Analysis
- max time kernel
150s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 03:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe
- Size 667KB
- Sample260722-d9jjsavway
- SHA256 31c0bd4d055779014e4046e0db5f247fcb8a66a1a9c4f9077bc20b782bdb5a20
- MD5 80e80866cb05d0a825c41aca695ab44e
- SHA1 326608a0e15ffdb49c8efa52d47dfc4cf8f2a655
- SHA512 5bd74638c730ffa8fd500e612412fbb15cbd417c15410da4c4fecea11cecff486a73d8acea140db5d9e65ac7bcd2b93be3e9c8fb9941923a99f62b5ea9f2eacd
- SSDEEP 12288:gSiZbbSoCU5qJSr1eWPUntBB0sP0MugCAjHUzTsh:gSi1SoCU5qJSr1eWPSCsP0MugC6eT
- TLSH T188E47C56769C33F5D1FBD239CA4E7A51ED727C010B20A64F13A953AA1F233615B2E322
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Renames multiple (258) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe - Executes dropped EXE 3 IoCs
pid Process 5672 Logo1_.exe 2540 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe 3832 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\D: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\RCX1CED.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX1C3D.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\RCX1CDC.tmp Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX1B9D.tmp Logo1_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX1C3C.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE.Exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\RCX29E5.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX1F1F.tmp Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\RCX1FC0.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCX2523.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\RCX2807.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\uninstall\rundl132.exe 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe File created C:\Windows\Logo1_.exe 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe File created C:\Windows\RichDll.dll Logo1_.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3324 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3276 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe 3276 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe 3276 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe 3276 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe 3276 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe 3276 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe 3276 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe 3276 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe 3276 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe 3276 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe 3276 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe 3276 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe 3276 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe 3276 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe 3276 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe 3276 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe 3276 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe 3276 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe 3276 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe 3276 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe 3276 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe 3276 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe 3276 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe 3276 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe 3276 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe 3276 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe 5672 Logo1_.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3276 wrote to memory of 4568 3276 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe 89 PID 4568 wrote to memory of 5100 4568 net.exe 91 PID 3276 wrote to memory of 3324 3276 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe 92 PID 3276 wrote to memory of 5672 3276 2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe 94 PID 5672 wrote to memory of 4700 5672 Logo1_.exe 95 PID 4700 wrote to memory of 4860 4700 net.exe 97 PID 3324 wrote to memory of 2540 3324 cmd.exe 98 PID 5672 wrote to memory of 4112 5672 Logo1_.exe 101 PID 4112 wrote to memory of 1832 4112 net.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:5100
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D42.bat2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe"3⤵
- Executes dropped EXE
PID:2540
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4860
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:1832
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3832
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe.Exe
- Size 1.2MB
- SHA256 9150219f0eace2ca8e21d8da4797a079c4c895fcda819c67038786346c933ec9
- MD5 da32cc9ebcfbc79cfe266a23f9a1a5e9
- SHA1 d50f82f3130ff344b02dcbbe22d5d7677e390d3a
- SHA512 e31508cbd82c33a06998c6e83f2b01f8c8170e5a4e8e3acb9058259f21473046929175414bef0271774a0531900c6445810ef2e6739b5565db5c5291db963a13
- SSDEEP 12288:X3Sgouvz0ZRHkXVfeeO4LMneqyQsWSjGQCfLBlS7guN1AnQ6i12NI+f:nSgouvz0ZRHkFfenxyQZXS7gZnQh2NIq
- TLSH T15155C40267FD7329F1F37B71EABDB2645E767C61AE39C50E5284025E09B0A909A31733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\RCX2849.tmp
- Size 91KB
- SHA256 98add0db7c43b0ba137127b6ddb34ac1b12ebf974253924384b6d33ed556634c
- MD5 dc1ce8a8316720190aa0fb637a928347
- SHA1 5ed751b59815bfe8e33dc4141e8a4a77599c030e
- SHA512 70805d4c9326af7043d408677b6adeab63db4e376ae57dc7b0a9a22c7972909c2c9822c96baeb07e41bedff9d0aad78df1a7e0aadc48c83e5d73ee0532989a61
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6/NT:YCSjGoLpWM6VsBEjxZZdy5
- TLSH T1F9935C5AB28DB376D0F299B88E0DF2E5BD397E301E19185FB59E2F0DDA760C1190C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCX2A96.tmp
- Size 103KB
- SHA256 d2ce3e90885919f606f63d95271c3251720b3b0c9ca8a00e766f840fe23e4338
- MD5 15e600768a9fba3a22680dac1b5175d5
- SHA1 52fa7a4c5ed8e5c61182b30e714ee1559cd30f21
- SHA512 53ff4187e57c895191e2f2ad6d7bbba0604feeb44e01b25dd0e7a669fa498c0f3a17d0c981425e92e02d72bc0a6caeb508afce89ef3a44bc52ee35c5a55dcb32
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx78SXzpn9t6M1XkSPsULMHiaNQ:gCSjGoLpWM6VsBEjx7ZdddtPlLqju
- TLSH T1B4A36B59B68DB372D0E289BC8E0DF2E5BD387E300F1A185FB69E1F0D9A765C1190C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX2906.tmp
- Size 118KB
- SHA256 44286cb468b055d4eee9c011b68e9505dde1f87baebb90d9d005e50238868538
- MD5 d1bffd92a5cfd05e786a18ff42b399a1
- SHA1 678cd6d85522988dab11c63a47b10b72fed2e59f
- SHA512 9022d9001badc5c376bc766264aa6c838d9c4429191817937beccaa8a0e9002291663f5c71c93e31cfd0bf4bfa0332adb5cd4be01841cd53e333199caa46ea37
- SSDEEP 1536:Y7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6x4GZjzQwK5WW7VCnE:JCSjGoLpWM6VsBEjxZZdQe5BV0IH
- TLSH T1EFC3AE59B68CF377C0E299B84E0DF2E5BD697E300E19085FB59A2F0DCA7B5C1590C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\RCX2C01.tmp
- Size 100KB
- SHA256 b58042eb545761dea7c1aeacd827b52ea63ea54d8e8aa91893435c0a26a828ab
- MD5 ce767b17879b7df460f690d75e99e052
- SHA1 627b0a9378a5f4fc39d6743301613e91a25be00a
- SHA512 a28b1d9ffc6509620e93641ad76d89cd2ccd111be996d650d42a1a76607717950d3adf88b5f88d692b101f1693425e444eaf2640f7e35eb47d56fa198f6a590e
- SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxQ8SXzpn9t6eqkSZZZ3nNj:oCSjGoLpWM6VsBEjxQZdJUnJ
- TLSH T1E3A35C5AB68CB3B2D0F189B89D0DF3E5BD397E300E59185FB2AD3B1D9A77081190C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe.Exe
- Size 783KB
- SHA256 498d71fc464217c2930b3b3627c4bbd1ab63cc632982834dc57c31ff9270f0c2
- MD5 d819804c1e1e085dbbac872ff17687bf
- SHA1 cb683774bff63b64fa68c8d57a168641612d6dd4
- SHA512 96cdeb1c06fd854a95461df58cb0fcdcf1ffe4fecd6eee2c9dbddcc95a146350c3de13aa464a12b16b5815c4be96d73385dab5e37883be5e3150cd3eba754c0e
- SSDEEP 12288:SVJjBq33vb5O8M+l1D0hwsEBoW/lx4Zf0Im98:SVbqPb88hv/l+7
- TLSH T14A05F765F56CB331D0F2C0B9C5DEB69AEE323C414B318ACB1246972C2E676D68636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe.Exe
- Size 4.3MB
- SHA256 d779d5609d3377d1aa5b2b054365421743f25501a2303385395c06d607c96467
- MD5 c5c6addba5765f1b66ef80a6fc671891
- SHA1 9717ad9f5969729ed30b020b5d1d1cc9e4ec06d0
- SHA512 5317fbc6b8b48e82f20adf2b6e4aaf61cf114161e83bc9a4c3b2880aebd847ed82a590af60cd32b411257fc95fc13e24fa1f13a0a23b635683ee3b78cdaa8311
- SSDEEP 49152:eQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3TH/:eQvGAdlCEL8c/bRNw5CO
- TLSH T189263A656BEC91F5E0E7D134897A95B2FB7A7C020D32EB4B0151CA2F2F336904D29729
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\RCX1F3F.tmp
- Size 91KB
- SHA256 3568434773f17e9232d6736021d3fb73be45a6d566f1b618949150aa59eac2aa
- MD5 c8737d20a3b1481127db89066598a373
- SHA1 501c2272e969ffd0204284b842526b767304b2c8
- SHA512 d34e65bcf6979e0aae5c907938d24f23f40453f2803637bddfa13811b837fd9e5033bb3f3ce4ed6ffad3b95caf2b24b449952c782dad711cdf041b440c49b604
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxm8SXzpn9t6NNL:YCSjGoLpWM6VsBEjxmZdEx
- TLSH T1C7935C59B28CB376D0F259B88D0DF2E5BD297E300E1A185FB5EE2F0DDA7A1C11A0C191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RCX30C4.tmp
- Size 92KB
- SHA256 b0b2652cb0171b5032597e2e3ad772a5deb01407d4ffa19df963890d1f07baaa
- MD5 d1e2c1370b473f743a57cdb75db982e2
- SHA1 8e928b426b1d2c882b91fcfba30e85ecf75d9421
- SHA512 8cbf0e22bfc9a07965994daccce8ed2a42f6f38e8fccc877caea363c88dcb82dd52ced819f21bcbd3cca36a2de5d65721482969c257e0eb989b1a18401383ce4
- SSDEEP 1536:h7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxQ8SXzpn9t6iNr:ICSjGoLpWM6VsBEjxQZdjR
- TLSH T184934C6AB29DB376D0E199B88E0DF2E5BD387E300E19185FB59E2F0DDA770C1590C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCX3142.tmp
- Size 92KB
- SHA256 ec0684a4d07b79448aef1779e5e158a78a1d371dda5ab8cd5260fa5e510292b0
- MD5 8a267ce4c17083deb6e145e4f747c81f
- SHA1 3238cd91d3dcf41f98ce17875006eb23dc3dd7ea
- SHA512 df9daac6023d652d9e7a9287c9cfd1b6c743d00646622dd90d2890e4b23db36d943526b7cbb231ff8adb4b51f0ef2c8b2031447bce5d28588736ae31148a1656
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6CqND:YCSjGoLpWM6VsBEjx+ZdDqp
- TLSH T1CB935B6AF28CB776D0F199B88E0DF2E5BC297E304E29185B759E2F0DDA770C1590C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a8D42.bat
- Size 704B
- SHA256 5cd31826e0c4a6e3183763eeee28ba923f36de8bd1e9ad235a094a9f7bd8cd08
- MD5 90ae2c5a9d88b807a9a995f571c32d43
- SHA1 a2e7e1e93b24c04142fa29cbb5e14daccb45b961
- SHA512 3e59ccabfc638602e7cfe5d61c18497c331b35e70f355f6c0898d3a98666259af79194b4d49e033509c6405e4304402776cadf5ba9ae954834bffd02c398b794
- TLSH T1E901A74286B9C9F9C48122334EF269BDCC7A39E86F157339D729E91631D000D7BE5291
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-07-22_80e80866cb05d0a825c41aca695ab44e_elex_icedid_njrat.exe.exe
- Size 574KB
- SHA256 0cf9864ae3a8679ed503f954a453452c93fa44f99ca6f39bbc5860abde7fd35e
- MD5 6503efe0a01c2d50c97be27f3cb10a43
- SHA1 a0cb3708603a18f02352d01ec672020e5bad5073
- SHA512 ebdbc553ba4348676fd3f2ca12e48af53a229b449a36e653dbfca90efb34d21033e41d1157dcca28c2b1e5f91368c0839298992247cf7d2e8feca5feab8ecea4
- SSDEEP 12288:jSiZbbSoCU5qJSr1eWPUntBB0sP0MugCAjHUzTsh:jSi1SoCU5qJSr1eWPSCsP0MugC6eT
- TLSH T12FC48C5A779006F5D17BD239CA524B56EAB278024720A64F03EA43BB1F233215F7F726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 93KB
- SHA256 4008e2fc16af6003a6fb4e03d7fb68cca1c6089a24d24c7eeb9fa4bcd5a28706
- MD5 46ac2102ce799cc17353b1e59c7baa06
- SHA1 3d2e2945b0288ab008db6e9fcdfbafcd1b5bd35a
- SHA512 4990afa32a99119b1ae9783e5357232ac27916d00d448799a85fba253a804a61f1ace2f894df1b466c8e5ad62de29465153f0957b0b478e8e4a2e5bb41abbe74
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxe8SXzpn9t65N8u:gCSjGoLpWM6VsBEjxeZdMqu
- TLSH T168934B5AB28CB377D0E659B88E0DF2E5BD697E300F19186BB1AE2F0DDA770C1190C195
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH