Analysis
- max time kernel
149s - max time network
147s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
31/05/2026, 03:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
- Size 5.9MB
- Sample260531-eb95hsbt3l
- SHA256 e5428a3161e639f081925535b43f10706fb0ebcf69562d060e17fe3f8c4136e5
- MD5 9a69a4bef47f5f59d4cafc2efe203ff8
- SHA1 b26d58874825feac03ea533cab651b25b6b56cfa
- SHA512 44ea7b2cf9b96b77f701d67d83d21052bf5c71226101afa71d3eb0a0b83c5e461cca38dd0ffd99fcecfdb0f346098327b68e4b58a89e8ba2d92ace3e97cf18ef
- SSDEEP 49152:UFuod7l339/XCRSDvwC10cVTq27kgYggldIeolfjVty6eWSZkUjfe2q17GOQWdkm:dEwC1/W2wgY/ldO4g175in0F
- TLSH T190566C43F3A911A8E09ED974CF3D66229F757C4A47B192EF219436E11A72DC43B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (255) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Executes dropped EXE 2 IoCs
pid Process 4196 Logo1_.exe 4832 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe.Exe Logo1_.exe File created C:\Program Files\7-Zip\Uninstall.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCXBAFE.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\RCXCA88.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\RCXCA99.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\RCXC7BE.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe.Exe Logo1_.exe File created C:\Program Files\7-Zip\7z.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCXBA1D.tmp Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\wt.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe.Exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\RCXBCF3.tmp Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE Logo1_.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\RCXCA31.tmp Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\uninstall\rundl132.exe 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Logo1_.exe 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe File created C:\Windows\RichDll.dll Logo1_.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4168 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4168 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4168 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4168 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4168 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4168 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4168 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4168 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4168 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4168 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4168 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4168 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4168 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4168 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4168 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4168 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4168 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4168 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4168 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4168 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4168 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4168 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4168 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4168 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4168 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4168 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe 4196 Logo1_.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4168 wrote to memory of 3240 4168 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 80 PID 3240 wrote to memory of 1060 3240 net.exe 82 PID 4168 wrote to memory of 2244 4168 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 83 PID 4168 wrote to memory of 4196 4168 2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 84 PID 4196 wrote to memory of 2076 4196 Logo1_.exe 86 PID 2076 wrote to memory of 3380 2076 net.exe 88 PID 4196 wrote to memory of 3096 4196 Logo1_.exe 91 PID 3096 wrote to memory of 2368 3096 net.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:1060
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B9F.bat2⤵
- System Location Discovery: System Language Discovery
PID:2244
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:3380
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:2368
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4832
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXC71D.tmp
- Size 94KB
- SHA256 6b8d1137ee89aba4f58f07f9eb06bb6c595095fbe2800f5a979051138a92fa40
- MD5 ded5885971267db724561424b2c63b90
- SHA1 ea5f7b9a6a828887eaa96eeea70bb2861258a8ae
- SHA512 92a720df43c43abb2bcfc6da99e49a4c6f887e339687bc054bfe8517aa03ffc9037d3791c30753f1346b0657540867d7b45e92522ca6670b2b61747d9210e0c2
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6iND:gCSjGoLpWM6VsBEjx+Zd/p
- TLSH T12C932A5AB18CB376D0E159BC8E0FF2E5BD297E200E1D599FB59A2F0DEE760C1190C285
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXC9CD.tmp
- Size 103KB
- SHA256 a1ca0d3092947d7785f8f1d8b3c47ef55d5f18394b2d8043909b18d37506b48b
- MD5 b3d44559c697bfd914fe33f132e137f2
- SHA1 787e756de1259b1bbf19dfa268903c08e9da7889
- SHA512 00c0cf7bb9b7f3ffc9d9178409f0530dc93c133b96175cea71f3ce2d174de36f0fd55126307e69f0b74260f93bfe6377376a5ced066c54a2cade7847c45c0418
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx78SXzpn9t6M1XkSPsULMHi4NQ:gCSjGoLpWM6VsBEjx7ZdddtPlLqtu
- TLSH T1C7A37C1AB68DB372D0E149BC8E0DF2E5BD397E300F1A186FB69E1F0D9A765C1190C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXCA0F.tmp
- Size 91KB
- SHA256 0456d4808790ae440af497ab355e2944535902a491bf5d48879c66050dbc8866
- MD5 00098038e7a2ff7662a456754e727121
- SHA1 8e901ce1808f3f2354d179fabad3de424f8671a6
- SHA512 854933c918f647726ac0736848273b69369540ada8936d8b4a16b5fc5c80c3e001e6bd8ff26ea74ffadeafdf768a3f13c4d3586b3dcfbb024da3d601aaf92e2f
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t65NT:YCSjGoLpWM6VsBEjxZZdA5
- TLSH T145936C6AB28DB376D0F259B88E0DF2E5BD397E300E19186FB59E1F0DDA761C1190C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXC8BD.tmp
- Size 118KB
- SHA256 debd59bfd83f4e3bf6d46ab765ddcecbd5b012bbdaf7a70992e30bb61788108d
- MD5 e40da309aa59e29c2446cc9026a4056b
- SHA1 2b7e15b6e7d67906b6717f253a7b415ad12c0bde
- SHA512 2efc95a730cd0d91e9f772536f72dca6701934342dfbc144b58644a69052e7cbe97beb2b13909eb6e1b5914602046682b32d00d1160899e275c88cd667a93178
- SSDEEP 1536:Y7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6x4GZjzQwK5WW7VCna:JCSjGoLpWM6VsBEjxZZdQe5BV0SH
- TLSH T110C3AE6AB68CB377D0E259B88E0DF2E57D797E300E19085FB59A2F0DCA7B5C1190C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\RCXCAEA.tmp
- Size 100KB
- SHA256 bdceb9e837e1a85499fabe3f1922e940c0d3640fddc41405bfc15fefa6803779
- MD5 63c8f8999626524f70789abbac9d29b2
- SHA1 f78711dd3fdbaa7db5cd537dcc0253cf3f408429
- SHA512 2cd3109420656678a32d56e125a7b67230f9aa76fb83bde707a5d5393fe8ad42eb08a68da9016ff4e71e0a4e07b4e7f48955cc259d5ef4fe3c87102bee9e5882
- SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxQ8SXzpn9t6eqkSZZZ3xNj:oCSjGoLpWM6VsBEjxQZdJUxJ
- TLSH T1FDA35C1AB69CB3B6D0F149B89D0DF3E5BD397E300E59185FB2AD3B0E9A77081190C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe.Exe
- Size 642KB
- SHA256 4a0b9fdba6ab076c0ba2fe55c457573f9ef28c7a7d2bf0de6798800cdc12c859
- MD5 13f87b93437bba9b4be20da863b8311d
- SHA1 83794c7a4a9585a6648e6f8e81940bc77bee2276
- SHA512 d186507ee667dfe1426bde304274bf342fa18fac381fd75d1034d37616e03144cf95fee4230dd4d53179fd4db719bedc005ff5927186adb273ba7b7dc0f575cf
- SSDEEP 6144:mXqoE2NXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ8F:EXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
- TLSH T14FE4F716F66CB331D0F2C0B9C5DEB68AED713C411B3089CB5286876C6E676E6853A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCXBA1D.tmp
- Size 92KB
- SHA256 95b58b1bb4e346097c05224d0558436766b1432a47e4da2a15883a26fa6cc060
- MD5 4279e26f2bb9956446ad3746551beaf0
- SHA1 321fd068b366eebb1f3d03aca5ca122bf16d300a
- SHA512 d4c1b3bd4f8dcc8d27537cd936b3a14d7af9797465fcec3bd034ae953768438a8bee74e17e6decf54ac3eeef86d6529a7f2c85a3465e54c6a72260a5d8ad56d3
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxe8SXzpn9t6YNL:gCSjGoLpWM6VsBEjxeZdxx
- TLSH T190935C5AB29CB376D0E55DB88E0DF2E5BC397E300E19186BB1AE3F0DDA761C1190C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\RCXBC9F.tmp
- Size 156KB
- SHA256 96410eb53e01340ba888b07f9665d3c6e39c4765cc76cfe2f85827377e73cca0
- MD5 e802dd97279fa710c1e41f428d88d4d9
- SHA1 97999821682af08a53fe8b21e796d2412de310de
- SHA512 ea189fafee46cc3d8cd64357218d270d1a8e4f5c16462ce6b4ec687967ba0fa4d78f54c516a73b442f23f01e48f28f6b31c4055c8e21cdccaca29757af98534e
- SSDEEP 1536:w7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx58SXzpn9t6PneNz:hCSjGoLpWM6VsBEjx5ZdseZ
- TLSH T173F3D576725CB776E0E599B84E0DF1E0AC6D7E201E2BCC6A715A3F0DBB761C11A0818D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\RCXBCD1.tmp
- Size 91KB
- SHA256 1ab4367223cc23c360dc46a5cd9ea1c90b2bd7ef2b385f05be5189321dce4e36
- MD5 fbf7057756425e41b93dc8da8b910982
- SHA1 b3fbd8bab1ae4c65791e360c294c80057284e94a
- SHA512 abf042a0ab1e704a588c7ee4f8166c183af3766beccff6686278364c660ada65c716e15f87a1e228e69ce65b188b5013a73a863de0506c46fb2da33f57748c20
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxm8SXzpn9t6TNL:YCSjGoLpWM6VsBEjxmZdux
- TLSH T1C1935C5AB29CB376D0F259B88E0DF2E5BD297E300F1A185BB5DE2F0DDA761C11A0C191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCXCF51.tmp
- Size 92KB
- SHA256 8c78d28fb87eccd31fba9436f8035db18a25ee08ad3c71cc1312117356efe10f
- MD5 9e622957535866bba4b645066375d251
- SHA1 85e0b9ce3ec7536d4cff5b7be68f7de4a9a667e5
- SHA512 a78ab95a786c258497515a605fa302923ca187f3faf93a3334cede2ab616a4291c64f1ffd0b133c1107e344404eff969411ff3a31c51056475db39510f7dbc9d
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6CIND:YCSjGoLpWM6VsBEjx+ZdDIp
- TLSH T1ED935C2AF29CB376D0F199B88E0DF2E5BC297E304E19186B759E2F0DDA771C1590C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a2B9F.bat
- Size 902B
- SHA256 ed56a06a4213e80c963bc655fcca27ec00b6db77d665b3337a0f80f1700e374b
- MD5 35293879f7594fe6b18ef7b93e493356
- SHA1 9cf6d0bddca4c2f32d3548ee10dfaa0f72fc738e
- SHA512 9a9083100446c34a85dc6275a475f9c4a61ee442d8e13c2a03c49303c257e67c0d537eb99ed2dffa0084d0ba7419e5df912229aae2db10237ceb318acf8e5847
- TLSH T18911A311CAB6FFFA5135A0178665ACDDC481325F7B0933229BBDC10D21D4C8CF999796
- MD5 SHA1 SHA512 TLSH
2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
- Path C:\Users\Admin\AppData\Local\Temp\2026-05-31_9a69a4bef47f5f59d4cafc2efe203ff8_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
- Size 5.8MB
- SHA256 949e4af3e2606039f10f991a4f4bea460988621c68351fe3c0a3df3d38465a3d
- MD5 1970916c568ec349c367db5bbb358c5b
- SHA1 de2ceea1e8969baa4bea56a49f341f36f9fca77c
- SHA512 e0b6de3120d7439235fbe2c8875aa93725f172382a79aa21ca5a5192108e3ddae8e67f2505681594a77940159aefd8e11527bce77338945d675a476fde02ca2b
- SSDEEP 49152:LFuod7l339/XCRSDvwC10cVTq27kgYggldIeolfjVty6eWSZkUjfe2q17GOQWdkm:aEwC1/W2wgY/ldO4g175in0F
- TLSH T109566C43F3A500A8E05ED9B4CF3956229B757C8B47B192EF26D436E11A72DC47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 93KB
- SHA256 1889666e905b6304b7f75c66d5816d0fe6b3db6ebc315c4be26b197bd303ce31
- MD5 d49b5dbeab2ff11d6a613ba1e3db0a7f
- SHA1 f911cc42acbfd0b40c63c65926ab79f3998b2f6c
- SHA512 fcffff917c1b753811519c0b0c96acba6c4bd7d0433b5eb629f7e68df794df2ae6d46c94d7f179c8e5b8663cf9d4d8c5d6b42ca5c6975cac3969c1ae17b21f1d
- SSDEEP 1536:J7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxG8SXzpn9t66N:QCSjGoLpWM6VsBEjxGZdT
- TLSH T1D8936C5AB28DB376D0F259B88E0DF2E5BD387E300E1A186FB59E1F0DDA761C1190C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH