Analysis
- max time kernel
117s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/05/2026, 13:22
Behavioral task
behavioral1
Sample
2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
- Size 1.3MB
- Sample260511-qmkvjsd18q
- SHA256 f65f11739e29fecb5f5eada586ed8b9381e8e763bb9f316b0dfa760d6a452938
- MD5 2340b10a739127d4bd3c20104738b15d
- SHA1 424c0a82b0a29c06d12f08aaee984804354cf37a
- SHA512 5d70ef9c350a116f62c8d7e6c7541e4da1c9bbf3939880692f5365c6bbc422b981286b9471e780c217dc7f3c39db311b1ce603f6ec95253e6ec09c99f8a23fef
- SSDEEP 24576:A3mnXoZ643mnXoZ6Q3Td9CHKy7GZj5jcAkSYqyE:A3k03kOTd9CHKyavpYq
- TLSH T14C557D12F7A441B5E073C179CAE29666EA7238451730DACF1394D7292F33BE19A39B31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral2/memory/5424-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b413-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5084-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000002a198-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5424-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5084-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x008a0000000272db-1001.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000028e88-1271.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d0000000004a7-1465.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a0000000004a7-1626.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000028d62-1853.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000025aec-2068.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b413-5.dat aspack_v212_v242 behavioral2/files/0x000400000002a198-12.dat aspack_v212_v242 behavioral2/files/0x008a0000000272db-1001.dat aspack_v212_v242 behavioral2/files/0x0004000000028e88-1271.dat aspack_v212_v242 behavioral2/files/0x000d0000000004a7-1465.dat aspack_v212_v242 behavioral2/files/0x001a0000000004a7-1626.dat aspack_v212_v242 behavioral2/files/0x0003000000028d62-1853.dat aspack_v212_v242 behavioral2/files/0x0002000000025aec-2068.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5084 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File created C:\Program Files\7-Zip\7zG.exe 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe patcher.exe File created C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe\XboxStub.exe 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$ 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$ 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5424 2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 5084 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_2340b10a739127d4bd3c20104738b15d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5424
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5084
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.3MB
- SHA256 f65f11739e29fecb5f5eada586ed8b9381e8e763bb9f316b0dfa760d6a452938
- MD5 2340b10a739127d4bd3c20104738b15d
- SHA1 424c0a82b0a29c06d12f08aaee984804354cf37a
- SHA512 5d70ef9c350a116f62c8d7e6c7541e4da1c9bbf3939880692f5365c6bbc422b981286b9471e780c217dc7f3c39db311b1ce603f6ec95253e6ec09c99f8a23fef
- SSDEEP 24576:A3mnXoZ643mnXoZ6Q3Td9CHKy7GZj5jcAkSYqyE:A3k03kOTd9CHKyavpYq
- TLSH T14C557D12F7A441B5E073C179CAE29666EA7238451730DACF1394D7292F33BE19A39B31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$
- Size 1.4MB
- SHA256 4ff39d2ba97147c3a208abeea13769c60c68e59fd972ec45004dfdaf496c5b87
- MD5 4e8db4dca3d1beffe2ea2f2b04210daf
- SHA1 3520ef6faedb264d476d7b8b85702e424ea8993d
- SHA512 09b754079e942761ccb7105fd37aa201bc8b471872a3137ea015f71bb646bdcf04ed44f723dd63f334292c9bc0012ea4f56ab6c9a0614f5e73c12f695ec3e6e9
- SSDEEP 24576:A3mnXoZ643mnXoZ6Q3Td9CHKy7GZj5jcAkSYqyEzhk:A3k03kOTd9CHKyavpYqTW
- TLSH T197657D16F7A401B4E073C179C9E29666EA7238551B30DACF139497292F33BE19E39B31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 1.8MB
- SHA256 87ec0f77f388fef386cabfb9d09b1df29ad7c8475f20c85a93914c5f6aa03b7b
- MD5 dc190d08dd0689876405b176e828e04d
- SHA1 948f6115d5f3d3064a30e31637e95df97b53f010
- SHA512 4225d48fab87f0719d7f91a3b5d6b86c8fde69f2814a8cc32a46167f79d03fc435627cf0c34d8bad16500fccaa6087876f713cf025e11d882403bd037202ef99
- SSDEEP 24576:A3mnXoZ643mnXoZ6Q3Td9CHKy7GZj5jcAkSYqyEfUr2d29dBrtpDiI:A3k03kOTd9CHKyavpYq/UidGl
- TLSH T165957D12F7E441F5E077C178CA929656EA7278450B30DACF039497692F33BE19E3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$
- Size 1.4MB
- SHA256 ef92f46b17eec4f6a53d038576c878e1e664b52998941a0f11cc3256c5b4e789
- MD5 3ce8a94416496be639692c08dde5e55c
- SHA1 6689a400a6ad6f16dc59a5e42a6c35a11b4e36d6
- SHA512 db27e56d6ff1581bf0d80c0b7daba715546a3f61f4155fd677d43b6924f56cba469fbcacdc485ea77922f5e2c2330c05c138eb5e512090acbe7ac90ca4eeafab
- SSDEEP 24576:A3mnXoZ643mnXoZ6Q3Td9CHKy7GZj5jcAkSYqyEZbBPzBAU:A3k03kOTd9CHKyavpYqtBPVAU
- TLSH T1D0657D12F7E441B5E073C179C9E29666EA7238450B30DACF139497692F33BE19A39B31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.9MB
- SHA256 937248da3e82edfe8a9b5a8607227c0e2f26abdb36cd5249663e090249c8ce7b
- MD5 573931bc0d6e966be08be2156dfa065d
- SHA1 444a2ef1d52fe2ac7c0e93012084067ae3f78397
- SHA512 e6818b9da17f3559e65b4650bbe0fd2c82f43f5d6f8c6c85787fc598bac4db2c947219cd702eed031d179a9efb6b4b034d49a7c9d74eb58f6c164158f156d175
- SSDEEP 24576:A3mnXoZ643mnXoZ6Q3Td9CHKy7GZj5jcAkSYqyED0Le5ji0hmxNrM:A3k03kOTd9CHKyavpYqjPji0Aj
- TLSH T1D5955C16F7A44275D073C179C9D2A656EE7238851B308ACF0395D7682F37BE18A3AB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 1.4MB
- SHA256 949003ca4c28c039757e7e3e0f2f80052235d756698d2b26eb18a5755137fdbd
- MD5 2b5c67ea5e2db09ff77a8ca80427761b
- SHA1 a0809ca847afcdb1d42816a07e82f35a8c5e9e2e
- SHA512 9213361231d3fff6bea626d09ca66e23a791ac6e7006a9a59822bce36589eb7b0b28dd784054f010df1edb774d306072cf958e751775f309c1332f4d3b834100
- SSDEEP 24576:A3mnXoZ643mnXoZ6Q3Td9CHKy7GZj5jcAkSYqyEuwE:A3k03kOTd9CHKyavpYqk
- TLSH T1C5657D12F7A441B5E073C179CAE29666EA7238451730DACF1394D7292F33BE19A39B31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\crashreporter.exe$
- Size 1.4MB
- SHA256 2cea93cdf78b2c264bf7e7f5d8783c11b4d9b31f918741d1f748cad43c82ad34
- MD5 c159294bec362d6500ccb12e434c6f62
- SHA1 4b45e30f1d62c97e440e1796f7351a294587853f
- SHA512 638aa957f9498c18bf4ff967e1c3808780c3a9f7a0834729437221b7cd3fb6c14613939791288faca20eb9c4614b5f15710025b147d9e122810efab0133a5d5b
- SSDEEP 24576:A3mnXoZ643mnXoZ6Q3Td9CHKy7GZj5jcAkSYqyEPF:A3k03kOTd9CHKyavpYqt
- TLSH T1FF656C12F7E402B5D073C179CD969656EA723C850B309ADF1394B7292F33BE19A39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe$
- Size 1.6MB
- SHA256 f6ff6aa9da484570b849cc24fd5c6ece1ef2bb0ebcb3873a4d8a4dd383c45e32
- MD5 39876a864eed74cf1d22ddab3f80489b
- SHA1 9ed839f2c4b650a47e5e1208f4200f57b8d69cd9
- SHA512 54a7ddeaf7bb2b5b235cddf4a6f0848b67736ba1d8bedd4a0efaa38d2973753f2d1b4e888de22b00613f3e14f11f035225b024f80f972ab1afc755cb1505217a
- SSDEEP 24576:A3mnXoZ643mnXoZ6Q3Td9CHKy7GZj5jcAkSYqyEfV+PAk2hMH3:A3k03kOTd9CHKyavpYq/i2WH3
- TLSH T19C757D22F7E441B5D073C179C9E69666EA7178450B309ACF1394972D2F33BE18A39B32
- MD5 SHA1 SHA512 SSDEEP TLSH