Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/05/2026, 10:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe
- Size 332KB
- Sample260525-mk8xtagy3w
- SHA256 2d71aff384606123c88b281c349ffcf7f83244f0dd38f00efa9099bcda4b26f3
- MD5 4a1920c7ffc2148ee2d2084187b0ffdd
- SHA1 f210b7f7948ff732bdf4dd31fe6be39b35d6b094
- SHA512 7b3dd2f71f08bd0346fe3527a3d8ef8601a9f42d63237afe18fe65d84005b8a247c4588cf08855426e038bc8b4c51c031ab8d70dd32008f23991b202f5facb0c
- SSDEEP 6144:mXqoE2W26XDpvPoYMT/DTqjgMSKfLJ7olgtlhns:1XDBAZzP/w24lhns
- TLSH T11A743929B79C7BF9DCE682788DAEF121ED317C200761DADB639446291E232C06E3D751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (255) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe - Executes dropped EXE 3 IoCs
pid Process 2092 Logo1_.exe 4572 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 4980 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe Logo1_.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\RCXC99F.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\RCXC9E2.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe.Exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\RCXBE3D.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXC900.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe.Exe Logo1_.exe File created C:\Program Files\Mozilla Firefox\updater.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\RCXCBC5.tmp Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe.Exe Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\uninstall\rundl132.exe 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Logo1_.exe 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe File created C:\Windows\RichDll.dll Logo1_.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1604 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 1604 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 1604 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 1604 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 1604 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 1604 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 1604 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 1604 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 1604 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 1604 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 1604 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 1604 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 1604 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 1604 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 1604 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 1604 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 1604 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 1604 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 1604 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 1604 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 1604 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 1604 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 1604 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 1604 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 1604 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 1604 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe 2092 Logo1_.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1604 wrote to memory of 864 1604 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 87 PID 864 wrote to memory of 3100 864 net.exe 89 PID 1604 wrote to memory of 3184 1604 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 91 PID 1604 wrote to memory of 2092 1604 2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe 92 PID 2092 wrote to memory of 2504 2092 Logo1_.exe 94 PID 3184 wrote to memory of 4572 3184 cmd.exe 96 PID 2504 wrote to memory of 3164 2504 net.exe 97 PID 2092 wrote to memory of 3880 2092 Logo1_.exe 100 PID 3880 wrote to memory of 212 3880 net.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:3100
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E5E.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe"3⤵
- Executes dropped EXE
PID:4572
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:3164
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:212
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4980
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe.Exe
- Size 1.2MB
- SHA256 6f7fd5edc38b77b3e847eeefc9c20a998a78d0a53f6ae857daea222533183481
- MD5 a5a384fc72829609925ab2dd53126915
- SHA1 6c979b8ab58c0d0fe813f601f098b0ae969b2643
- SHA512 62f5c6f8e5c4be80165f3e51da31dbb3e9470a37b2489bad68bdbf8bba514727ea1d4ac8e41f42fac0768d24288b95768128de4f931d71e18eed82b8d1d43c6c
- SSDEEP 12288:F3Sgouvz0ZRHkXVfeeO4LMneqyQsWSjGQCfLBlS7guN1AnQ6i12NI+f:dSgouvz0ZRHkFfenxyQZXS7gZnQh2NIq
- TLSH T12555C40267FD7329F1F37B71EABDB2645E767C61AE39C50E5284025E09B0A909A31733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\RCXC9E2.tmp
- Size 91KB
- SHA256 a567f4fffbd1b33867124e6531d2ee8b2982125a638c75da7b43e2e1c125a776
- MD5 77aa0e1977f476efc8737feb5addcf39
- SHA1 47efb029f65428bff0a5baa6711374424e6ab741
- SHA512 2d690182436ceb17be9ec6590d0dde7f11b9b9d3b68d43c5029d3c8b8b873565490baae3a5a6d930a5d4fd615fe5cdf11ae5e449375c8657ab5c1dc7f2e6e8dc
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6xNT:YCSjGoLpWM6VsBEjxZZdM5
- TLSH T12C935C6AB28DB376D0E299B88E0DF2E5BD397E300F19185FB59E2F0DDA761C1190C191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXCB73.tmp
- Size 103KB
- SHA256 742b2019651362fe67da7a19288776610f4253de8760ea42bd14c35e66d63112
- MD5 824bcac149ab8169e282952735c8fbbd
- SHA1 c83e62d85c90474edb845f5cb7ddb87035ae91be
- SHA512 728af4660e195ac508828918ea3e4b2b8aaefacb74c856289d0572e731115c30bc54b92817a2ffd4ec663d951a729fb328b9928411b172ed59c557f4d6f5e38e
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx78SXzpn9t6M1XkSPsULMHiENQ:gCSjGoLpWM6VsBEjx7ZdddtPlLqdu
- TLSH T132A37C59B28DB376D0E249BC8E0DF2E5BD387E300F1A185FB69E2F0D9A765C1190C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXCA63.tmp
- Size 118KB
- SHA256 8dce519c0690c2fa257e999e00e35081798ddc0f5ee942851cc6e12ebaca008d
- MD5 d4917f64840ab1fd15b57517c950c81f
- SHA1 f13717c532d14a28eedc6674b376169b938737f6
- SHA512 96a28e2bd0980b198600aa7074aab85dbfe7afc6194edd0dcec525dc36a6cea8e190d59b692c71024657030d9a9364cb60f2ae0bd26c7ae878b751df36c0427c
- SSDEEP 1536:Y7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6x4GZjzQwK5WW7VCn6:JCSjGoLpWM6VsBEjxZZdQe5BV0yH
- TLSH T1B9C3AE6AB6CCB377C0E259B84E0DF2E57D697E300E19085FB59A2F0DCA7B5C1590C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\RCXCCA0.tmp
- Size 100KB
- SHA256 9dcc53ffac89bd4a5d65f07e3506a7bf2716e69fdf30765fbc11361ec114a5be
- MD5 0866e5f6f092812c67b82734433075f1
- SHA1 b7ab972a8758c92f9a03843738b041e7c7aee6e2
- SHA512 575cc4f75f6034f3f69d4167256dea51227c9ccbc7df3fae07a63a269e74780a01ac42ad991aad121cb6b627a4fc87a8716b96145d2fe05ef18740bf528d5b5a
- SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxQ8SXzpn9t6eqkSZZZ3JNj:oCSjGoLpWM6VsBEjxQZdJUJJ
- TLSH T186A35B1AB68CB3B6D0F189B89D0DF3E5BD397E300E59185FB2AD3B1E9A77081190C195
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe.Exe
- Size 642KB
- SHA256 92c94b8eb4eb4ab9e957f0a4bed1ce70c818cec070972424d583aecde80b7583
- MD5 d80fb11e0326c292968d686bc70b6feb
- SHA1 992c8e1d4414992b54154654832ba27ab860953d
- SHA512 0aaa960d1c448948a8ffcda0ca4b0b1d6d890762ffe3588a842c9a04a5cc9bed45f0399eb6d2e4922b71d8d55ce9e909a7ace5e3417bb6af1cd85a644606a012
- SSDEEP 6144:mXqoE2fXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ8F:CXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
- TLSH T1E1E4F716F66CB331D0F2C0B9C5DEB68AED713C411B3089CB5286876C6E676E6853A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe.Exe
- Size 377KB
- SHA256 a1017cf33765cb5b444abc5103024777962d1734bb90c1c8cd4f896d492b8013
- MD5 7f404317a1b99f6c5479a0a41c76e46b
- SHA1 7f8f4068e355c195e07b148221cede4be0ce8fe2
- SHA512 2266f650100ac29aa6f8aa763def6e2a58b62b43252b35c6f43c32ff76c14a6861ce2d24f3f5d62341d6221089ff08a544c6d29cd4d905e9384bc67255e86fa6
- SSDEEP 6144:WXqoEuHAHdwS/WYoTOLHIsPPzAdnz0YutYPDvhI:aCd9/WYoaLHF3z0z04PDvhI
- TLSH T1AD848C95B29C3BF4D8E385398D1DB556EEB27C250B20C61F23A8371A5F332911C2DB96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe.Exe
- Size 4.3MB
- SHA256 0e1426a4f5bce399d7098756064f5a06868594ac2739d3146f576c8355a750b8
- MD5 55e242bddc0ace7989b0b21d33e3bf3e
- SHA1 df330fcea3ee81e0ef86aca11702f444bf8c0bdb
- SHA512 e7f67e99cf94df14fd257d6941f00db5a2def5cf7e66d53f64c8358ea3b2dfa2f8fb6e59e82080fb97a84e98ceddb5fd0135db215c6d6e7774e87fef707b122a
- SSDEEP 49152:sQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3TH/:sQvGAdlCEL8c/bRNw5CO
- TLSH T15B263A656BEC91F5E0E7D134897A95B2FB7A7C020D32EB4B0151CA2F2F336904D29729
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE.Exe
- Size 554KB
- SHA256 33d827be6229b9862e7e398ed4892c1b221ddc844a30c67f81848afc840ca787
- MD5 cb47a244fc8d8d496e54a4b8c45a59a1
- SHA1 b98b9616b58c336f8ac793d7ce04a35564d78cb3
- SHA512 5816250f6f2361ff56a052f271475e011ca47e6edd93560b2b6b5c27db3eb9b2e12cf2b00c2ba919b25957c8fae961b1b9642d7e815ef578640cbe4e05e483fd
- SSDEEP 6144:uXqoEWxzyiL7nVDcmdCI6BHAlSpFG/+Ls3ze30xLs+br0YzirzhafYmf7Pvm7Mq7:kDnVDcmd/6JAB/6N30xQ+hpvm7Mgj
- TLSH T1D2C4292032FDB318C8FB1B709C3DB6812E767EA56D81C6AE29543B6D4D723428711B97
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\VideoLAN\VLC\RCXC012.tmp
- Size 92KB
- SHA256 6d9cfcaa4a1276b5dc466eec0221a6dd0cdd6f84e3fc796ced131857299cca4a
- MD5 c33ac701511a4be5f732161c7e2d78e0
- SHA1 35c3c216376c9c3c00f08ed27cb6aed1c0fb5f00
- SHA512 9c80740db9ce9265fcc92fb6f56c00bdba22134822d58081b8bd87b5f0e544fd92b75b33dd595d9fdf3f4b3fea85d0e0cecfef1f70bbecf925cd736ab49a5913
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6fND:YCSjGoLpWM6VsBEjx+Zdyp
- TLSH T19E934B65B28CB376D0EE59BC8E0DF2E5BD297E300E19185B759E2F0DDA7A1C1190C18E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a2E5E.bat
- Size 824B
- SHA256 8e53c0c288ae20e171f7bd15eb71d3f568e5e85dc8fd37a9be7e101f8b41fcc7
- MD5 0754bbd66eee9bf184a47e29cee4cf6f
- SHA1 1b848a9088468988a93d52a9851c1453042d5bea
- SHA512 642be60fba42f091f12965955baa3619018b4c16d7fe81e9fc316788de139c4a5d111058f90d2734d579cf424b40a5410dfd00495776028e52d1b4877290227d
- TLSH T10E019B16DAFFCA4F452630230FD75D9AC811268C6F1C33119F5EC66D21C284D7AE6716
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-05-25_4a1920c7ffc2148ee2d2084187b0ffdd_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
- Size 239KB
- SHA256 fcd3a002ebe8f18615a8fd6bcf561b54276a9e8952a3cc683bbe95843fcc37e5
- MD5 8af4b7f9fcabf7fe2ba30bb74e825574
- SHA1 541c90a14a81121402aa6ad382185668a0bbecf2
- SHA512 7e6576de0712f9011e7cd150c8529a5fd9602373eba6a3b51f32f21a6c4a8a2983583da5d17b4429f258fb14f786d66fc3a4b9e7346906f7589d068a050bc729
- SSDEEP 6144:G26XDpvPoYMT/DTqjgMSKfLJ7olgtlhns:uXDBAZzP/w24lhns
- TLSH T1FE346C3AB79009F9EC67C27DC9F2C522E67278650360EADB039486651F237C46E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 93KB
- SHA256 2955441b19a9d66d6b2610227491546e32b02883f09dabc0cb6a657ac1494225
- MD5 3a2f6ed937eb8a3fc1edd9aba837cfaf
- SHA1 9227341b0bbec0d248e1574dbe75bfdd2efb5de8
- SHA512 df1a43b757e1f3cc85c532d4cc35a0275ef852225e77e7702e1b3245f576152a7acd50987f306da0b2a337f867f737332c3efb7c3f71d7d6fce9dbd9cce6f16a
- SSDEEP 1536:J7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxG8SXzpn9t6aNd:QCSjGoLpWM6VsBEjxGZdrr
- TLSH T1EF935B6AB28DB376D0E249B88E0DF2E5BD797E300F19185FB59E2F0DDA761C1190C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH