Analysis
- max time kernel
101s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/07/2026, 00:55
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 963KB
- Sample260720-a98bcsds61
- SHA256 4c2073faf90419f399ab7ca28170246061e6594148666fd75c8545acfa60e5b3
- MD5 9a4784db6aefdc10b0ab822f2a8e4447
- SHA1 b887e06ba578b965247be39e29d1f6b79e751856
- SHA512 f9d5677f371e3624f161fda041a76fc16d65b32477c1c2235909f586d59ab6229ed0d930e4862b4441056fd115bd1cf0451d08b07da4111a1f2866336dd92147
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqbf:cuytJJ8y5iTvO
- TLSH T1D825AE1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 16 IoCs
resource yara_rule behavioral1/memory/1940-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024483-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1652-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b83-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000235e4-165.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002124f-289.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002124d-291.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000235e8-304.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002448a-712.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000225ad-1256.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1940-1498-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1652-1517-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x002200000002021f-1525.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000023124-1864.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00060000000006cf-1963.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000000741-2050.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 1652 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe$ 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe$ 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe$ 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$ 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe$ 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1940 2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe 1652 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_9a4784db6aefdc10b0ab822f2a8e4447_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1940
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1652
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 963KB
- SHA256 4c2073faf90419f399ab7ca28170246061e6594148666fd75c8545acfa60e5b3
- MD5 9a4784db6aefdc10b0ab822f2a8e4447
- SHA1 b887e06ba578b965247be39e29d1f6b79e751856
- SHA512 f9d5677f371e3624f161fda041a76fc16d65b32477c1c2235909f586d59ab6229ed0d930e4862b4441056fd115bd1cf0451d08b07da4111a1f2866336dd92147
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqbf:cuytJJ8y5iTvO
- TLSH T1D825AE1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 1.4MB
- SHA256 e4795b8deb57172d8dc6e55cce52b1c969d1ac8dce6d1d4c01591eb491e92fd7
- MD5 330215e1bdaa574347bf60067252b33a
- SHA1 4e4f4dd98f652df5d3d137e9433a2d1e91169286
- SHA512 3fd0b06d2ef88dfae32f94d1f9e2ef562cb498def2d14eabde6a57f27ecc59d9542876ce8787b3aec7724cc8d9e788f4c22462d3b5b94642ce1bc95bc351f695
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqbP3Td9CHKy7GZO:cuytJJ8y5iTvMTd9CHKyao
- TLSH T111657C52B7E404B5F173863489A19712DBB6FC660B21CBCF2394561E1F32BD19E39B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe
- Size 1.0MB
- SHA256 70f725128ab24df49a0f56977d2722b125b280aab96b45957be88bcf2f73e4d1
- MD5 f637c7727d5e0e8d36e1c90740e627aa
- SHA1 6bf240fac1d35ac372c8f600b7b9c92de75f2a38
- SHA512 026a376635973bcfc9ccbe1b1f82e30dd0bda7497be1b179432afc7da5b2fd9a91f32bbe912748bfa31d6a3ff85309fbf77071938f694040b9b01aefad720a05
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqbRbBPzBAU:cuytJJ8y5iTviBPVAU
- TLSH T1F1359D1377E444B1E162463489E09762EB7AFC620B20C7CF6394975E1F32BD1AE39726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 11d0d73b57d02b80e3b1c173cdf34280afe798a61f397d890ce103bfb0d3f2f2
- MD5 d835391c83cd7eea485176f02b2e5b2e
- SHA1 39b59f125a1d8928783e80bb15cc999701f05df0
- SHA512 fddfaf5248c5108057183d2e2c276c6e4197053dc78fc9596ab711053e658bdec360912caedda39d8b099db366642717bda75284d0bdaaa2b2162ec0ba82ba0e
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqbL0Le5ji0hmxNrM:cuytJJ8y5iTv+Pji0Aj
- TLSH T1E0656B16F6A44671E073C175C5D2A75AEA7278520B3087CB5384876D2F33BE29E3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 1.1MB
- SHA256 6f8636e902e3522dd834be41801a0ee0e43d7a5c178642333e87ec84eb5a2d1f
- MD5 a76dd6eab5576a6863d3f56d5150a728
- SHA1 cb4ff2db298c5ee4b0423eb4271f8df3164057e0
- SHA512 0fb31fcfbca56b25073be223af2fb9004ad87dae2d4605ca74c1f04bf8dc3ddd3589c0ce050babc95c1f0c7091d04e95162c023ee3ac635f63c8fcea2b689e39
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqbAD:cuytJJ8y5iTvD
- TLSH T17B354912F69444A5E06E4234CB919652B777BC610BE087CB63D4E23E1F326D1AEF9723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 986KB
- SHA256 c7c8f08983d37ca7759c7b198a82f1a15d73bb2e990df273a10d7d0feabf5873
- MD5 bc279f6d323a79c8a72c8201ad3c1060
- SHA1 8bc531b72e825df992d01bd380ad1f850c66bf0d
- SHA512 331a05cdf25c5adb0cc912f0871342eb27ec9ed57e77ad7ba3b82d2d1e146bab8ab36dff8f898b4d2827c3aa3872f53df4deff3e036a5a93b8b8b3f9c580585c
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqbiN:cuytJJ8y5iTvX
- TLSH T11E25AE1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$
- Size 986KB
- SHA256 c15c68b853050fe0b4296d5b29cb9c3910bb2f6aaca9041140dcb77bd2264de8
- MD5 154364ba59826910bdb7cb0a08b3943d
- SHA1 5240865ce962e5ac2bbbc63f094e4e143f50627d
- SHA512 c64cd11c2c133e5efa48d5fa5fc99ac00efeab534aded06530fd022d4b08217544ccdd09fdabe90990237222c43608b0dea1d6ad645d8517336b32626f0ca4d4
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqbdp:cuytJJ8y5iTvI
- TLSH T1F025AE1277E444B2E162823489E19756EBB6FC620F21C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 986KB
- SHA256 4ea76797b0d55cee73fa4ec2f7282e683fc4aa672d80efa1c4adceff787cc195
- MD5 78e88d605359a55a9e55f56b0b7e4c59
- SHA1 5830baa0deb6ebe8295c74a522b0f34f07b3bc57
- SHA512 6c77c38346daf4c39e3006f8e9746073af531f90afb935f837bba5ac2a786f4bee787b6e7b41c9312e448735c594a8b5b17682db38fe759e1a5c9f123b1449e7
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqbGF:cuytJJ8y5iTvR
- TLSH T1FB25AE1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\servertool.exe
- Size 986KB
- SHA256 d564f51c5b1d0e9c4f168cc5bc629f28ab3fbab20668f69d9560672d86cb7681
- MD5 19594a143aad1ba3e9a7cd92811674cf
- SHA1 506de0fcae40013502990d3b2d6827ab40940707
- SHA512 368bbe140afb52bc691b5595bf2b83ee9e797ee7b9d4524775d46c84b2ce607362a867ab8ec482e97f93535d96e18a07a75da95e802e646fcf8368c90ce39f40
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqb8I:cuytJJ8y5iTvG
- TLSH T19525AE1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe
- Size 1.0MB
- SHA256 e9c7a2e431b06734b81e15ced4f31f887e523ef77024f268faa1dd7e5e6256fc
- MD5 cef445ea9e5bade2cd40e027dc7bc47a
- SHA1 48c00b66d73130148138523e27e5dd17efff536e
- SHA512 24e560966daff37041bcbda8a33553dd010c5fc974fd6f4c483f4dd17d8dcad9577ddc19bf34afe0a244f200e7775d6be793b00f767ae42f7f02007f95e4c98c
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqbHF:cuytJJ8y5iTvG
- TLSH T152358C12B7E444A2E6A24130CD959752EB76FDA10F108BEF2354B71E1F327D1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 1.4MB
- SHA256 37ad12fbf22bb0e5be4a3ced88561a8d6b19f2e510d2654e09cf198f63dda3ea
- MD5 6af05cff1668b93a2b61daf8fc628d65
- SHA1 2f172c26060e3fdeff06239b2a75a47843c1073e
- SHA512 8ac7fb40dbc0768473449cfdb7c27f62bdb2853cceb8c1c036077d65b75d045c8a0fda71bc33f597cd99dd4be2efc2d29061df0e8700ab39fa333d8cb0df3dda
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqbW3npi63iC:cuytJJ8y5iTvVXpiMh
- TLSH T1CC655A1277E88075F1B357309AB592529A7AFC624F31C78F2394560E1E71AD0EE39B23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe$
- Size 1.2MB
- SHA256 467f5333eaf0282b2b7c59a649a9394e431d6c9a9c3675cbdd9e1965f8c2f698
- MD5 89594b08c81682633248c1da05f34569
- SHA1 4fce791d0b69a486f9b40ae62c0da724c906d6a1
- SHA512 1b11f187dc87e0219cbc0c72337c99232b1d02e2ef443e72319727a3122984683638bcd9324e74d39b5782a326fad2995ddfce56f9198bce7ec69cf191efa093
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqbHV+PAk2hMH3:cuytJJ8y5iTvci2WH3
- TLSH T10C458C2277E44476E163423089E4976AAB76FC624B21C3CF6354970E1F72BD19E3A723
- MD5 SHA1 SHA512 SSDEEP TLSH