Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/08/2026, 22:28
Behavioral task
behavioral1
Sample
2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe
- Size 1.3MB
- Sample260827-2d2bqadp91
- SHA256 307a3533765cae4e1ab9b3ec92a7efde8cf89e1c715570bb0bdf33ccd23882ae
- MD5 146a688a091ca93cd068e8f62666ff41
- SHA1 2a7ad93dc23242cdf532fc86705c731f29ce1fa6
- SHA512 905c0d39a8de12d1899d694be0208f1141b927ec70a0d46db9cf4ea45c0a059f40066ae0a150db87c9c3f3806678a8bae1f5d6835e52ee3849f2dae3fbcea455
- SSDEEP 24576:zsXN4Jk+p5RJVJTt4D7/SAOZi+5v48cKfP:jJDp5rVBXdcS
- TLSH T1DB556C83BA502AF9C066C138A5730A42A9B439095731F79F43ACF7363E56BD11F39B91
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\getmac.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SndVol.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\finger.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\odbcconf.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\unregmp2.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\taskkill.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mfpmp.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\MuiUnattend.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fontview.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\replace.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\resmon.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rrinstaller.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\xwizard.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\certutil.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\help.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\print.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rekeywiz.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\print.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\verifiergui.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\DpiScaling.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msra.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\perfmon.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\raserver.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sc.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tree.com 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mspaint.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\user.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\icacls.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe -
resource yara_rule behavioral2/memory/2584-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000a00000001b144-5.dat upx behavioral2/memory/2584-1037-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/2584-2915-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\7-Zip\7zG.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\7-Zip\7zG.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\UnregisterInstall.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Defender\MpCmdRun.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{ECFE93F7-0E0D-49A5-A40C-A888E035F269}\MicrosoftEdge_X64_139.0.3405.125.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\show_third_party_software_licenses.bat- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemApps\Windows.CBSPreview_cw5n1h2txyewy\CameraBarcodeScannerPreview.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\r\AppVStreamingUX.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\showmount.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\HOSTNAME.EXE- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_netfx4-vbc_exe_b03f5f7f11d50a3a_4.0.15912.355_none_d6930f2587043445\vbc.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.26100.1150_none_3d9125d57cc0da9e\r\WMIC.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winver_31bf3856ad364e35_10.0.26100.1_none_b345269d05057414\winver.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.26100.712_none_f5f8369ba361b124\r\msiexec.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\r\phoneactivate.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.26100.1_none_1df4641271a5054b\UserAccountBroker.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SecureAssessmentBrowser.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.26100.1591_none_71da000f2a392039\r\IMCCPHR.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_vmconnect_31bf3856ad364e35_10.0.26100.1591_none_2bf6278ffa2525b6\r\vmconnect.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_wpf-presentationfontcache_31bf3856ad364e35_10.0.26100.1_none_028d3f2f7abaac3f\PresentationFontCache.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-resume_31bf3856ad364e35_10.0.26100.1742_none_091721c8d0a92082\winresume.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_11.0.26100.1150_none_0f016472f35d0135\r\ieUnatt.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-label_31bf3856ad364e35_10.0.26100.1_none_5422b42832d51a31\label.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-workspaceruntime_31bf3856ad364e35_10.0.26100.1150_none_c24c8b338d2c21f3\r\wksprt.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\finger.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fontview_31bf3856ad364e35_10.0.26100.1150_none_e04b5db66660ee87\fontview.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\r\rpcinfo.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1150_none_fb078fe8106f7572\cmmon32.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.26100.1591_none_9d960bc9bb2901f9\rdpclip.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.26100.1150_none_664cc5d65cf1b4d8\wsmprovhost.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..agespaces-spaceutil_31bf3856ad364e35_10.0.26100.1591_none_782468f07f32b467\r\spaceutil.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupcl_31bf3856ad364e35_10.0.26100.1_none_55a2ae3453d48859\setupcl.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\notepad.exe 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-gameinputsvc_31bf3856ad364e35_10.0.26100.1301_none_2476c9fd1a91bf33\GameInputSvc.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.26100.1591_none_435b2733e13c4689\dxgiadaptercache.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.26100.1150_none_5cbb86162cb9f00b\wevtutil.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.26100.1150_none_6767c467165c7708\r\nslookup.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printdialog.appxmain_31bf3856ad364e35_10.0.26100.1591_none_20d2a02f892fa68f\r\PrintDialog.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\TextInputHost.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-magnify_31bf3856ad364e35_10.0.26100.1591_none_14427ce57d177902\r\Magnify.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..-client-aggregators_31bf3856ad364e35_10.0.26100.1591_none_1057fc96a520e997\AggregatorHost.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.26100.1150_none_713524eb211332eb\ReAgentc.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15912.0_none_7f1c6fee223c55e3\mscorsvw.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.26100.1591_none_4ab0905276b69755\r\CheckNetIsolation.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.26100.1_none_0c53e49062af0dd7\SystemUWPLauncher.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.712_none_231685f601e78e59\r\SpatialAudioLicenseSrv.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.26100.1_none_9187ca465243b700\schtasks.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.26100.1_none_68cde88f2c470738\netiougc.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\NETFXSBS10.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-driververifier-tools_31bf3856ad364e35_10.0.26100.1150_none_5ce3f0df6c2eb9bb\verifier.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\AppVNice.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\Microsoft.Uev.SyncController.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.26100.1591_none_7fa1f11eafc6c01d\r\wbengine.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.26100.1150_none_d0187a73d39a8bd8\IEChooser.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieinstal_31bf3856ad364e35_11.0.26100.1150_none_c83b3d886b00dded\r\ieinstal.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.26100.1591_none_f346527b3b1f36f2\r\BitLockerWizardElev.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.26100.1591_none_bc36ad3cb5eb132d\wermgr.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..oreuap-iotuap-tools_31bf3856ad364e35_10.0.26100.1150_none_c74b9bded5451f89\iotstartup.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tieringengine_31bf3856ad364e35_10.0.26100.1150_none_4b5f1683145608dd\TieringEngineService.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.26100.1591_none_4345324c74f92366\r\ctfmon.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1000_none_5f95cc5803dfafcd\mofcomp.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.26100.1591_none_6b60aaf7ce5c0f38\r\AtBroker.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-restartmanager_31bf3856ad364e35_10.0.26100.1_none_877dba7dc10bf8a0\RmClient.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.26100.1591_none_4345324c74f92366\ctfmon.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_compiler.exe- 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-27_146a688a091ca93cd068e8f62666ff41_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2584
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 2.2MB
- SHA256 45f9296a9538c605176da3f0070dc5209c3576235e0cb8bcfa2c3b596c7a265f
- MD5 740a1b3db87ffe962e6a2d079af4fd1a
- SHA1 e4db76865601687fe3b89354c0c2b45f98441716
- SHA512 bbf3fee16c1f53f874e7b887f30b729c3074a5f288a69e23c17ea61e6887426d0799687199035f1fb957cd64384beb9b118aacfb8771d5059291b6e48a91d878
- SSDEEP 24576:zsXN4Jk+p5RJVJTt4D7/SAOZi+5v48cKfJa7/ezSC6vUyD/aqgrvWx6q8wyuS:jJDp5rVBXdcT/ezSC6vUzPvMHjyR
- TLSH T193B54A52B67843B3D0B2C079C5F36A96FA71340647309ADF0249E7293E277E18E39B65
- MD5 SHA1 SHA512 SSDEEP TLSH