Analysis
- max time kernel
87s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/08/2026, 01:02
Behavioral task
behavioral1
Sample
2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
- Size 1.5MB
- Sample260801-bd2pdacj5s
- SHA256 09b2bf0b6d2ad8fedd3c25706d87ee66b5c5aa33d28137eecf34d748f9f2e992
- MD5 cf03fc465648b9d7c5cc1f3dac962e53
- SHA1 af9f1962df1fd3b13648d4562b0c1d507f43b995
- SHA512 f3b6f38104a6602ba5487ca0bcacebf102ee4058c4dae96d56c2d5e236477bbd3d59b9d79d32aa6f22e7887fabfccf4d370c6be6436e14a3219ce25307a020a3
- SSDEEP 24576:A3mnXoZjzyacNVOE/ZxUiKiYQhcC3mnXoZjzyacNVOE/ZxUiKiYQhcT:A3kM63kM7
- TLSH T130659E13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 12 IoCs
resource yara_rule behavioral1/memory/3528-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024626-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/5008-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b88-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3528-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/5008-59-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000235b8-121.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x006500000001f2b6-753.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0009000000021638-1031.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000001e970-1391.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001800000002029c-1563.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023116-1793.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024626-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b88-12.dat aspack_v212_v242 behavioral1/files/0x00020000000235b8-121.dat aspack_v212_v242 behavioral1/files/0x006500000001f2b6-753.dat aspack_v212_v242 behavioral1/files/0x0009000000021638-1031.dat aspack_v212_v242 behavioral1/files/0x000200000001e970-1391.dat aspack_v212_v242 behavioral1/files/0x001800000002029c-1563.dat aspack_v212_v242 behavioral1/files/0x0002000000023116-1793.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5008 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$ 2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe 2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe 2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe 2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe 2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ 2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$ 2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe 2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$ 2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ 2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ 2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ 2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ 2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3528 2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 5008 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_cf03fc465648b9d7c5cc1f3dac962e53_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3528
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5008
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.5MB
- SHA256 09b2bf0b6d2ad8fedd3c25706d87ee66b5c5aa33d28137eecf34d748f9f2e992
- MD5 cf03fc465648b9d7c5cc1f3dac962e53
- SHA1 af9f1962df1fd3b13648d4562b0c1d507f43b995
- SHA512 f3b6f38104a6602ba5487ca0bcacebf102ee4058c4dae96d56c2d5e236477bbd3d59b9d79d32aa6f22e7887fabfccf4d370c6be6436e14a3219ce25307a020a3
- SSDEEP 24576:A3mnXoZjzyacNVOE/ZxUiKiYQhcC3mnXoZjzyacNVOE/ZxUiKiYQhcT:A3kM63kM7
- TLSH T130659E13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe
- Size 1.8MB
- SHA256 0cc136731023d57abaabc25b2b5dfa2c59299cbaa184f8b8c49fcea3b33a09fb
- MD5 fbc89c08ca44246fd316c8fafd872e6b
- SHA1 d58a909d522746271090d2438f6c1d1a5ea0fa2e
- SHA512 7626cc4424fa29a3b464c2ed29d436ec55b91b5e272195393875930ddf08a9004af462cb6b7f819d0162092ff60cd53cb45291300b6f685135f831194b3afbd5
- SSDEEP 24576:A3mnXoZjzyacNVOE/ZxUiKiYQhcC3mnXoZjzyacNVOE/ZxUiKiYQhcF3UNUpEisI:A3kM63kMxUN+Eir
- TLSH T1EB858D17EBA408E5E516817499D64716FB71B8625B61C3CF2368832A2F337D06E3E3B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
- Size 1.6MB
- SHA256 0f8c11a7c208f6e53e2a886362ddbb849b959baf5ab0a28d8d11549061e60e2d
- MD5 88b3c430d31cf38f4be896dcfca21762
- SHA1 e1337343737d33ba1a67925c916679c8a20321ab
- SHA512 4ca7c28e883222375bc0c9d0169310f1fc03d58bb4cf0a1d31ca59d82d010a845c472fc8f12cfe039632bb4c455ab852b6e503d0dc52622fc8e93bcc45d7e14c
- SSDEEP 24576:A3mnXoZjzyacNVOE/ZxUiKiYQhcC3mnXoZjzyacNVOE/ZxUiKiYQhchTjE:A3kM63kMJw
- TLSH T1BA75AE13DAA114E9E5068170A9D54626EB75BD676BA0C3DF232CC2112F627C07F3E7B8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$
- Size 2.0MB
- SHA256 833b0007663c4bfbb3e66e59a420a10ada2adbdf32a4e4536627dfd9e6890a38
- MD5 0a02386e0b13c4e157c81dbe626abf4d
- SHA1 f3b8b349e56448f0cf52b92ea188c6ae80a551f2
- SHA512 c7c53938dcd7d8caf31e0a9f1022d2db5550c579bc45f73609b05bd3e725c4a065e0abb6165d0475585becc25a9cadf45b9152d9ba185ef3ae4422d8acf64aae
- SSDEEP 24576:A3mnXoZjzyacNVOE/ZxUiKiYQhcC3mnXoZjzyacNVOE/ZxUiKiYQhcC86n9kAJ9w:A3kM63kMaT9t2
- TLSH T15FA5AE03E7E404E9E01AC170DAD64616EB75BC571BA1D2DF236882252F637D06F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.0MB
- SHA256 d0bd3cd7d2673884bff6a6d9bcc846a24b600347fd69729b55a3a3bc2db985be
- MD5 3c0676be4ec31bcebe1bc3db73be5121
- SHA1 0a6774076d5810f4b0d0b5f866deebf1d293d796
- SHA512 9035534a5ffeafd6a4c6270031d9b9a735c5d0db9949b1fb2f73fc2e9972f837bd6f6862a243e4fc5eb5afb06259ae08ccbe20b4f245013bdbd30d31ec7a853f
- SSDEEP 24576:A3mnXoZjzyacNVOE/ZxUiKiYQhcC3mnXoZjzyacNVOE/ZxUiKiYQhcP0Le5ji0hJ:A3kM63kMnPji0Aj
- TLSH T1B9A59C17EAA406B5E027C174C9D2565AEB7178521B70C6CF2358C3282F63BD1AF3A7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$
- Size 1.6MB
- SHA256 ce28d33c0f21574b1ed74afe17afd50f9ef7a167a8c663ae27e0a6de5aa210f4
- MD5 eff1e24189642d241e4e46450209fdf3
- SHA1 880bf8ef5abea278143f483265ecad3662702b2a
- SHA512 943f8afee48c7e4fece24f6a92fedd8921ad659171a88fd18469a98383ad8220b0ee419012dcdda4b19dbff0d97f5850ae91cbb46b0facd76df45339c47df0be
- SSDEEP 24576:A3mnXoZjzyacNVOE/ZxUiKiYQhcC3mnXoZjzyacNVOE/ZxUiKiYQhckD:A3kM63kMg
- TLSH T153756B13D69004E5E10E8170DB954612FB77796657E082DF23E8C23D2F627806FEA7AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
- Size 2.0MB
- SHA256 99093e9591d2894fd3d0e7a5d427ab63701cfbfd13f2f53b83c1d8fee68ac153
- MD5 704fb7871cde2b766258ce8478185347
- SHA1 7f80e5427855c82c51679c2165bdd43f668336ce
- SHA512 bc9d467d8c8298c2b1767d247e2b135ea41d5e18bcbf8c015eca026ef66a9fcbd6f39175c95fc0fb9f0e2954623048159463ec5845437cbd22e2d35ea3a44805
- SSDEEP 24576:A3mnXoZjzyacNVOE/ZxUiKiYQhcC3mnXoZjzyacNVOE/ZxUiKiYQhcnUOlZ7q/c9:A3kM63kMvUOlk09
- TLSH T1BC959E17EAA408E5D12B85749AD64612EB757C525B60D3CFB32CC2252F237C06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 1.5MB
- SHA256 dbe61fb42b538dcf45067fd38aa9fe167da5e974dfea5d223ced26b6f992c48a
- MD5 ebc1b00959e8c7f6fbc2cf81d08d4949
- SHA1 d471f3995d5fea33a34241d98318b48287e7f646
- SHA512 1f09def4f13445e9ccc6cd24226b343f51a28d7c93199e48c789eed5f94e2b626b3f67ddfbd5b8f21a5b4c774ac40cf90da761f9cf6b687eb54c16cec215aef1
- SSDEEP 24576:A3mnXoZjzyacNVOE/ZxUiKiYQhcC3mnXoZjzyacNVOE/ZxUiKiYQhcSwE:A3kM63kMg
- TLSH T12E759E13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH