Analysis
- max time kernel
97s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/07/2026, 12:12
Behavioral task
behavioral1
Sample
2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
- Size 954KB
- Sample260727-pdmgcaag47
- SHA256 a9d0eb002469e4259a82bc1bf64f7c9d3920cbf33a10b88160c719c0b7af553b
- MD5 667d7bddece8b1dd87b165e5a5686657
- SHA1 ef8da1e7f17be9ea86f7629933259a97a9c57a25
- SHA512 583d1227e37ecba57f67865b842d513b9effdb92ca44e487ae4e750e6bc5a26e4e96b574d5c476baa3438e2bc6b35a2a4dc47a76fcfad2b5b946ed9cf359929a
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljzyPz5L8r0a:t/sCv7rTiw2RYwZCUs+zyrN
- TLSH T15025291767E80894E466A13489B54606EB72F8651B30C7CF12B88B3D1F63BF0BD39B25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral1/memory/4652-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023339-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/5100-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b3d-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bcf-40.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4652-41-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/5100-42-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021f3b-985.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002161d-1289.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00050000000228e0-1393.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001600000001db2e-1708.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0013000000000723-2073.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0002000000023339-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022b3d-12.dat aspack_v212_v242 behavioral1/files/0x0003000000022bcf-40.dat aspack_v212_v242 behavioral1/files/0x0002000000021f3b-985.dat aspack_v212_v242 behavioral1/files/0x000300000002161d-1289.dat aspack_v212_v242 behavioral1/files/0x00050000000228e0-1393.dat aspack_v212_v242 behavioral1/files/0x001600000001db2e-1708.dat aspack_v212_v242 behavioral1/files/0x0013000000000723-2073.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5100 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe 2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$ 2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ 2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ 2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe 2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe 2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe 2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe 2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ 2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ 2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ 2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe$ 2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe$ 2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4652 2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe 5100 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_667d7bddece8b1dd87b165e5a5686657_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4652
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5100
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 954KB
- SHA256 a9d0eb002469e4259a82bc1bf64f7c9d3920cbf33a10b88160c719c0b7af553b
- MD5 667d7bddece8b1dd87b165e5a5686657
- SHA1 ef8da1e7f17be9ea86f7629933259a97a9c57a25
- SHA512 583d1227e37ecba57f67865b842d513b9effdb92ca44e487ae4e750e6bc5a26e4e96b574d5c476baa3438e2bc6b35a2a4dc47a76fcfad2b5b946ed9cf359929a
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljzyPz5L8r0a:t/sCv7rTiw2RYwZCUs+zyrN
- TLSH T15025291767E80894E466A13489B54606EB72F8651B30C7CF12B88B3D1F63BF0BD39B25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe
- Size 1.5MB
- SHA256 33bac706d8376bc6c29120266411a00fd4b5209c3f315f311914fedcfcc42ed5
- MD5 1080b4dd3c708de7f5e21a06c6000a7f
- SHA1 21813ad456f0cef27d6ef507b47c0282f3a45c7b
- SHA512 ee11801134492b8573e747b9e75e05fd2d03f62b780c47a7af919e04f73d635161a8804ffd0736df74efe9003b651789e44a57f3823faeb9191446dcd79eade7
- SSDEEP 24576:t/sCv7rTiw2RYwZCUs+zyro6rY+BersufmiiIJccsnbW0KA7:x7iw2/P8Y+BeFsQczKA7
- TLSH T13E759D5777E80894E562A13489B54606EBB2F8651B30C7CF12B88B3D1E63BF07D39B25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe
- Size 1.1MB
- SHA256 3876fe0fb990a9c0ca539fae7b36a205d8bf63cfa01852c83ccafbeaefb8ea5d
- MD5 1867d16a4e5c6a75bf6c591be2648b79
- SHA1 75e31a52bb19a8fccc456202db444ba9c5cc6f84
- SHA512 59f1346f7bdd79f10aeb938445ee483516954a970e476ba4c84ba4136d705fde82707314f9e209ddc9dfdea70e524db0f92c32080fd8ce59eeebe0cfce3dbe5a
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljzyPz5L8r0RWnRJjEt/gmpn:t/sCv7rTiw2RYwZCUs+zyr4Gen
- TLSH T103352A1777E804A4E567A13489B54606EB72F8651B30C7CF12B88B2D1F63BF0AD39B25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 6908496c54ebe82080457fa844386bc3820e7b1f71779b8f8a30be829af0385f
- MD5 ff706ced9276e22adaabe0291a9b29c5
- SHA1 876184b02cd99ca674e91f19b98881ff7c9ce672
- SHA512 dc7daf80ef6376142ff26c9812f26f056a8c91eb5318afd483ffc5665731a1312f0302c1dcba61f8b490dd82ab496aef804cb6d5f3306b359e667ebb2e22b66a
- SSDEEP 24576:t/sCv7rTiw2RYwZCUs+zyrZ0Le5ji0hmxNrM:x7iw2/wPji0Aj
- TLSH T1CB653A17B6A84661D073D174C9E6964AEB72B4561B3087CF12A8873C2F23BF1AD39731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 969KB
- SHA256 1dcc0c9eebdf99c3129bd4af8aca1ba32f598ab087297805a59fadb52b856aac
- MD5 52638841da0c2843d0c321c3d695ab85
- SHA1 d8c01e99ecd7ba838b6c96d788d6dd7f18b51119
- SHA512 e35ea42b13d7404a752b212ffc8108073351381cd457f8090a3e72639bfba76b56ffc8b002a23403fdbe8853188992518565e9328d2a9d726e6f778c0a30f53d
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljzyPz5L8r0ka:t/sCv7rTiw2RYwZCUs+zyrLa
- TLSH T1F325291767E80894E566A13489B54606EB72F8651B30C7CF12B88B3D1F63BF0BD39B25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe
- Size 988KB
- SHA256 406bf8cf476280b7d164349f3af58028b6b2d4461fa5236683a9deb8c48ffd56
- MD5 4144243bf595171cba292507f5542e4b
- SHA1 aeb13fcc0abe8bf57143280984255867a3290bdb
- SHA512 17b586d0fe061b4b7ac28a70f06dfde5b0b5d377f33768e18668deb4a26e6a25e23a4953b8adb71880733dc55e4837f6537d109431a0ef5404505715ea8ce6cb
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljzyPz5L8r0n1:t/sCv7rTiw2RYwZCUs+zyrU1
- TLSH T11C252A1767E84895E467A13489B54606EB72F8561B30C3CF12B88B3D1E63BF0BD39B25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.0MB
- SHA256 e137781cfdf5c65609e6ecff1242cd5e2f47f9640699c6a696d61b9e8e5e84a8
- MD5 0674e452a8b56d65c38f9ccc10eb1238
- SHA1 9148658c0a9012fcb6977594cb4590e4ec8643b7
- SHA512 181fe48f0a25ed5c4fd0561898cfee2ab96cff362e5d801b66336bed9795284b34ed2b9668f2baaf1489126f1585e8598fd1fe4ea117cc6b113e1e619bf315f4
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljzyPz5L8r0YF:t/sCv7rTiw2RYwZCUs+zyrZF
- TLSH T1BA353A57A6E80594E5A261308DA94601EB72FC951B3087DF1278BB3D1E33BF0BD39B25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 1.2MB
- SHA256 2627d4b49bca21391354489bff08dac36137edad8a6ef42ca2083e53fe5fe56e
- MD5 841ecb510667cb37e14caaf3147db15f
- SHA1 f1b3712efcf8e9cd839259560717d9eb8e5de616
- SHA512 9683fdbe32f50e8633c9deeff7d23f37358160aa56a3338816fdbf9d7ddcd6d0274bd621c3b9c6cc4c1c459e6f9491d4c5c6a0b89fe2cc9e32a21ccfaba3eabe
- SSDEEP 24576:t/sCv7rTiw2RYwZCUs+zyrJV+PAk2hMH3:x7iw2/6i2WH3
- TLSH T1E1455B2777EC04A5E473613449B94616EB72F8561B31C3CF12688B2D1E63BF0AD39B26
- MD5 SHA1 SHA512 SSDEEP TLSH