Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 14:26
Behavioral task
behavioral1
Sample
2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
- Size 8.8MB
- Sample260602-rr5k7agy7m
- SHA256 1034908e26ac05e441ac4b869be98f98744d3f0253f34dd59953fff73210738e
- MD5 59e2c7898fec7135b2fa68e4aaaa9f7c
- SHA1 b2fc5bb16a8998a549b5e1cb5c53dc3edf98e140
- SHA512 fc0699bbfe0fc2cbc3b1fed826718f3d74f19dced988810558a22839e93a4b49be7ed20ebcea5a48b4c474c07577db152ebd1a13cbdb1c573979d1037064da9b
- SSDEEP 98304:Z3qqUHxqPF4VMNW6A6CWQtZ/K0tM6AjohLapIy6iRs6X:ZaHxXME6A6CWyZ/K0tM6SohcIy6iy6X
- TLSH T1E6967E13F1A001A5C066C179CB829626EBB13C554BF096DB965DB3E82F37AE07B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\calc.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\clip.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dvdplay.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\logagent.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\netsh.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\srdelayed.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\runonce.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\upnpcont.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ktmutil.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\label.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\logagent.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PATHPING.EXE- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\netiougc.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WerFault.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\whoami.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\auditpol.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\perfhost.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\quickassist.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\winrs.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cacls.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ftp.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mshta.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ndadmin.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\shutdown.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Magnify.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mshta.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sethc.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cmd.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\relog.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe -
resource yara_rule behavioral2/memory/2856-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x002800000002b20c-5.dat upx behavioral2/memory/2856-870-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/2856-3194-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\7-Zip\7zG.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-e..otocol-host-service_31bf3856ad364e35_10.0.22000.1_none_e08d858702e7237a\Eap3Host.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-shellappruntime_31bf3856ad364e35_10.0.22000.120_none_0e11f85980658aa8\f\ShellAppRuntime.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msdt_31bf3856ad364e35_10.0.22000.1_none_061aa9eb56b04ee9\msdt.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-impexp-extexport_31bf3856ad364e35_11.0.22000.1_none_5c143d9b7acb165f\ExtExport.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_10.0.22000.1_none_aef18f12e09924ba\aspnet_regiis.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_wpf-presentationhostexe_31bf3856ad364e35_10.0.22000.1_none_6a1935736c898073\PresentationHost.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-runas_31bf3856ad364e35_10.0.22000.434_none_5b46b110e29f5b31\f\runas.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.22000.100_none_1c26ef58a3003bf2\f\SystemSettingsAdminFlows.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_installutil_b03f5f7f11d50a3a_10.0.22000.1_none_d094352fcb43807d\InstallUtil.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-windows-minwin_31bf3856ad364e35_10.0.22000.469_none_4b2e9fd5814459a0\r\winload.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..estartup-change-pin_31bf3856ad364e35_10.0.22000.194_none_ecba39f8d9cbe846\f\bdechangepin.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.22000.1_none_f6f65975fbba31fe\WinMgmt.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.348_none_6b5eb3c4c1ffcde9\f\WerFaultSecure.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sysinfo_31bf3856ad364e35_10.0.22000.1_none_45984ec0fd57e0f5\systeminfo.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_curl_31bf3856ad364e35_10.0.22000.434_none_841ec22dd6bd92c4\f\curl.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-processmodel-cpt_31bf3856ad364e35_10.0.22000.1_none_0b6ad273acba9ca1\w3wp.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.318_none_c7ea7e014d4524f4\SyncAppvPublishingServer.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.22000.493_none_674ce99b39869941\r\ntoskrnl.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.22000.1_none_f49ae11ddec89744\LicensingUI.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.22000.65_none_f3a35be8937453f0\f\TabTip.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft.workflow.compiler_31bf3856ad364e35_4.0.15806.0_none_eb7fe9dcc519b26e\Microsoft.Workflow.Compiler.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\f\SenseSampleUploader.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.22000.65_none_9b4fcb543bd21a13\LaunchTM.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceenroller_31bf3856ad364e35_10.0.22000.1_none_1788ef5112142c1f\DeviceEnroller.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-newdev_31bf3856ad364e35_10.0.22000.1_none_67b9e8fa55722b23\ndadmin.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.22000.469_none_82154d2009b8e727\r\MoUsoCoreWorker.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx35linq-addinprocess_31bf3856ad364e35_10.0.22000.1_none_86dac86e5184145e\AddInProcess.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.22000.100_none_cbf7ec6fc0f80985\SndVol.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-extrac32_31bf3856ad364e35_10.0.22000.1_none_3bc1e2973d0f3919\extrac32.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-getmac_31bf3856ad364e35_10.0.22000.1_none_6c96deb2db24e7d4\getmac.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.22000.1_none_ddb5359fa07e69e6\print.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.22000.120_none_28babea403fb06cb\f\CallingShellApp.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.22000.434_none_1c2ba06bc5084235\edpnotify.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sstext3d_31bf3856ad364e35_10.0.22000.71_none_e67840367b6dc817\r\ssText3d.scr- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_serviceinitiatedhealing-client_31bf3856ad364e35_10.0.22000.194_none_17fbd7504b9de242\r\SIHClient.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-notepad_31bf3856ad364e35_10.0.22000.1_none_cfb2d573a92990de\notepad.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\CapturePicker.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.22000.318_none_569ec118f1c50925\f\winload.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.22000.318_none_8e5804ec62c5891c\f\cmimageworker.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.22000.1_none_9ecf8c975ae30adc\tree.com- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.1_none_5fa2feeecc138dd4\TiWorker.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.22000.71_none_ccb71d3ee4c7b8a6\r\ByteCodeGenerator.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-muicachebuilder_31bf3856ad364e35_10.0.22000.1_none_7aa4e433ee022a53\mcbuilder.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_addinprocess32_b77a5c561934e089_4.0.15806.0_none_faef98edc711143e\AddInProcess32.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_10.0.22000.1_none_d9e8af91dd649cea\UserAccountControlSettings.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsmanager_31bf3856ad364e35_10.0.22000.1_none_72526c5b8ceef21d\WmsManager.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.22000.318_none_349d8ac96fe3d679\r\appidtel.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-o..onalfeatures-fondue_31bf3856ad364e35_10.0.22000.1_none_aa4d552cc54f3bba\Fondue.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.22000.318_none_7fdfd2b2e06a7af9\nvspinfo.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.22000.318_none_8e5804ec62c5891c\f\cmproxyd.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ng-server-isolation_31bf3856ad364e35_10.0.22000.1_none_f2f2b094636b4172\PrintIsolationHost.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.22000.282_none_9ed8cb052ff869e6\r\TokenBrokerCookies.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-musnotifyiconexe_31bf3856ad364e35_10.0.22000.282_none_345ca27cf9ce36c0\r\MusNotifyIcon.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.22000.1_none_ba1c45853a21e276\IMTCPROP.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.22000.120_none_3d11f25cbb74100a\sdchange.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.22000.318_none_2cba3682f8941339\f\DiagnosticsHub.StandardCollector.Service.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.22000.434_none_4f4ac04322f04123\r\PktMon.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_10.0.22000.120_none_ef0bb92fa937f7ee\f\RMActivate_isv.exe- 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_59e2c7898fec7135b2fa68e4aaaa9f7c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2856
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 9.3MB
- SHA256 f51c010dcee9dc5f66fb02e81dba1387dee87cfb484ccba4651bd5d35b617090
- MD5 5cc37f841bab708df63c1045ab041764
- SHA1 8307bb45d01bc55011f0a77f009694d61c7ae32c
- SHA512 063bbe7360c63cce6219672d7b6c68d330ca64791260c888c3c0ed7ff6ecd4c4f4122d0d1ca02102007d5aba86fa5bcc3afff0fa4ac5abe24f506d8d4b3324b5
- SSDEEP 196608:ZaHxXME6A6CWyZ/K0tM6SohcIy6iy6Doe:ERXMzXdyZ/K0trFC4Wse
- TLSH T199A67E13F1A001A5C066C179CB829626EB713C554BF096DB965DF3E82F37AE0BA3D721
- MD5 SHA1 SHA512 SSDEEP TLSH