Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/07/2026, 14:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-27_8a2ad865f0bbe2463f5fb089fdf0c74d_elex_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-27_8a2ad865f0bbe2463f5fb089fdf0c74d_elex_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-07-27_8a2ad865f0bbe2463f5fb089fdf0c74d_elex_icedid_njrat_vidar.exe
- Size 4.2MB
- Sample260727-rtbe5avckd
- SHA256 0b568012c235053dde0abbeebbf2a7b930f147e43051da5d5aa9cc868b66a69e
- MD5 8a2ad865f0bbe2463f5fb089fdf0c74d
- SHA1 14e1aabdc932c83322243cf03068f8530490d56f
- SHA512 25c02443f289af5d52731887a0dac62c94465243d1b49e9c4adb0917efd4f3884607ca262fc9c2c5969b4e3613eb2402d02de2549c6df382caf3a87a3b021514
- SSDEEP 49152:e4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3Tf:e4QvGAdlCEL8c/bRNw5CO
- TLSH T1E2165C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation 2026-07-27_8a2ad865f0bbe2463f5fb089fdf0c74d_elex_icedid_njrat_vidar.exe - Deletes itself 1 IoCs
pid Process 3428 svghost.exe - Executes dropped EXE 2 IoCs
pid Process 3428 svghost.exe 2284 2026-07-27_8a2ad865f0bbe2463f5fb089fdf0c74d_elex_icedid_njrat_vidar.exe - Loads dropped DLL 34 IoCs
pid Process 3428 svghost.exe 3428 svghost.exe 3428 svghost.exe 3428 svghost.exe 3428 svghost.exe 3428 svghost.exe 3428 svghost.exe 3428 svghost.exe 3428 svghost.exe 3428 svghost.exe 3428 svghost.exe 3428 svghost.exe 3428 svghost.exe 3428 svghost.exe 3428 svghost.exe 3428 svghost.exe 3428 svghost.exe 3428 svghost.exe 3428 svghost.exe 3428 svghost.exe 3428 svghost.exe 3428 svghost.exe 3428 svghost.exe 3428 svghost.exe 3428 svghost.exe 3428 svghost.exe 3428 svghost.exe 3428 svghost.exe 3428 svghost.exe 3428 svghost.exe 3428 svghost.exe 3428 svghost.exe 3428 svghost.exe 3428 svghost.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: svghost.exe File opened (read-only) \??\O: svghost.exe File opened (read-only) \??\P: svghost.exe File opened (read-only) \??\V: svghost.exe File opened (read-only) \??\Y: svghost.exe File opened (read-only) \??\Z: svghost.exe File opened (read-only) \??\I: svghost.exe File opened (read-only) \??\K: svghost.exe File opened (read-only) \??\L: svghost.exe File opened (read-only) \??\M: svghost.exe File opened (read-only) \??\W: svghost.exe File opened (read-only) \??\B: svghost.exe File opened (read-only) \??\G: svghost.exe File opened (read-only) \??\J: svghost.exe File opened (read-only) \??\Q: svghost.exe File opened (read-only) \??\R: svghost.exe File opened (read-only) \??\S: svghost.exe File opened (read-only) \??\T: svghost.exe File opened (read-only) \??\U: svghost.exe File opened (read-only) \??\E: svghost.exe File opened (read-only) \??\H: svghost.exe File opened (read-only) \??\N: svghost.exe File opened (read-only) \??\X: svghost.exe - Drops file in Program Files directory 23 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\dotnet.exe svghost.