Analysis
- max time kernel
150s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/07/2026, 02:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
- Size 1.3MB
- Sample260706-cf7tvacy6p
- SHA256 5fc7cb875576a022991287d6d41b0cb72990e4bbe78cc86bcfc0f0d22ebe3225
- MD5 8efebbcbef24ee7001d14ada159d70ea
- SHA1 3a328c483ffc1556054b5924fc829d66da0d0ebf
- SHA512 35d27424ac54c79f54b88e6ee326f36ee375a5425fc11d4b9f8381bdbc89e4850dcb7d163aa67ea1428f58c880aadb09d6281a801559a554968c450df70df161
- SSDEEP 12288:CyNXb/7t0iUk2E+UiOS/osQbCP+V/7h0L6unnOPl4jK7en3mawkfd8PzH4qLiavg:Cu/7t0ib+UiF7ACE/UmafSLi4euLHa
- TLSH T1DF556B17B69D73E8D0EED1748A4DB275ED727C520B34AADF0290B2191E37AE05B3A710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (259) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe - Executes dropped EXE 3 IoCs
pid Process 6020 Logo1_.exe 6096 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 848 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\D: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX7AC8.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_90781\javaws.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\RCX888C.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.Exe Logo1_.exe File created C:\Program Files\Mozilla Firefox\updater.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\RCX87DC.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\RCX89D5.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe.Exe Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\uninstall\rundl132.exe 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Logo1_.exe 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe File created C:\Windows\RichDll.dll Logo1_.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4312 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4312 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4312 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4312 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4312 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4312 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4312 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4312 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4312 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4312 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4312 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4312 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4312 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4312 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4312 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4312 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4312 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4312 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4312 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4312 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4312 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4312 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4312 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4312 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4312 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 4312 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe 6020 Logo1_.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4312 wrote to memory of 5820 4312 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 89 PID 5820 wrote to memory of 6048 5820 net.exe 91 PID 4312 wrote to memory of 5860 4312 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 92 PID 4312 wrote to memory of 6020 4312 2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 94 PID 6020 wrote to memory of 4988 6020 Logo1_.exe 95 PID 4988 wrote to memory of 6036 4988 net.exe 97 PID 5860 wrote to memory of 6096 5860 cmd.exe 98 PID 6020 wrote to memory of 5336 6020 Logo1_.exe 101 PID 5336 wrote to memory of 5704 5336 net.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:6048
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aECEB.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"3⤵
- Executes dropped EXE
PID:6096
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:6036
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:5704
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:848
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCX8345.tmp
- Size 156KB
- SHA256 ec81057ae78a6e3d34ece1bcd7958511999b0d8a02cbcfd2bb235acec22f0f61
- MD5 4359851ab8f115291e26eff80279baf5
- SHA1 b779ba32623df0c40c1fde42fc2bf474cc2192d3
- SHA512 3431eed5872774ed8df91180b88ef1198555532d2d753b891b9c9defe8684290a6fae380c8a6b7af88c77daf2085012bb94ced394773c1de68a9cdb7bf49066c
- SSDEEP 1536:E7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxkZ2HQuhtjRQXQNz:dCSjGoLpWM6VbBVjxkZ2wuhttQAZ
- TLSH T1A0F3A26EA18FB3F6D3E1597C8D1CF2D1ED29FE20CE19285A75D93B0E9A760C34508291
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe.Exe
- Size 1.2MB
- SHA256 6d07bb34d50317f8f3928cbc08afdae5b292e0638c32a0257172cf83007d6b83
- MD5 8773c9d6f83b8eb78380d223e083fd7f
- SHA1 e357003da01116e26b2960b0a941639b7e47da96
- SHA512 97e96db8d297c7ca3cf104f98986f80e4cbb1b80e1e252e407f176e0208ddd1952a8806f31b31af07835259c76abdd3ef3a360d3566f674208e8ee2f8e9477da
- SSDEEP 24576:yfSgouvz0ZRHkFfenxyQZXS7gZnQh2NIq:8SgouvAeFfenxyQZXS7uQ0NIq
- TLSH T1CE55D40267FD7329F1F37B71EABDB2645E767C61AE39C50E5284025E09B0A909A31733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\RCX875D.tmp
- Size 3.5MB
- SHA256 a5e4a3affe000f33676857b3773915e80ae716c77655f93f5faaa07c743e0214
- MD5 eb28d5421993fc07e4cd1443c90a337e
- SHA1 b098671db75dc577ed71ced4933ff4fd40009029
- SHA512 bc51ea9ded58e8607eaf55ba0cf0589084edcf47d45336ea6bd91e93cbdf15e99e02ee4e59e5d762662e7a8d76e5e50301222e7f9b4a2e9c37f5a8510b6a7c4d
- SSDEEP 49152:PS2aBW08mKqRXGPd39PyPvnkSN+EcrxA3vGCDlBYMO74U2y+PhC:qbN/ki+EcF0pDeN2y/
- TLSH T104063903A19922D8D099C174CF4AA632EF62BC8907F162EF365076D52E77AD03B3DB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCX88AC.tmp
- Size 91KB
- SHA256 fbef7ebba35ed82c5d1e035efc8e40a65227b23c6637aa4688acf4f54c1a21f0
- MD5 e405a4629aee2841a8747bc063511786
- SHA1 6c7d24793f2d690134308e0eb0a75a950da4b349
- SHA512 63676f8a9456b453828f9ff26b42e4f64a086abe85bb638cd0d30fcefecf14b6de2af87dbf4654ba5eba95ac83fc5076225b90dddccbd1b71bb270e942d466de
- SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxEZ2HQuhtjRQXwNT:ACSjGoLpWM6VbBVjxEZ2wuhttQg5
- TLSH T1D1934B5AB28DB376D0E299B88E0DF2E1BD397E301E19185BB69D3F0DDE761C1091C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX86CD.tmp
- Size 118KB
- SHA256 76385d8ac03603e12af1c7e9d0df3eed8bf9a0b6cd9eaac2c71481f61bd293d4
- MD5 20c1b2dcf3b31223bd1c8a37fff06507
- SHA1 071ee6092e1002db26225267f67bc284bafb7ec8
- SHA512 72f60ed81dd23492cd8fbe59d5d5c359b80944bff5588feb1df0f5a4d7eba61f927090249a6d18cb9f9e876221a33ff9645db0ae4a493149e9f6df46a66395bc
- SSDEEP 3072:FCSjGoLpWM6VbBVjxEZ2wuhttQPe5BV0PH:vXq1VX9ae5v0v
- TLSH T1BBC39D6AB68DF377D0E299B88E0CF2E57D257E301E19085BB5993F0DCE7B1C15908292
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\RCX89D5.tmp
- Size 100KB
- SHA256 5d833741eefd0cbf607b9d48af9fed37dff86c9dedb80472ec0d80f6c7b2ef44
- MD5 c4daa4431eca1ddfd3ea2dabb5211196
- SHA1 3efd6cd6723bcfa3ade28d04ee6f37ee5f259018
- SHA512 33efe834b0b289cb00e6447e81b7d74d5ff76bd09a8e2f025cd1163a005aa2b8212e164d206f2d06964025bceb116f8dec425ce482814ec097d0c2866df0d3c5
- SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxdZ2HQuhtjRQXeqkSZZZ3oNj:4CSjGoLpWM6VbBVjxdZ2wuhttQgUoJ
- TLSH T150A36B56B68DB3B2D0E18AB88E0CF3E1BD357E300E59185BB29D3B1D9E771C2191C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX7B59.tmp
- Size 92KB
- SHA256 649151b37703af62456bfccb54f299373e9b03cc11ded35f8243ef8d7721a47b
- MD5 1d7279e3cbba080535ece7f51e893347
- SHA1 72f7138be4a00e3b7dec1c9ce30e8f0a7ad0f9a7
- SHA512 6464933270b4a8ae2fb13bf1d89bc7c6bf1f8abb4c066332ee03661f263394688ad3d5b90faf8276ded385d33827cfb7be0cfae0b683518467f08654c8df5d39
- SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxjZ2HQuhtjRQXRNL:wCSjGoLpWM6VbBVjxjZ2wuhttQBx
- TLSH T132934B6AB28CB376D0E299B88E0CF2E5BD257E301E19085BB59E3F1DDE771C1090C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\RCX7E0D.tmp
- Size 91KB
- SHA256 dcb25691069045854e8cfa1478c2b86b14db7628faeb53350ca524e78f8a9be5
- MD5 6d4a2056f1fbdb2a36b585dce5c0b9d5
- SHA1 86157e6fdecc1687af7ba8e54d7b1c47a5721454
- SHA512 f8de2d23ea5205f367a58309f9894f71170a4e7263003e580a2c8c19846e261296a582bdb0f4f197403c7e034cc9ddb505742cf02c2424af7f4a3cf6f68f55c7
- SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxLZ2HQuhtjRQX2NL:wCSjGoLpWM6VbBVjxLZ2wuhttQGx
- TLSH T141935B5AB28CB376D0E2A9B88E0CF2E5BD257E300E19085BB5DD3F1DDA771C15A1C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RCX8E0C.tmp
- Size 92KB
- SHA256 5b31ae9745506db82ac85f350dab239211bdaf9e26b8e7684eb9abb28bf8da49
- MD5 33e9ba1a82c15c32573920e7191fa4c0
- SHA1 c738398b9e727cee3b9aea4b9ebb40413fd59c41
- SHA512 a3a1fe9744a4e0f3edc2d041295c66fb5b0b43ce9df40216197d2e6e1c19261545f2b34b74babd7504456381b16efb015417ab1dc56f87efa0c8d84097cf7087
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxdZ2HQuhtjRQXpNr:YCSjGoLpWM6VbBVjxdZ2wuhttQ5R
- TLSH T17F934B6AB28DB376D0E299B88E0DF2E17D397E300E19185BB69D2F0DDE771C1491C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCX8E6B.tmp
- Size 92KB
- SHA256 bec1eeac7f6b8fee890de7c7c735281ab7c863380fef39247ddffe709dc0a38b
- MD5 7e6347fe7b9b7b671803dbf61f493067
- SHA1 563a1c024aad9fd5da337c7db1a5b4655015994f
- SHA512 56ec3c69620ce32c862cddf031465e2292d5b2f19c73b1f6bbcc903ff8b5ff60ce94a783a64a95c38a1735df0430fe25ef012b8cdee10c9cfaea78eb36447afb
- SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxDZ2HQuhtjRQXCBND:4CSjGoLpWM6VbBVjxDZ2wuhttQSBp
- TLSH T17C934966F28CB776D0E299B88E0DF2E1BC297E304E29185B759D3F0DDE771C14908286
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$aECEB.bat
- Size 902B
- SHA256 67c654b668ed04e60eb9f80619b475dec131de891b5f3395247d9bc2cc14f9f5
- MD5 752414e93c815c2edc3b7fd736788576
- SHA1 8d4b57a2a4b4f80abb5dbfbc8f3efaab1eec9ddc
- SHA512 66cd57901f2e1f24685355e3d0b859a0e2e36eba82b667a687ae557b3a7310344c97f2d9d9ecc20510a8d7063932f8dfb65aa63f6118872b8f8788a8eeb33ec0
- TLSH T16211CA52C5E9D6AD0821B1AF09259DCDC0666B5E3F193339971D86EF12C680CFAF23D2
- MD5 SHA1 SHA512 TLSH
2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
- Path C:\Users\Admin\AppData\Local\Temp\2026-07-06_8efebbcbef24ee7001d14ada159d70ea_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
- Size 1.2MB
- SHA256 9f7f04ce2bae3e76e41ddc706f9c1cc35405a1d21c488fe4f81eb89fdff51907
- MD5 044cafeb287abc6a500c821b547d32f0
- SHA1 595fb18d1e5c64f60737cbc1061285cc2374dc88
- SHA512 683475098a9dc2b072427ce3a240ebf45c1201ca0ebbc8933bfcd74a5875716b82f201c1b0751c559313d00ca4990c323fa22974ddd7528654290ff36814b84f
- SSDEEP 12288:4NXb/7t0iUk2E+UiOS/osQbCP+V/7h0L6unnOPl4jK7en3mawkfd8PzH4qLiaveZ:c/7t0ib+UiF7ACE/UmafSLi4euLHa
- TLSH T1F4458D17B79941E8D02ED178C7458236EA72BC520B74BADF0690B3592E37AE46F3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 93KB
- SHA256 7668ba1c9944ce05279a14c6cb02f0849168afcc0a638679bcb3b608371510e6
- MD5 e291c3b5a5c10054cf61dd7d36add454
- SHA1 1ebe955b3f8084e23ea7750e65ae994eaa6d4543
- SHA512 0b825a4681290733205945391d7294915021893ec9c69573b6ccf712b4810e5720e5f0fce0eb2f0be3bac69d437d5b00e9310b5e62418c411e037bc3ca8fd6e2
- SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxrZ2HQuhtjRQXNNq:oCSjGoLpWM6VbBVjxrZ2wuhttQ9g
- TLSH T198934B5AB28DB376D0E25AB88E0DF2E1BD397E301E19185BB69D3F0DDE761C1490C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH