Analysis
- max time kernel
80s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/05/2026, 15:50
Behavioral task
behavioral1
Sample
2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
- Size 969KB
- Sample260527-tabynaaz9k
- SHA256 1bd8c28bd45999bfd219c9c82f7131ddba39f8bfdb64c88b2b3b2f64b8a4e4bd
- MD5 b425c5c67aedd3e92fe9103a2f5890c1
- SHA1 3732835fd704dcac14d0742ca26b001ecabc398d
- SHA512 b854e1e69df9856823f477e7c23ed997cf84db34d5a067e24b7ae9767d1c2ba6da12b1129634a04cc4048e64e88baaedd2bd4fdad03a55868fc3edac48a8c639
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L84yPz5L80mu:A3mnXoZjzyaEzD5TvinrmkzyZzy0mu
- TLSH T144255A17A2951FE9D12F813489924A62E7737C224F2097DF13646E263F336D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 12 IoCs
resource yara_rule behavioral1/memory/5016-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024542-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4628-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bc9-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/5016-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4628-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002352f-147.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0029000000021673-1249.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002456d-1608.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024575-1686.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000000071d-1960.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022995-2050.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024542-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022bc9-12.dat aspack_v212_v242 behavioral1/files/0x000300000002352f-147.dat aspack_v212_v242 behavioral1/files/0x0029000000021673-1249.dat aspack_v212_v242 behavioral1/files/0x000700000002456d-1608.dat aspack_v212_v242 behavioral1/files/0x0007000000024575-1686.dat aspack_v212_v242 behavioral1/files/0x000400000000071d-1960.dat aspack_v212_v242 behavioral1/files/0x0003000000022995-2050.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4628 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe$ 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe$ 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$ 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$ 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$ 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5016 2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe 4628 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-27_b425c5c67aedd3e92fe9103a2f5890c1_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5016
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4628
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 969KB
- SHA256 1bd8c28bd45999bfd219c9c82f7131ddba39f8bfdb64c88b2b3b2f64b8a4e4bd
- MD5 b425c5c67aedd3e92fe9103a2f5890c1
- SHA1 3732835fd704dcac14d0742ca26b001ecabc398d
- SHA512 b854e1e69df9856823f477e7c23ed997cf84db34d5a067e24b7ae9767d1c2ba6da12b1129634a04cc4048e64e88baaedd2bd4fdad03a55868fc3edac48a8c639
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L84yPz5L80mu:A3mnXoZjzyaEzD5TvinrmkzyZzy0mu
- TLSH T144255A17A2951FE9D12F813489924A62E7737C224F2097DF13646E263F336D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
- Size 1.1MB
- SHA256 f28ff44734445d92a18e082fe39edffaf00ab97c8b8a10f84f4b7244e4ae62c3
- MD5 fc12534498d71d51bbe152acff307c79
- SHA1 127d026fdef9678c92bc5e801fb24f998c4a1f2b
