Analysis
- max time kernel
111s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
26/04/2026, 08:57
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe
- Size 492KB
- Sample260426-kwpbfaey6k
- SHA256 93044f78e9338c1ec7f362c39a876129697b2769c353301e9e557f4ff85e363d
- MD5 97bd4830d9fcb974dbe318840e0b57de
- SHA1 005476336a305471ebde78a5d608fc5938dd7296
- SHA512 bb78b382e5e9bc370a8355bd3145d49a6ca6c5de803d7620c4e6ef0dad013182fa90bab04290f68f96edee1c654d36b2057222f34f6f298b1357544cb52059e8
- SSDEEP 6144:cVOTvRNAUhyrXCfTXkxqDH2LO7QAIS2rNczuHLlB8iGnC:cQWrXC9xQA1zurlB8ZC
- TLSH T17CB41816BB5040B5D592493046A1A76DA735BC25C9238E4F3394AECEFFF1BC19E28336
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 30 IoCs
resource yara_rule behavioral2/memory/3928-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001900000002b4df-7.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4396-14-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028de2-65.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002aa67-162.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028a31-214.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028a32-221.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028a38-252.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000002aa68-259.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028abf-526.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028d00-637.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028cbd-734.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000291ab-796.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000029a6e-803.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000028eca-853.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3928-1112-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4396-1126-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028e59-1270.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000700000002589f-1433.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000025a3e-1476.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000002572b-1489.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000258a4-1508.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000025b07-1516.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0007000000025b27-1529.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000025b3a-1536.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000025b3f-1555.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000025ba0-1556.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0006000000025ba1-1557.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000027b9b-1896.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0018000000000673-2139.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 4396 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$ 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Maps.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$ 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3928 2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe 4396 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-26_97bd4830d9fcb974dbe318840e0b57de_cobalt-strike_conti_elex_hijackloader.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3928
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4396
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 984KB
- SHA256 691226b525cf350f3c1bad60d9660fb45ff336f3795c4502262242181dd6a57c
- MD5 8cd87a0ce80f6f64f0ea6f0669dfa328
- SHA1 d9ed80e9b5478df39891bf529e04f9c64c5d8926
- SHA512 385fc767afb23ef8aa52ed08d81003fe588b1444ec201ac2378d54948152cc22a105b86ebb7264b243c1340aa2dc05d5da824d9678a9297018423721c499736a
- SSDEEP 12288:cQWrXC9xQA1zurlB8Z3QWrXC9xQA1zurlB8ZC:0rXC9qTlGZjrXC9qTlGZC
- TLSH T1A0251816BB5040B5D592493046A1A76DA735BC25C9238E4F3394AECEFFF1BC19E28336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe
- Size 627KB
- SHA256 0ab276d921d9137625adc67c3de134186fc26a8666f69e0f21cbb335f2d83fea
- MD5 6ed940d533c61f5c0c53efc08464d895
- SHA1 f6b6f1485ab688ebcf5d42f37e886520cc5c92e7
- SHA512 67e70356da23128e21be64ba4d435bc347dc86448bc574978a6a8971acb7a7901a58367c2745ecf9ded2fac736b0fa53e2ef9abab83990aa83f1385418f372ff
- SSDEEP 6144:cVOTvRNAUhyrXCfTXkxqDH2LO7QAIS2rNczuHLlB8iGnamsjF4N5QVrZZ7Lxe:cQWrXC9xQA1zurlB8ZamEZrZq
- TLSH T11AD44B127B8080B5E59206301AA4A6AD5775BC31C9634E8F7354AEDEFFF1BC09E25336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
- Size 780KB
- SHA256 71c0ec238632405dd9990dc9d90198ca0e063416956d5012898e48b51727a52b
- MD5 796d1c0fe8f30ba1d1897ba1b0009dec
- SHA1 10289e272937e2f8ac4182442d1ffe883e385941
- SHA512 32431803cba9b34cd73f7ca6bf9d9713dee093f2f503876c1e7b3bfcdb5e5eb332a0214ea4fef934b85f5b7fe5a46eeb730dd6ff27e5ed1e12903b41cc6f5a98
- SSDEEP 12288:cQWrXC9xQA1zurlB8ZXZ4Q5VYf6exwI1oB86:0rXC9qTlGZ79exZCB86
- TLSH T1800528027B9084B5E59284750965A72E6725BD22CB139ECB33606ECDFFF16C09E39336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 521KB
- SHA256 194fb8fef3bdfc109a34785c6479be550083f9066b5a5c2544bad2b02705934c
- MD5 d00f48612f6ae546b4809643b17acb30
- SHA1 a15a100ce9ab9b02fd8d26dfb48c4409ecaacb3f
- SHA512 b347e9d5c9ebb1ef2832fa3718b5e5fbc18fec74f2c397a48d9ebddfedd08e4d25338e0d6ecaf9852bd48539dafb41ecd00d182328129bbb01e441c363aa72db
- SSDEEP 6144:cVOTvRNAUhyrXCfTXkxqDH2LO7QAIS2rNczuHLlB8iGnBBwr7:cQWrXC9xQA1zurlB8ZUP
- TLSH T183B41806BB9040B5D55249304AA1A76DA735BC25D9238E4F3394AECEFFF1BC19E24336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 538KB
- SHA256 0e5fd4d92f782df5f19e8a9cf81ee80fd47152e5ce39592414db6e43b9b93677
- MD5 750a20eaa2b9d6fbc4ed97494cc8495d
- SHA1 ab63be64e54e08672455835e43b50e602a850aac
- SHA512 86d1f668e6610eaf8716d3a2e8158c8461a1bfeb8845f23d65f8c9a5c891949af32c78d95b968ca88e57b21ffd05e0e6b643173a9c6369576a30093a12a00a3d
- SSDEEP 6144:cVOTvRNAUhyrXCfTXkxqDH2LO7QAIS2rNczuHLlB8iGnzA86/:cQWrXC9xQA1zurlB8Zz0
- TLSH T149C429127B9040B5D592497046A1A76EA735BC21C9238E4F3394AECEFFF1BC19E25336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe
- Size 583KB
- SHA256 cf188888ed2575b85230a15fa26b2cf1c11c4729c5e324f9032608e8a0cefdca
- MD5 c24c6ab0fa3dba4fef77302a33f20b0b
- SHA1 154bc19b7dfe6726c4d1f5fd13e981bd3fbc2770
- SHA512 dcab2a7927a98b819bed04dfac39b6bab5d7cebd9696ffe4e7f66670e00b0d3b93de9f97c439b4e93bc8a850cb085e6dfd5ae728d747a1b8416371ee066d5594
- SSDEEP 6144:cVOTvRNAUhyrXCfTXkxqDH2LO7QAIS2rNczuHLlB8iGnXvldRgLd:cQWrXC9xQA1zurlB8ZI
- TLSH T1EAD42A137B9080B5D59249304A61A76EA775BC21C9638E4B3394AECEFFF1BC15E18336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
- Size 705KB
- SHA256 b537d23a6168e6140919e2b432ebd55951433d43364babaa05dad596f14a8a67
- MD5 b3669183749176256bf33cdf199e53e8
- SHA1 be1f5a801b5774bbb1eec4e3634649aea30e6aa2
- SHA512 9e819108b4089bf9ef8823e7131e734be779d866dc75a5665516823e77a5e603f7577e8eb7ae96b4714361f56bb83ebf47d8ec546bcbd4286f2d94dd8fab4feb
- SSDEEP 6144:cVOTvRNAUhyrXCfTXkxqDH2LO7QAIS2rNczuHLlB8iGnBcT93PiY+Fa7BdvGX:cQWrXC9xQA1zurlB8ZiaY+FUB2
- TLSH T10CE439227B4180B6E552053049A4AB7E5629BD15CB634ECB73989FDEFFF0AC15E30236
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe
- Size 837KB
- SHA256 3eb58d532cdb21d94468ae95e6ffe30746df0074e72bb65ce1eee5371df4fcdd
- MD5 c0b3a1bc007270153c55ad2d57b0926f
- SHA1 10e8fccb0bdf7531eef4724e7ed3d223c617cbdb
- SHA512 90cf0c49184989044f463afdf073ed5109a9d2896d90c0e86b51067cac3f2b97a83d7484e888bd498d831b42fa1a818956af94ff71d579953356527aa84a334e
- SSDEEP 12288:cQWrXC9xQA1zurlB8Z6qwKhHSDeWTRW8fdebE:0rXC9qTlGZSKhyDZTRW8fdeg
- TLSH T1CD056B02BB4180B1D55205304AA5A36D9779B861CB234ECB6398AECEFFF07C19E35776
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
- Size 576KB
- SHA256 724d17a3314b43b369ffb62892c77107dcd83f8262340e488a6bec75270c6ff7
- MD5 0fa3db7996efd1428753dba5c80ebd2a
- SHA1 005c140f896f57d9c36aa83177d985c6d3a8e7af
- SHA512 7f3fd57fff181c7e8ff5e0d4cfc30cb4e53ae6d14037eb434c42c635a446457945ab448875f40708e4828188f9abada52dfb1e2bfc57e531ac836b6dc5572606
- SSDEEP 6144:cVOTvRNAUhyrXCfTXkxqDH2LO7QAIS2rNczuHLlB8iGnhzkmIL3E7QPQLk:cQWrXC9xQA1zurlB8ZhYmIjE72
- TLSH T160C43A127A5080B1D592493046A5E76EA735BC21C5638E4F3394AEDEFFF1BC09E29336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 544KB
- SHA256 4d9002e6cd0629978c6307935c7ed45b039b02f0cb1af44b3b6ec97a62382fd1
- MD5 ce6a6739ddf10cf332217c18e10f3ebd
- SHA1 38a7f8f3a54b3361c569629af77e28ee18920c9d
- SHA512 04d8b96bb230bb0b45b1912308f9d34a9cfe4b95b9a8c0d7e4f077976e7b6f836df06f8cd8ca1aa67e14a5f239356e091850c45ca7c9527f13d36036560b0807
- SSDEEP 6144:cVOTvRNAUhyrXCfTXkxqDH2LO7QAIS2rNczuHLlB8iGnXFQw9J:cQWrXC9xQA1zurlB8ZXFfj
- TLSH T1E3C429037B5180B5D552493006A1A76DA775BC21DA238E8F2394AECEFFF1BC19E25336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
- Size 599KB
- SHA256 295486692605016c8f5b8c3019c68e99a8a3627c2b79fac8ae4a76dc1addce64
- MD5 aac074c20b46b15f6c3ae2e14b502661
- SHA1 8094b6957802f4a7d5db5f6e99855dfd07a75ce3
- SHA512 e98a5eee30854945f06f18d3aa6ea35a088a025e0eb637406a05b26a14f4f1c6fa6387a9de2e45dfbaf3a45933efb9eb398646c85fc2acaa81882710e500452f
- SSDEEP 6144:cVOTvRNAUhyrXCfTXkxqDH2LO7QAIS2rNczuHLlB8iGnNp3VL4kv6l8aGok:cQWrXC9xQA1zurlB8ZNzQl8Hok
- TLSH T1B8D429077A9140F5E552493046A1A66DA735BC25C5238F8F2394AEDEFFF2BC09E29331
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe
- Size 590KB
- SHA256 ce16bd5865e8e40b7ceda91eb1942d22a9ffe5f6137e1b7fa8934814e97043ed
- MD5 9f8749b2dfee84f921ceb5cbbdd43fb5
- SHA1 f7a9dba7a89b2f94148526d46e2f06aaa3e96424
- SHA512 babc2a856d6c7efacddc84c8e160805ea21007e2dc9385bab728687dfd4757a3060591cf6c1bfce60d13eb4d951e7e115a7629207dfd769f7c6fc333dc548d03
- SSDEEP 6144:cVOTvRNAUhyrXCfTXkxqDH2LO7QAIS2rNczuHLlB8iGncZNr2fYLPzB+AwU:cQWrXC9xQA1zurlB8ZcbrNPzB+NU
- TLSH T107D43B037A9080B5D552493046A1E66DA739BC21C9138E9F3394AEDEFFF1BC19E25336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 540KB
- SHA256 cc8be408cdbd73627cd0d0bc17c326b2b0e4e2b9b8016066621ecc9c38637b8e
- MD5 ddcc81718e4465061e947eb71bdcb81a
- SHA1 7fb857dd9ea724fef28c5c9efa8c793a2b598c5a
- SHA512 bfd94e10f0b9a7c9a12175e818505b5987085a1e73a287820ca2ffe2973bb6880e102141c4809b9608bfb7f037922e7a5c214dc3cbf867d774fe5826c2216bd6
- SSDEEP 6144:cVOTvRNAUhyrXCfTXkxqDH2LO7QAIS2rNczuHLlB8iGnncr0X9:cQWrXC9xQA1zurlB8Znb
- TLSH T143C43A02BB9040B5E592493046A1E76D6735BD61D9238E4F3294AECEFFF1BC19E24336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$
- Size 636KB
- SHA256 10ec168375e08a74778057cc92684781ec13d0859cf2eabedee8d17305ab2f82
- MD5 350313a444b1d8fc1938ba4042d875a2
- SHA1 3a4ae49883f50e25ed9e50624a2135a62a2957c4
- SHA512 74a6ea935259783900ac2c3b93a22400c503abad2d7ee5786cd717613effce63ad0a657a0f86540abec18714092812d983c28d324bffabe6c8bfeb1b7fb0efa6
- SSDEEP 6144:cVOTvRNAUhyrXCfTXkxqDH2LO7QAIS2rNczuHLlB8iGn73psmeI+sQFqT3Qi:cQWrXC9xQA1zurlB8ZAXsf3z
- TLSH T131D47F06EA5040B5D15E4530C761966DB6277821C6E38E8B22D4EEFEFFF1A805EE5233
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 515KB
- SHA256 efcfa02f2f4db0bfd06017b65f2888ea2ad21c5066a2513bbf301b7c9f5efdda
- MD5 78f9b3f9b88ae5a82e947e49898f2b49
- SHA1 749697ea69694d3bd3a52928bc26f80da10e5623
- SHA512 690dfaa1c2a7f466b973a0366232618db76dcc17be44ec0eb779377b6b1a3521cc734309376d3a054c027d17f5ac254df2553bfb0648ac25e231e29691156ba6
- SSDEEP 6144:cVOTvRNAUhyrXCfTXkxqDH2LO7QAIS2rNczuHLlB8iGnQJZ:cQWrXC9xQA1zurlB8ZGZ
- TLSH T154B42A06BB5040B5E552493046A1A76DA735BC25C9638E8F3394AECEFFF1BC19E28335
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 515KB
- SHA256 a8acab3a8f83e973fffcc54f4ba6e3a466a1ae253c6285c6489253ee20485d03
- MD5 a7af1ab1e3fbb539ab8279e164977064
- SHA1 8354341d18da7c7d735db30252d8106369b458e2
- SHA512 996c11c12787d7f0f913bba6f816fdbbc5c282f41d1d3293a57c4c44660a7d4d6e46460c6c39d34ddd9549962085dc8641d274fad85555b0ab86c3c74818c4a4
- SSDEEP 6144:cVOTvRNAUhyrXCfTXkxqDH2LO7QAIS2rNczuHLlB8iGnoe1:cQWrXC9xQA1zurlB8Zx1
- TLSH T136B42A06BB5040B5E552493046A1A76DA735BC25C9638E8F3394AECEFFF1BC19E28335
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 515KB
- SHA256 478fff2e2abc5c660008e0d155991d95b485aea1a9967b1ff3429dc657f85a41
- MD5 8303417c8214a17c3630e9c7c31d523a
- SHA1 0f46a9284e30a486d9178564a8ef8c4c3bd501ee
- SHA512 03e28d9e71701c6b63f76172da0b140f7f65960d41e42b547f76c08a32dfc9bf6282ab9160271e514d1cbe86654f0e7a5edbc87d93041a4f135169e22a35146c
- SSDEEP 6144:cVOTvRNAUhyrXCfTXkxqDH2LO7QAIS2rNczuHLlB8iGnKio:cQWrXC9xQA1zurlB8Zbo
- TLSH T104B42A06BB5040B5E552493046A1A76DA735BC25C9638E8F3394AECEFFF1BC19E28335
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 515KB
- SHA256 df6efede1bb6304d1247138bf4bc975b5523e6909d91147f57115e562e66d048
- MD5 372a46a6f55d5474a6bb94d081d87671
- SHA1 20bcb2266105366e6be2229ece39bb57886149da
- SHA512 743e4eaf2c2d8d17c44265c9ebfb0960d83b9173c23b55f26d70f2ed38edbaf820bf7ecc52abfb032f684e31481c2582fcec02ea14223b5f2bf11d5fb05a9300
- SSDEEP 6144:cVOTvRNAUhyrXCfTXkxqDH2LO7QAIS2rNczuHLlB8iGn7Tu:cQWrXC9xQA1zurlB8ZPu
- TLSH T110B42A06BB5040B5E552493046A1A76DA735BC25C9638E8F3394AECEFFF1BC19E28335
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
- Size 515KB
- SHA256 0028e9497b2e31c21bf29ec22d37b03b9506904310454c10e0409a866353b271
- MD5 373bf7ba4a6a4ad13a119cc132f8ec7e
- SHA1 288c3b976c6c3808bab19e5e9bb9f418826281f0
- SHA512 0b0b3d93913b8b54df044a05d886e24dfb215e3481ed73576b98307f9f5b45d669a0089335fd43b60423dca3bb6a937562867d1efd97ffa05aa2aacaef40cbaf
- SSDEEP 6144:cVOTvRNAUhyrXCfTXkxqDH2LO7QAIS2rNczuHLlB8iGnPij:cQWrXC9xQA1zurlB8Zqj
- TLSH T1A9B42A06BB5040B5E552493046A1A76DA735BC25C9638E8F3394AECEFFF1BC19E28335
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
- Size 515KB
- SHA256 762fbfa06a71e7073cd45f32d2c25c1345b938b97c15158d16e7125b38eac640
- MD5 58dd8c66bc4d7f98b8ad839e61e5cd5b
- SHA1 6239bea18c629c482f318c7fea596a7c69c8e1e6
- SHA512 5b9e1bc3a1eefed0aabd4996221410300fa4cb4ff606bf01d9ccd7d80868fdffc72fb91f22c5e868d40076eb130ef609cd094bf212560c7ac4c3c5e8fec866f6
- SSDEEP 6144:cVOTvRNAUhyrXCfTXkxqDH2LO7QAIS2rNczuHLlB8iGnkEM:cQWrXC9xQA1zurlB8ZFM
- TLSH T188B42A06BB5040B5E552493046A1A76DA735BC25C5638E8F3394AECEFFF1BC19E28336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe
- Size 515KB
- SHA256 11868a9ef753b8c6a26ea9f24cc34f2193f3d4e305fb39c89ea8d7bfe8eff6c2
- MD5 ba8052cdc18f2e733bd946b8d52b3806
- SHA1 e9163100c3941b3fa0123d60f20ab7731d629e6e
- SHA512 f8179b9f8592dc2bbeae48c268dd8ec1ae39d3759177fb2066acc7c5289e63b67f694092a1493b92cea04f5d27cb593ea95ced4d85d2823c49e9d618ab6b578a
- SSDEEP 6144:cVOTvRNAUhyrXCfTXkxqDH2LO7QAIS2rNczuHLlB8iGnuDv:cQWrXC9xQA1zurlB8ZOv
- TLSH T13EB42A06BB5040B5E552493046A1A76DA735BC25C9638E8F3394AECEFFF1BC19E28335
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe
- Size 513KB
- SHA256 1e22b5396a3e5582c54de731ae95983ec51caa848dc99c4768d4e348d1dc029c
- MD5 39e27f9eac521a6655915282dff987ab
- SHA1 318330dc42aae5276cbbb65c994822557f1b1ae7
- SHA512 5fe27ec5367c289e252a00840816dffdefd023076d41e0df950b11cd2c21bbf6c61b75e00113d02c0b8d8926c39414844960e1d125e3d898596c588613016f39
- SSDEEP 6144:cVOTvRNAUhyrXCfTXkxqDH2LO7QAIS2rNczuHLlB8iGn3H:cQWrXC9xQA1zurlB8Z3
- TLSH T169B42916BB9040B5D552493046A1E76EA735BC25C9238E4F3294AECEFFF1BC19E24336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe
- Size 513KB
- SHA256 775bf5a0fffcf9c58e27cae9e30fcf19dce45c0af977132c42a63c644cf14256
- MD5 168fafc11c71da614e5081fb6614bea9
- SHA1 2353cb7bf32dbd1a46eb8fba78cb60b029ffca37
- SHA512 ddb0ff49fe75ad6f0e4536a479314aa2d1c2d5387707f0ae069c8a47f0aa70241b4baff7dd287fd7c91ecec4af3cc3c0255665b8236b1b35c4411fe74b07183f
- SSDEEP 6144:cVOTvRNAUhyrXCfTXkxqDH2LO7QAIS2rNczuHLlB8iGnrGP4:cQWrXC9xQA1zurlB8Zr04
- TLSH T157B42906BB9040B5D552493046A1E76EA735BC25C9238E4F3294AECEFFF1BC19E25336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\misc.exe
- Size 901KB
- SHA256 a9ab36b3d3bb9a1919eba3997f2aae140376027ec42cac284464dfd741e42898
- MD5 04305c0d808ccda27e8c6d8fd6c9d660
- SHA1 16db23bdda4bfd53327aef87e6d80291f9447ccb
- SHA512 8355b70e49c4d14f5470f65800aa9d98629fbf06ece8a11020bd75ee0035d90ea042c6c26f33d976d2e5cf9cd14f6126c521f20ab754579a48f225c5eaa28e56
- SSDEEP 12288:cQWrXC9xQA1zurlB8ZnIpzuq7xgUe+wdr9RfM3X:0rXC9qTlGZIZuqZM9RfkX
- TLSH T117153806EB9040F5D15285308666D67DE772B854C9235F4B22A4DEDEFFF2B90AE28331
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe
- Size 1.0MB
- SHA256 59495165f7d14cda733e55a470332c839bac2c93ec37544986c50af4f0c787ec
- MD5 3c44029ff5ff5ff143e9e65cf60bcb9a
- SHA1 31177224fcb2ec228055544b32424ad90e2d2394
- SHA512 42ee79ee43ffc9274d668f84c781863b8802679b71c09e923dec225a52280d56f48e4dfd9771e71dacd872c76599f7cedb2efacdd957b2f67d652b34d1cb5544
- SSDEEP 12288:cQWrXC9xQA1zurlB8Z3QWrXC9xQA1zurlB8ZgF:0rXC9qTlGZjrXC9qTlGZgF
- TLSH T158351802BA9140B5D59209308E65A76DA735BD61C9134EAF2294BFDEFFF1BC0AE14331
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$
- Size 581KB
- SHA256 4d90e97dec485f4ca0e483bb1a8261b1a07ac87be3babbad30b68dbe93cf4f28
- MD5 e9da9b8037dced7a773e018db50578ea
- SHA1 a273842c6875aa1ce51ab8bd20799bb1358d62ef
- SHA512 025c13209962f4e9216d606ba5b853a45f41b78d1ec78564b473244b6431050dd4472b0bddbd7d0ffa7b7bfa91db6e424cde25a503c0cf2932dde3045541fa4f
- SSDEEP 6144:cVOTvRNAUhyrXCfTXkxqDH2LO7QAIS2rNczuHLlB8iGnOwGFzh:cQWrXC9xQA1zurlB8ZOwsl
- TLSH T1CEC42902BB9440B5E5A249704560976D9735BC61D9238E4F329CAECEFFF1BC09E25336
- MD5 SHA1 SHA512 SSDEEP TLSH