Analysis
- max time kernel
149s - max time network
128s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
07/05/2026, 12:49
Behavioral task
behavioral1
Sample
2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe
- Size 1.4MB
- Sample260507-p2efmses5v
- SHA256 a94047c1069c6d0ad17e71d9743070a3b1db24d4fcde6e2e8f1a7f39bce92c10
- MD5 3a1f83a8196a878f1bc5941439d13e5b
- SHA1 3f6f68508406de7cb1e7f42c556043a31203dc95
- SHA512 735c0aa4ad77c1649fbcc12128b4d90341c8a12a9a4dc2a86f36bba4393a245375238bfb2da3951174822ba24ef4717e48219ea339ea260916db39e3d0978791
- SSDEEP 12288:vfZD+k3HVJ5xDfp4D7/SAOZi+5v4+rcKfty:3ZJVJTt4D7/SAOZi+5v48cKfM
- TLSH T1A36519E656DC0DD6E09B2B3C55B25A2BCD90BE34043696221AC4E4CF1E9FED7062C772
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\user.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Robocopy.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\winver.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cipher.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\extrac32.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sdchange.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\svchost.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\userinit.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\stordiag.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RpcPing.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dccw.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\autochk.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\shrpubw.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SearchIndexer.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sdiagnhost.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\compact.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dtdump.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mstsc.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Dism.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\DWWIN.EXE- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\more.com- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\regini.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\certutil.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe -
resource yara_rule behavioral2/memory/2136-0-0x0000000000400000-0x0000000000518000-memory.dmp upx behavioral2/memory/2136-2-0x0000000000400000-0x0000000000518000-memory.dmp upx behavioral2/memory/2136-8-0x0000000000400000-0x0000000000518000-memory.dmp upx behavioral2/files/0x001300000002ad60-7.dat upx behavioral2/memory/2136-21-0x0000000000400000-0x0000000000518000-memory.dmp upx behavioral2/memory/2136-22-0x0000000000400000-0x0000000000518000-memory.dmp upx behavioral2/memory/2136-28-0x0000000000400000-0x0000000000518000-memory.dmp upx behavioral2/memory/2136-34-0x0000000000400000-0x0000000000518000-memory.dmp upx behavioral2/memory/2136-33-0x0000000000400000-0x0000000000518000-memory.dmp upx behavioral2/memory/2136-27-0x0000000000400000-0x0000000000518000-memory.dmp upx behavioral2/memory/2136-1062-0x0000000000400000-0x0000000000518000-memory.dmp upx behavioral2/memory/2136-1175-0x0000000000400000-0x0000000000518000-memory.dmp upx behavioral2/memory/2136-1178-0x0000000000400000-0x0000000000518000-memory.dmp upx behavioral2/memory/2136-1299-0x0000000000400000-0x0000000000518000-memory.dmp upx behavioral2/memory/2136-1760-0x0000000000400000-0x0000000000518000-memory.dmp upx behavioral2/memory/2136-3189-0x0000000000400000-0x0000000000518000-memory.dmp upx behavioral2/memory/2136-3190-0x0000000000400000-0x0000000000518000-memory.dmp upx behavioral2/memory/2136-3191-0x0000000000400000-0x0000000000518000-memory.dmp upx behavioral2/memory/2136-3194-0x0000000000400000-0x0000000000518000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\show_third_party_software_licenses.bat 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\show_third_party_software_licenses.bat- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.22000.1_none_570a42293a25658a\comp.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmagent_31bf3856ad364e35_10.0.22000.469_none_403fa699a3654657\r\MDMAgent.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.22000.120_none_97c4601a91ef2a4b\r\mfpmp.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mountvol_31bf3856ad364e35_10.0.22000.1_none_089d1713563c5f72\mountvol.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.22000.1_none_49632d3770877d59\CHKROOT.CMD- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-where_31bf3856ad364e35_10.0.22000.1_none_b416d6c5e2f3a677\where.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5519d2fa88b436fc\SearchProtocolHost.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cipher_31bf3856ad364e35_10.0.22000.1_none_0daec752de4278a6\cipher.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.22000.1_none_388372a9953bb48f\iscsicpl.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_4548a15e322e11ac\chgusr.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.22000.434_none_95bd8d59818abcd7\f\nltest.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unattendedjoin_31bf3856ad364e35_10.0.22000.434_none_ae734c6bf20696b6\f\djoin.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-utilman_31bf3856ad364e35_10.0.22000.1_none_58ed4d9536066242\Utilman.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CasPol.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.22000.120_none_c92bb840373729ed\f\AddSuggestedFoldersToLibraryDialog.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.22000.120_none_a6b2722d9eed2eed\f\fixmapi.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.348_none_7c4c059b9e36fe85\f\SpatialAudioLicenseSrv.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.22000.1_none_615eec7b6e862785\fc.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.22000.1_none_fdc8d4cbc9bb5f92\ctfmon.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-userinit_31bf3856ad364e35_10.0.22000.37_none_c87c050022130145\f\userinit.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.22000.65_none_90fb210207715818\f\Taskmgr.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.22000.434_none_986ff8587a758e7c\f\WUDFHost.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.22000.120_none_9ed34dd5b0c53507\r\WpcUapApp.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AssignedAccessLockApp.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.22000.1_none_21c411966b3ba1f5\nslookup.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.22000.282_none_1a017429cb7fea2c\f\rdpshell.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.22000.65_none_6e6aca3ab1161ee5\f\pcaui.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-warp-jitexecutable_31bf3856ad364e35_10.0.22000.1_none_2e5256cb5b543e55\Windows.WARP.JITService.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_product-containeros__windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_2b1b00237ae1bbca\f\SearchFilterHost.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_069016efd47610d8\wmpconfig.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-osk_31bf3856ad364e35_10.0.22000.1_none_010071125eb7c4f1\osk.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.22000.1_none_d7fdc61a4a1da73a\PrintBrmEngine.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.22000.469_none_e653782f0144d814\f\SysResetErr.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.22000.282_none_66112670800af37c\f\vdsldr.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_bsdtar_31bf3856ad364e35_10.0.22000.434_none_518c740df132d17d\f\tar.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.318_none_c7ea7e014d4524f4\r\AppVDllSurrogate.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.22000.41_none_ea5a28018e2bb582\wdagtool.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.22000.348_none_04e0603a0d245e07\ie4ushowIE.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net-command-line-tool_31bf3856ad364e35_10.0.22000.1_none_a875ef267740234b\net.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.22000.1_none_ef1ce2dee8e9f117\BackgroundTransferHost.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_10.0.22000.318_none_64b09e1111e8c6f6\r\winresume.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.22000.282_none_59d63580ebab6c4c\f\WpcTok.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.22000.348_none_1cb0f82bf1aef3cc\lpremove.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.22000.194_none_841924fc9a413271\wimserv.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.22000.1_none_ba1c45853a21e276\IMTCPROP.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.22000.1_none_833f67c8d584d19c\dplaysvr.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_eventviewersettings_31bf3856ad364e35_10.0.22000.1_none_4b3b75ad087c3772\eventvwr.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bcdboot-cmdlinetool_31bf3856ad364e35_10.0.22000.194_none_5c736727c3870f49\bcdboot.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.22000.282_none_ed4920c9a3fd8bd2\adamsync.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.22000.376_none_fbeabbf57111df0a\f\vfpctrl.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.22000.120_none_8faca973dc064b74\r\NarratorQuickStart.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.22000.258_none_dfe62f4e03f8472a\r\LsaIso.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.22000.282_none_d1df129ba9a9b56f\fsutil.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WebExperienceHostApp.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-efs-ui_31bf3856ad364e35_10.0.22000.1_none_4cb865a88c5f8f71\efsui.exe- 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-07_3a1f83a8196a878f1bc5941439d13e5b_elex_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2136
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 1.9MB
- SHA256 7d6e24eea26a8ac40be1f784876b07a702919fcd83261f6feaa71ae2def61c52
- MD5 4b46eaf2049116a6aefee879333d7fe7
- SHA1 2fd67305994c5fb842058a902545218043342d18
- SHA512 1ce5fa81c8aa294c84241db02274d6d72c249f945e1b19e1afc8d666d3921261cfaf6fd47156a61a73d1b781a30bce9c23f82586282ad84e48ed141121d8be48
- SSDEEP 24576:3ZJVJTt4D7/SAOZi+5v48cKfW0Le5ji0hmxNrMD:jVBXdc9Pji0Ajm
- TLSH T16F955CA6A2EC0AE2E0AB977C84F2562BCD60B9340635865306C4D59F1E5FFD7063C772
- MD5 SHA1 SHA512 SSDEEP TLSH