- SHA512 53bbafb44d4cc2b56f6f8d980a20e88b6c885e459f3d432549c16f861de28b191a6040b4240f507715e5c1f2566420c97cc1cac1164f6b2a52637b53ac6d8890
- SSDEEP 24576:A3mnXoZjzyaEzD5TvinrmkzyZzy0mVGen:A3kM456r9ebI
- TLSH T106355B17A2952FE9D12F813489914A52E7737C224F209BDF13645E263F336D0AE3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe
- Size 1.1MB
- SHA256 1de8a4edc77af91a728fcaaea102a460ed9e4c8ebecd4a054f6d8a4bc75e3600
- MD5 fd14348aaf52a59aecc5c05cdc3ad0f7
- SHA1 c7f73d6f4a8fbcab057154676c7a7f29d3ff86eb
- SHA512 f130da35b101f2eb9d22d3a0988402b871a04e5f8acf720ff5a905eb3b72dbb3b84f1b96cb90dc91cdae74fbb17ec358f8be78c4fcdea6e71b879a83f23fffa3
- SSDEEP 24576:A3mnXoZjzyaEzD5TvinrmkzyZzy0mCTjE:A3kM456r9e3w
- TLSH T128355B17A2952FE9D12F813489914A52E7737C224F209BDF13645E263F336D0AE3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 30cfe1f790d55f56da28ae08c574badbe60e3088af855a9ebba9895480e70c87
- MD5 2d90d05f40db130902cc7a82e3865db7
- SHA1 1a9577c169f5557ea3b26b6911e11e9475a50242
- SHA512 2536d64b05ff8e9931753ba3f5b09c94d7c0ed21b5db84306cc6e5455fe2eeb9a0b74f523092f77ad1aee3063fce7c6906eda3b3987222a7d9857d0f5d55eab5
- SSDEEP 24576:A3mnXoZjzyaEzD5TvinrmkzyZzy0me0Le5ji0hmxNrM:A3kM456r9etPji0Aj
- TLSH T143754A16B6A44BB5D02BC178C9D25656EB733C520F308BCB03949E793F276D19E3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 1.1MB
- SHA256 70ecd7e070c556b6aca76536534fefe37e51d109b250c54d4f3ca7aec70d1745
- MD5 e033a8f651982ab937cd5010446f34f1
- SHA1 485266834504a9b1a1153353c18ce58fa189c324
- SHA512 453407e7d901246f3fdb8de7e1a0300235ba1d080b0a581bb18cc64d6cfd48651b7f06f8182ea5bf2bf1af9ef96373eb70f9cd6bc8d823cb1131383cba58d331
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L84yPz5L80mEXsf3z:A3mnXoZjzyaEzD5TvinrmkzyZzy0mHD
- TLSH T15F35E516E2941AA8D12F8134CB914652F7737C214FE097DB13D4EE3E3F226906EEA653
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe
- Size 1.0MB
- SHA256 89964da75214c8ac1671841b1987ca676f6702a5b1a6c73ff60e5a2e0a097115
- MD5 42e6cd4169a97da1952cf724c40b009d
- SHA1 5b25a7f6ca91513528bba54f25d0f19883386dbe
- SHA512 21925542c7abddc69d3644043167588b51d12b1d17e6c09a49ef32df7fe7a4887f4d9201ebb0a7506aff43f8bfa301ae1d3b2ae8573c819516117f661973453a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L84yPz5L80m8F:A3mnXoZjzyaEzD5TvinrmkzyZzy0m8F
- TLSH T164353907A2951BE5D56F8134CD964A12E7737C620F208BEF13647F263E326906E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 1.4MB
- SHA256 2ed30c4db3843cfdea90cdaa03b315f9a9144010e09c5ad5ddbcd1ee6cebf0b2
- MD5 3048d8df0642b45668751a2605703f48
- SHA1 0980059079a0a6dc240ee210481685eb85bd368b
- SHA512 f7c15b76d6f5fbd87c130b4c57adadb09adeceb3c03f46e67d679b7685e530126990778ca2ab3132c6966a728646e2fb44769fa9cf7f29d374b2f98c226056a8
- SSDEEP 24576:A3mnXoZjzyaEzD5TvinrmkzyZzy0m13npi63iC:A3kM456r9ecXpiMh
- TLSH T1AD655A03B3E45AB4E1BB42349AB54651A7777C224F3087CF13945E293E726D0AE39B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe$
- Size 1.2MB
- SHA256 42e0881a270d56db53bbfdb4851d4a81937cdff5f1024368967aa02f6f5145a8
- MD5 8969f3ffcef2beb38d1008ce1db63845
- SHA1 3934093e25a2810e13f1bc1476d4a12387cb4b33
- SHA512 87bad7f4ec84a0fe3cb6026ea366268ef1c1504e105694f4b95734087a4c5ba23347f22760a03cdbe78db704530517b2768101b134b634670f8adb98fe79a320
- SSDEEP 24576:A3mnXoZjzyaEzD5TvinrmkzyZzy0m8V+PAk2hMH3:A3kM456r9edi2WH3
- TLSH T141457B2376941EF9D12F813489A55626E7737C224F2087DF13646E2A3F326D09E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH