Analysis
- max time kernel
150s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 05:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe
- Size 667KB
- Sample260803-fm6f5scd32
- SHA256 487f8c94754f60fc823c9879560ecabab9f8062e5d4f3f55f6b060dfdc7926f1
- MD5 87a47740010230e5a82007d85f6e5106
- SHA1 cdaca800fb3770ebbe61ba30c13254786d9a76a7
- SHA512 7e9e9006342f2ace269404d1a1768387e8b9a5658ae0bdd721b7f379f84eaeaf8e30845da130cebc7bac0769cc676f6cea9e5f47df476c6d39d75b2153f66242
- SSDEEP 12288:rlSiZbbSoCU5qJSr1eWPUntBB0sP0MugCAjHUzTsh:hSi1SoCU5qJSr1eWPSCsP0MugC6eT
- TLSH T1AAE47C56769C33F5D1FBD239CA4E7A51ED727C010B20A64F13A953AA1F233615B2E322
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Renames multiple (258) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe - Executes dropped EXE 3 IoCs
pid Process 2440 Logo1_.exe 4808 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe 1648 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\D: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\RCXB048.tmp Logo1_.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\RCXAFF8.tmp Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\RCXA068.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe.Exe Logo1_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\RCXACA1.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\RCXA2E7.tmp Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\RCXA089.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXAECD.tmp Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe Logo1_.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\RCXA078.tmp Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\uninstall\rundl132.exe 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe File created C:\Windows\Logo1_.exe 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe File created C:\Windows\RichDll.dll Logo1_.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4184 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4676 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe 4676 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe 4676 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe 4676 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe 4676 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe 4676 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe 4676 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe 4676 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe 4676 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe 4676 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe 4676 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe 4676 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe 4676 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe 4676 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe 4676 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe 4676 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe 4676 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe 4676 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe 4676 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe 4676 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe 4676 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe 4676 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe 4676 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe 4676 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe 4676 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe 4676 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe 2440 Logo1_.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4676 wrote to memory of 2328 4676 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe 89 PID 2328 wrote to memory of 3304 2328 net.exe 91 PID 4676 wrote to memory of 4184 4676 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe 92 PID 4676 wrote to memory of 2440 4676 2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe 93 PID 2440 wrote to memory of 4544 2440 Logo1_.exe 95 PID 4544 wrote to memory of 4344 4544 net.exe 97 PID 4184 wrote to memory of 4808 4184 cmd.exe 98 PID 2440 wrote to memory of 4720 2440 Logo1_.exe 101 PID 4720 wrote to memory of 4580 4720 net.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:3304
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a10DE.bat2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe"3⤵
- Executes dropped EXE
PID:4808
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4344
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4580
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1648
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCXA8FE.tmp
- Size 156KB
- SHA256 9a7c2aa86894ba443a5bb542e4f2806f09e5877fec2b8005b0055e8816f134b7
- MD5 d78e93fb6833da471bf0194620d48350
- SHA1 c299785e98d909c5f6b9cc4a759612adc32f7156
- SHA512 9a3b6e9e7283e62363feb24af750c41c3669d5dda9b1f2a71e79a11cbfa8f82c7f6d49596977152687c68ad86a15230ba45c8ab9071875e0596ec66583d12f78
- SSDEEP 1536:w7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx58SXzpn9t6RNz:hCSjGoLpWM6VsBEjx5ZdMZ
- TLSH T1C5F3B36EB18FB3F6D3E1597C8D1CF2A5ED28FE20CE19285B75993B0E9A760C31508191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXABFE.tmp
- Size 94KB
- SHA256 d8d93131073755f109a310d912b7cc1bf5987ba277d9906c58a6df1698059270
- MD5 b5ea458299f2908c03a9e9301eeb06ad
- SHA1 9b6a82115e9302fecf1444cb7abc9d0f4b6ba5e0
- SHA512 0494aee7cd955487c5e637f874a4feb839123e60c6a580eff43cad4864a595f16cbbb1fee2080aeda1e1199a0e48298b04c7a47832f6542a23a8e716bbed468d
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6CND:gCSjGoLpWM6VsBEjx+ZdTp
- TLSH T150932A5AB18CB376D0E159BC8E0FF2E5BD297E200E1D589FB59A2F0DEE760C1590C285
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXAECE.tmp
- Size 103KB
- SHA256 742b2019651362fe67da7a19288776610f4253de8760ea42bd14c35e66d63112
- MD5 824bcac149ab8169e282952735c8fbbd
- SHA1 c83e62d85c90474edb845f5cb7ddb87035ae91be
- SHA512 728af4660e195ac508828918ea3e4b2b8aaefacb74c856289d0572e731115c30bc54b92817a2ffd4ec663d951a729fb328b9928411b172ed59c557f4d6f5e38e
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx78SXzpn9t6M1XkSPsULMHiENQ:gCSjGoLpWM6VsBEjx7ZdddtPlLqdu
- TLSH T132A37C59B28DB376D0E249BC8E0DF2E5BD387E300F1A185FB69E2F0D9A765C1190C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXAF2F.tmp
- Size 91KB
- SHA256 a567f4fffbd1b33867124e6531d2ee8b2982125a638c75da7b43e2e1c125a776
- MD5 77aa0e1977f476efc8737feb5addcf39
- SHA1 47efb029f65428bff0a5baa6711374424e6ab741
- SHA512 2d690182436ceb17be9ec6590d0dde7f11b9b9d3b68d43c5029d3c8b8b873565490baae3a5a6d930a5d4fd615fe5cdf11ae5e449375c8657ab5c1dc7f2e6e8dc
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6xNT:YCSjGoLpWM6VsBEjxZZdM5
- TLSH T12C935C6AB28DB376D0E299B88E0DF2E5BD397E300F19185FB59E2F0DDA761C1190C191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXAD50.tmp
- Size 118KB
- SHA256 8dce519c0690c2fa257e999e00e35081798ddc0f5ee942851cc6e12ebaca008d
- MD5 d4917f64840ab1fd15b57517c950c81f
- SHA1 f13717c532d14a28eedc6674b376169b938737f6
- SHA512 96a28e2bd0980b198600aa7074aab85dbfe7afc6194edd0dcec525dc36a6cea8e190d59b692c71024657030d9a9364cb60f2ae0bd26c7ae878b751df36c0427c
- SSDEEP 1536:Y7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6x4GZjzQwK5WW7VCn6:JCSjGoLpWM6VsBEjxZZdQe5BV0yH
- TLSH T1B9C3AE6AB6CCB377C0E259B84E0DF2E57D697E300E19085FB59A2F0DCA7B5C1590C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\RCXB078.tmp
- Size 100KB
- SHA256 9dcc53ffac89bd4a5d65f07e3506a7bf2716e69fdf30765fbc11361ec114a5be
- MD5 0866e5f6f092812c67b82734433075f1
- SHA1 b7ab972a8758c92f9a03843738b041e7c7aee6e2
- SHA512 575cc4f75f6034f3f69d4167256dea51227c9ccbc7df3fae07a63a269e74780a01ac42ad991aad121cb6b627a4fc87a8716b96145d2fe05ef18740bf528d5b5a
- SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxQ8SXzpn9t6eqkSZZZ3JNj:oCSjGoLpWM6VsBEjxQZdJUJJ
- TLSH T186A35B1AB68CB3B6D0F189B89D0DF3E5BD397E300E59185FB2AD3B1E9A77081190C195
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\RCX9E6B.tmp
- Size 91KB
- SHA256 28a5d71a5c29ae53a449f5e26f9ca4c3eb044c56c3d44676fcd407e9d309ab3f
- MD5 eb064b270f73143bbbe5625fd293262c
- SHA1 9571ee26f9a3173ef32c6a4e40bb1659989183e3
- SHA512 56881e2d6947aa6077cd4ab8c5550dba201d228e5117fefea5edc5237ace38d57c326f76611c320b97415b240efc87dfc0121150c2ae7f336a799e5ab7679f7d
- SSDEEP 1536:J7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxG8SXzpn9t6lNb:QCSjGoLpWM6VsBEjxGZdQB
- TLSH T130936C6AB68CB376D0E159B88E0DF2E5BD387E301F19185FB5AE2F0DDA761C1190C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX9FD9.tmp
- Size 92KB
- SHA256 e96d91c42307a0306bcfc6492584e422806e1bc8e8c2f71686233cd08d6485b2
- MD5 db4f7a8956ddbbf01a12c4156e27d215
- SHA1 c7f4b1a41af9e29afa1ddc4a1987f5b1765fa4b6
- SHA512 899a12cb2cb2eb5cf1e90fafaafa15360af89b8c4809d3cc3b72e08f26c2861ae39f78e5e1a6eee728435f2f619b816728d22ea807e8bbb2a314a668b2e12137
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxe8SXzpn9t6kNL:gCSjGoLpWM6VsBEjxeZdJx
- TLSH T1F6935C6AB29CB376D0E159B88E0DF2E5BD397E300E19185BB1AE3F1DDA771C1190C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe.Exe
- Size 545KB
- SHA256 869f9c41102cf9c89ae1dbe3efa10817d993678021ecfc7552e992c245eacf12
- MD5 2ca6a881176554c8d732fa7e2a9d1e81
- SHA1 b94f7e05fa972d766dedf1389eff83d585e526c7
- SHA512 c9633db255d2577093efa51580471bbe1b2fbd7516a633f6f83e1de7c841f58f365f1ed780b9f0661521d64d21ef527a53129b5f694ce430474ef55ca3883941
- SSDEEP 6144:+XqoEwQ78n5Qw0tneDA/sqhleIc0HftDrkYY1hj63hgDonsogCh6NEpAFM:b85bM3npxYfj63hgD1ZiL
- TLSH T1E6C4D50277EDB335F1F31B31AE7DB2615E7ABC619D35860E23841A0D49B0980EA75B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCXB636.tmp
- Size 92KB
- SHA256 37f384e354898f55e655ff5edaaec13a4fe6ed2b962e5962d68a9477d15e95aa
- MD5 89cf80f31cc081cfed9cc8f9142de5fa
- SHA1 c775d8f7028385418a5a2c7c7636dfc3948cdfaf
- SHA512 6cdbadbe00ceae25525d8ea9bc021550aad928ff2ac64f90de8ec79f8e4a82e37bd41a1c3e67adab2436ab6c1dd2ac2c8d1b344a4bea8c5638c60092221ff10f
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6CUND:YCSjGoLpWM6VsBEjx+ZdDUp
- TLSH T18F936C6AF29CB376D0F299B88E0DF2E5BC297E304E19185B759E2F0DDA770C1590C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a10DE.bat
- Size 704B
- SHA256 9ec89dc94760a21d50ae7e3e4015b3a3fb6ab8a2cbb460f132ab67cbef56db1a
- MD5 072f03509b6580f7c87d1c0736bdc017
- SHA1 790c9e9dd4c4e0371cb5c25e0ecfa143bcb1a920
- SHA512 ba42f9834e4e9d9b63dcb4c9a3555090088f4f4d92d741b6ab86532fe1d0fd4e18a3b4387e1dc5a8b178113eec7a9041881b2736010ab1cc710035239475f00d
- TLSH T12101F710419A59FAC842227F09E60DDCC8733EC86E36A251E7199CFF32C05CD77B6222
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-08-03_87a47740010230e5a82007d85f6e5106_elex_icedid_njrat.exe.exe
- Size 574KB
- SHA256 0cf9864ae3a8679ed503f954a453452c93fa44f99ca6f39bbc5860abde7fd35e
- MD5 6503efe0a01c2d50c97be27f3cb10a43
- SHA1 a0cb3708603a18f02352d01ec672020e5bad5073
- SHA512 ebdbc553ba4348676fd3f2ca12e48af53a229b449a36e653dbfca90efb34d21033e41d1157dcca28c2b1e5f91368c0839298992247cf7d2e8feca5feab8ecea4
- SSDEEP 12288:jSiZbbSoCU5qJSr1eWPUntBB0sP0MugCAjHUzTsh:jSi1SoCU5qJSr1eWPSCsP0MugC6eT
- TLSH T12FC48C5A779006F5D17BD239CA524B56EAB278024720A64F03EA43BB1F233215F7F726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 93KB
- SHA256 49b501bf68e5983723357fde28fcb430813ec69331384ceec95f7660c185c826
- MD5 0e6ad40d7f84f98b934013a5df41dd16
- SHA1 c62f91ef20a1efa6c11fe67f77d109d55ae98212
- SHA512 eb2c3b44c4ef4a20300fccf280d757f2145f2a244d60a36193aca94d7a740ef2fb0e508d37e0e43c80285f2366487150e109f716dea0c589c54aae8a4ed9d1c8
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxm8SXzpn9t6LNl9:YCSjGoLpWM6VsBEjxmZdKr9
- TLSH T10F935C6AB28CB376D0E299B88E0DF2E5BD797E300F19185FB59E2F0DDA761C1190C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH