Analysis
- max time kernel
150s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/05/2026, 01:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
- Size 1.1MB
- Sample260511-bnf6esht5t
- SHA256 0b019f641acc974ae14ee7e24e13214cfc34d04f991e11cafaad0aa6402b463d
- MD5 5473ed5f7c1f16af4a865de7b50ce0f1
- SHA1 bb8e4f2d801e44377ef0bfb1c421bac26c8093ce
- SHA512 81e739d425175765db2021421efc288d0b0f8fc667071918c3e60109ff7879633d940beee106a478861871b1c28e739a4d20f853f3cfc1819ccf84ca02274699
- SSDEEP 12288:etZ41TtTuRWny8d+roTfREZW9Ax3K8CbEcieT6O48OwgIk55bCu/8huoMTJ/8roP:/tTuRWFsronbEqa6+GG8yKrO4cv
- TLSH T123357C1BA69C73F8D0EAC1748A5D7132ED72BC520B20AADF0690B3191E77AE45F39714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (257) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe - Executes dropped EXE 3 IoCs
pid Process 4688 Logo1_.exe 4892 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4968 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe.Exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe.Exe Logo1_.exe File created C:\Program Files\Mozilla Firefox\updater.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE.Exe Logo1_.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe.Exe Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\RCXCA9A.tmp Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCXDCF3.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\setup_wm.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\RCXC85F.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\uninstall\rundl132.exe 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Logo1_.exe 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe File created C:\Windows\RichDll.dll Logo1_.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2268 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2268 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2268 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2268 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2268 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2268 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2268 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2268 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2268 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2268 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2268 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2268 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2268 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2268 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2268 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2268 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2268 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2268 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2268 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2268 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2268 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2268 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2268 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2268 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2268 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2268 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe 4688 Logo1_.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2268 wrote to memory of 724 2268 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 84 PID 724 wrote to memory of 4240 724 net.exe 86 PID 2268 wrote to memory of 2316 2268 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 87 PID 2268 wrote to memory of 4688 2268 2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 88 PID 4688 wrote to memory of 4396 4688 Logo1_.exe 90 PID 4396 wrote to memory of 3784 4396 net.exe 93 PID 4688 wrote to memory of 1188 4688 Logo1_.exe 96 PID 1188 wrote to memory of 3176 1188 net.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:4240
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3AD2.bat2⤵
- System Location Discovery: System Language Discovery
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"3⤵
- Executes dropped EXE
PID:4892
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:3784
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:3176
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4968
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCXD581.tmp
- Size 156KB
- SHA256 958374c932a592df312171e240d1e54711dce44a675649b24880d463a357c3f6
- MD5 f41bd6e8722c87eb794cd3dc561a68fe
- SHA1 9fbf7b5ed95bb9a97161ed192b44af4535b09257
- SHA512 3740dfd8d287e49c5ffdce211c70c794516874ed513a91fdf3bd67322495688b9407bcba650a0f40cdc2f735e86fe423639966fae0ac26edd55110b59fb92fb4
- SSDEEP 1536:w7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx58SXzpn9t6gNz:hCSjGoLpWM6VsBEjx5ZdtZ
- TLSH T1E6F3B36EB18FB3F6D3E1597C8D1CF295ED29FE20CE19285B75993B0E9A760C30508291
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXD7E5.tmp
- Size 94KB
- SHA256 c860cf44f4174acba820391f674c414aaaabe89c820f5d170e9ff23eff0c1b41
- MD5 ad9159d3111af275bc81cf57e3e422ed
- SHA1 3f08b8a6d92bd0c6ab6c26c803b51bbd8d44a7f7
- SHA512 d0001ffcbf50c0e90144f8baa8b0544d456191c0ebe3af71b8b96f2e272a7bd4390aeeff79fee08f55b0d707aee9e564bb3f4f7c2ee728912bb6014a59149b06
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6PND:gCSjGoLpWM6VsBEjx+ZdOp
- TLSH T150932A5AB29DB3B2D0F259BC8D0FF2E5BD297E200E1D199B75992F0DEE760C1190C285
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXDC1D.tmp
- Size 103KB
- SHA256 832e42e461c8bd30529330656de5f958036e57f7501a8c21ffcbf09f77e7f299
- MD5 3356964c9bca04977612b113bab59476
- SHA1 127bbcf2b4cd43b15342e005fb4738763eccf5fb
- SHA512 1e99cc0d2c9d3e51d0e191952aec39d1abc8754b88a2cc4b9437592b23e730894c43700aa0cb31e2c5c1072ae9b981e4f222ce40fb7997a178ce07c7a92e8c4c
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx78SXzpn9t6M1XkSPsULMHiVNQ:gCSjGoLpWM6VsBEjx7ZdddtPlLq8u
- TLSH T157A37C6AB28DB372D0F299BC9E0DF2E57D397E300F1A185BB59E1F0D9A764C1190C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXDC7E.tmp
- Size 91KB
- SHA256 3e0ffb71eb76b83bbb0714228cc0c2ae6e26bd1f6f4b3ff8f3f9db068bef9ebb
- MD5 3abdb5ef56277c52f798718b29c2137e
- SHA1 bcd52b364a4338fbe963703d97a53de1b6071813
- SHA512 f312bf013dc72aafd338231d86a0f00e1b74c4fe95458aebb8e98ff3d5b5f5ec25a9b406dcca740533cca51e4781a2660a704dae9fbe7023c38876378422393d
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6ANT:YCSjGoLpWM6VsBEjxZZdt5
- TLSH T120935C6AB29DB372D0F299B89E0DF2E5BD397E300E19185FB59E1F0DDA760C1190C191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe.Exe
- Size 4.0MB
- SHA256 68ce8bd52b1abcc54c8d193e78c1034202158cc367719e88455026ea347b1811
- MD5 c5afad0a26666f6c910b981ec7f04b2b
- SHA1 72bb8d2ae11c89a09bec28b6ac2eef3c7dbf13fe
- SHA512 00cd76e9e690bd37429dc032e76b50186fc0cf2c64fdff00ac481f99efb6b762d06e22cca9a74fb39c34bb580498a70e5b58961b03a9e49c9d37a0aa6bec1e2a
- SSDEEP 49152:BudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/Baj:TijnUdYd+RaAj
- TLSH T185164903B29D62D4D089C074CE5AA232AF617C8947F161EF3690B7DA2A73AD47B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\RCXDDC6.tmp
- Size 100KB
- SHA256 2a67dc73e5308a2da8ae657a5cd89655853871ec5b520d557564dbf723c671f6
- MD5 e8d72aa183d67ef8860f4eee9cad3c68
- SHA1 5b9d6a07e1be3ba746bf2a2da3132659fac09912
- SHA512 b38bdfffcc835ddeef85935936aab3d4df482459fa9efeb5e67ed76e886ca15e15e39f45d6a1cb720f74861d1658063cc2930c9ffcdd54537c2d786d3a911d9f
- SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxQ8SXzpn9t6eqkSZZZ3INj:oCSjGoLpWM6VsBEjxQZdJUIJ
- TLSH T10BA35B5AB69DB3B2D0F189B89D0DF3E5BD397E300E59185BB2AD3B0D9A770C1190C285
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe.Exe
- Size 642KB
- SHA256 7a4ecb42907684bf69ebf0e408b60a91efc6c537a2a2d13d38782777208a2453
- MD5 cbe0c4277a36fb8139e54818dca3b182
- SHA1 4fdb5e5dfc66569372f8eed64f815d8eb92a837c
- SHA512 71a189b307a28c6009577b4f2a4022fb27a84879feb125103aee343a694634013132a6c18a661d50b19faaec78bc689d6640f611080bd7addf5ca989199cbff0
- SSDEEP 12288:erXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:i0Le5ji0hmxNrM
- TLSH T16CE4F716F66CB331D0F2C0B9C5DEB68AED313C411B3089CB5286976C6E676E6853A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\RCXC85E.tmp
- Size 91KB
- SHA256 0ede660066374095b0f2d2a795fa5c5b605022294ee539f3eefe0be72db486f1
- MD5 85870b888bd9c46308e7a69d0d9e29e5
- SHA1 212395284b7c3382c6f01b6edd2bb15a3cc9fe79
- SHA512 0157c1d4a28593b6e8ab792a265071f2511611ded152525e459c9d3b31c8feabe9d987763b306ad3440be48b4375a3b4d54c355a461897d4cfe9443930b2b9b5
- SSDEEP 1536:J7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxG8SXzpn9t6UNb:QCSjGoLpWM6VsBEjxGZdBB
- TLSH T152935C5AB68DB372D0F259B89E0DF1E5BD397E301E19185FB5AE2F0DDA760C1090C292
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCXC9CC.tmp
- Size 92KB
- SHA256 b1edaba59258b93a813af43f83e931f374f0b97c80da91e7fb49c9f9e6df3fb2
- MD5 0df8c0184ae6eb744da8e0224e8f4db8
- SHA1 ef35d2e355dd1c11a8124d495d91340a3e1794a3
- SHA512 d800b39077fb26fd7cd662f77f57d34267517ec50b860af673b8edfbaff6f7852d9c2618265c5c68f85bc41530df6ccc86586703774c34fa410814701f404064
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxe8SXzpn9t61NL:gCSjGoLpWM6VsBEjxeZdIx
- TLSH T192935C6AB29DB372D0F259B89E0DF2E5BC297E300E19185B71AE3F1DDA771C1190C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\RCXCD0D.tmp
- Size 91KB
- SHA256 424c8fff083f401cafad763c6dde11acd90ececf16de85ebb55224c5e82da8ad
- MD5 cfd3b13935afe78092b0e062b3e3066c
- SHA1 e95acba12f4088842778807f55a2b44131b831df
- SHA512 7aeebba7a3e07fe7478b8241bca8a5345b44f5faf10746d4682179381a54e6fb4c85147486007ef88879c3d356a3d246de445d1faa8019feb03d1b7c917b36d8
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxm8SXzpn9t6qNL:YCSjGoLpWM6VsBEjxmZdzx
- TLSH T1A7935C5AB29DB376D0F269B89D0DF2E5BD297E300E19185BB1EE2F0DDA7B0C1190C191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe.Exe
- Size 545KB
- SHA256 6ba4190583a87af860bbb00b3a495ae496d4bf24e4ccd9679164206e12f2b92c
- MD5 86d1ecb581531fa5063b9eef2a4aef0d
- SHA1 ac5cd4f474aa4a0827e975aa75ba8f7c31abf27e
- SHA512 86ffdf57d2a5d2bb13fb2e0b609ec1947417fae76b3b9ba63d9dd539bf3984e4cbf12f2603406b146874b86208a652b9c5f657037f985430c12dc4dc431ef08b
- SSDEEP 6144:+XqoEwl78n5Qw0tneDA/sqhleIc0HftDrkYY1hj63hgDonsogCh6NEpAFM:o85bM3npxYfj63hgD1ZiL
- TLSH T145C4D50277EDB335F1F31B31AE7DB2615E7ABC619D35860E23841A0D49B0580EA75B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a3AD2.bat
- Size 902B
- SHA256 1050305b7b18658b4bb13fe7436c5a8751bda9f89e5858cd0f011eb997a6d767
- MD5 7f392531d06b5debed1718018875e6ce
- SHA1 30b6e2a5a4a470d75e89b0b80fbbee9a2226f68b
- SHA512 a0515fa39e93c7e8633ba0dfce31bd177764f418655c9ca0059915026220263630133c3801ca146f6680028a0ac13dceb9957e30743d34288961d9c1bfb5ef5d
- TLSH T1F111C452C1F1F7EE853860564A32AD9D8805276E2F5433116F58C06E50E5C1CBA5BB37
- MD5 SHA1 SHA512 TLSH
2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
- Path C:\Users\Admin\AppData\Local\Temp\2026-05-11_5473ed5f7c1f16af4a865de7b50ce0f1_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
- Size 996KB
- SHA256 0ff1cbb1212fc12240a17455eb525fc152724134f760efd848ef86b8a03e85e0
- MD5 4b9433103a5315a2ffc060a4beee9aa2
- SHA1 2b19ab27a925bcafb595e746effa2e5231241f68
- SHA512 99296c47919f77c21d8663ff2bac1d0ce7ab386b458568a0dc9cadaecababcb049b29ed64a2d8adcd910c0480f270d67fd599f4b38927b434f5065450e5d3c1b
- SSDEEP 12288:BZ41TtTuRWny8d+roTfREZW9Ax3K8CbEcieT6O48OwgIk55bCu/8huoMTJ/8rovX:atTuRWFsronbEqa6+GG8yKrO4cv
- TLSH T19A258D1BB79400E8D42AC175CB554236EA72BC560B30AADF06D0B3692F77AF46F3A714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 93KB
- SHA256 b0ff333d8ed2795da6f694636e31c9e6bf262f98c9f88cfbfe86992372a45c17
- MD5 660935f0140e83269ead1f6a896fdadd
- SHA1 28a88b420baa83d8157c3425e62a695c1a423240
- SHA512 ef9698e08935390a4bd73b5852898709d95bdb106b5b8e70af5e9285cd55feae363e9782d213d922da72315eadbc26c7db55876b86f93f24f1b8ec0ea7d67bc7
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6CFNT:YCSjGoLpWM6VsBEjx+ZdDF9
- TLSH T1C5936D6AF29CB7B6D0F199B88E0DF1E5BC297E304E19185B759E2F0DDA770C1590C281
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH