Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/07/2026, 22:41
Behavioral task
behavioral1
Sample
2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
- Size 19.6MB
- Sample260708-2mfflsas7n
- SHA256 ec209801cd57c0ba751265432026207158d6e183d9842a37505cbcaf603a2e23
- MD5 10193477cc9ac8f1382b70d2ee3ef599
- SHA1 5c3c890e78039e0a6eac8848416571d97238e051
- SHA512 6da3b87b13f7570cb450c75277775d6837c1d077b7a1d4a8134d5ae5271119c14084e85b3355fe101e1506c53402ac0b8eb9fc69cb303aa098e73627f66fd086
- SSDEEP 196608:ZaHxXMZ6+oEKmd00dFdUDX56CWyZ/K0ttYVAATYTfATfQoo:ERXMo5zqWYdyZ/K0ttYZTUk3o
- TLSH T1AD276B03F29784AAE0A9D138C921863597313F6E87B381DF791871D8EA376D37639712
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Custom signatureDetects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x000c000000024269-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Custom signatureDetects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x000c000000024269-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\fontdrvhost.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\quickassist.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SearchIndexer.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\autoconv.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msra.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\winrshost.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dllhst3g.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tttracer.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\certreq.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fc.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\compact.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\takeown.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\upnpcont.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\auditpol.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dllhost.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sort.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dccw.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cipher.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\hh.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tar.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\certreq.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cscript.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Netplwiz.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sdiagnhost.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fc.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mobsync.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\more.com 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\perfhost.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe -
resource yara_rule behavioral1/memory/3284-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x000c000000024269-5.dat upx behavioral1/memory/3284-304-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/3284-3216-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javah.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\show_third_party_software_licenses.bat- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\ieinstal.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmprph.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-tasklist_31bf3856ad364e35_10.0.19041.1_none_e888ea072e0fed05\tasklist.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.19041.264_none_29367e02ede71097\wbadmin.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-synchost_31bf3856ad364e35_10.0.19041.746_none_477a57e55b61aba8\r\SyncHost.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-core_31bf3856ad364e35_10.0.19041.1110_none_29d8ec742bfd8b13\fhmanagew.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsselfhealingsvc_31bf3856ad364e35_10.0.19041.746_none_59e1ce71631fef8f\f\WmsSelfHealingSvc.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netbt_31bf3856ad364e35_10.0.19041.746_none_48b2bd808a742e25\r\netbtugc.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-where_31bf3856ad364e35_10.0.19041.1_none_1e18f0f5b1e8db7d\where.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_edmgen_b77a5c561934e089_4.0.15805.0_none_ae80a3049486a75f\EdmGen.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.964_none_dddeea757b7fbba7\r\ssh-keyscan.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-core_31bf3856ad364e35_10.0.19041.264_none_92ee62a6d5b1c18a\fhmanagew.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssvc_31bf3856ad364e35_10.0.19041.746_none_9ebd3ef9f0c794b5\r\WmsSvc.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.19041.1_none_02ef1556ab50e6d8\wabmig.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_10.0.19041.1_none_efd4c696d660bdad\vbc.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-dtc-tracing_31bf3856ad364e35_10.0.19041.1_none_cdd05846922cdabb\msdtcvtr.bat- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.19041.1_none_53029e0f94a11c6d\WUDFCompanionHost.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1_none_ac040ccaa73c8c1b\user.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_330dfb2b06b21af6\tree.com- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\r\relog.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ttings-removedevice_31bf3856ad364e35_10.0.19041.746_none_915a78ef54321214\r\SystemSettingsRemoveDevice.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\msil_presentationfontcache_31bf3856ad364e35_10.0.19041.1_none_679d42cd97347ace\PresentationFontCache.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_4.0.15805.0_none_646d7347043be71c\aspnet_regbrowsers.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\r\ScriptRunner.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_db09942beaf4fdfa\r\Microsoft.ECApp.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\f\hvsiproxyapp.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.19041.746_none_47ec758ff9f94aa6\TapiUnattend.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1266_none_f5ba41fece31d7fe\SpatialAudioLicenseSrv.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_netfx4-ilasm_exe_b03f5f7f11d50a3a_4.0.15805.0_none_a790160b3d9e046c\ilasm.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.19041.1202_none_cd68049c9076546f\mighost.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmagent_31bf3856ad364e35_10.0.19041.1_none_faedbaa2bd7d01c2\MDMAgent.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.19041.1266_none_e488d49c8a22d21e\r\winlogon.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_hyperv-commandline-tool_31bf3856ad364e35_10.0.19041.1_none_e2f75fda217d5015\hvc.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.19041.1_none_cc9d1ee374152f46\UserAccountBroker.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.1202_none_b918e36ffc7a6ffe\f\eshell.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.19041.1266_none_8f272afdd624490f\sppsvc.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..alservices-webproxy_31bf3856ad364e35_10.0.19041.746_none_0f70f5a5b71ec478\r\TSWbPrxy.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.19041.1_none_8119ed75508e4ffe\wevtutil.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.19041.546_none_70569b662ddb706c\r\CameraBarcodeScannerPreview.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-isoburn_31bf3856ad364e35_10.0.19041.746_none_c42bf1ebf80a8661\f\isoburn.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1110_none_20a89186aedb6af7\msinfo32.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-openwith_31bf3856ad364e35_10.0.19041.746_none_4b1a1978d1832a5f\r\OpenWith.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_23e2379a6f03d0cb\gpresult.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\r\AppVNice.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.1202_none_7cdad2e52790705d\r\wdagtool.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.19041.264_none_098f3a6c3a48359d\f\printfilterpipelinesvc.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-write_31bf3856ad364e35_10.0.19041.1_none_1573dfb37c7563ca\write.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bootux.deployment_31bf3856ad364e35_10.0.19041.746_none_1c0a97992f105d4b\bootim.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-diagnostic-results_31bf3856ad364e35_10.0.19041.1_none_ded7404f8608d19f\MdRes.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userinit_31bf3856ad364e35_10.0.19041.1_none_9219c799710d7e86\userinit.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.19041.1_none_8bc62bc63a30d6fb\nslookup.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.19041.1_none_d67c2e3d05659825\winrs.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\f\AppVStreamingUX.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.19041.207_none_8d07de31084775c6\r\wuauclt.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.207_none_e2f2dfeea7fa44fc\r\icsunattend.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.19041.746_none_726cc4a1ebcb1c1e\f\wlrmdr.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.19041.746_none_2b8b5a41940eac9f\r\prevhost.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ldifde_31bf3856ad364e35_10.0.19041.1_none_7ab9b2c3efd290ff\ldifde.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dfsvc.exe 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1_none_2537dd4c480ec91b\rasphone.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spectrum_31bf3856ad364e35_10.0.19041.153_none_59d1094dec9b8480\Spectrum.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-workspaceruntime_31bf3856ad364e35_10.0.19041.746_none_045e85893c117e35\r\wksprt.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensordataservice_31bf3856ad364e35_10.0.19041.1_none_b3f4f49ac9993d28\SensorDataService.exe- 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_10193477cc9ac8f1382b70d2ee3ef599_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3284
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 20.1MB
- SHA256 798721248252afceedb32a3453ddd6b6dc9a1c8b47fb3b6667326c48f6c50c5a
- MD5 416d1ae8d67f22e6eadcab90c248c9e8
- SHA1 cb35a8e6976fc7f6017ecee36ad2ec534f535bd3
- SHA512 80f209fd2424a5158f99eb3884bd4139946fb36e02c39ff0776907df4a2a99489d7360cf8fbb5d85618bc9f26d13bc2091a6469fc0db01c41e792d11f5286489
- SSDEEP 196608:ZaHxXMZ6+oEKmd00dFdUDX56CWyZ/K0ttYVAATYTfATfQoSo3:ERXMo5zqWYdyZ/K0ttYZTUk3F3
- TLSH T1B1276B03F297846AE0AAD138C921863597313F6E87B381DF7518B1D8EA376D37639712
- MD5 SHA1 SHA512 SSDEEP TLSH