Analysis
- max time kernel
150s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
05/05/2026, 07:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
- Size 330KB
- Sample260505-h6s19sat3x
- SHA256 99dcfd49ad0170fc0fc4c098462eb38b53a621935a73219c25bae4af506d2de2
- MD5 9e8e796a87fc5a77a4e3571fc686d722
- SHA1 ba3a7d9f02fc28ba94faceac67f64e08947f22a8
- SHA512 9b4589b725b58c748f9eb7bcab8183dfb7c6b7d920775ceba025f3db380580db1b0ac9bd1b633ec39d18e603f1c4055a0e99a316d8bfafcf28aa8be3173a5a16
- SSDEEP 6144:ZXmRmjzAVQiI+WjFDfoY9+6s6Be/ODsTnJyQlnutM:gScQiHmNJLB9unmM
- TLSH T10C744969A39C3BF5DCE6817CCDAEB112ED317C110B64D6DB23A44A291F232D06A3E751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (257) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe - Executes dropped EXE 3 IoCs
pid Process 4256 Logo1_.exe 1100 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2936 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe Logo1_.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe.Exe Logo1_.exe File created C:\Program Files\7-Zip\Uninstall.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164875\java.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{A32B1890-3A43-4988-9723-087C4F57D342}\MicrosoftEdge_X64_139.0.3405.125.exe Logo1_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe.Exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\RCXE53D.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe.Exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7zG.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE Logo1_.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCXEDEB.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.Exe Logo1_.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\uninstall\rundl132.exe 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Logo1_.exe 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1804 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1804 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1804 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1804 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1804 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1804 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1804 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1804 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1804 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1804 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1804 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1804 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1804 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1804 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1804 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1804 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1804 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1804 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1804 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1804 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1804 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1804 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1804 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1804 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1804 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1804 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe 4256 Logo1_.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1804 wrote to memory of 5020 1804 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 80 PID 5020 wrote to memory of 2700 5020 net.exe 82 PID 1804 wrote to memory of 2260 1804 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 83 PID 1804 wrote to memory of 4256 1804 2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 84 PID 2260 wrote to memory of 1100 2260 cmd.exe 86 PID 4256 wrote to memory of 4480 4256 Logo1_.exe 87 PID 4480 wrote to memory of 3160 4480 net.exe 89 PID 4256 wrote to memory of 4512 4256 Logo1_.exe 92 PID 4512 wrote to memory of 1000 4512 net.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:2700
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a538A.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"3⤵
- Executes dropped EXE
PID:1100
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:3160
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:1000
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2936
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXF010.tmp
- Size 77KB
- SHA256 b4b5fd3f7b6f3976abeb5edd4f4e61196ed151ee40e79c3e441a55324804a771
- MD5 49a2d9691f7a6468683cac569f5f1605
- SHA1 968654c291ac4d48805fdc950b58fea43de2c61c
- SHA512 433676ae27e063ba2c845c9fdc9cb9a399ee008172331fc2aa29db3d307a9c1f02dc706cf2be53ec564eab5b840073d175e7530f026f8d5690b72517dc1075ba
- SSDEEP 1536:a7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjx5:TCSjGoLpWM6bblmjx5
- TLSH T12E73D756B18CB3B6D0E299BC8E0FF2E5BC257E201E1D58AFB59E2F0DDA7A0C1550C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe.Exe
- Size 3.3MB
- SHA256 d5738251f4d0e3ec9029ce91deb214a9956eef58f0a1be2e0cfd218237da54ae
- MD5 b003147edc310231b3e7449f6e6270ce
- SHA1 f572f687eaa5379f8a355eef7a647cf0e4be17e9
- SHA512 a65fcb5ede6d6c67412ef24f74d2f829ee6e7ad7a0b1760018ddcb732ac85732024e6d8ed944e483826d1bcecabb0095fc60e7897bd305b8dfca8c24768b8c83
- SSDEEP 49152:pglZ4ThD+gGTZbqZK95S4pTiX2EUqMzADxulO7Udq+KqOuBk7bVnU7wF62JtY0:Zs6Gwxul1EE4wsH
- TLSH T1C9F53703E29D22D5D099C074CE4EA222EF627C8D47F562EF3290B6D52A77AD47B39710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXF44B.tmp
- Size 74KB
- SHA256 13aed7b0b812c039b414ea8e3c4ec13a33400cdfefff6c1454cb929bb345822d
- MD5 3f50541a3ed46d3ed72b7a6d5a5fb32e
- SHA1 9de06eaf94564c560b334b4ceb87fcaf74c7db74
- SHA512 b302f02c19eb8a67aed66a6d00e467c201123c5083479de9f583dfc8ead4e179c9775dd25c9c81f8c23d44c065861baf9962a266a0782e6de9d3c44c4d042c86
- SSDEEP 1536:m7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxX:3CSjGoLpWM6bblmjxX
- TLSH T13B732B65B28DB372D0F299B89E0DF1E5BC687E301E19186FB69E2F0DDA771C2190C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe.Exe
- Size 4.0MB
- SHA256 0440889a65d9f32774fc7ab04400141dfd914a5dcdb32aac0e068ad4972aba21
- MD5 336ce1e22e1ae2c7ebeac4e495ca60c6
- SHA1 e4d19a4125c64d7317a54f1f4e5264193e8b81c3
- SHA512 9edc48f1879c07b0d9de5bd744413000abf75d28e9075586aef486d74cec840ded4a4006f56be7b11531590ebf4e15f63f3c4aa6eab02896aea8591379919bf5
- SSDEEP 49152:JudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/Baj:bijnUdYd+RaAj
- TLSH T125164903B29D62D4D089C074CE5AA232AF617C8947F161EF3690B7DA2A73AD47B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\RCXF555.tmp
- Size 83KB
- SHA256 980a814c422376242245e8d04a62fd4d6455e2bbf413b85fcd594168d1c80796
- MD5 01da875c496db303ce6a45f6ee58f048
- SHA1 3cfb95b4d471af2cabd5c54a269ce4a6ebdf2dd2
- SHA512 99cde8abee2377abe46e91d32ffe6d71b39a565a468584dcc8fdf8bd752dd1cd84a61de7726de322e89a80b1745299cdbfa61d1e06b36621c953c265949d746e
- SSDEEP 1536:u7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjx5qkSZZZ3v:/CSjGoLpWM6bblmjx7Uv
- TLSH T10D832955B68DB3B2D0F189B89E0CF3E5BD257E301E59186FB69E3F0E9A77082150C189
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe.Exe
- Size 638KB
- SHA256 5a7961018a6d6105438a7b30705d8845be860c8c98c8726b20c6daff546f3694
- MD5 840ec582419a600acc5ef71c723ad58a
- SHA1 4b7fcfdfb6b233f900a681a52ede9f83f2658dbb
- SHA512 90abd0f7d14c5d5e14a113b43342cf82d32175dcd5d65d4dd3c68abab408d4352401f59a07380e32d9ef6f50c3bd0bb13bc0ef65ed91e4ef3554f414a721ad4a
- SSDEEP 12288:g4XZNYVLeyUji0h90ZD0wxpGZIVuKrHs:h0Le5ji0hmxNrM
- TLSH T1A1D4F715F66CB331D0F2C0B9C9DEB68AED713C411B3089CB5286876C6E676E6853A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\RCXE106.tmp
- Size 74KB
- SHA256 aa66fcfbc954203d051d413783d11a6754b7d94cdcd999136feaedf77196c0d9
- MD5 156c9dd8054bc981434e57150c718d2d
- SHA1 89521106a16113aa1469b8576f6b43d96c596322
- SHA512 4f9a076060cc5c3209aead80a83d4c666ca3d6532d63f2053ca6a4180e02ac2b5d67aaf90624cb52eba0b1a9cf26950212386a4456e4ce47a56e98a4efc4535c
- SSDEEP 1536:q7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjx+:DCSjGoLpWM6bblmjx+
- TLSH T1A9732B59B68DB372D0F299B88E0CF1E5BC683E301E19186FB6AE2F0DDA771C1150C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCXE246.tmp
- Size 75KB
- SHA256 61f0ba9bc0184172f82313f06f5778dcb642872371bca71d4c7dcecaacc183f9
- MD5 c0b80b18f779ca73eec8e499ef3b2027
- SHA1 7e23e85d1d4ee8ade8c43e119db70305c95c0956
- SHA512 10da6232e137cdb09e857473d7d576940a2808723506eb208fb44b69f0ca70d9f572a60b77a63f8968cbe10981be200e1bd341d2ace63d6262fd1fe4dfd11c25
- SSDEEP 1536:O7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjx+:fCSjGoLpWM6bblmjx+
- TLSH T124731A55B28DB372C0F699B89E0DF1E5BC257E301E19186BB5AE3F0DDA7B1C2190C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe.Exe
- Size 4.2MB
- SHA256 b876356516e550501d7eb4973fe58af4297b7e9f7c8e10f73017089ace3950fd
- MD5 49feb01f57204c1699d1e7b02c4e4cb8
- SHA1 95b7e31cd3b4a6e38a73334ea194832a3b65e5ec
- SHA512 cf69aaefebd299da293ba9d8c15f149f9d9f93645c83f625da9ec0d885f83447eeca3bffb73ec8f9aee6186ab6ba2e052419ff0e8bb31a769e6bef6770f6e3a0
- SSDEEP 49152:3QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3TH/:3QvGAdlCEL8c/bRNw5CO
- TLSH T125263A656BEC91F5E0E7D134897A95B2FB7A7C020D32EB4B0151CA2F2F336904D29729
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RCXF97D.tmp
- Size 75KB
- SHA256 994d6d1cebbda2d58efff3abc77336ef40b52a14467e75bae819a8ad15762757
- MD5 622c075cf780f8a4c8f799b50dcff575
- SHA1 eb562bc84c04e1118c28b128af85bb2c239c9b2f
- SHA512 694eaea6a3b28bd83cf0dae865b811e7abab2abde9390a717ae5795b78b0b86d8cb0c7bd652d81b882160eac270386f42361d9fbab397f61ecafaf5b79ce2926
- SSDEEP 1536:O7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxe:fCSjGoLpWM6bblmjxe
- TLSH T1DF732A65B28DB776D0F299B88E0DF1E5BC287E301E19186FB69E2F0DDA770C2550C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCXF9CC.tmp
- Size 75KB
- SHA256 f559154c3f178db561ec82a271c9c1c0160ce71afe6afb2234c7d9c9a596e778
- MD5 dc288c5c8a0ee4dec8b8a775e13a20a2
- SHA1 be4d79bd34ce2d8106b40681c61f58fa616d02ef
- SHA512 e12f62c995c3c3e4be9ec7e8632bd5ceedeab01c26319105efcca7745b981129ddc15189c9b11c55a3802087bb26e940c1f49bbaaff10496cb58bfe9430a651c
- SSDEEP 1536:W7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxH+:HCSjGoLpWM6bblmjxH+
- TLSH T1F4732A65F28CB776C0F299B88E0DF2E5BC247E305E29186BB59E2F0DDA7B1C2550C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a538A.bat
- Size 902B
- SHA256 aecd2089f6867499ab82f21b7dd9bc035aac8a62f0e1eb611e6dce23e0e62881
- MD5 2b1a9bdc40b5c178c5bd79238edc0ce4
- SHA1 577b99324c9f214c89e3cd03a0d390a6fba6f7c0
- SHA512 b94b6ea9cb052351e5f24914c9f4ed50bba660466122847afa0179277725ac99bab8b75888c7b637adda8789437b218ed386b36617d669e01b7f0866394c7d49
- TLSH T192110C22C3B6D79E4425E06A0666EDD9CC02224C3B5D3332671EC00F20F5C2CF65275B
- MD5 SHA1 SHA512 TLSH
2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
- Path C:\Users\Admin\AppData\Local\Temp\2026-05-05_9e8e796a87fc5a77a4e3571fc686d722_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
- Size 241KB
- SHA256 66adbdbd251a5b9c37bc1448952e56e99c3b4ab7893aebdac0662ed987f24781
- MD5 3052548c3fba7473d5a4eecf2c59c3ec
- SHA1 eaefaeb0b0b24f7ea2c706a06cbf081aafad7c72
- SHA512 570e9186096568b85fc94194264f874d9dc55249f6ef6c00031eec8924bd8977549cef57d8657b9d84c01fbec9335608f14c9c6677573c11e9d33deb8bb8b545
- SSDEEP 6144:fzAVQiI+WjFDfoY9+6s6Be/ODsTnJyQlnutM:fcQiHmNJLB9unmM
- TLSH T139346B7DB39409F9EC6B813CCDA28516E67278560360E6DF13A486261F733D06E3EB91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 89KB
- SHA256 f8b17fbe57fdb1da07e505ddcf47ed404664ca9ed1a3539b8507c12999564840
- MD5 7c586fea078d90b482ee1c6cd2adeadc
- SHA1 9cb6ebda61399a52ee8846f66eb01d4050567b95
- SHA512 19dc3be88e4a40961665d4b8bb9bf2bf080ae213648b27c3170da94b2cfea13d9c8ae0a35d7ee2b7916db5a7e02920d1c9ba68edd259d33682f9082c086282f0
- SSDEEP 1536:q7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxfWt8Nj:DCSjGoLpWM6bblmjxrNj
- TLSH T1B693286AB28CB3B2D0E295BC8E0EF1E1ED353D201F1558DB72AA1F1D9A775C2153C285
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH