Analysis
- max time kernel
150s - max time network
106s - platform
windows10-2004_x64 - resource
win10v2004-20250619-en - resource tags
arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system - submitted
11/05/2026, 12:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
- Size 4.6MB
- Sample260511-pn9dvsds3r
- SHA256 f0baf9aa6efd89c7f4e3086324387c61968c5603a25b077a93fafdfc2a8f2535
- MD5 02b4a6b4ac415beca0532f3fa3ea9ce9
- SHA1 ceeea778bd40129588fddd3aa4388a4ff1a35a0a
- SHA512 81aceb7e19f3b90a6fa566787db48b549680ffb5428d707d921860979fadbf12704de4677921e1a0e81ce621c31cd1f45657d8e0b369f32fa7a665d3cc43b41f
- SSDEEP 49152:NmSTiX15IJv/pKKCECpExtwDzS9MAvM6+kuXunb7Q97/tKJ+AaLLeNF7pbhCtIbt:ZJ0Py9Mt/XuaK+EhC4t
- TLSH T148365A53A36610B8D46FC8B4CF29552296353C8A43F496FF26D876F51A32AD43B38F21
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\F12\IEChooser.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\appidtel.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\at.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\control.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\sdiagnhost.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\wowreg32.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\convert.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\gpresult.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\instnm.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\net1.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\msra.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\mstsc.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\Register-CimProvider.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sfc.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\userinit.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\regedit.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\hh.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\logagent.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\ntprint.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\at.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\chkntfs.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\doskey.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mavinject.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\ndadmin.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\poqexec.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\provlaunch.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\dplaysvr.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\OpenWith.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\RdpSa.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\RmClient.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\sort.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\tracerpt.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\dfrgui.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\extrac32.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\netbtugc.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\certutil.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\EhStorAuthn.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\wiaacmgr.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.195.61\MicrosoftEdgeUpdateSetup_X86_1.3.195.61.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85250\javaw.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\msedge.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.61\MicrosoftEdgeUpdateOnDemand.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85250\java.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85250\javaws.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\notification_helper.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\msedgewebview2.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.19041.746_none_4b0a936d86cdd479\r\windeploy.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\f\AppVShNotify.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.19041.423_none_15f557c171018574\r\CHXSmartScreen.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.19041.1202_none_c0150a0a443c0ffc\wbadmin.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.19041.264_none_839983ebef167c68\f\CredentialEnrollmentManager.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-runtimebroker_31bf3856ad364e35_10.0.19041.746_none_744cb37f06e446cc\RuntimeBroker.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.1266_none_aa0661cc14f9fe9a\r\vmwp.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\f\SyncAppvPublishingServer.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.19041.84_none_40bd4149a6d52edb\r\AppVClient.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.264_none_3f30ef10158954bf\CustomInstallExec.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.19041.746_none_c1db40c45e8f2d9e\wbengine.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_addinutil_b77a5c561934e089_4.0.15805.0_none_fcd173bc1b434b81\AddInUtil.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.19041.746_none_a8b46aaa6c07ca3d\CredentialUIBroker.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.19041.1288_none_f26bd0dcdf662cc9\AgentService.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_23a707c9a0b5a8e1\LaunchTM.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\UevTemplateConfigItemGenerator.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.19041.1266_none_2262e67641106c48\SpeechRuntime.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.19041.1288_none_f26bd0dcdf662cc9\r\AgentService.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.19041.1_none_44197b0fdd55f562\AccountsControlHost.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.19041.1052_none_0bde546bcaf8e34a\f\ClipUp.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1_none_9613f8b833f2e8f1\ByteCodeGenerator.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.84_none_a689f818199cbaf8\r\Taskmgr.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.19041.1_none_b719750f25d4cc37\AppResolverUX.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.264_none_3f30ef10158954bf\f\CustomInstallExec.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.546_none_4eec2752c7ea16f8\r\backgroundTaskHost.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.19041.1_none_1b0a4d6f748b99f5\fsquirt.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-utilityvm-setupagent_31bf3856ad364e35_10.0.19041.1_none_cf994a1a65720fd5\wcsetupagent.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\r\AppVShNotify.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.19041.1288_none_f26bd0dcdf662cc9\r\AgentService.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\f\Microsoft.Uev.CscUnpinTool.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.19041.746_none_7000e6adf00c3d30\CloudNotifications.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_adobe-flash-for-windows_31bf3856ad364e35_10.0.19041.1_none_e190f18a08ed1a44\FlashUtil_ActiveX.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.19041.1_none_82a36c559596820a\aspnet_regbrowsers.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-tetheringservice_31bf3856ad364e35_10.0.19041.746_none_6ba9668b45cb4938\r\IcsEntitlementHost.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.19041.1_none_80ac2d61ac960bf3\CredentialUIBroker.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-assignedaccess-guard_31bf3856ad364e35_10.0.19041.844_none_10a0a60f1ec9cc10\n\AssignedAccessGuard.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.1266_none_ab5bdb26141e0be5\r\vmms.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..perience-ait-static_31bf3856ad364e35_10.0.19041.1_none_e6d5a48c4da284da\aitstatic.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1266_none_eb6597ac99d11603\SpatialAudioLicenseSrv.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.19041.985_none_c3639a9e3ab1a351\WindowsSandbox.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.264_none_0e32f443c4669fed\hvix64.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\r\SyncAppvPublishingServer.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-analog-facefodhandler_31bf3856ad364e35_10.0.19041.1266_none_1f1ff89fbf279f16\FaceFodUninstaller.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.19041.1_none_0d3d1dcf5184d281\appidpolicyconverter.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.19041.423_none_df344b9fe5390f25\r\AppResolverUX.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.19041.1266_none_a88c5999d8585853\r\pcalua.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate_31bf3856ad364e35_10.0.19041.1_none_fa14fc3992df87f1\dllhst3g.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.19041.1237_none_9ad73d125ac89655\bfsvc.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_10.0.19041.1_none_03029e85abc99279\bitsadmin.exe 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1684 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe 1684 2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_02b4a6b4ac415beca0532f3fa3ea9ce9_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1684