Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 04:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
- Size 493KB
- Sample260604-e3x92aaz6r
- SHA256 0c7eb739c9c7f37430078b2272edda882a074996580b5fc2ab73a93168e695ed
- MD5 947267e552c002bfbc8af8a7ed14d54f
- SHA1 92304ff588b96b3a3004bb57793b166722d56720
- SHA512 4deb168e7b6282335e435c46206888635f59e7cc5cf8e2b16c5fb6124c328dc801338926987beb0e63fe04c017cb2be67dc152b7ba32699627e228d74f2ff395
- SSDEEP 6144:WXqoEuSVovqN+7Hb9OjEPBY51q35D8lwJcuS6W9ejMD8iZIfN49KHJg3PfcKrKyk:NV8qN+l5Y5s8l3t5vQJAdGyk
- TLSH T114B46C29F39C7BF8E8E691788D5EB151EE31BC250B2095DB339496292F332D01A3E751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (257) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe - Executes dropped EXE 2 IoCs
pid Process 2212 Logo1_.exe 4044 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.Exe Logo1_.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe.Exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\RCXDFF5.tmp Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\RCXE109.tmp Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\ScreenSketch.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\NewsStub.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\RCXE1AA.tmp Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Solitaire.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\RCXEB22.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXEBD3.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7z.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\WinStore.App.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\TerminalAzBridge.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE Logo1_.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\RCXEC73.tmp Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\PaintApp\mspaint.exe Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe File created C:\Windows\RichDll.dll Logo1_.exe File created C:\Windows\uninstall\rundl132.exe 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Logo1_.exe 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1888 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1888 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1888 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1888 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1888 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1888 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1888 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1888 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1888 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1888 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1888 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1888 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1888 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1888 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1888 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1888 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1888 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1888 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1888 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1888 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1888 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1888 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1888 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1888 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1888 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 1888 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1888 wrote to memory of 1616 1888 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 81 PID 1616 wrote to memory of 4892 1616 net.exe 83 PID 1888 wrote to memory of 3476 1888 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 84 PID 1888 wrote to memory of 2212 1888 2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 85 PID 2212 wrote to memory of 4028 2212 Logo1_.exe 87 PID 4028 wrote to memory of 3584 4028 net.exe 89 PID 2212 wrote to memory of 4436 2212 Logo1_.exe 92 PID 4436 wrote to memory of 4024 4436 net.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:4892
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5186.bat2⤵
- System Location Discovery: System Language Discovery
PID:3476
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:3584
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4024
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4044
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXEAE1.tmp
- Size 94KB
- SHA256 dda945d9eee98c1b046f27e22725b56809ffa8dab1232d874181f0a4a18df3c9
- MD5 0b97e01b56a6f76ec6a97913bd28683b
- SHA1 9811e4ff99890ab2287c1c87e94c032d5ede3dcf
- SHA512 4e538d3ce64d21b9cfae6ca7619082167677878b4bbecb676ed7981c4658a78f8e192a07b92b564af30eddd706f0318a27447b448b2994222f5241d6fec36cfd
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t62ND:gCSjGoLpWM6VsBEjx+ZdTp
- TLSH T12D932A5AB18CB376D0E159BC8E0FF2E5BD297E200E1D589F75992F0EEE760C1590C285
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\RCXEC84.tmp
- Size 103KB
- SHA256 1bb7f0e744d58eb3d9af07d4a390fd8dc3188535c21c367c359708a0eef2cc43
- MD5 0163581e3c90c6c9708f9fbb7b8eda72
- SHA1 55caf282109df6569e2f26e010c2ac7ff221d986
- SHA512 9e7ff61137f388f3bc6e31c1d41d595ddcaf8631a981356b9de544b833318d5dcef1760c839359446be2dddd84cde3eafdb9209ecfc954520252c0a4077f3b9d
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx78SXzpn9t6M1XkSPsULMHiANQ:gCSjGoLpWM6VsBEjx7ZdddtPlLq1u
- TLSH T1CBA36B19B68DF376D0E249B88E0DF2E57D297E300F1A185FB69E2F0E9A765C1190C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXED47.tmp
- Size 91KB
- SHA256 50e8837e809954307bad2d969fba414775c29441f7841d385429e7ebbb9a7255
- MD5 364065a7ee8bd74e8a018691bec07982
- SHA1 449a58c873839a19bccc2f96ddcfa0f2696f9c82
- SHA512 dea89c927e163f897c841d341d7706d77e85b08ee5296ff72fa29e4097bf3187568923e81425586f789eb3bceba83d1591085fc23e2e351a9daefbac9d4c2559
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6pNT:YCSjGoLpWM6VsBEjxZZd45
- TLSH T100935B6AB28DB376D0F299B88E0DF2E5BD397E300E19185FB59E2F0DDA761C1190C191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXEC14.tmp
- Size 118KB
- SHA256 012a812689140fe26e2a9d38d858c01ef95dfe0d0a25d88fb6c073c9a440224d
- MD5 b1e7e239177173873b37339e2e8b6dad
- SHA1 a063607f9876b7231d5c2760edf6c397e8a4dbca
- SHA512 dffa7679ead353184654beb273b19d67e2c4e10c96a61cd913afb0690f5610b330b2cc7f7233f81d54e4dff7010b1da716643754bd6e5791ee12c614aee8c5ca
- SSDEEP 1536:Y7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6x4GZjzQwK5WW7VCnu:JCSjGoLpWM6VsBEjxZZdQe5BV0GH
- TLSH T149C39D69B68CF377D0E259B88E0DF2E57D697E300E19085FB59A2F0DCA7B5C1190C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\RCXEE12.tmp
- Size 100KB
- SHA256 98b914476043a60a133695230c7a58a8b98e998782fc3e05359feffdf1b0aa1a
- MD5 273def70360dc316efd2aaa618cdfff9
- SHA1 e024f868033905998de49bd1a80a0b88cf348799
- SHA512 2d3d84858c2748b91159a0cf417fc5c95352b4d0280785cad8e24f8e97d83d80387c6469ecba6729bb4b979a599c584975210664fd34af015d1cd61182fc39cb
- SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxQ8SXzpn9t6eqkSZZZ3xNj:oCSjGoLpWM6VsBEjxQZdJUxJ
- TLSH T110A35B1AB69CB3B6D0F189B89D0DF3E5BD397E300E59185BB2AD3B1E9A77081190C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe.Exe
- Size 642KB
- SHA256 624f145be11bc4c2ac7b20273432746089312a6a381b9528a87e80ff3cab4756
- MD5 6bc3791c7e481bd910ddc37128f2c67b
- SHA1 77507ae5f922daac16ff076ce8d3e17e10812f25
- SHA512 c0e6b1877387e5d916550b4fea4f6b54c0fbc229a4128ed789e54cc4553347289b25cff17c58dfce39cd33c3f4978a3fc30e9856aec19f54b43761c21e0aaf6e
- SSDEEP 6144:WXqoEuGXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ8F:PXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
- TLSH T1EDE40715F66CB331D0F2C0B9C9DEB68AED713C411B3089CB5286976C6E276E6853A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\RCXDEE4.tmp
- Size 91KB
- SHA256 8e1d0351717a214cb777ca055b2d7655bb31f3f82512296abc165525e19aac0a
- MD5 800bf3708a3fb44b6593102d1c6b031c
- SHA1 c1010bf2df15ede79ff7ffe51af0a56307b3025f
- SHA512 0152d3933ff0c5c477080dc85446d2591e171388286a80f9f3852f81a9b73152ad4df61d1e7e043711edd579b979ec09d27e8285a665fca5ccce77ebca36566a
- SSDEEP 1536:J7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxG8SXzpn9t6tNb:QCSjGoLpWM6VsBEjxGZdsB
- TLSH T12B935B6AB68DB376D0E259B88E0DF1E5BD387E301E19185FB5AE3F0DDA761C1090C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe.Exe
- Size 4.3MB
- SHA256 ce328b90405313e60a84b482c9e04896f2481d218d5231b58290a9dee58f0b9c
- MD5 a3d7506688fc3a17f084baefe7b83cbf
- SHA1 2d3f2ba0e29ed2fe5eec1f7a03ecaa6ce82760ca
- SHA512 89a5192ab9998b01017735f2c7ab096a931b85cd4d39fd947eab59d97ae3b0c9b6308adc13169790cd8b6481f5852fc1f4fe5668938a719e9a8e012d1bb5d258
- SSDEEP 49152:YQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3TH/:YQvGAdlCEL8c/bRNw5CO
- TLSH T122263A656BEC91F5E0E7D134897A95B2FB7A7C020D32EB4B0151CA2F2F336904D29729
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\RCXE23B.tmp
- Size 91KB
- SHA256 152c274b6bf8e385309d052253a5695168c6bb4adda5c940e4ea983cc994b803
- MD5 541dbaf9b11535748926bdf60306df49
- SHA1 ba7ffdde613287629bd1b969eaf1f5836d4849b1
- SHA512 cdad550ed7b1eee527feb10de01dd8ed8f5c8d01424293e2c1092ad3b3c52bfb2495bdbb5fbabf73db673a31bd79a453fe4f7e3b2a6de872d843ba1641738010
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxm8SXzpn9t6PNL:YCSjGoLpWM6VsBEjxmZdax
- TLSH T15A935C59B29CB376D0F259B88E0DF2E5BD297E300F1A185BB5EE2F0DDA7A1C1190C191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\VideoLAN\VLC\vlc.exe.Exe
- Size 1.0MB
- SHA256 89b96f0048749c65d650933b87412b654cdd98a3074426a9897737cd18a4984e
- MD5 66aca7db7d6869661905a74a0ab2d9af
- SHA1 1106eb7f92ecbfcfe3a6d1ca445c8e19cc5695bb
- SHA512 db702e983cd22a7ae8f6293e253afe2bff5c01c3b4a49a27089d8f6e99c572aaf1454d933b0e3f7ed5bddf3292f5e35e82d0d3e249ad2b4e10f4c59e19290323
- SSDEEP 24576:Oe3xAibB85Z1HrWtB8z1L1O6J75zzz3zzzozzz3zzzzm:VxAibBEZ1LWtBzkOm
- TLSH T1A2353A1BE2AE77E9C5EFC034879EF7716E30BC5902247E2E2955D7222E10D509B2E724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RCXF297.tmp
- Size 92KB
- SHA256 4888f00138c752b0da8c6eaa52df19e984421172dc606b78458793d9b4ac3569
- MD5 64bce9b0a204d755e6db41d56072fdd5
- SHA1 239548df3713ccaef2daa19ec859867a86545484
- SHA512 b88f57b2bb6d2e84313289e6b314dd3f1861cc1bc3e0c0cdda3adc0a89a7f3a6018744eb13207e8fd1c846c94a328a0858434564521a27f2d55536c3dd89fe31
- SSDEEP 1536:h7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxQ8SXzpn9t6INr:ICSjGoLpWM6VsBEjxQZd1R
- TLSH T180935C6AB29DB376D0E199B88E0DF2E57D387E300E19185FB59E2F0EDA770C1590C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a5186.bat
- Size 902B
- SHA256 6d22603199d4d1cd1fb25326bcfad4e757d3a3c31c5df9c607c36ac1d8f70721
- MD5 751ee0c736b029720d75ad7a57ae3d5b
- SHA1 a0486732e4a860e1c5385cab2c66da16cc5e3e3e
- SHA512 f801923807316e4dc3708f316864d9b22b236fe83b2da1434c1bfef3ebb66eb56ad4d9df7eaf4417b44be3ced2f1a54b1fd41e23a715ac4e4fdd5822056c4339
- TLSH T13E112916C5E2E9E81421F0A24E957DCDC863378C3B6A3222679CDDBF50E190CE975722
- MD5 SHA1 SHA512 TLSH
2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
- Path C:\Users\Admin\AppData\Local\Temp\2026-06-04_947267e552c002bfbc8af8a7ed14d54f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
- Size 400KB
- SHA256 e56fc414569ac2ec2720d4fa1e53e20e1fd73381b80dbfd80050142157da2cad
- MD5 55cff01b895bfd009bb31f70fd9b1b74
- SHA1 083ee6d39c2314e07a415726ade7d80fd28fadbe
- SHA512 553ac694f700f1674d3cba0f62a4d9fb7d2fff043177d4218add57750865926e68cea101d8ec926fb5a54cd7b290db9cd00a088450b9d9f3cf801a9dd8a63bc4
- SSDEEP 6144:tVovqN+7Hb9OjEPBY51q35D8lwJcuS6W9ejMD8iZIfN49KHJg3PfcKrKywJ:tV8qN+l5Y5s8l3t5vQJAdGyk
- TLSH T1D7948D29F3A05DF8F83AD178C9929512EA32FC550760E6EB239496252F332D05E3FB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 93KB
- SHA256 5ad2eead96b4195378093032e3499905571240b7a2f65bffc06f9068f1056737
- MD5 465db0804333f4b1b092dcfcf9b38b28
- SHA1 3a1998bc523dfcff099ac2ec39f03930c35a8935
- SHA512 565efc4f38b0119140b3144a35422567dcdcb2146ea240a66969e21c30070e0252291bf3652204e720a94a76561b83651624c23bf2dde2b82b7d4adc673bb160
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxe8SXzpn9t6JN:gCSjGoLpWM6VsBEjxeZdQ
- TLSH T122934B6AB28CB776D0E659B88E0DF2F5BD397E300E19185B759E3F0EDA761C1190C182
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH