Analysis
- max time kernel
90s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 01:40
Behavioral task
behavioral1
Sample
2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
- Size 977KB
- Sample260808-b3mxhsbb28
- SHA256 206e14a037b8b65165efd3c8dfd0bb731d086a2f7b1fdabfbd127768d8143b7c
- MD5 297c39c630c79f52e2841881b0abd190
- SHA1 65cf09a117e3703f6000f3437b6780e553e6c823
- SHA512 f199c0b5374074cf8c84deefc0d68ef5c7a2ca255ba3d3e36c2238bf8bbe24b4cf6b40238cf1d11d169cc64d0879fb5e1c8925f8d3254aa1733dc8714eed3a4d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjPzyUjEF:A3k03kB56r0a
- TLSH T18D256A07A6950FE8D01F81748A964A22EB737C121F2097DF1354AE253F72BD06E3A797
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 13 IoCs
resource yara_rule behavioral1/memory/4448-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244b2-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/404-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b88-13.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4448-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/404-59-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000235ac-153.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000214fa-720.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000224cb-1010.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021c94-1028.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000225d1-1026.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000600000002154c-1553.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244e4-1765.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000244b2-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b88-13.dat aspack_v212_v242 behavioral1/files/0x00020000000235ac-153.dat aspack_v212_v242 behavioral1/files/0x00020000000214fa-720.dat aspack_v212_v242 behavioral1/files/0x00020000000224cb-1010.dat aspack_v212_v242 behavioral1/files/0x0002000000021c94-1028.dat aspack_v212_v242 behavioral1/files/0x00020000000225d1-1026.dat aspack_v212_v242 behavioral1/files/0x000600000002154c-1553.dat aspack_v212_v242 behavioral1/files/0x00070000000244e4-1765.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 404 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$ 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe$ 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{51A7B87B-57A4-493D-87A7-45DD03C49092}\MicrosoftEdge_X64_139.0.3405.125.exe$ 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4448 2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe 404 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_297c39c630c79f52e2841881b0abd190_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4448
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:404
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 977KB
- SHA256 206e14a037b8b65165efd3c8dfd0bb731d086a2f7b1fdabfbd127768d8143b7c
- MD5 297c39c630c79f52e2841881b0abd190
- SHA1 65cf09a117e3703f6000f3437b6780e553e6c823
- SHA512 f199c0b5374074cf8c84deefc0d68ef5c7a2ca255ba3d3e36c2238bf8bbe24b4cf6b40238cf1d11d169cc64d0879fb5e1c8925f8d3254aa1733dc8714eed3a4d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjPzyUjEF:A3k03kB56r0a
- TLSH T18D256A07A6950FE8D01F81748A964A22EB737C121F2097DF1354AE253F72BD06E3A797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
- Size 1.1MB
- SHA256 28a9e1f8e10823ae8f1e7c25ac5cc56600781b486cea3cf1cc00698861d59335
- MD5 78dfe79f7b7bf5150ea362a05fcfee58
- SHA1 d3d7a1ace391367dda51628812326a29f4e7b397
- SHA512 f869fb61484f8a3d86f57f85e001f59cd671fe3b69e108d6506f40b0fa8ca4d97ac5066e12e151e94f334d735d52fad0aad5193e146db1466f9852785bdc03af
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjPzyUjEXTjE:A3k03kB56r0Iw
- TLSH T14D356A07A6951FE8D01F81748A954A22EB737C221F2097DF1354AE253F32BD06E3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$
- Size 1.5MB
- SHA256 5bae4bae7939f6605a9421765713d50d9857f67fab3dc8ce756012a7a23dca0a
- MD5 4b09e7136cecee51a8ff182d6f49a6de
- SHA1 6a84bf20c5526b4ac60b70a0db596fa64a56f764
- SHA512 a052c7aa26db0684a8c4302158f0fa5e04006a24a632dc75e090b12c0ef71cd0d77ac24c40a880ea29650bbea241879661feb207acf90da5e3f03de30c4be01d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjPzyUjEI86n9kAJ9tA3L:A3k03kB56r0VT9t2
- TLSH T12A656B02A6940FE8D01FC1348A968662EB737C561F60A7DF1354AE253F33AD06F3A756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 42ffba674893b5effcce382636ce79e299ce9096a13f70513e04669250820c2c
- MD5 c920b0a539450c9743fefa8e6d87ec9c
- SHA1 bfaeb2a3551246e7464563ef8dbe9bb0cb412f27
- SHA512 8ee66e0e195d0726d9ef1636843758948a5b2d52013b25ce65a59dc31084340bc5d4cad078385dc6ca52c77fd4bd27e9917c84f819173c512be1a6731e1e4256
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjPzyUjEB0Le5ji0hmxNrM:A3k03kB56r0qPji0Aj
- TLSH T177755B16F6A44BB5D02BC078C5D29666EA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 1.1MB
- SHA256 8be373f3f4ad4f78a4cb8ccf4e02447ef631c0506111254013994180fee57f37
- MD5 ab0b6bc15d3a85aecdcf2be6120a3a70
- SHA1 b7f4b66a2973ac52ffdae6d0c7193e2736dfb763
- SHA512 6203592c25f3ff105688dbbb562ff8d06b7d6922028fff5e1c5bacb2e865ef815b0b3ea38c70e7055b71cd5337d82ced3d4448d1fc39073b752ce05b043f2070
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjPzyUjEKD:A3k03kB56r03
- TLSH T133351606E6940AA8D01F8174CB954622F6737C125FE093DB13D4EE3D3F72A906AFA653
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE
- Size 1.2MB
- SHA256 0e1b8bc787ea32379d60523527297dc40db97a19b3b0590852d991f27e4f1b46
- MD5 b612d88c74afc9ca3033dd902a4ba735
- SHA1 302e147d23a9ecd98c59bb8518fa079125af6c35
- SHA512 0ea85d7de209d1a0df86bad8f329c8d1754d0567648e7b50e41cf1d60fba193f4c46b0f67bb2c1c59341d37761c170a524caf60941f2c1b204f72a81e6976ba2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjPzyUjEWu2w2JUqr:A3k03kB56r0bO6r
- TLSH T1C2455907A6940EE4D11F81748A968A72F773BC511F2097DF1354EE2A3F33A906E3A752
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
- Size 1021KB
- SHA256 86ac681bc784ce27cc3def2fd89d34587c9040f89f004081f2928618c5402534
- MD5 cda4572d48a47e8b4471e667c382f8f6
- SHA1 b96474cbb5154d7ccbcffaf442ddda2fef7fc3f8
- SHA512 1d3a2577c168e8b454ead5b0331442b07629d24fa5769f14ee6576fd597fee1c6f6b6c9aaecc7cc54e146c1e7a3889b6c834b302c79ad16862ee0327494e4b76
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjPzyUjEcwE:A3k03kB56r0b
- TLSH T195256A07A6950FE8D01F81748A968A22EB737C121F2097DF1354AE253F72BD06E3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE
- Size 1.5MB
- SHA256 b5d604e816cae9886a6dc118d429bd77b9f9f7a328dd8a344b01036b0ab1ba1c
- MD5 58448a1800d396befcd472e1f0c4e96e
- SHA1 ba3770770ad24a219b4471fdfbbda9d038a6a79c
- SHA512 0fae388cc3ba897c8fe5f0b3777ebc99c76a6ce35ba5354b8b99e7d4261062bd7320e79d8cb1947056f7b14c6879a259af9f3dadcfb83cc6fd59dfea994d8f45
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjPzyUjEL3N+tCn50ChWdArKV:A3k03kB56r028tDZqrKV
- TLSH T18C755A47A7944BE5D01F817486A68572F7B3BC510F2097CF5354EE2A3F336A06E2A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$
- Size 1.5MB
- SHA256 b43e1c05f7d42fcb2a49e8ba855f9e9de06e93045e204b653f9636e864fd0ce8
- MD5 aee900767be12cdfce13c6e0333bb714
- SHA1 216e0ea59ed0c17a0d7d3c4a43663585c3b136ab
- SHA512 1247d953bf9899bc802ac6d23d54f92c07bfd2cb28cf81dd9a6d3d0624e572ea61058c1a721eb0941dfcf512d38168e839b8910d26c9b3a32ca5865aa8334b09
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjPzyUjEcwyCn50ChWdArKV:A3k03kB56r0VDZqrKV
- TLSH T1F9755A56E7944BE5D01F813486A68572F7B3BC510F2097CF5354EE2A3F336A06E2A722
- MD5 SHA1 SHA512 SSDEEP TLSH