fa7ae3efe04d7d3d429c0f008d820aa0dd0fd7be01e2f891433c0f51c93d0097

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/11/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-10_f6c2197a2d2e65b9ada05c0105069c46_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 445KB
Sample261110-e7y25ayzft
SHA256 fa7ae3efe04d7d3d429c0f008d820aa0dd0fd7be01e2f891433c0f51c93d0097
MD5 f6c2197a2d2e65b9ada05c0105069c46
SHA1 af0fc96ce874b27f737ef138b58b00c4bdb00317
SHA512 bd75eeb5d2b26fd8dfe325a574105a6720d3ee7449b5527a95cd29ecde54142bebd79cf9643b032bcafa26b5cd506e4f4fe4d3992c7a6638f10e1b038fb003cc
SSDEEP 6144:dVfjmNEbXNXHBV7SoULakIzOrgiLQsUaF8oQ4fJXnIZRob:77+EbXNxV7SoUukIzOzLQsUain4ivob
TLSH
T1F4A42A10165F0CABDC93F53D8A618E4BD5F27C110B66C6AB66A02D5A7FB328369353C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4464	Logo1_.exe
2316	2026-11-10_f6c2197a2d2e65b9ada05c0105069c46_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lt\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\StoreRating\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\de-DE\View3d\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\uk-UA\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Media Player\Skins\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\MEIPreload\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\as_IN\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\AdSelectionAttestationsPreloaded\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Trust Protection Lists\Mu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ar-SA\View3d\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\contrast-white\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	2026-11-10_f6c2197a2d2e65b9ada05c0105069c46_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe
File created	C:\Windows\Logo1_.exe	2026-11-10_f6c2197a2d2e65b9ada05c0105069c46_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4392	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Logo1_.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-10_f6c2197a2d2e65b9ada05c0105069c46_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4464	Logo1_.exe
4464	Logo1_.exe
4464	Logo1_.exe
4464	Logo1_.exe
4464	Logo1_.exe
4464	Logo1_.exe
4464	Logo1_.exe
4464	Logo1_.exe
4464	Logo1_.exe
4464	Logo1_.exe
4464	Logo1_.exe
4464	Logo1_.exe
4464	Logo1_.exe
4464	Logo1_.exe
4464	Logo1_.exe
4464	Logo1_.exe
4464	Logo1_.exe
4464	Logo1_.exe
4464	Logo1_.exe
4464	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 4392	3756	2026-11-10_f6c2197a2d2e65b9ada05c0105069c46_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe	84
PID 3756 wrote to memory of 4464	3756	2026-11-10_f6c2197a2d2e65b9ada05c0105069c46_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe	85
PID 4464 wrote to memory of 3200	4464	Logo1_.exe	86
PID 3200 wrote to memory of 2180	3200	net.exe	89
PID 4392 wrote to memory of 2316	4392	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-11-10_f6c2197a2d2e65b9ada05c0105069c46_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-10_f6c2197a2d2e65b9ada05c0105069c46_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE078.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Users\Admin\AppData\Local\Temp\2026-11-10_f6c2197a2d2e65b9ada05c0105069c46_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-10_f6c2197a2d2e65b9ada05c0105069c46_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe"
    3⤵
    - Executes dropped EXE
    PID:2316
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3200
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdate.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe
Size 236KB
SHA256 088fd7b1d7a2d3ce7a3c4a01783b90e90fde62a57a71c2c192bdb8c6b31b7809
MD5 f7275882976650eac0e1a1cc1ebd5949
SHA1 9f0b15cf0abed7fae3a1d573d48cc82b3c45028a
SHA512 690b87effb8f1ce6bc70ef8a5b97a48ffd521abad661dc3601b407235a955ac58d4dc53c6b42445c5e808d2c6be23cc2adfb1a80d404e83a1280eca129648659
SSDEEP 6144:/VfjmN27gKNkhSR/5kHouyXnZhB+h8WH3:t7+27gKNkhm/JuyXnPB+h8WH3
TLSH
T1E334912233F84969F8F35E306C749F29993EBC35AD35E72E1640219E2D35A51D922B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
Size 660KB
SHA256 1f5273390ccaab3a0cf6930b6413e8e67a5069ac8fbbc8b9b85edb7b679ce1f3
MD5 96b8792e80ab0fe18763663ce9e14422
SHA1 11ca6fef21184a7c2d9c7dc760ac6e932b80589a
SHA512 c192db426ec1147647b4e91028631794cf8677d4c618924ed0afc073b6bad15eb99253639551ea5e541858ed17b98d5c97959320065f0db3533a75b2cb0d8181
SSDEEP 12288:vp7+inMwHskY7gjcjhVIEhqgM7bWvcsi6aVtrIyzU40vy3W/ceKSHMsiFyY6XN9:x7JMysZgjS1hqgSC/izJfojymk4HM5yJ
TLSH
T14FE49E3294614032E6F106B3A958E2347D7CE22867148DAEE3E8ED5D3EA849177F7347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$aE078.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aE078.bat
Size 944B
SHA256 299978c3c77d8e25fc023a764b860e438f820907b65c1a1cd0b8edfa70e1decd
MD5 f7104c0ce14624c648f845d01fdaafe3
SHA1 e58a871a82a9d58ce18d632f9ffc73ebe7e96db6
SHA512 cf86d30c53e89d0ab0f2911761e78de5f1d541fe40829734619627d95c0b9f5c0e994220f1640a548e619822aade7e76a209809ddc2c23a130906c732241bed8
TLSH
T1DC1136C1CAA7CBB50A81A0170DB998FFC511199B2F0937D463DCCF3E10D426C15BA766
MD5 SHA1 SHA512 TLSH

Submit Download

2026-11-10_f6c2197a2d2e65b9ada05c0105069c46_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-11-10_f6c2197a2d2e65b9ada05c0105069c46_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe.exe
Size 418KB
SHA256 9b59fa708eef8e6c1ed698e83efed9ad66e70665694d18591d89ed6ac15d666d
MD5 c511e4f260ee30fc1f5f45b366c1e936
SHA1 ff4ffe173128d9982a8c30ced3eef6f144efa760
SHA512 cc48273fe33c95f23156e3d296bf246fa036a812d5a5dbecf23641d289318f2e4d77c448d505ebcc8514a1a908f3a278520f2f0cf185621e3dbb75bf5c5751b6
SSDEEP 6144:3bXNXHBV7SoULakIzOrgiLQsUaF8oQ4fJXnIZRob:3bXNxV7SoUukIzOzLQsUain4ivob
TLSH
T193941A10165F0CABDC93F53D8A618E4BD5F27C110B26C6AB66A16D1A7FB328369353C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 cdc84c3a4626eeb254f4bc98aa4d982ebac2c838f4e44473cdb9c9caea07bd05
MD5 f32a38d29c3ec4a3189ee059f978bd68
SHA1 44f671b1bbcb11da17466686bef74421497c9424
SHA512 7b4e5e387f9badb79d0acbc54c5fd79fe7babc9351d7a367c9d47663d86053d1283bfa2c5f8808875e57c930542d0677d1b352ef97716761e9326f6c84b8c509
SSDEEP 768:f1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoZw:NfgLdQAQfcfymN
TLSH
T160C2D0B422C439A4DC224E7DEBC55722A33D4638A0ED1075A0B156FB2732AB4604DF6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\_desktop.ini
Size 10B
SHA256 6a98726a74c3faf830f855996a54c2fef58caa784785e9c949352918d0b6d578
MD5 252c40ea19fba6ef24af8605afe33595
SHA1 f297f377a42e449ab69691ae96fdc885a905e988
SHA512 dc913d6296d95ac28bf8427703f8e309fd54a69e58903bf01e882c5685e8655f8034e44deee4dd83a10984dcadbc1a29017952d8600874dc7281696c223631d8
MD5 SHA1 SHA512

Submit Download

memory/3756-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3756-12-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4464-27-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4464-33-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4464-37-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4464-490-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4464-1246-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4464-20-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4464-5035-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4464-9-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4464-5538-0x0000000000400000-0x0000000000434000-memory.dmp

Download