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe svghost.exe File opened for modification C:\Program Files\7-Zip\7z.exe svghost.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe svghost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe svghost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe svghost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe svghost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE svghost.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe svghost.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe svghost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe svghost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe svghost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe svghost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe svghost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe svghost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe svghost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE svghost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe svghost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe svghost.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe svghost.exe File opened for modification C:\Program Files\7-Zip\7zG.exe svghost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe svghost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe svghost.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\svghost.exe 2026-07-27_8a2ad865f0bbe2463f5fb089fdf0c74d_elex_icedid_njrat_vidar.exe File created C:\Windows\svghost.exe 2026-07-27_8a2ad865f0bbe2463f5fb089fdf0c74d_elex_icedid_njrat_vidar.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_8a2ad865f0bbe2463f5fb089fdf0c74d_elex_icedid_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svghost.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2284 2026-07-27_8a2ad865f0bbe2463f5fb089fdf0c74d_elex_icedid_njrat_vidar.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4488 wrote to memory of 3428 4488 2026-07-27_8a2ad865f0bbe2463f5fb089fdf0c74d_elex_icedid_njrat_vidar.exe 84 PID 3428 wrote to memory of 2284 3428 svghost.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_8a2ad865f0bbe2463f5fb089fdf0c74d_elex_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_8a2ad865f0bbe2463f5fb089fdf0c74d_elex_icedid_njrat_vidar.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\svghost.exe"C:\Windows\svghost.exe" "C:\Users\Admin\AppData\Local\Temp\2026-07-27_8a2ad865f0bbe2463f5fb089fdf0c74d_elex_icedid_njrat_vidar.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_8a2ad865f0bbe2463f5fb089fdf0c74d_elex_icedid_njrat_vidar.exeC:\Users\Admin\AppData\Local\Temp\2026-07-27_8a2ad865f0bbe2463f5fb089fdf0c74d_elex_icedid_njrat_vidar.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2284
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 630KB
- SHA256 6fdb73165561baf410937d158e2dfc656264d013a07f915d5751d23aa65897e5
- MD5 9fc16a35ac3399d360eb332db53ba2b1
- SHA1 e0a3ac828a996e1b7c282246377ac381cd7d0788
- SHA512 7d38af997c847a208bfb562513840517f4d8e3a62b058cd4b8a76be24f5f822767ab2c5c712cc8bc39c36c971bbcee0655c5c7074e8fdddb461610e0efbcb942
- SSDEEP 12288:vXZNYVLeIYSWXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:h0LeIPa0Le5ji0hmxNrM
- TLSH T14DD40926F6748335D073C0B9C5D2A68AE971308657308ACB4296C77C7F67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 630KB
- SHA256 1fce0a80e7db5aff4d358bb1d8fa3147d411a8d355c1e00cb72f8d9849552a77
- MD5 96bfac4374eb37499f844a44e7245df3
- SHA1 cc346e75b8322252933af5c116ea9886454400f2
- SHA512 b2d2c05580170659d0ac6938132806de42c6f2841a5401fbfe84ef559396af229c90bf6969aea0a37c46f4c284bbc8c762f1c637112e3302055320bb09083367
- SSDEEP 12288:TYSWXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:TPa0Le5ji0hmxNrM
- TLSH T1B9D40916F6748335D073C0B9C5D2A68AED7130865B308ACB4286D77C7E67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.0MB
- SHA256 9f08e4258a31c49fbbfd64d30ea7ef419eddfc43152bfcfa20d27bbe0ef83cbf
- MD5 ad44cdfb7f412589ce08ab2793c82c3b
- SHA1 621757ba3cf504f134dc2e7cfbf496c9aafb9d84
- SHA512 8465eb43c02a2559cb21d446299ac1cd5e0ef1be33e548614eeb98ce80f909b9ea5bc74ad43df030d4158ae685af17e3784975e282dcbdf6478d1c3415eb5925
- SSDEEP 12288:O8vaa81481soeyezSC6v/ciLKK3kg5aqghpSy1TIPxTmqCLwKzu/:7aJ/ezSC6vUyD/aqgrvWx6q8wyu
- TLSH T12035D825F5788333D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 692KB
- SHA256 0163ec83208b4902a2846de998a915de1b9e72aba33d98d5c8a14a8fbf0f6101
- MD5 4159ff3f09b72e504e25a5f3c7ed3a5b
- SHA1 b79ab2c83803e1d6da1dcd902f41e45d6cd26346
- SHA512 48f54f0ab96be620db392b4c459a49a0fa8fbe95b1c1b7df932de565cf5f77adfaae98ef1e5998f326172b5ae4ffa9896aeac0f7b98568fcde6f7b1480df4e2d
- SSDEEP 12288:9VJjBq33vb5O8M+l1D0hwsEBoW/lx4Zf0Im98:9VbqPb88hv/l+7
- TLSH T152E42A66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 14KB
- SHA256 2ffa1c010889dc2c03dfef2271343ac6032c3966530c383b92d3dfd99a3aadc5
- MD5 5dfdda860ba69df0ae0ab193cf22a4ad
- SHA1 631c3b573b87688a9c5c5f9268fa826b315acb22
- SHA512 ba844e4157d1da80879d89d52155e10f02682f34d92a5a7a57fb1d723cac66b01ff3aace379072780c01720419fd21f1f25279f6587950e9ed4c43688c284a95
- SSDEEP 192:Qplw/Q3AjmqdD5KOEBrXJWRVkdQ2l+827nNHy+NXNUoynP+yJihMNV28d/o:ulgQ3655Kv1XIRV2Qi4Xax+yJ+MNH
- TLSH T1CA62D502CBA454E1FBFB0631B9FA298B5AB6BD104894DE1E47B07F9D0C34680E566357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 95KB
- SHA256 40c1da98270e6be9ca45354744358dcd76d5866176d6f771344191b27c5e2157
- MD5 a6ba27811e1f773b995d9c2a41aa9dd9
- SHA1 8fbc91ccd39e02cadb6323b4817456376e6b265d
- SHA512 e70f70def4c8a520ad50590afee16ca91ff0932277deda23b69dad0d3947123256b5ad7da38df3cb373d49a7173420f5647f856862067f6479a71481be104960
- SSDEEP 1536:uHqaN6qHZukvSQc+HNAn6wPHX589HiF4V1dQh3geDmN6HSKm7Ct/EyYd9IAZ44Rs:jaNVHZukvvVHC6++uq3eqW14k/EyK9fY
- TLSH T1A9A3D007C79020A2F7FB1534B5FE2A97967AAD2089A4DE4E47607BDD0C38354E962373
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 362KB
- SHA256 13b7bad19cce2d408a47bdede942dff27d41a0f35023881490df2e53db19eae6
- MD5 9c562637c3902b75b20c9c5d3f5df15c
- SHA1 88094b7b5ed9a29fdd1570a755165dcc89f25193
- SHA512 ede6fdc3c5baec40942db8b3ab1006a99bd9eafd9e458198dc97424d85c5c0b26bafb18454d7a1a3b67fde28a64dee9a4673faacb39ad194f4eaedbece928d53
- SSDEEP 6144:MknVuOGK9faaOOr/BJ/GKWWBNU6ITLBi0qttclOKgU91Bg:MkVyYSVeBNUbTVO86Uq
- TLSH T1AF843A3BEE28FCD2C27A8DB857918640E77274704F61A3CBD165820E9E136E15E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 128KB
- SHA256 f359da830c95f860b768bad6ddde3536292feed024fbe90ee572114188213c71
- MD5 a28f23bfb548a70c01b4f9e57ec8f1c7
- SHA1 0c62e3d6ac460c1d0ac476fd69d473504b52a746
- SHA512 6959db587fe8f039f9da577a6a70f46ece10608bb0472307fadb6063424505c4aaaf93d7444afde08d52e1b9b722ac6e2a2a7cfce696fa5162fdcefa80d92e2e
- SSDEEP 3072:xrecrS2aozwLseqW14k/EyK9fa4UerecrS2aozwL9:wcr0XdK9fafcr0X9
- TLSH T14FD37C41A7A88217F9BB1F34B5F481522E7DEBC63D31C61E1889B49A2D637C09A1173B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 440KB
- SHA256 7f43ca202d0542aef2bdf3be9a890155c8960eb6d36ffcffa6f884171065d1ef
- MD5 8602a6aa0b6a8d4f3d18e5c02c8934aa
- SHA1 06c6fb6243391a07ed3f4dccbb738a8f7261a8cf
- SHA512 a2acc2ac547a17b34cda1ebb60c31d8146ceb1f23723dd9aac058a8fc6d26745b4bca87e535ffa7586000b391526d713662dd4f0f18ec9faeaeb347b5bbccdb1
- SSDEEP 12288:tAwSfxL+YSyAwSfxL/2Dc3jDLLmt0LDQewsAjRE:eMP3aewsAju
- TLSH T134A47C31FB34D536D6BB0DB21B36CB1B143CAA104B651DC3E3A89D9E19702D22776A1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 23.5MB
- SHA256 6a80e116a27546fa333655f1bc80db6112275162a1485c63921bc6e69dffd046
- MD5 0ed7cae2128bfe521543279a8a2b7a49
- SHA1 6bcfebbd900dc3bfaccb22ee9d9cf903df937999
- SHA512 2cc1fd40431b8e09745d583529112c21927b8e108f3e32c6f8b043e77146802a388916d69b714b72327c01ad40b34e38a42d68b34c1d288d3e49b7e9fd18f581
- SSDEEP 196608:XaEtQeTbvf2zlO12sJTv6Ja1cpVLyXIldPlbuJHi:XaEtQevvqc2W1cpV2XI32i
- TLSH T13F474A91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 23.5MB
- SHA256 e027bb70697f41a9d2b79b01aadbf2372adf5943cdca04b9da8d638333bd586f
- MD5 6e6fa31153d475823522cabf5ee0b071
- SHA1 2165b5af46cf454908629bc351ae0fbf222e67d7
- SHA512 2857769a141acd36b5e3761b2f9d7c3a67864702d122d97aa192bf5d040cd4df76610eb4d3fa305420d1321a022bf6c2ed2793eba549f2a7a45f3334eb17e551
- SSDEEP 196608:X/EtQeTbvf2zlO12sJTv6Ja1cpVLyXIldPlbuJHi:X/EtQevvqc2W1cpV2XI32i
- TLSH T14C474A91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.2MB
- SHA256 9d540970a3479294bb8ae4bdf320ec31499c741248a440117763b5a28a7d6116
- MD5 86687ade3e1f0cccacc5d6aeb218c0a9
- SHA1 9a499e351d38c1cb8698990922afb7ea8d0728ba
- SHA512 ba616fcc4cefe568bcfb5a97636e5b29014a1ebfaec9706e0712c62c646755bd258e0e58a3e3fc84eb80ca2604a0b31a2d8e9c035d9b95f2f983938a9fc8feaa
- SSDEEP 24576:tkPhCbRquA/m2z+L5WqJdrHCYRFiV+XenmE3Pnzc344:eZCbRquA/m2yL5zbfFiV+XenmE3/z
- TLSH T108B55C0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 660KB
- SHA256 9f848ed8003012281a87960788dc84f42d83a2a59dae93f449d2c75a3970fb65
- MD5 73df3ce30f1e57e7d8abe4f2cede8a29
- SHA1 eff50ae244c07ad017ad72487995910fc6eb6348
- SHA512 ed9cfec3d6b9342075c8a46790861fbca54189c1726b33a092d66223608998302266d27ce6e3760a36e5b433cded884a1af9c3c643845d7cbda33ba44e2a8be2
- SSDEEP 6144:kwAI7xA/GtAou6z6bsQ6u6z6bsQIFoiDmzvtA5qbh497S9BcHmD1tYFLqY/W5R0i:ZAZ/GLA6AIFoiwtA5qy97S9uaYFLq3Oq
- TLSH T1EFE41981EBF945D4F5B39AB899B6D571EA76BCA61E30C30F1260C11F1E33A509D24B32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 257KB
- SHA256 8c47f981e1a46a42a268f53ef1b1476555a54bed7077f7b13b1e562c4c9c049e
- MD5 17dc54ade85613728a43f2d733527c5e
- SHA1 6420a7744edb234f8cf989b7f261265baa381e94
- SHA512 632541e69c61398c3eb07ea7b8e7a21a6a765b592939f091bf8319cacbf7f294860e5f80c82e8e7ab29e2a20e67dd4d1e34171b2c5858d30ce9b9bcbe167ee43
- SSDEEP 6144:bmw5HEiIsCCINUGBZjgXwYz4WDZSFxgHiGfE:bmw5HEjsChNVBFgl0WDm+Cp
- TLSH T1E8446C4677A40CF9E96795388697C536FBF2B8022A21DB1F0760C65B5F33351AE2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 177KB
- SHA256 72011d12a6c2135e686be92c31ed9b1c7fe509ac9d92a8d91dfdc7de4d974e92
- MD5 08a994996b67751690ad5030fd08aa5b
- SHA1 35f2ea6e46f12b225664b4511efded6143f355a8
- SHA512 6fd25dd6133b75caadbccd3e7011403cf1ca535e10bc74ca568c2a6dd8072bdfdca9fe7f1323895e95d1d962339b163e4e21e187bf005dca666eb3e2b69d6372
- SSDEEP 3072:TCiyiukvvVHC6++uq3eqW14k/EyK9fa4UXkv57OsX2T3TH0XzZP1Pwe8UXDCsCys:MknVuOGK9fa857L2DTH0Z1Ie8YDfvat
- TLSH T1F204CF5A33E430FAE2A35238D9F55A46E7727463673583CF066042AA1F23BD15E39732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 143KB
- SHA256 7ae20d0542a544b54730a5520a2c7b56dc9235be1a4dc1331763786a16fabed9
- MD5 7d4ea76b6e0659fdd36b34499f964aea
- SHA1 6b7700ed5632d176fc0efbc5611192644bc391d4
- SHA512 41ecf5f0a70828d114056bacd8fde364e2685e3c2f58a785540af7056e3698b027cd3bcce64ab840814ad3d2c5a0eac0a3528cdd88b737eb02671e816eff27cf
- SSDEEP 1536:8vJ9psmemUoXVpuoM+/7BUNs9OFVJqp+uIBQepE4XKF3QcOzm:8vJ9psmeIBcV8pQFq4XKF3QP6
- TLSH T1FBE3C31AD29802E8C06E6179C7568A41B7337C6687E1D3CB53D0F53E1F766909EEAB03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
- Size 56KB
- SHA256 6e25f414dd65440cd0c285990f4eef789a831fff640dadb4afdf79a5dfd95bc2
- MD5 8e4a401d4862a3ab07d4e7e17cbdfc78
- SHA1 8ff6d2c100a2ba9b8159b9f733da011c8e448534
- SHA512 74477239112082429db839be011cbe3d7d8fa66c9b8089dc93b18c1392ae57c935f39446227049e6f7f29e86122d191fa4f2f8d59b87f1f7b6eba3ae4d61a579
- SSDEEP 768:cQ6XULhGj8TzwsoeZwVAsuEIBh8v603eQdWu/idw1R9zZb3:SCVbTGkizguid8zR
- TLSH T15D437D0A67B900E6E46B81B4C5E25A47FE7AF552231196CF0FB8C21A1F637C09F39B15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
- Size 64KB
- SHA256 8213b9d08bab963769a154eec681c0931efa401803526ba0a62d2ae2673c45cc
- MD5 51b15decca5d847a24d61fa8e1b7cebf
- SHA1 b8932da29d6870ee2206bbd0fbd6a076f190897c
- SHA512 4d4f310a0db56b674cc291787908c286feaf358737edc2818ca6a3a43fd3de76b419ae139ece9ed1ed16106ba6d460e97f2ab3d3b15f9d0d5f48ca9bf5fa9592
- SSDEEP 768:Z4k2yi+RgnjRQ/hsUnkrwFFuVSmes3ETTfjiqoumO1R9zZlhE:Z4kIvrUnkrauV8TxouBzzhE
- TLSH T145538E4413E900FAD55F42B8C1A29A06F976F4124790A6EF0BF8C62A1F53BC1DE3E785
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
- Size 141KB
- SHA256 aa0abba38260b3a5349dd4f6f703006528f53d5f557d18627136b98515fd081b
- MD5 9cc2f4fc724e739883e598ac87504a37
- SHA1 8e63faedaabcdd108bc01a195575db965761eb2d
- SHA512 39009ed487446f1ba005d8c946f703ea551cf8e942e53a43a1b5baed945eb91e4a43e7f8b51eb99e763bea7a5fb8e776afceef9a82dfaebfb29ca77d79802cd8
- SSDEEP 3072:Apw5Z/KtbmmD22RQXSfj4k/EyK9fa4UZpw5Z/KtbmmD22RQXSfj:Apw5ySuJQXIK9faTpw5ySuJQX0
- TLSH T143E3AE8523EA00EDE16B01F881E35647FE79F85257A0D6DF0BA482091F637C19E3DB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
- Size 141KB
- SHA256 4771301fbb3df42e1ab6ca6aa8b500bc3ba53eb07c33b722ef7bd5cce4ce0bb3
- MD5 9afd243055f494e334374075afefc3bc
- SHA1 9fc32315fc41ac34b49d054a830e73f04c9ddbfd
- SHA512 7ee639c9a0a0cf8f926873f5e5163cdaa78b47adad8b7a5b45d4413818af46ca0370c20debefa5b765c67032505c2cbc6929cac947d681dc39072036c9547409
- SSDEEP 3072:TCiyiukvvVHC6++uq3eqW14k/EyK9fa4UZpw5Z/KtbmmD22RQXSfj:MknVuOGK9faTpw5ySuJQX0
- TLSH T1B3E3E18623E200DEE16701B4C2A71647F979F8539BA0D6DF0BA5820D1F637D59E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-07-27_8a2ad865f0bbe2463f5fb089fdf0c74d_elex_icedid_njrat_vidar.exe
- Size 4.1MB
- SHA256 78425e626d0830c35ee05307ad6958055493acebbb8a2548ba3de4af6d6378f7
- MD5 2864c8b005a6414e2fa9b06c1e089dcc
- SHA1 3041fbd63ae570b537c38a315050c06aa566362f
- SHA512 bf8fd10e7d517c183f0273b9b997c57c552154e8e65889a4277dea81c3d8104eebf12b4e5b179e95f5f261b5be01d3db13b7c46b8d723d951fbdaa0b15ec70c3
- SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3TH/:ZQvGAdlCEL8c/bRNw5CO
- TLSH T1F2165B656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mmprq
- Size 4KB
- SHA256 ecd0c3c3490c7f05ebc48c9788c6e8ca9ebc41e4e8ca18f18fd0cb53104b8467
- MD5 91926a4d1077fbec549badb734004a13
- SHA1 3914d16516a42140daa33554abd579ca3f377d44
- SHA512 b2921a70f55c705e9a17c330313ba1a133f00069debbf71ce69115dc3ebdbdb6c7cd335b2d56197d9c09727ecfc4ed28bf1ebeaff96dbca4c3e5461721f9e4a6
- SSDEEP 24:GVIIIIIIIIIIIIIIIIIIIIIIIIIjBawBaVwaKETawJvmyWMSWI/fgfm3CKv4p3Il:+lDk/8E
- TLSH T1AE915BF082F578A4F1153477B5D4B23837C4BD4ECC51A4F6E799B98AF4618C221E9A0B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\svghost.exe
- Size 81KB
- SHA256 21fad7bdcb08823c874a8a9cf796c91691ecdf505282cdce79d8638fdf4fd2d1
- MD5 ef3ba6bce00de0d4a3f0080c5cd32f72
- SHA1 f9e806ef7b37d93a216c4d6f54f4186753c6deaa
- SHA512 35cc4cb940161afd55d08b07b7364ae3ebf3b34562921f8626ad7591f7a1e7f5488ec6e7686d91e5f11a5b0c8e87829251bf7b3d1961ea8f55fd8846a95a8e6f
- SSDEEP 1536:oA1V5CfA/L3WiukvSQc+HNAn6wPHX589HiF4V1dQh3geDmN6HSKm7Ct/EyYd9IAx:TCiyiukvvVHC6++uq3eqW14k/EyK9faO
- TLSH T14E83026B2743700AD6A251347B5F27E5917D09B3EFBC934E4F82509D1B8A3296D22F31
- MD5 SHA1 SHA512 SSDEEP TLSH