001a011-1178.dat aspack_v212_v242 behavioral2/files/0x0003000000019e4f-1216.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2896 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$ 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{0AF901DF-08D6-4B70-B8A5-E1B085E881A8}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ patcher.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\EdmGen.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 616 2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe 2896 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-27_efa85e3eeb4a9cb477ea46889235a82b_conti_elex.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:616
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2896
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe$
- Size 180KB
- SHA256 aa52147129b7148d7dedf6720623af7029a8fe09659a2fd0e00ae3d9921febb0
- MD5 01298d05a999660a7fef0453df6a24ac
- SHA1 6f98da84ccbe7fe37191a1edf819d737b3252fb6
- SHA512 bd6ec779c00bcd0c50552dec4f61155bb20a1b53b18012d3646d1c93745ea8457a5ba7e3c8e5eca177ce90bbd4181606babb3ca1fab2a33f91dee595edae44d7
- SSDEEP 1536:/Q74pP7GxdMjCAW6Q74pP7GxdMjCAW6Q74pP7GxdMjCAW6Q74pP7GxdMjCAWm:pP7GXM+YP7GXM+YP7GXM+YP7GXM+m
- TLSH T16E044B9AA756E0F8C083803512FD6E3F75377C1362B7A36E52D0E1D51A34958A37AB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 104KB
- SHA256 e386ad597af461d122ee979fabc720f601e5e83633d4f23e3804d89ea3a943f0
- MD5 8c11084e53c97c0c8d420a3d0c562984
- SHA1 5bb6f255d0934160ddee5f5f4722a296976cdabc
- SHA512 9b3452af5553c62a68cda75c6d6884ca292728e59511088f8a9d891c808ef8b42b058320fb21ed6024f852f0e2f876f56e22669db6d54decd2607d2471c6d8ad
- SSDEEP 1536:/Q74pP7GxdMjCAW6Q74pP7GxdMjCAWZHqaN6qH:pP7GXM+YP7GXM+waNVH
- TLSH T104A36C979765A0F8D1D7803022FD6E3B75377C1352A2932E52D0E6D81E34958E37AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 539KB
- SHA256 53b099008a96316cd41ba38e62073fad1f8ecb87b6bbf6a9a96e610ac2b9e36a
- MD5 c5eafd651264ccc13982b87e4cf41acf
- SHA1 84151b0f6e9963a5720ce2fa14b7734343552eb3
- SHA512 2e65cb7a597453780a5fcb7501fb14ed0fd01334c99d95b8b6d3f112d153daff0c766aa1f6ea9eb20dc8ab72ecd508adb4b2bfcced89d9777a66680221e68452
- SSDEEP 12288:1egegegeOAwSfxL/2Dc3jDLLmt0LDQewsAjRE:1egegegezaewsAju
- TLSH T18AC47B71EB74E036C2BB087117B9DB3A243D7D214B6216CBE3E8D99D19302D16376B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 203KB
- SHA256 5db65d2dc647879d06243ae4d94aa17d6203a8d4c9f86fd61a13a211644828c3
- MD5 6fc70774e9b77f59dff4c64e6d03cfd1
- SHA1 c41ef44aba36eb4ca3ea28d99eb682fe5c225771
- SHA512 2599f0459cebab6d9e1189ef919c24ba83ed8bebf2a9bfa3a4c9d35f18122e638a6c30eebbd8047ecc95c1596d40b702a8587b9fb8a458112aae0fe6922ab07d
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+Q1Hky8xy:1G8+gG8+gG8+gG8+gE6
- TLSH T1DE146C9B9766A4F9C083803012FD6F3F75377C1362B3936E6290D1941B34A98A37AB75
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 203KB
- SHA256 99e45d4d69211fad18b84ba6a1aeb5cd4d65dd2e85b1e57f211217b225866fc6
- MD5 ee723064ce225004f003eeb47f6193ee
- SHA1 0801865039eaf203097908f6badceac55711474f
- SHA512 605d3a08bef8f657f05073e1266c35495c24d8bfd456b9139e319fe2d0c946cf470c4a20acf3a68abde0e020e3733f9629a56437c509c49a23df32687a1a9fb1
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+Ud70/sxQ:1G8+gG8+gG8+gG8+E4N
- TLSH T173146C9B9765A4F8C083803022FD6F3F75377C1363A3936E6290D1941B34A98A77AB75
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 203KB
- SHA256 3f9b31981b8650a6d2528b075e7bcfa61898376f0af9aaddbb1ef52d3497f82d
- MD5 ac21028f714211a0aa974bf4fb59f7c7
- SHA1 d9b8534439081ad023717bfd8e46218e6a46d298
- SHA512 5d34849155d2b4996693a52e2eaf5ef6b546b739a6f1cae23f0367fecd1357e09a8bb0885085ac879afe42016d8e890fa6ef4bacfd68fddacb76bc94b7c235c1
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+IdXK6oxF:1G8+gG8+gG8+gG8+Yaf
- TLSH T1F9146C9B9765A4F8C083803012FD6F3F75377C1363A3936E6290D1942B34A98A77AB75
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 341KB
- SHA256 da0cc3bc28c57984613701d5e8389e0d1fc3723f6dabb0c6121c8cb29621dfdd
- MD5 2f70812ad8ee58f2289e07414b77994e
- SHA1 b2dd339bb1f9ec5d0fc2386c327646062b4ee4d8
- SHA512 b8143ae8445e389c4efb60fc0d241a5cd4db794be48feb1d834e46022a1c57f8cbea05e9bc8ba0c33171ca366675f9111b974132b8149c9e50488fc3f076b730
- SSDEEP 6144:1G8+gG8+gG8+gG8+Hc+D/0vxBzkiLz9u7:1egegegeRyPz5L87
- TLSH T1AC747D5767A560F8C0A7813445FA1E3AB7767C33177193AF1390C2A52F26694AF3AB30
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 203KB
- SHA256 28f22b4813c239d821fe208402e4abee55f74b63884d15fbfeb3466934bfdd81
- MD5 e1b55fe3c761ca92ba488ab144b31acd
- SHA1 a64d7c044bfb1bd7f185b6dffad3430c5e54a6f7
- SHA512 2d4cc333a2dd10f886bcbb8cc0180a369dce30c77198fa323a645dae67dc6c853cd7e19a1f8863219a3620d07a17f180d40e99c10a637f1a82e2a5ab00ecac9e
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+Sd1AWCxS:1G8+gG8+gG8+gG8+uio
- TLSH T166146C9B9766A4F8C083803022FD5F3F75377C1363A3936E6290D1941B34A98A77AB75
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 203KB
- SHA256 1361be35a89e8362175989a711d62508d25f16262c411e563d13ea237f6ea5b7
- MD5 d6446bd54500ba13c2b253413624088b
- SHA1 f9124956ab5374e3c7fc78f43598f26e0f5de006
- SHA512 89b4988c84ebed94ec27e8335215932fa34df76c1f1df3e12356272bedd956840ff11faf8cf67359093f0fe6b1e9de932e5846ce495f4ed6f8f825c7ccd41cb8
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+dd4wn7xk:1G8+gG8+gG8+gG8+XTu
- TLSH T1C7146C9B9765A4F8C083803022FD6F3F75377C1363A3936E6290D1941B34A98A77AB75
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 341KB
- SHA256 d35700ea4556fecda0f3897533919a32756ebd7c0cc6ac0fe9fd37ef2cad658c
- MD5 c43055931dbe0f180bc8ded0ccae53f4
- SHA1 d08dd32afd0992ca60f7b5cab45b837cbf77c6c3
- SHA512 396e11f486f7bd626b1d015f80de9246ef7720e36793268f906a68fc525daa19b18436ad734988585bac17b3678a8d0c690c5020465e43c49a983fd64ce62772
- SSDEEP 6144:1G8+gG8+gG8+gG8+wc+D/0vxBzkiLz9u8:1egegegegyPz5L88
- TLSH T110747D5767A560F8C0A7813445FA1E3AB7767C33177193AF1390C2A52F26694AF3AB30
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 465KB
- SHA256 de30623f1b52a4cd55ca597f2c7ea2ea593bfe497acb52fcceec707e592ca9c1
- MD5 040fd9a9b6b8858a98b5f1b87aee323a
- SHA1 11917c161390caaad84d5bc4329cb953b200fa98
- SHA512 dc9b20559f6448306c3657f09b20537ca60100c7f900a421337f08ad89bdb0f6f3c6ce0b950550261c22f8fb85e5552f27a6bb0d895916483da69d6472e74c51
- SSDEEP 6144:1G8+gG8+gG8+gG8+2AHdwS/WYoTOLHIsPPzAdnz0YutYPDvhI:1egegege2Cd9/WYoaLHF3z0z04PDvhI
- TLSH T13BA4AE95B35058F8D8A3813989A94A3AE5B37C170770C35F13E4F2A61F337A05A3EB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 645KB
- SHA256 0ce6962685818016f38b2aea9680344ff9163e79eba5afc6fd61a3b8b68f1aae
- MD5 86d852e848e0c3657df959bef5a7c13a
- SHA1 4521bdd2a24b3ccf2a715305cc99b9800280a571
- SHA512 a726798c7c59620b33517cec5c1620d083400388b360835c9c39340119a237754a72944a95b3aba52b03d87c35b46a6d475f606425878fe0ecc344fcded84cd5
- SSDEEP 12288:1egegegeLi4e7WRdTfgwCHKy7GLbbdIvx:1egegegeL3Td9CHKy7GZI
- TLSH T172E46B91F3E410F8E0B3863589B65532EA767C561B71DA8F03A4E5591F32AD08E39F32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 203KB
- SHA256 25fc336858d47696687b42a6c5af4baaf37dac32809f01f4b61258852a032d4a
- MD5 a36165f0d217fd67dccea4ad0f4a835f
- SHA1 009c9e9ab740f72242bf43bfdaa7cb2c909e1e3d
- SHA512 cc2420525617f7ce6bbf99220aac9ebc8aecdd87cdb3b236f0711c5dd26842bc1bb7f96c71b1a0dbff4ac8a870abe3a2ea6cadd82ec0afba1e1d7f26faa1240f
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+IVvwljxR:1G8+gG8+gG8+gG8+4I9
- TLSH T10C146C9B9766A4F9C083803012FD6F3F75377C1362B3936E6290D1941B34A98A37AB75
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 203KB
- SHA256 770dc969a32e5a667a442af84b3bf079d65cd7e5bb52aa18cb97c504e3900789
- MD5 2f9fa530d4ec4decb80c01f22aca7eb0
- SHA1 fed178ae44ad3e80fd243e15f990a40d6185ba56
- SHA512 20d4a4cd1f70ea1f1603c06855599aaca1a7546e503468457adbd9b68cd93e4db557d2cdc6fadc50b7c250e4922696a945ab8963afc38261012806c08b61722b
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+7oAMWxA:1G8+gG8+gG8+gG8+Nc
- TLSH T1E4146B9B9766A4F8C083803122FD5F3F75377C1362B3936E6290D1941B34A98A77AB35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 203KB
- SHA256 d83caf82f487eb88b65f595d18f681a709e9185fc478fcc038486ffa29a8c5d8
- MD5 33a519c3d6aee2ee8ca5599c478a840b
- SHA1 c6541eec24b50d8f0adbff3d2f806de153eeb22f
- SHA512 4779ca42aedb8a0e13e31778f889d3383ffe7422c901d968a4e09eccd41994ba374e299a92fe4f72aaa5cdae505a5e0d01df322eb54d2bad88a461c462af7d38
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+LVbEY6fxV:1G8+gG8+gG8+gG8+Z4p
- TLSH T1AC146C9B9766A4F8C083803012FD6F3F75377C1362B3936E6290D1941B34A98A77AB75
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 203KB
- SHA256 59d3b7a7c044b879f89f74f2ac47e0d01cdcfa684fdb7b44fefbed1ec93ed32a
- MD5 b44dd33f5d397cfbe588589f051312fb
- SHA1 d68d962cee1c0b8b3484b0017c65b06bd40cc0aa
- SHA512 f3965a57e702fd95c94b4e418d95ae6ccce1380cd74cfefe8525dc06df569846d5c9b782fd34db8860e2cc677acf3499d62d77e8684050844861ac49f7ea6d65
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+idr9ebYlxy:1G8+gG8+gG8+gG8++Re0a
- TLSH T1B6146C9B9766A4F9C083803012FD6F3F75377C1363A3936E6290D1941B34A98A37AB75
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 203KB
- SHA256 fd1d1693be74067af3dec3af5877c7650dfea6c858858c3c34d3abeddf53e4d0
- MD5 b1d8632d5f5c7e1bf602053fe445edda
- SHA1 eaaaf7553a33ddc479dedccd7280b5189d9ba402
- SHA512 f4cdc03d649b73a5dcdf22cf087d8ef815be558dc03f795b534c10d79c14d0f11f8ab3c40ddd5034998e4adf11e0c1f17930ba863b524073c19d508d86c02820
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+HVGis4xR:1G8+gG8+gG8+gG8+1xF
- TLSH T130146C9B9766A4F8C083803022FD5F3F75377C1363A2936E62D0D1941B34A98A77AB75
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 203KB
- SHA256 db979f479225695138e83a0c36f22ab94b769b75845aa559611ef6b585a98770
- MD5 e234bb2a2f4b443dcdff11b7c9182578
- SHA1 b63492c8e488b916f6446f4a3096bdd6e918cb7a
- SHA512 c9b6ba0a5b6dbd97ca223a48641eb820541df384229d8c49e39d8636a223c62d2bcdd5f3f1ca9f03c792d3743562d621391ef45148ae7f7638212aa35f021735
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+s1WSXBx2f:1G8+gG8+gG8+gG8+EnC
- TLSH T1AE146D9B9766A4F8C083803022FD5F3F75377C5362B3936E6290D1941B34A98A37AB35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 203KB
- SHA256 9308bba1f8103e85ee06106b442aff74d6ce0a6397317b7ebf190b3c2a74917a
- MD5 2ec4545ddac5f33b1811a26f453f6f0e
- SHA1 7a2658f1cdaec72c66e1a9b8b112646e47068842
- SHA512 bcd2b0e61e9c8dea1fa83ee93d10736ce3004716f52588ed915793330ad26d593375b58887138f20291f6206976eb9645ba2b6547e3926dbff6b24ea53e5d57b
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+yVZ028xK:1G8+gG8+gG8+gG8+eiw
- TLSH T1EF146C979766A4F8C083803022FD6F3F75377C1363A3936E6290D1941B34A98A77AB75
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 203KB
- SHA256 6bd3b6427b4a50dc5ec349517b2c69556a1cbbfc42a6c61f9f9c57a950c6247a
- MD5 f1a038853cfac226b0099488ed443582
- SHA1 27ed0d38919f80ab80545c03217fc6e5bf2627e6
- SHA512 ac4799260c3ca39985e553c048f1d8b256db633a38291df004ad1216281cef00fc638ef58d6136bef4683358da38be843d494773a7b1d08c5ca541ea6be8fc16
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+717gtWxm:1G8+gG8+gG8+gG8+J8T
- TLSH T108146C9B9766A4F8C083803122FD5F3F75377C1363A3936E6290D1941B34A98A77AB35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 203KB
- SHA256 b88a83ce1fd7fb99a8a672604df1179fba463e7ee12a42ece615f1b0249326b0
- MD5 d09098b9faeae7680681427a776d298b
- SHA1 be97ef1b598bd65dbd0bb91a9bd12a73a8b5fecb
- SHA512 f8fe92de025395ef4b124c33bdda321778b98ee5759e2cad43dceaa3181d2134a10022bd084039de2d56f839f40cc512abd39d07455440713de6052db9f05c35
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+6VMAFRxk:1G8+gG8+gG8+gG8+Gnu
- TLSH T136146C9B9766A4F8C083803012FD5F3F75377C1363B2936E6290D1941B34A98A77AB75
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 203KB
- SHA256 a9157c40a9222479c8a594fb3afbb272fe87cd609d920148348a943ead299319
- MD5 b7bc501204ce1d1484e52b5cb03c5376
- SHA1 53a2f0ff66214105bfcc3bc358efe7809e41133f
- SHA512 5cb231220299520b6d9b42b295dd80e7c9d52f87cf754df4dcb53e548120a8ba7be3a791089a56620d24d4b04b12b86a000322b7e5a43e6ba3796088bc12f87d
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+3V3OqJxo:1G8+gG8+gG8+gG8+leb
- TLSH T1AC146C9B9766A4F9C083803012FD6F3F75377C1363A3936E2290D1941B34A98A77AB75
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 203KB
- SHA256 859437dbdc9feeea6f0e065f9dd7db0e86682bd2de3bf73038a5bdb02daa80fb
- MD5 b8a8f4277156b3f4b8208cd0eb559d8d
- SHA1 9a2a579f2aea61404d70249fa2004775d2ecf838
- SHA512 d234b72ba7e3582cc9ad46a99671e24b0078301fbe6c50bd9bab1ad49aff871cef2f5b2f20e1d431105222266e33a8f439cd522e752dee85e60fbb85b582d859
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+gV6UIsx5:1G8+gG8+gG8+gG8+4hf
- TLSH T1F0146C9B9765A4F8C083803022FD6F3F75377C1362B3936E6290D1941B34A98A77AB75
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 203KB
- SHA256 657b634647e2134e85eeac696eda0eda7a510f443d8e15a8ae7d7662c60c3b6a
- MD5 686199a8226764940f27cad91022b288
- SHA1 2d98bcdf62cdc59e532803df4a8c362e44f8fe81
- SHA512 423e8473e4a097e895744be016de22f55de67a90edb06aa02300b3cdb06773068b5ff4904c65ec44faa71be9c6251536e4c8fdde6462accb1eb5714207089866
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+C1XgrnzTx0:1G8+gG8+gG8+gG8+2QPy
- TLSH T1D9146C9B9766A4F8C083803112FD5F3F75377C1362B3936E6290D1941B34A98A77AB35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 203KB
- SHA256 50e458c7c066225fdc711810d17105a043f7ab4ab8095710abef1084eee01983
- MD5 f1636399cc50c7bad877115ce79a440e
- SHA1 6c1238771ab9208d510c8e6beb5113d1aaf90cda
- SHA512 96e1bc7858d56e508c58d42c61bbcb2cff6b8881d5feb4d7b9bf69c38fcf38158d7efb53182df0a62437269c9604a0770aae25345ed6ee7573784faf1b07313a
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+OVmE7exH:1G8+gG8+gG8+gG8+61k
- TLSH T1B3146C979766A4F8C083803022FD5F3F75377C1363A3936E6290D1941B34A98A77AB75
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 203KB
- SHA256 130a6bfe17324bcb5f8f90520f7780fc5213e44796767879936ecdaeba3228f6
- MD5 20e86426ea8fd324f4ff91d4a3bc7797
- SHA1 bdc1d820abc7e00d41d7d7cb3ba00133ca128426
- SHA512 afbe1ce930b043d48705b67aa124ab977b6c3a28d80589563980d997f799b3ec90bf59c504965bfa6e8abf2a7e4496d319e267923fe655c8a51e35f27b53705d
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM++VvGlAx7:1G8+gG8+gG8+gG8+q+0
- TLSH T1D4146C9B9765A4F9C083803022FD6F3F75377C1363A3936E6290D1941B34A98A37AB75
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 203KB
- SHA256 e631288c646ccda43a268646b346242aa9a7a079d988bd4751790510d0fc7fb5
- MD5 76514dfb1aceb25ea3e8071e0910ed8e
- SHA1 8a93422b29767e28a699f5c92394e5fe277d2039
- SHA512 3ed88414b6f1a6cda28ebf185119af41872ab0f3fca02e1bb527f292304422f986a28cda1bebcd1d027c976d656b65075cd2d4afc3d26ee4e9be066402191dd6
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+KVScXLrxa:1G8+gG8+gG8+gG8+WJ70
- TLSH T1FD146C9B976694F8C083803022FD6F3F75377C1363A3936E6290D1941B34A98A37AB75
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 203KB
- SHA256 df30cfd78d1cc8a3dbec202b506ff3a48a67e02a5262e97e5de2a079f4044187
- MD5 d59cf781035fb7129c87b3e13137f9fc
- SHA1 75ef155f28d72703c8100653bf33720a4299af27
- SHA512 71fe30ab91ef146d78a75d94de8edce9343093e8da7b16a6f4e02a0f96e7120fc75325309067680705a8845e65767a24f941074f6be735ba36ad8a627b5c9c10
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+aVLUIzxU:1G8+gG8+gG8+gG8+m4r
- TLSH T16E146C9B9766A4F8C083803012FD6F3F75377C1363A3936E6290D1941B34A98A77AB75
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 203KB
- SHA256 de4c8d0bc0f5ff83aa52c82b3f3ea312ea43ba3b6b60d5794515dcebb3c26476
- MD5 1499a4432398f101824896501a73863a
- SHA1 fe7fb9c5f616b8a6738222e95e0ab16a58953307
- SHA512 7ae7d3be27489b7fae38df90e030114bf3cae69118addcb765dbee66620eb164ebb3f163c0d89a9a8f905f2803f91aee9adc77ad565ca7ad8b6850e7e2d6a8c0
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+/VLkGZrxP:1G8+gG8+gG8+gG8+thn
- TLSH T116146C979766A4F9C083803022FD6F3F75377C1363B3936E6290D1941A34A98A37AB75
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 203KB
- SHA256 529321af3466aaa061ea02dbb4aefaa171bcc2250587fbc934a4352ca4c69017
- MD5 e24251b120d7347f3b38b4583ee72d1e
- SHA1 e8905943057cc6e709cd916987203bb466aebec5
- SHA512 9cb4bfe3ee5dae67ba73d21c3537483aecbd81c81658ee7c15fda485d24d5796a4292f7ff5f82ccfc1adb65105d707829d32197f82b42023dbff3127649addab
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+AVDuJHxN:1G8+gG8+gG8+gG8+wix
- TLSH T1DA146C9B9766A4F8C083803012FD6F3F75377C1362A3936E62D0D1941B34A98A77AB75
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 203KB
- SHA256 4e7b28b01a7beb5592b4c7e2de7fa2cc5cb43896da9066054e6d5cca279a0bfe
- MD5 b72b4938e0cf38375da1e6f04f3ef753
- SHA1 ca7cccbd16e5157e7218f3638ffed35696770c0f
- SHA512 9f8d351a0c6b093f512fda492032d6a64efb9fa15f87c4e2e0874e42ab5aace0f7adbc0537b0e0a76367b5516bf781a4929ae90615d080d43ec784149125ffe8
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+QVFCdaxF:1G8+gG8+gG8+gG8+AwA
- TLSH T101146C9B9766A4F8C083803012FD6F3F75377C1363B2936E2290D1951B34A98A77AB75
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 203KB
- SHA256 3903dcc4177fe108d5b14dafd8df8e1e8ff642ab6ea3c2e870778b087b6f6de4
- MD5 bff7d067d052adf2115f87a350a16f29
- SHA1 42c71343b072eb6b814c055f866f6f5798963d82
- SHA512 5c75211d30a7bab0ccc960b391aa4ff0ea525f1e5655de782a6a3c8e91f5efb0de206ee431cf76e8401c7a0027de28a08943480515e5cc6a83772b56ed2486ae
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+L1cWSyexU:1G8+gG8+gG8+gG8+Zc9Q
- TLSH T163146C9B9766A4F8C083803122FD5F3F75377C5362A3936E6290D1941F34A98A37AB35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 203KB
- SHA256 0e3da6e4e7e8d415c06f9bc294acb9128ae9f48ff9b4df7439acc66ade49244b
- MD5 3304e178d811428a42b315a5e22d9b1c
- SHA1 b5a8f5399e730dcb395e288885cc5ff3a24ed5f6
- SHA512 fdc9c7d46cb84cb2dcb5c78df1f314526cd57cab60c42f6bd1cd411556ada210694d5d5f4cd4976abbbf35fdbbe65eab5fbb8c3e881e093cf91f72bf1fe8a06d
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+PVG4KcxU:1G8+gG8+gG8+gG8+9R4
- TLSH T1BB146C9B9766A4F8C083803012FD6F3F75377C1363A3936E2290D1951B34A98A77AB75
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 203KB
- SHA256 322f014a5ad2fdc1d78e198c9cda89722d89cd27c6d0495eed99f3a61b2672ac
- MD5 4b0df3b2149d1746e2c2a0f5de8769f2
- SHA1 06c4ec3a65904626d44f8794ad6e8c47ef191e70
- SHA512 bde2f6f6ddc2f5a829dfb6ab104f993595db88afbaa6a094f2d2e228d2abae1fc1bc8c50bc45c1f163b714c8f6e19cf9081b0fa6624dcbd95a759051a90ea10c
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+3V16u9xR:1G8+gG8+gG8+gG8+lAu
- TLSH T1C2146C9B9766A4F8C083803012FD6F3F75377C1363B2936E2290D1951B34A98A77AB75
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 203KB
- SHA256 77b77033c0e8e7c90a049562a4b1cd83404b7c323b75572e136270f75ecf8f6c
- MD5 59f3ebd703b034eea05e9c080235e556
- SHA1 1f0b219c49c8171812580c02f7dccf4faa036142
- SHA512 680826efeb20fdf7b727d341621ad85daa522e15300a6118dcb2cd00b7cf414a13a4c6e03828a68e2d7a9f12551dc5d4467b26f39223acc63816fe1c0962f105
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+yVtWl+xI:1G8+gG8+gG8+gG8+e8j
- TLSH T1F7146C979766A4F8C083803022FD6F3F75377C1363A3936E6290D1941B34A98A77AB75
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 203KB
- SHA256 ae001bc33095deb76efb080770fc004db11f3ba70f5214cd64a92c77e9e3cbb6
- MD5 c225496b4e2830cbb8749083178d4eef
- SHA1 25d52c80780689ea4f467d67e5e4a016b28be73f
- SHA512 68f78658441316e4ff6bb8f6b46e562e2187087e182c4710e83efc6925e3aeddea3467fdfeb5abfcaaffcfe1c2c9a19f72e9738fc7265a5d764a975976487fb5
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+oVGIG/Ejxk:1G8+gG8+gG8+gG8+Yzg
- TLSH T1AA146C9B9765A4F8C083803022FD6F3F75377C1363B3936E6290D1941A34A98A77AB75
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 203KB
- SHA256 b82dd3f6c7ffc19d3647bd786adfee3dad2f9899a6a9b74b38bdfa84cf66e857
- MD5 60d66164ad24eecc13bef18478fe2e6b
- SHA1 69727214b1ee6747f1f4236621579ff6a36e850f
- SHA512 70866b517b37efa61d7bb028f4cec9cc413bda8fd71ae30d4ce75b48510b00e87c73bea06b21ad25230c33b1cf17062a8cc458dcd5a884625af10fa8d56be89d
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+RVQ6R9xG:1G8+gG8+gG8+gG8+TxI
- TLSH T11D146C9B9766A4F9C083803012FD6F3F75377C1363B2936E2290D1941B34A98A37AB75
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 203KB
- SHA256 2dc1cc760d5e2f162fd5dd728f09fe73bb8ba245db8fe2d9d70495cea51f6c7c
- MD5 04649fb0815d9ab3538f399b43f18a29
- SHA1 06de62b008b60b61f6ea0d9a52238d8876d5a230
- SHA512 423b68a18528197f362c4625bf3df079a5491533db44cfe478cc92bf9fd3a7b0e7d8d5a006e9f2915426af034667c36a760d5457cc6fd74e04b7e945a5a12452
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+/Vigp6x1:1G8+gG8+gG8+gG8+tdo
- TLSH T152146C9B9766A4F8C083803012FD6F3F75377C1362B3936E6290D1941B34A98A77AB75
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 203KB
- SHA256 2e9f139146e3fcbee668b1cb5d43622c62a1ee17ab30bfab50753d4125445fcd
- MD5 1b9af87733fd3f5d7e6b8596c5a48ac4
- SHA1 ee6e98653d05c05f48a2858fe486abab0d1b443c
- SHA512 196372a6344f25c1a58ae1d25e1654a7a40f612f86b030e00c340c7137b28034048f2f4fc37a15f045d036ddd615df7d538fbbc60604bef4496c8fef0009f6de
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+RVB6LkxN:1G8+gG8+gG8+gG8+To+
- TLSH T188146C9B9765A4F9C083803012FD6F3F75377C1363A3936E2290D1942B34A98A77AB75
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 203KB
- SHA256 3657c371b15e90f0d62f88d760911ad50bdaa1ab6e55df9eb6680bb328579426
- MD5 0f13b3868cc41ec807a6235a61e16a27
- SHA1 ba0d248dae7b22dab4dc2f1739a8825089e140b9
- SHA512 26f822d3a4df131a08a7a7217172e284c078b1d6377b4123cd02ee271c0b5d7f17e89cec4b462adcac0e71b940d6379429c9074dba61a526fcaf818501075732
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+9V56dtxy:1G8+gG8+gG8+gG8+/cQ
- TLSH T11F146C9B9766A4F9C083803012FD6F3F75377C1363A3936E2290D1951B34A98A37AB75
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 203KB
- SHA256 706033c64e5f287fb898372f86d60e6fb8ee6ebb2766dd21c87a0d05ea25b938
- MD5 b6f1e3192c2d4366aa784600401ae40f
- SHA1 18beb466aafa48ada8e389fe0d344efcbf3be9b4
- SHA512 1e496c39005112086f60ec472d2869ed6893883685092574e60b26b1b5bfcacea170dbabcb86f7dbf62d9a9162e5019c1153218fb13170dceeeb800de13d5c17
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+X1IsS6xf:1G8+gG8+gG8+gG8+lDX
- TLSH T10C146C9B9766A4F9C083803022FD5F3F75377C5362B3936E6290D1941B34A98A37AB35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
- Size 400KB
- SHA256 eb93253056e1577de1c37d02631a0a6e4ca18820e48f014e506c671f6f6cc4ea
- MD5 8fb2e27d74403676f5005d56e3b132d1
- SHA1 8215270fc6ad42e4105a207b73c5f57673ab5002
- SHA512 800af986bd795d367363d6ad27b3657f35becaa7859f02feb822c948f828fb7412044e0ff62bccdf0b9ff11df8f1fd1439b3f4f371f9e2d3c759a79681cb4717
- SSDEEP 6144:1G8+gG8+gG8+gG8+Zpy6+Ado/C8uSyCq7IwBqDe:1egegegeZQ0dWCXSyCq7IwZ
- TLSH T16E949DA6276054F5C0F3803955E68B3FB2767C2213B593CF41C0C2A52B27AD86779BB9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 203KB
- SHA256 a4015713705627a28df0f7e189581ac0d62fd1ee2c3c9ce696675cf656d8de69
- MD5 2d2dbd01becfacc19c6b63f488a25f30
- SHA1 90dfcffe86bd97bfdc7b7b100b37bf39f5e8f641
- SHA512 5b8e7254b270694e7524b04f9fa5d084ac45c7329e8ec4f1291f6b1f2703f18e7405c3d2daefd0f56086cb59e1a231009f261951506092495985f711e838ea79
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+iVB4l2xE:1G8+gG8+gG8+gG8+OeL
- TLSH T1C4146C9B9766A4F8C083803012FD6F3F75377C5363A3936E62D0D1941A34A98A37AB75
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 203KB
- SHA256 ee8f7ff13c22f805cd1346696d147719c3bedb0293a6f970a85cf1b49da5d8d4
- MD5 4f5b977e1fd07d6d835e790f87b54ebe
- SHA1 3676ad374843f7c0c90cd7c3e9496af4004a7f01
- SHA512 b557b35ebd703ded7dad067b1cd444de60ec635708b4dec84ba9c69fcb9d7509ffb454f819de4d0b1dacd050f60b684a6ca70093512b1889ed5786de315908a8
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+sVzkJRxHC:1G8+gG8+gG8+gG8+8oFC
- TLSH T106146C9B9766A4F9C083803012FD6F3F75377C1363B3936E2290D1941A34A98A77AB75
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 203KB
- SHA256 f49790af128a7867bb738072e18c1baef2a872927311ea8385845ad8998f9c31
- MD5 645057c91b9dcb308dc042d1e7b5cb0f
- SHA1 0910dc1169c739591457d88f6a6709886ac17e7b
- SHA512 16e039f63d73a1aded2a55a5bff046702593fda9036d1a469fcc3b828ce2deb1cf8eb246c1455557b58b634b57c8d4bab0ad64958129fcca67a05d7a69dafd61
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+YVqUbbx3:1G8+gG8+gG8+gG8+IRh
- TLSH T156146C979766A4F8C083803012FD6F3F75377C1363A3936E6290D1941B34A98A77AB75
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE
- Size 764KB
- SHA256 d37c279acb2e94316ce61081bf9f460a482fe604c56936b3853e4fa29d8546ab
- MD5 06ff52408ffa2a127112f112136e619f
- SHA1 598ed638dace9f914aabd03071f3714407a4f7dc
- SHA512 79dd5081a11b0e5c41ff1695c1c24b7def668c4b7998ebb08f793ac47fbd74630e7d642a9d445283a61d50be29f0baaa8b1009c2de297da0de8d94bef9b4df25
- SSDEEP 12288:1egegegewbzxWFtfh5F1bMIIp/GR0lCmuih5VM6S:1egegegewxWFtp1gIm/GR0lhd5S
- TLSH T18FF4298EFF948CE1D452A03885B6877EF6B2BC551A61930B5264F21EEF33F506D28721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE
- Size 322KB
- SHA256 c2657c8732673880908805b99d2ac90e7ecb347adcb06fac530dce125f0037fc
- MD5 0f5215d31d8ab9841a2a1ef85691c060
- SHA1 c33124cb29f9420e27d19a973f2d35584d3f94e0
- SHA512 51f9a583d6cb7e78d2dfc08c120ed0a98057a788c96941d5bfbc7e0c1470cdce57daa1ce7a1bc971dbafd6bc459af0179bec4439a6e3ee7ba9d8fe9f0f04c7eb
- SSDEEP 6144:1G8+gG8+gG8+gG8+CcbPTEwkqrlJ3kVzGMnBufNDS5lSnn/A:1egegegejTEMlDhNDS5lS/A
- TLSH T11E648D56B3A490F9C042803046F99A3BB777FC632962532F2690F65D1F35794AF39B28
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE
- Size 304KB
- SHA256 31014298963ec06700baae7ac8e8d39659c977ce93b0aa9c8d3a84080fb23c16
- MD5 e4fcca5826a483a7e4618cd4a60c6ebe
- SHA1 7aad028b1388d3464cc01abdc94353ad42f8005a
- SHA512 82ca40da3cf01af8f33d0b9e30fe3f8bf602fa5551b85f2326614d37ad4fba696e474b6d6f90e5c487d778fd2c8e24984484fb5983c803ba595aeda1651e7360
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+E6RFVYcZS5WuxyLrH3rDyLFBoGHC7u+Q4K:1G8+gG8+gG8+gG8+E2K5WhLrH3ruAlK
- TLSH T1A3648D8BA3A150F9D093813041F96E3AB736FC632572932F1790E1961F366949F2AF35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
- Size 598KB
- SHA256 f33cfa2948e449c593fe39fe8001ce40f7a20bb3af879927efa7dba9beeadec4
- MD5 b392c3ec574f3abf00e06ee5680e2464
- SHA1 c535135554a04b5aec54f90548d77365719a1401
- SHA512 138027cd5cf286c95d343a81c815db005895ea0befa92710ab5ce3aa3f1c7073f9bbd6c5172d3074573625ec5a7422832a238827f952e112ba1a41b323cc0a4c
- SSDEEP 6144:1G8+gG8+gG8+gG8+kczoRywRnj7XXXXXXd/n:1egegegekWwRnjRP
- TLSH T19AD41EE736C3AA49C84E5C3878F5DA779CA0AEF005930926F35DFEBEA532A0957C0511
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE
- Size 361KB
- SHA256 66bcc67d3f103909bd5db3d01109021124fd84eff14e2822901f918350ddada9
- MD5 9cb3447cbd18482c0c1aa7bcb4db4ee0
- SHA1 d330df860a5e32186113eb1df2149d6d3bfc62b3
- SHA512 9eef985057a04ac9cdba7a5fb5e75070423c94694833c7be92df44ee1e2d989861dbccc6dd66ddd39e25020aa2addca6a3290e9cc8e99d768390d9509a902e40
- SSDEEP 6144:1G8+gG8+gG8+gG8+8rI13t7Y0P/IJbxCdUy1hEuOvOYOhODOXOYOzODOaOpOxO1h:1egegegeSI13t7ru1CGebG
- TLSH T193743962562C80E1C19E43B84BB9CD7AFC35BD511615AB4F02D0FBFE2E39B007E5A225
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE
- Size 838KB
- SHA256 49523d09dfce58bc27635ebbb1909abe95ba6705c7a6f0f734e91ba7f48b2b50
- MD5 ef993b6a9c12583c3ed89f79e4482821
- SHA1 33d4e6aad8695645ee5af153b4038f6dabfedc23
- SHA512 c33e61d144242acb1f1d5abcfd610aa405e27e8e06f5ad480e286e62bf348c3ef08e15724fa3c8e126555e7d8c43cf1c0e5c8b15db75b8f45d20f14ad68e2542
- SSDEEP 24576:1egegege+MRIWmfvD09Zm757fLAS7msy6cLtPxUSdI70w:1111qIWmKmd7DAS0S
- TLSH T124057C42A3A540F9C45FC174C95A973BFB72BC062524572F8290FE5A2F376226F1D32A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE
- Size 295KB
- SHA256 9a573175eaf78afdadd5e707b2784d7117890d8bfab241dab9920b0320843e5c
- MD5 931cfe3338cdab341b1e7e9be3540b41
- SHA1 8135344ed6fec3d4619bff85e8be6c545ec726be
- SHA512 aa88602d0abec7a3fd0c2a4fed1303b6b236da79be58947ed2d7c7d4c32a989b47dfd80bc8e83a2ab1a3c85c1f67e60f091803ed1cc64de95a066deade806bb3
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+pb2ADPKi/tZxaAlvCzVWK0tZfa3OKqG3r:1G8+gG8+gG8+gG8+1FjrZx36wKsf2OMr
- TLSH T18C547CAE676084F5C043C13051FA9A37F736FC522EA1532F9790D69A1F31A94AF29B31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe
- Size 335KB
- SHA256 745ae7c6778058bd20b1e9062d0c4d4288cb42f75a9753263713e348c20ef297
- MD5 0736da68270ed479341679e30bbe8574
- SHA1 4d276b399e3d463623fcaf0cf78adc8a3d36db77
- SHA512 bdd84fa54c21c3c5a052924350a584d8e961549412570d6ca17eb3421648f87efb4fb8f85c2698eae8bbaeeb1ceeaa3b5563f91cedb9b155c2c5aed46c4a661c
- SSDEEP 6144:1G8+gG8+gG8+gG8+SSeHNq/DSSMjelZdGaFkr:1egegegeSSeHNXSKelZ3
- TLSH T1E9747C4B77A4A0F9D043C03482F99A7AF777BC622D71632F1290D25D1F36694AF29B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe
- Size 213KB
- SHA256 6cfb05c0efa05e566f84929527e5ce9a7161c0e03f458f181414e820ce8902d5
- MD5 1aa612fc69f1643635d22a2f23e71263
- SHA1 1c3f54f980acd90e031ff5d4cd27b4d68bcdc9fd
- SHA512 69e0c65d401555c0bca4edb9616e4968750091cff6984c1ff3260c35903cccc305a17434d30efa83afbcd5dc8a57a9c53cf6899a6c8bb380fdf9dcaffc82376a
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+hJIkiGnJ:1G8+gG8+gG8+gG8+DIbC
- TLSH T116247D9AA765D0F9C0C3803012FDAE3F78377C5326B2936E5690E1D51E34B98A729B35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE
- Size 256KB
- SHA256 ad4a07a64a88a74f5cb4f0fd4e66d41d0fda6021a46d668696382cb19dbecaf6
- MD5 0401cd282a96b0a7b5015ec11db36868
- SHA1 bec9359ca52fe274681dce0cc60b7fd12d51bb6a
- SHA512 a3189db395036aa1fbc4b24135ac8f0d2f06d99476cf53893f6e25c8806c1016183ebdaed4b6c879b09242cb5bda6bb0f152edf5d18845e6a2d4b296901aff2d
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+gKHkA8sfluF4TUawK1eVS+:1G8+gG8+gG8+gG8+gKHk3klOz
- TLSH T1F6445C86775590FCC4C2803091F9EE7B7936BC5316A5F26F2298F2991E30E546B2BF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE
- Size 756KB
- SHA256 10194957eefbc6785608c7de87d9551543c60b311e69f3a0f96a1788fe152faa
- MD5 aaf324986239f94acd462a7f229362fe
- SHA1 d8e9f638a5e33c49fe360da6543cb69a0a7eb926
- SHA512 5739ddd32a87d90aa0c0892b0685da26cf8ecca4ae55d1d9efad5f5ff691909e2eda5649c6451042c39207fcd1405a0428a40cc1775384297a37f0c5ab57392a
- SSDEEP 12288:1egegege1c3N+tCnf1IUqMniVkhWMWNArKRsNY:1egegegeC3N+tCn50ChWdArKV
- TLSH T188F45C9AEBA496F5D0679134C6BAC676F7B2B8410B31A30F4290D36F2F375605E1DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
- Size 224KB
- SHA256 75b92e2007124b49eef7b875eb4f631bf911e2697cd5fbf228e211bb0fa875d0
- MD5 12008d3f1fff18d6ce517b34030975c7
- SHA1 5db9bea5f4222a14f3cecb4f242124153a5d3e91
- SHA512 5a32daebda7b043b74ff895ecdbeca62022502a0638961e662a0983acd91846cf0e7cf6e44df8a5c3ecce900715d54e86d1eecd94d6e87a6aed51ca7f146c7b9
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+kaj+/KlsLfwMfy7:1G8+gG8+gG8+gG8+kyF2LfFfi
- TLSH T131247D9A9765D0F9C0C3803012F9AE3B7937BC5326B2936F52D0E1D51E34B98A729B35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\msotd.exe
- Size 236KB
- SHA256 f1ce50914895b7067f61b2dfe60aa6c6f34b1d82472011f25f661a18b7c4dbf9
- MD5 bb271386b390cfba20d50f0b83985c74
- SHA1 50dc12a7c7fcc7884438581cd9549894b704f19a
- SHA512 c4decee573bbc83380bdd5ac028f3d460a5faa61439ca7598f3bb53a9663533cd064d9f5d8fd729255e685332d2ffb3fd64dd0f13cb301dff70c2b900af7f50a
- SSDEEP 3072:pP7GXM+YP7GXM+YP7GXM+YP7GXM+3aMrqglGDyv:1G8+gG8+gG8+gG8+3a7glGGv
- TLSH T18C344A87675594E4C082903012F9AF3BF536FC1F2562522E19BCED942924BB8B73DB35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe
- Size 735KB
- SHA256 cbdd771b1c7f9de0ad7ccd8465930f19949dc6b09bd7a0d13d68cb17b1fd22b8
- MD5 6b6428c45f10e79106609383896a69a2
- SHA1 838260a7efe5dc07bd3855a4e7f365b7750809af
- SHA512 bf65b796d3ac4e5f8e66b1c917f8d40f62877ca5f409ebad5c2ebb57c32c21963574d9b1cf572a11bddfdb9bf01b8694ff53a7f04fd2dab350b205ce94e367de
- SSDEEP 12288:1egegegeT208eFhiguZvtqg65z3LcIPr0lypFpL:1egegegeT207FhCw5UcAlcH
- TLSH T1E7F43945F7A880E2E166A5348AB68571FA777C131F70D30B3595F22E2F33650AE29B31
- MD5 SHA1 SHA512 SSDEEP TLSH