Analysis
- max time kernel
92s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/10/2026, 12:36
Behavioral task
behavioral1
Sample
2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
- Size 1000KB
- Sample261026-ptbpsaez8k
- SHA256 6a6c786c4c6e72e4e8dae475aa6930ebc31ef06ed82d2ffc53380f92c77ef59f
- MD5 c86dfe346bf023ac4cfa918a3f3d9b08
- SHA1 4410bf4c5553d1f3f1bed92e45e4992615dae2a6
- SHA512 b123f336e5533e74d3f7147aa460e79ef882fb6f16482fd7ae47cc12ae4cb1a3f60dd2e7f7585cc08e6f1fac230ace5f39ff0bb7ea759435e95cadbf15e2f14f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFHfy1gL5pRTcAkS/3hzN8qE43fm78Vd:A3mnXoZjzyaTjF/T5jcAkSYqyEd
- TLSH T17B256B16F66442B5D073C1B9C9D2AA5AFB71344617308ACF1399D7382F23BE19A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/5068-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c469-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c46b-10.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5068-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4256-34-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a0b7-1010.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019ce5-1253.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000000144-2074.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c000000000144-2098.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c469-5.dat aspack_v212_v242 behavioral2/files/0x000e00000001c46b-10.dat aspack_v212_v242 behavioral2/files/0x000300000001a0b7-1010.dat aspack_v212_v242 behavioral2/files/0x0003000000019ce5-1253.dat aspack_v212_v242 behavioral2/files/0x0008000000000144-2074.dat aspack_v212_v242 behavioral2/files/0x000c000000000144-2098.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4256 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe 2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe$ 2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$ 2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ 2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ 2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ 2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ patcher.exe - Drops file in Windows directory 28 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$$ 2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5068 2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4256 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-25_c86dfe346bf023ac4cfa918a3f3d9b08_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5068
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4256
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1000KB
- SHA256 6a6c786c4c6e72e4e8dae475aa6930ebc31ef06ed82d2ffc53380f92c77ef59f
- MD5 c86dfe346bf023ac4cfa918a3f3d9b08
- SHA1 4410bf4c5553d1f3f1bed92e45e4992615dae2a6
- SHA512 b123f336e5533e74d3f7147aa460e79ef882fb6f16482fd7ae47cc12ae4cb1a3f60dd2e7f7585cc08e6f1fac230ace5f39ff0bb7ea759435e95cadbf15e2f14f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFHfy1gL5pRTcAkS/3hzN8qE43fm78Vd:A3mnXoZjzyaTjF/T5jcAkSYqyEd
- TLSH T17B256B16F66442B5D073C1B9C9D2AA5AFB71344617308ACF1399D7382F23BE19A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.5MB
- SHA256 3ff742fb722db65af65fa9cad76af20f73541de88a4c7d2ebb15c3b5eeac2b35
- MD5 f601fb67229cb5715b46e8bfc436fda4
- SHA1 c39d9766b788de58a5ba6c13dcf2d4520ad96ce0
- SHA512 989511ce9e6e6fa9a399191df6ef55ea634c58621a38c5c3e142f5e1fb919f29bcd3a7ec5ca3c162c16674b267b709dd31229a5f80f4010c98aa812fb9c50c3b
- SSDEEP 24576:A3mnXoZjzyaTjF/T5jcAkSYqyEv0Le5ji0hmxNrM:A3kM3pYqPPji0Aj
- TLSH T1E3754A16F6744275D073C0B9C5D2AA9AFE71348617308ACB1395C7782F27BE68A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE
- Size 1.0MB
- SHA256 f787204007c9dd35d81f673eac40cd48d095ce6ef5976270071ef83470777ffe
- MD5 648c42ea8d3d71b80577183f797618d3
- SHA1 d18916692b955310f993970efd93c7f04af99577
- SHA512 e2d7965b00e8ca1c58288f6c413bba480dac85e3d667ecbd2c98b9a55f21d8f392b675b7626a751ec5b0385e033492897519cb88d975a42558cf8f641533f832
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFHfy1gL5pRTcAkS/3hzN8qE43fm78VywZi:A3mnXoZjzyaTjF/T5jcAkSYqyEywE
- TLSH T1AB356B16F66442B5D073C1B9CAD2AA5AFF31344617308ACF1399D7682F237E19A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
- Size 1.1MB
- SHA256 0a986db4a75e503b46f51ea8621c95175639890b7d5a9e48f5589154d01488a5
- MD5 0aec8cb3b579de99fcb7dbc54cd55255
- SHA1 df6a9c8fef7492d00078d9a6fda5e0d2db167745
- SHA512 35fc2f187db60a356d8d9489f3e5e7d3418c82f7d50a9f777b3e411102fcfd2c8a7082235deb8784c0230d48cc21cb9fbf6b93bfca2fd1432647d6d97ae03449
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFHfy1gL5pRTcAkS/3hzN8qE43fm78VrF:A3mnXoZjzyaTjF/T5jcAkSYqyErF
- TLSH T105354A16F6A442B5D063C079C9D29A56FA317C9207308ADF1399F7392F337D1AA3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\LimitConvertFrom.exe$
- Size 1.5MB
- SHA256 fb3c2731a9dde152b88010aeaa6e2e781d1925b60a4570cfb7bd51fa0b1304de
- MD5 f697c25c8bcdd4e5caab58bd95e509f8
- SHA1 ba411b8f911d95f2715e8c7b5d5860cd847f3672
- SHA512 3406628b3fc4b32c5aed301b98faffd57447b0a3f1ed23e78860b2f75e82c9adfe1b16200d6d932175222d15b82710c28e29ea286fdd9c9558d69a93ae2ee440
- SSDEEP 24576:A3mnXoZjzyaTjF/T5jcAkSYqyEjFPdoKLUu7OvZ/75ueUgG:A3kM3pYqZCKgu7CJ1k9
- TLSH T1C675AE16F66442B5D073C0B9C9D2AA5AFB31345617309ACF1399D7382F23BE19A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$
- Size 1005KB
- SHA256 ab825c49e15cc65ef9a509895157857366740468fc400a118dab606dbc2ba348
- MD5 693cbd4f68dd86834af9bbe90be7a42b
- SHA1 c7534479d0a99b7ccdad70eabae4abcb229adfa4
- SHA512 1886f6f44153359c2ce7cc8e2d43cf95ccbf86046145b853fa94dbb05bc0654202ef8fb3d1e6911c937594cc33d234fbd8ee66c5639cec218ce82ec87bfdc402
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFHfy1gL5pRTcAkS/3hzN8qE43fm78VA+l:A3mnXoZjzyaTjF/T5jcAkSYqyEA+l
- TLSH T189256B16F66442B5D073C1B9C9D2AA5AFB71344617308ACF1399D7382F23BE19A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH