Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 00:26
Behavioral task
behavioral1
Sample
2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
- Size 8.1MB
- Sample260707-arc3haet7s
- SHA256 f715402eb6e3908c8072482e7aa80552b6cbdb02df8c0b0f94f46eeab88ad9c6
- MD5 e150a4d79488fd71cd5d11348fb6035e
- SHA1 05390acfa2434fb21aea606cafe1df1691bfcc44
- SHA512 fd9f5cc04eb469972d146b86916a6dae017b66cddc0847db3fe02bcdef51c63b90b02d093d13baef5fd8bc32b970e6750871c4838eb34560c5cee81603ad36e7
- SSDEEP 196608:vGBfW7GBfWAbvd/Kmd08gTH2qBpu1QfLIqOoa:UWIWAsqKTHNBpu1Qfcqa
- TLSH T192864A12A19914ACD19AD074CB4B8526EB313C8A07B5A8EF1285B6F53F77AF03F39711
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Futurax 1 IoCs
resource yara_rule behavioral2/files/0x000e00000001c616-4.dat family_futurax - Detects executables packed with MEW 1 IoCs
resource yara_rule behavioral2/files/0x000e00000001c616-4.dat INDICATOR_EXE_Packed_MEW - Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ati display driver = "ÔN@" 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\certutil.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\setup16.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cleanmgr.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cttune.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Netplwiz.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mobsync.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\win32calc.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cmstp.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\pcaui.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sdiagnhost.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\hh.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mode.com 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\more.com_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\perfhost.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\resmon.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\where.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dfrgui.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\help.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\iscsicpl.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PATHPING.EXE- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\where.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Com 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\relog.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RMActivate.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\makecab.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wowreg32.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mcbuilder.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\chcp.com- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dllhost.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\eudcedit.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ndadmin.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SyncHost.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ipconfig.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\firefox.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\dotnet.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\7-Zip\7zG.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\iexplore.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\MsMpEng.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmprph.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-tapicore_31bf3856ad364e35_10.0.26100.1150_none_80212900f68082da\r\dialer.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..crosoftedgedevtools_31bf3856ad364e35_10.0.26100.1150_none_4b9ba76194d03300\r\MicrosoftEdgeDevTools.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.26100.1591_none_a548c43e37f4b89b\r\ie4uinit.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.26100.1591_none_c6e1de18243de2ea\edpnotify.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.26100.1_none_6bac5cbeaae00b9d\tttracer.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_48e47fdfbf0a33b1\TiWorker.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\AccountsControlHost.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_98f799d63c0fa1b8\r\Microsoft.ECApp.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmappinstaller_31bf3856ad364e35_10.0.26100.1591_none_356e88b34c16567d\MDMAppInstaller.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.26100.1591_none_c0c9b77316cf6b10\r\sdclt.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1591_none_e4284e3cb060c8bf\wscript.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.26100.1591_none_3bb2eaeeb6f37532\r\dtdump.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-japanese-setting_31bf3856ad364e35_10.0.26100.1591_none_58449d9961468d2f\IMJPSET.EXE_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_b184dc3c337d380b\r\wmpshare.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.26100.1_none_f7b54b8cda580fc5\ThumbnailExtractionHost.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..bootencodeuefi-task_31bf3856ad364e35_10.0.26100.1591_none_8f5a876d69245542\SecureBootEncodeUEFI.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.26100.1742_none_9c21c77df9054577\tcblaunch.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.26100.1150_none_160ad4e2bcc0210f\browser_broker.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..estartup-change-pin_31bf3856ad364e35_10.0.26100.1150_none_8d8407dd0453280e\bdechangepin.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..estartup-change-pin_31bf3856ad364e35_10.0.26100.1150_none_8d8407dd0453280e\r\bdechangepin.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.26100.1591_none_9271e9806df3ec14\MBR2GPT.EXE_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-computerdefaults_31bf3856ad364e35_10.0.26100.1_none_0dbef45e6036c735\ComputerDefaults.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.26100.1591_none_f7c94c8b5e2407fe\r\explorer.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.26100.1591_none_4177de30403bfb76\r\CredentialEnrollmentManager.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-castserver_31bf3856ad364e35_10.0.26100.1_none_c492cc5e99915bfb\CastSrv.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.26100.1150_none_d0d1e07b8681fa6b\r\dllhost.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgesh_31bf3856ad364e35_10.0.26100.1150_none_648c8216bc35a3e5\MicrosoftEdgeSH.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ncsiuwpapp.appxmain_31bf3856ad364e35_10.0.26100.1591_none_8b74ec1a688877ac\NcsiUwpApp.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-firstlogonanimexe_31bf3856ad364e35_10.0.26100.1_none_c842a966f62dd0c5\FirstLogonAnim.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..teelevatedinstaller_31bf3856ad364e35_10.0.26100.1150_none_21762269bb195f5b\r\WindowsUpdateElevatedInstaller.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_userexperience-core_31bf3856ad364e35_10.0.26100.1591_none_53ec4fcd7ac99448\Core\SnapLauncherProtocol.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppResolverUX_cw5n1h2txyewy\AppResolverUX.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_a5031b637767a4e7\poqexec.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.26100.1150_none_b21dc6dde1913832\r\winrshost.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.26100.1301_none_acf5850f76c86db8\r\WPDShextAutoplay.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\msil_jsc_b03f5f7f11d50a3a_10.0.26100.1_none_4c13a06c8b009cc4\jsc.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.26100.1000_none_6715fee261171762\wevtutil.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.26100.1_none_20d605b4c2450a61\fltMC.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-getmac_31bf3856ad364e35_10.0.26100.1_none_1346e96d3ee86ee9\getmac.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\ARP.EXE_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_netfx4-ilasm_exe_b03f5f7f11d50a3a_4.0.15912.146_none_9f891aedaabbca5a\ilasm.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.26100.1150_none_7c0a3bab447f4af9\r\ByteCodeGenerator.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.26100.1150_none_3d0419d754916346\r\wslconfig.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmagent_31bf3856ad364e35_10.0.26100.1591_none_e0bca845ce26528b\r\MDMAgent.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..executionprevention_31bf3856ad364e35_10.0.26100.1_none_c6d712038d260ae7\SystemPropertiesDataExecutionPrevention.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Windows.PrintDialog_cw5n1h2txyewy\PrintDialog.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_10.0.26100.1150_none_9f6738de73cf4ce3\dpnsvr.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_wpf-xamlviewer_31bf3856ad364e35_10.0.26100.1_none_5301f4e1e5797d14\XamlViewer_v0300.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.26100.1591_none_e0a0e7a383989b03\r\IMEPADSV.EXE_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_multipoint-logcollector_31bf3856ad364e35_10.0.26100.1_none_9d1627fd03aed8d9\LogCollector.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.26100.1_none_fc5f223b9b5c3cc5\RMActivate_ssp_isv.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_regasm_b03f5f7f11d50a3a_10.0.26100.1_none_bb53ccdac90dda7a\RegAsm.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.26100.1742_none_07d5a4b5643ebc7c\ntoskrnl.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensors-runtimebroker_31bf3856ad364e35_10.0.26100.1591_none_4483428c4f7fb3a1\r\SensorRuntimeBroker.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-deployment-package_31bf3856ad364e35_10.0.26100.1_none_5bc14811ec1c13bc\TFTP.EXE- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\MiniSearchHost.exe- 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseNdr.exe_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.26100.1591_none_2bcc571573c94745\IMESEARCH.EXE_ 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1920 msedge.exe - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe - Modifies registry class 38 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ msedge.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ msedge.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{959C46CD-0FC8-48AF-9BF9-8FDF9FF6FC7C} msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{32021779-943A-4B4B-8908-3688272B4114} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{C9A2163E-CD13-495F-B3A0-EC0CDDB41AF2} explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1964 explorer.exe 1964 explorer.exe 1288 msedge.exe 1288 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
pid Process 3772 msedge.exe 3772 msedge.exe 3772 msedge.exe 3772 msedge.exe 3772 msedge.exe 3772 msedge.exe 3772 msedge.exe 3772 msedge.exe 3772 msedge.exe 3772 msedge.exe 3772 msedge.exe - Suspicious use of AdjustPrivilegeToken 56 IoCs
description pid Process Token: SeShutdownPrivilege 1964 explorer.exe Token: SeCreatePagefilePrivilege 1964 explorer.exe Token: SeShutdownPrivilege 1964 explorer.exe Token: SeCreatePagefilePrivilege 1964 explorer.exe Token: SeShutdownPrivilege 1964 explorer.exe Token: SeCreatePagefilePrivilege 1964 explorer.exe Token: SeShutdownPrivilege 1964 explorer.exe Token: SeCreatePagefilePrivilege 1964 explorer.exe Token: SeShutdownPrivilege 1964 explorer.exe Token: SeCreatePagefilePrivilege 1964 explorer.exe Token: SeShutdownPrivilege 1964 explorer.exe Token: SeCreatePagefilePrivilege 1964 explorer.exe Token: SeShutdownPrivilege 1964 explorer.exe Token: SeCreatePagefilePrivilege 1964 explorer.exe Token: SeShutdownPrivilege 1964 explorer.exe Token: SeCreatePagefilePrivilege 1964 explorer.exe Token: SeShutdownPrivilege 1964 explorer.exe Token: SeCreatePagefilePrivilege 1964 explorer.exe Token: SeShutdownPrivilege 1964 explorer.exe Token: SeCreatePagefilePrivilege 1964 explorer.exe Token: SeShutdownPrivilege 1964 explorer.exe Token: SeCreatePagefilePrivilege 1964 explorer.exe Token: SeShutdownPrivilege 1964 explorer.exe Token: SeCreatePagefilePrivilege 1964 explorer.exe Token: SeShutdownPrivilege 1964 explorer.exe Token: SeCreatePagefilePrivilege 1964 explorer.exe Token: SeShutdownPrivilege 1964 explorer.exe Token: SeCreatePagefilePrivilege 1964 explorer.exe Token: SeShutdownPrivilege 1964 explorer.exe Token: SeCreatePagefilePrivilege 1964 explorer.exe Token: SeShutdownPrivilege 1964 explorer.exe Token: SeCreatePagefilePrivilege 1964 explorer.exe Token: SeShutdownPrivilege 1964 explorer.exe Token: SeCreatePagefilePrivilege 1964 explorer.exe Token: SeShutdownPrivilege 1964 explorer.exe Token: SeCreatePagefilePrivilege 1964 explorer.exe Token: SeShutdownPrivilege 1964 explorer.exe Token: SeCreatePagefilePrivilege 1964 explorer.exe Token: SeShutdownPrivilege 1964 explorer.exe Token: SeCreatePagefilePrivilege 1964 explorer.exe Token: SeShutdownPrivilege 1964 explorer.exe Token: SeCreatePagefilePrivilege 1964 explorer.exe Token: SeShutdownPrivilege 1964 explorer.exe Token: SeCreatePagefilePrivilege 1964 explorer.exe Token: SeShutdownPrivilege 1964 explorer.exe Token: SeCreatePagefilePrivilege 1964 explorer.exe Token: SeShutdownPrivilege 1964 explorer.exe Token: SeCreatePagefilePrivilege 1964 explorer.exe Token: SeShutdownPrivilege 1964 explorer.exe Token: SeCreatePagefilePrivilege 1964 explorer.exe Token: SeShutdownPrivilege 1964 explorer.exe Token: SeCreatePagefilePrivilege 1964 explorer.exe Token: SeShutdownPrivilege 1964 explorer.exe Token: SeCreatePagefilePrivilege 1964 explorer.exe Token: SeShutdownPrivilege 1964 explorer.exe Token: SeCreatePagefilePrivilege 1964 explorer.exe - Suspicious use of FindShellTrayWindow 52 IoCs
pid Process 3772 msedge.exe 1460 sihost.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe - Suspicious use of SendNotifyMessage 42 IoCs
pid Process 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5108 StartMenuExperienceHost.exe 1964 explorer.exe 4732 SearchHost.exe - Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 4532 wrote to memory of 672 4532 2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 86 PID 672 wrote to memory of 3772 672 IEXPLORE.exe 87 PID 3772 wrote to memory of 1428 3772 msedge.exe 88 PID 3772 wrote to memory of 5724 3772 msedge.exe 91 PID 3772 wrote to memory of 1920 3772 msedge.exe 90 PID 3772 wrote to memory of 5724 3772 msedge.exe 91 PID 3772 wrote to memory of 5724 3772 msedge.exe 91 PID 3772 wrote to memory of 1088 3772 msedge.exe 92 PID 3772 wrote to memory of 1088 3772 msedge.exe 92 PID 3772 wrote to memory of 1840 3772 msedge.exe 94 PID 3772 wrote to memory of 1840 3772 msedge.exe 94 PID 3772 wrote to memory of 1840 3772 msedge.exe 94 PID 3772 wrote to memory of 596 3772 msedge.exe 95 PID 3772 wrote to memory of 596 3772 msedge.exe 95 PID 3772 wrote to memory of 596 3772 msedge.exe 95 PID 3772 wrote to memory of 2172 3772 msedge.exe 96 PID 3772 wrote to memory of 2172 3772 msedge.exe 96 PID 3772 wrote to memory of 2172 3772 msedge.exe 96 PID 3772 wrote to memory of 5676 3772 msedge.exe 97 PID 3772 wrote to memory of 5676 3772 msedge.exe 97 PID 3772 wrote to memory of 5676 3772 msedge.exe 97 PID 3772 wrote to memory of 1092 3772 msedge.exe 99 PID 3772 wrote to memory of 1092 3772 msedge.exe 99 PID 3772 wrote to memory of 5388 3772 msedge.exe 103 PID 3772 wrote to memory of 5356 3772 msedge.exe 104 PID 3772 wrote to memory of 5388 3772 msedge.exe 103 PID 3772 wrote to memory of 5356 3772 msedge.exe 104 PID 3772 wrote to memory of 3060 3772 msedge.exe 106 PID 1460 wrote to memory of 1964 1460 sihost.exe 107 PID 3772 wrote to memory of 4440 3772 msedge.exe 123 PID 3772 wrote to memory of 4440 3772 msedge.exe 123 PID 3772 wrote to memory of 3696 3772 msedge.exe 114 PID 3772 wrote to memory of 3696 3772 msedge.exe 114 PID 3772 wrote to memory of 6036 3772 msedge.exe 115 PID 3772 wrote to memory of 6036 3772 msedge.exe 115 PID 3772 wrote to memory of 6036 3772 msedge.exe 115 PID 3772 wrote to memory of 248 3772 msedge.exe 116 PID 3772 wrote to memory of 248 3772 msedge.exe 116 PID 3772 wrote to memory of 248 3772 msedge.exe 116 PID 3772 wrote to memory of 5456 3772 msedge.exe 117 PID 3772 wrote to memory of 3896 3772 msedge.exe 118 PID 3772 wrote to memory of 788 3772 msedge.exe 119 PID 3772 wrote to memory of 936 3772 msedge.exe 120 PID 3772 wrote to memory of 936 3772 msedge.exe 120 PID 3772 wrote to memory of 936 3772 msedge.exe 120 PID 3772 wrote to memory of 2760 3772 msedge.exe 121 PID 3772 wrote to memory of 2760 3772 msedge.exe 121 PID 3772 wrote to memory of 2760 3772 msedge.exe 121 PID 3772 wrote to memory of 6032 3772 msedge.exe 122 PID 3772 wrote to memory of 6032 3772 msedge.exe 122 PID 3772 wrote to memory of 2672 3772 msedge.exe 126 PID 3772 wrote to memory of 2672 3772 msedge.exe 126 PID 3772 wrote to memory of 2672 3772 msedge.exe 126 PID 3772 wrote to memory of 1076 3772 msedge.exe 127 PID 3772 wrote to memory of 1076 3772 msedge.exe 127 PID 3772 wrote to memory of 5832 3772 msedge.exe 128 PID 3772 wrote to memory of 5832 3772 msedge.exe 128 PID 3772 wrote to memory of 1288 3772 msedge.exe 129 PID 3772 wrote to memory of 2384 3772 msedge.exe 130 PID 3772 wrote to memory of 2384 3772 msedge.exe 130 PID 3772 wrote to memory of 2384 3772 msedge.exe 130 PID 3772 wrote to memory of 5092 3772 msedge.exe 131 PID 3772 wrote to memory of 5092 3772 msedge.exe 131
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_e150a4d79488fd71cd5d11348fb6035e_akira_amadey_blackenergy_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Program Files\Internet Explorer\IEXPLORE.exe"C:\Program Files\Internet Explorer\IEXPLORE" 212.33.237.86/images/1/report.php2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://212.33.237.86/images/1/report.php"3⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x368,0x7fffb75ec188,0x7fffb75ec194,0x7fffb75ec1a04⤵PID:1428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1656,i,13727758485235176496,14292737806546618832,524288 --field-trial-handle=2376,i,10652347139388162328,3268523282698355338,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:114⤵
- System Time Discovery
PID:1920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,8720395712197235903,12858764376792748535,262144 --field-trial-handle=2376,i,10652347139388162328,3268523282698355338,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:24⤵PID:5724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,2234509393888813549,4120746176091918489,524288 --field-trial-handle=2376,i,10652347139388162328,3268523282698355338,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:134⤵PID:1088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,6565737782946998559,17031805960351440267,2097152 --field-trial-handle=2376,i,10652347139388162328,3268523282698355338,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14⤵PID:1840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,4228972607708154629,4069383354110567276,2097152 --field-trial-handle=2376,i,10652347139388162328,3268523282698355338,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14⤵PID:596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,9990584843779846193,17180764117197678257,2097152 --field-trial-handle=2376,i,10652347139388162328,3268523282698355338,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:94⤵PID:2172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,7500040951049910453,17287220604158576305,2097152 --field-trial-handle=2376,i,10652347139388162328,3268523282698355338,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:14⤵PID:5676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,12917344628400078814,13799670475063621395,524288 --field-trial-handle=2376,i,10652347139388162328,3268523282698355338,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:144⤵PID:1092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,16589214614425283437,9981982997446139400,524288 --field-trial-handle=2376,i,10652347139388162328,3268523282698355338,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:144⤵PID:5388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,1583727326241093400,1915036583609875330,524288 --field-trial-handle=2376,i,10652347139388162328,3268523282698355338,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:144⤵PID:5356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,16208557154276153421,9475584950177126331,524288 --field-trial-handle=2376,i,10652347139388162328,3268523282698355338,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:144⤵PID:3168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,16208557154276153421,9475584950177126331,524288 --field-trial-handle=2376,i,10652347139388162328,3268523282698355338,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:144⤵PID:3060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,6323181619218692440,2244266911636446510,524288 --field-trial-handle=2376,i,10652347139388162328,3268523282698355338,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:144⤵PID:4440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,5591840549855702727,592953868589309073,524288 --field-trial-handle=2376,i,10652347139388162328,3268523282698355338,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:144⤵PID:3696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5068,i,7804425077234016401,4882253375019569555,2097152 --field-trial-handle=2376,i,10652347139388162328,3268523282698355338,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:14⤵PID:6036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3816,i,12457470900365300619,2291511540991354464,2097152 --field-trial-handle=2376,i,10652347139388162328,3268523282698355338,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:14⤵PID:248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,11674607382470840928,8406469378797754147,524288 --field-trial-handle=2376,i,10652347139388162328,3268523282698355338,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:144⤵PID:5456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,7439454364519908320,10245921488345894684,524288 --field-trial-handle=2376,i,10652347139388162328,3268523282698355338,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:144⤵PID:3896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,13243352009663871245,7817998322280304916,524288 --field-trial-handle=2376,i,10652347139388162328,3268523282698355338,262144 --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:144⤵PID:788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5604,i,522473751190628262,11342525145948771434,2097152 --field-trial-handle=2376,i,10652347139388162328,3268523282698355338,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:14⤵PID:936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6388,i,11917052602600504899,5286212396320560347,2097152 --field-trial-handle=2376,i,10652347139388162328,3268523282698355338,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14⤵PID:2760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2860,i,611923738120206122,6344300544635753329,524288 --field-trial-handle=2376,i,10652347139388162328,3268523282698355338,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:144⤵PID:6032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5488,i,57212137657306814,123741573241523099,2097152 --field-trial-handle=2376,i,10652347139388162328,3268523282698355338,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:14⤵PID:2672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,329685505759333283,9463538011057574027,524288 --field-trial-handle=2376,i,10652347139388162328,3268523282698355338,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:144⤵PID:1076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,6914313156119807818,8995686542988180011,524288 --field-trial-handle=2376,i,10652347139388162328,3268523282698355338,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:144⤵PID:5832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5444,i,11679998225802208746,11464235390513552244,262144 --field-trial-handle=2376,i,10652347139388162328,3268523282698355338,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:104⤵
- Suspicious behavior: EnumeratesProcesses
PID:1288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6168,i,4604281762246292304,3456235378334953271,2097152 --field-trial-handle=2376,i,10652347139388162328,3268523282698355338,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14⤵PID:2384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3880,i,6879084739907050248,14653028150730202898,524288 --field-trial-handle=2376,i,10652347139388162328,3268523282698355338,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:144⤵PID:5092
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:3992
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1964
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5108
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4732
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4180
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4440
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 9.0MB
- SHA256 8594378c5e5bae85709b946d4c8221f54946f95fa91a43a6389e7308a31a91d3
- MD5 84bb703bc447bb2f4c8f542b0b62716f
- SHA1 b52a2bd8c276c71bee3e2f62d2f90a33254638b4
- SHA512 d4bb20898947de6e7699d4d0d0674c005c4a6dac83058901c14f120ef27870acb41fae39f252eb6483a5b4d32611288ddefbd5751913b019399cbc8f640e6f61
- SSDEEP 196608:vGBfW7GBfWAbvd/Kmd08gTH2qBpu1QfLIqOoQ7:UWIWAsqKTHNBpu1Qfcqy
- TLSH T146965B12A159116CD1AAD074CB8B9526EF313C8A07B4A8EF1285B6B53F77AF07F39311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 b2d903efec8d558eba6ee4ac12873ce1439014705e9d819ff4dfcffa10c4b270
- MD5 d9964ad138b9b56ea7891b8576b8a6ce
- SHA1 e8153c0a553b8b81a07f1bbc77037f1700b79956
- SHA512 7028c8597edeb715bb44be72ae48ceb181161e73b5380897f449df22a8c2b5302f664d632f2373c4c7a712d85a4b0ca70a4a062d6af265eefcac45dd99a660f1
- TLSH T1FCD092A4BB40EC0ECA91287B25B69A19B6409831BC56061A8966B0F88C517831A1B0EE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 c1d0eccd9de1dbbf6cbedcb541fa52903c78d66d4d260136bc73243b056beb74
- MD5 12c06f300a4b88646d6fda378a48455e
- SHA1 86d58840d0666ad8999198dad1983a8cfd61fd18
- SHA512 76e813720fc8cd4d829570b1b32d711d2d751540dea1fcac581dd9a5963c4e3161cffa07350cc8d5477fa02d0eb7b1c29b8ffb567f85b5a94259654ff2af3928
- TLSH T118D092A8BB40ED0ECA91287B25B59A19B6509831FC56061A8866B0E88C517831A1B0FE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 e85b42789b9608033ed426a51436c66060aa42e161801e628af67e1cb7a7e1d4
- MD5 c17d2a71443bf61d402c42cdc48c3d47
- SHA1 201282d451323ec65a3312aa4730aa6d94613b84
- SHA512 b670d3577a9798049bcb0cb5627f54d753216445ac8ee3f046bb240cec2ad172f6b1b5b7c30032fa8fc23617a676bb1554674beea43b8ab85b6b9dbf3a25245f
- TLSH T1086196900F3346E2D72075B754E26889FA7784F202CFFEDB60C0A17B9A7EB446242920
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59f340.TMP
- Size 3KB
- SHA256 1d955a606083ddac9f38c0a787ae7f5d015f4205d653ed4eafd9c3112ad248e8
- MD5 b7f5ea608b5e5b3f584f5d91364703af
- SHA1 5c185b4ebeac0c7cc00291a1058938cf5feeef0f
- SHA512 b95d8f370f4dd28c379f2b3f04b821ed03e677ecc2e5c99b67bc1e2c79e21c242dfb099bc9f886f19f4fc5d8814a532f497059c4269096c3e423dc5eedf2dd34
- TLSH T19161A8900F3346D2D720757754E26889FA7794F502CFFEDB60C0A17B9A7EB446741920
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 c383be12cf2e2150d87fe34b3eb6fa6de96ab7337603a5fcbe72f67344354e68
- MD5 da28d643b3c4b26cf74fb4e7294e456d
- SHA1 3c104fadeaf974b6664275735d1675f4e6a5b9b8
- SHA512 969402dcb83d6cc1a0e270a72d9407a6d47ea4dcedece53635a42d27b33ce333b28ed5a76756dd91e8b39e235441faaa09bd7cf3a1fad0619eac806fb480c1f9
- TLSH T12C51CEF3C3E4866EC91196F0AA187E2BCE1D0915432C3D5AC9E4EF5B93E2471E141A5F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 14KB
- SHA256 1587e5df9251e0a7c367533e3b7710ec5486ce6c9eb9ffefb7af73d20d4dc5fb
- MD5 de7caea9c43e4bbfb14ef10b4b25a82f
- SHA1 f16597bfe7f02f37067da88269d98acd5f95e64c
- SHA512 f195d9021acae9a453dd4b70fa3c1bdada0ff58f6cc88648b93263783f51fb2d1d3cd218bbfce22b33f0641d0dd5f44799898d9e5cf9dccc5f1eba77c7acce11
- SSDEEP 192:sxRVSRTyM/jK1Ml8wCs/fn8soOa/3ZPUzoA8pi/tk6+WNIYnltNGyIUIgDlJ:sxRVSb8s/fn8sopJP1i/jIEzb
- TLSH T1CC62C916A6285977CCDBD21DFA517F53D6F81463A2901E44AAFCCA0C05E7AED221382F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 11KB
- SHA256 dd4331e4b2307f29105a9d36c2afc6d7bfeca060649bb7f5b1eccb4a177bbc17
- MD5 8bf15415576d2a1ba46b3827c48c5714
- SHA1 6adad4d35b8c436e966e5388ab8d2d20fb7b06d6
- SHA512 68f63f3a828f2522616a1e1667b2953e0ce8b1f6e2214d8b558ddcf35e653b70dff350c0439cda5f3329791828b34dadfbef5c4b945b96055e185f696a9eee85
- SSDEEP 192:sxRESRXCs/fn8s5Oa/3rgdazoA8pi/tk6+WNIYnltNGyIUIgFJ:sxRESAs/fn8s5pkZi/jIEzv
- TLSH T1F3329716AA68993B8CCBD21DFB55BF53D6F91033A1941E44EAFC8A0C05EB6DD220741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 14KB
- SHA256 eb3ae01631e659199af2098b8d4128144f78734b56294036dd5356df37abe443
- MD5 9eeb624a7544fd9d3373999e9b476935
- SHA1 2dc42ec29f380c21314a092b4980c8ca8f7e1297
- SHA512 ebf68d08619c0202baf41f86bd8c0b3a5b8a91be4c3cc18a01e734db808932bcf904263996f8e5f82b88e91aa1d506d46caab2758f6549638db4ffcff5f7c2d9
- SSDEEP 192:sxRVSRTyM/jK1Ml8UQgCs/fn8soOa/3ZPczoA8pOP/t06+WNIYnLtNGyIUIgDlJ:sxRVSbq3s/fn8sopJPNQ/TIizb
- TLSH T17C62B816A5285977CCDBD21DFA51BF53D6F81473A2901E44AAFCCA0C05E7AED221382F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 27KB
- SHA256 f38066de82cd8e6bcf0019f8702291718c94c986d3af7a721b8834e356c1d1f0
- MD5 00e00242719ec96987bced021540e1eb
- SHA1 436c09b777b9c2614b859e98e4ccab5441e0acbd
- SHA512 819cd2781655c5b7c12aa68a3cc732a9057c99c1ecab9cc494d5292b1ebd7a761d4d2680e9e09463d3bb4cb61a8d41a5fa488c2dde5768aeac92b396ead36b55
- SSDEEP 768:JoYhvs7pLuL7/2Wgqcfiw8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJXgcproJvlBq:JoYhvQE7/2Wgqcfiwu1jayQcCJva
- TLSH T11BC2DB2B740CCB7E4F804ADDE8197E9A6D6802CB9698CD8047FE995C03C77EE511A4DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 32KB
- SHA256 0249f0429b1688897ded8679cb5aeac1aca7d1b762ecea7f18e0ead55535f21e
- MD5 965b906ad38c72f0d2f0b6883b7a03ca
- SHA1 403cb8431697d963a71d51a1cb01a59548299661
- SHA512 5bd75b1146020373f8e94173fc34be07714d23885a731fdae0cd090bbc2ba93f6de1799fbb5e82684b4330d760123920893868b3b47c7352ae5b38c054320aa5
- SSDEEP 768:Jl6hhs7pLuL7b2WgqcfHw8F1+UoAYDCx9Tuqh0VfUC9xbog/OVdS3XguproMRzNa:Jl6hhQE7b2WgqcfHwu1jauS3QuCMRzE
- TLSH T182E2EB3B780CCB7E4F804A9CEC29799A6DE801CB96D8CD5447FA894C03C67EB511A5DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\bb878386-c3ca-4ca0-b711-549797a827ac.tmp
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 38KB
- SHA256 80f32cf606ce4437b570e325a44de7b8d5f47cdc101db4cecdeb8a7b2fde95f6
- MD5 6a26e6cffe392afce4f4f13526ff0a18
- SHA1 af3cfedc496af2fcc43db157176bca6f11dd9b61
- SHA512 ae02822e9a7e7d081b0d9b679158d86992453fd2be260891870e8df00dfd3778f6344ec7d42eb25cd5d7ba1cae5eb77ff0f614618eeaa78893f5b050e5dc32e0
- SSDEEP 768:arv+4UNbdg3VKN2YreNSLfWf0tyfPX7DGFzoqPcNMCNFI534Z:absby3cpfWfLfP3WkqPaaeZ
- TLSH T1CD03AEB5A8B899374CF7C288B75B3657BFF0116345841B54D8E96B0E428F2EE130F926
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 38KB
- SHA256 d588ed66bb069d162c90f1726df5bf5082eb9464b8b05a7cf67d180b4e924a17
- MD5 64c7161c14068d86f52001c4e0542a29
- SHA1 421429e2bd35de883e64ac2893da87862fbeef6e
- SHA512 399ef19ce6da519fc2a6bb0696d8dca3a1ce4421f5192144b72c03bd34a85c1e745af963577eebb18bed760da58a8dee3e7d6b83c55c7ba1846c2b84647c1ec6
- SSDEEP 768:gFjj+923DwgaKxxVfWf0tyfAX7DGFzoqPcNMCNFIb9Mo:t923dfWfLfA3WkqPaab+o
- TLSH T1AA037D7ADCA4CA3B8DE3C789B716365BDEE001A785886DC4D9D95E4D01CB2ED030BD15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 38KB
- SHA256 7c0077d07d914360a00b771e2cb6609bd524f771380439232c277cb0d1a486ad
- MD5 47e170ae4d2dc0945eac101ad4085c6d
- SHA1 5a9adc0fbdfc627a63579b9f523320702ee53e3b
- SHA512 a2b0ab8cdd75549ab364eb6121c672115eb34d6b00ab6d26e0eab64e7be2f158cfe7b454ca145f02d2b8529ec527824a4645bccdfba4607ec50ce2044e559907
- SSDEEP 768:Vrv+4UNbda3vsYreNSLfWf0tvX7DGFzoqPcNMCNZgeVH1SkM:Vbsb43jpfWfi3WkqPaKEH1Y
- TLSH T1F703BFB6ACB445378CE3C689B75B36076FF0116746440B94D8EE2F0E879F5AD130BA26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 35KB
- SHA256 e44a1f6994547907006be600d99b80bcb175794224b581dc6c8be1773b007a5b
- MD5 091fb04cc81c6103e9d53f4171fc5534
- SHA1 c4d99142a5bf1d9a1f0a5d03172dfa7727bb0b9e
- SHA512 18174446b0301b50b00db3245987fd2800359352c755ed68a0d8cf297693a6b6beedd522a31a7bc4da605da4fe13587cb0a615f83f9b6f5d54e8c9ff265b0fd3
- SSDEEP 768:nj+923VKx2YreNSLfWf0tyf3X7DGFzoqPcNMCNFIb9Mo:K923CpfWfLf33WkqPaab+o
- TLSH T1D9F2AFB5ACA44D374CE3C689B72A3B5BEFF0126741841E44D8ED6F0E46CB2AD070B925
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 132B
- SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
- MD5 f5a3b29f9a977e23d6ca4eb728238f9f
- SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
- SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
- TLSH T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 252B
- SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
- MD5 551baa462724351873ccd655a8b64ea3
- SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
- SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
- TLSH T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ff0fa252-1422-468e-b23f-7b3a8a164009.tmp
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 607B
- SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
- MD5 76b78ed7ff6273215b134d6a6488035d
- SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
- SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
- TLSH T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 599B
- SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
- MD5 658ab8c32d4cc5deb36ac5f63da4658b
- SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
- SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
- TLSH T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3772_1302412853\CRX_INSTALL\content_new.js
- Size 10KB
- SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
- MD5 3de1e7d989c232fc1b58f4e32de15d64
- SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
- SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
- SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
- TLSH T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
- MD5 SHA1 SHA512 SSDEEP TLSH