Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/08/2026, 00:56
Behavioral task
behavioral1
Sample
2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
- Size 10.7MB
- Sample260810-bakaxsdc68
- SHA256 bda3f2065953dc55c726d4193374a258ae68cee893af2ea0d9e129ed49d0a0ab
- MD5 5ef7cc7d8fe227d7ccdfd4ec318a672b
- SHA1 b23228a4638d8bb7315e2b6c67d5353f09e1c7cd
- SHA512 e4340d9f1dffea944c1a06524ce4ac3d1f6cbc091e910cab99ca47242554d779573725637303e191b622dd735c19d59791e5a1f837894a5f89d240db59df4ed6
- SSDEEP 98304:Z3qqUHxqPF4VMNP6TUyL6HtItjkgcfwWQtZ/K0tGOFWVRuLftCTP:ZaHxXMZ6466HtItoKWyZ/K0ttYVAATP
- TLSH T16DB61903F253545ED246D53489298A32A6213F6D47F358FFB858F2E4EA365E33638B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\print.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\clip.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\forfiles.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\psr.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\at.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\convert.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\icacls.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mfpmp.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wscadminui.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\help.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\user.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cacls.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dplaysvr.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rrinstaller.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SettingSyncHost.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dialer.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dtdump.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\raserver.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\format.com- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TapiUnattend.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\winrs.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mmgaserver.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cmmon32.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mshta.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tasklist.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\gpscript.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\stordiag.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe -
resource yara_rule behavioral1/memory/960-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x00110000000243b9-5.dat upx behavioral1/memory/960-556-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/960-3232-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{E3C293D9-92A2-430F-A573-2511CDB7A4F8}\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\show_third_party_software_licenses.bat 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\firefox.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\7-Zip\Uninstall.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\7-Zip\7zFM.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..s-datausagehandlers_31bf3856ad364e35_10.0.19041.153_none_dbdeec75cdd2a4d1\f\DataUsageLiveTileTask.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\f\ssh-keygen.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.19041.1266_none_b2317523477fbd48\f\lsass.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\SecHealthUI.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-waasmedic_31bf3856ad364e35_10.0.19041.1165_none_a82485b8f343811f\f\WaaSMedicAgent.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\f\SenseCE.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_4de8bd849baaa96f\WerFaultSecure.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.546_none_9e094af3987dca57\r\svchost.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_a4f6113bccc284b7\logoff.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..utermanagerlauncher_31bf3856ad364e35_10.0.19041.1_none_4406801793afabed\CompMgmtLauncher.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.19041.1_none_5c015a65c60d8097\hnsdiag.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.19041.1_none_f4db83a870443aa2\CloudExperienceHostBroker.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.19041.1_none_dc058eb644f1f90b\bfsvc.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..onentpackagesupport_31bf3856ad364e35_10.0.19041.746_none_3db5b5ee37a4dee7\f\CompPkgSrv.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-newdev_31bf3856ad364e35_10.0.19041.1_none_c76758d7f0069e2e\ndadmin.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_2dfbb21bd5166adc\f\Taskmgr.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..mnotificationbroker_31bf3856ad364e35_10.0.19041.746_none_a5ade2e84580e250\f\DmNotificationBroker.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpdmc-ux_31bf3856ad364e35_10.0.19041.746_none_cc5cbb9556301da3\f\WMPDMC.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.19041.1202_none_324ea383dbfddeb9\mavinject.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.19041.1_none_d7cac98c90803a6a\auditpol.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-windows-minwin_31bf3856ad364e35_10.0.19041.173_none_2dc175215ae8ec39\r\winload.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.19041.746_none_d22800313aa7eb5c\r\regedit.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-waasmedic_31bf3856ad364e35_10.0.19041.207_none_11794cc79cc85d1d\WaaSMedicAgent.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.844_none_c171e0be75e709de\r\dsdbutil.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.1266_none_5fd6523a3130632d\r\systemreset.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.19041.1202_none_dfaaff89afe4f3d4\r\vdsldr.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.906_none_9204c42a031e28cf\r\appcmd.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1_none_2f8c879e7c6f8b16\rasphone.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.19041.1288_none_6c70124c60e2b4ef\vmcompute.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\SenseSC.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.19041.964_none_510ebdd9292eed06\diskpart.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..-network-management_31bf3856ad364e35_10.0.19041.1_none_7a53549f2797bc70\nmbind.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icm-dccw_31bf3856ad364e35_10.0.19041.1_none_db3463b66241962d\dccw.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.19041.1_none_8bc62bc63a30d6fb\nslookup.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-at_31bf3856ad364e35_10.0.19041.1_none_02f2b1ed23420c30\at.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.1266_none_cfec8db821d83671\winload.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.1165_none_1ea3d2b20faf7de3\f\fontdrvhost.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runonce_31bf3856ad364e35_10.0.19041.1202_none_8a7b0186743e499b\f\runonce.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..egistration-cmdline_31bf3856ad364e35_10.0.19041.1202_none_b3f538f2c4a648b2\r\dsregcmd.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\a267614236e5d701639700001815341f.UwfServicingSvc.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..pture-wmiv2provider_31bf3856ad364e35_10.0.19041.84_none_dc38e61c21c1b710\NetEvtFwdr.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_bd2b0ef5b58e1540\cscript.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.19041.1266_none_e8d910c7c702b558\MusNotificationUx.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.19041.153_none_ff44cfa7cb529ce3\r\lpremove.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.19041.423_none_12ca604b48f8d3fb\f\CapturePicker.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmagent_31bf3856ad364e35_10.0.19041.1266_none_b9c280a4d350d170\f\MDMAgent.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.1266_none_fb98272b39a47240\f\MoUsoCoreWorker.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.84_none_ffbdc333a0778274\f\hvsimgr.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.19041.746_none_4028b8f4f6c0b829\f\wpr.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-ui_31bf3856ad364e35_10.0.19041.746_none_2c2bcd67e9d4665c\f\FileHistory.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\r\hvsiproxyapp.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.264_none_513ab7577ca57427\SpeechModelDownload.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.19041.264_none_31474dbf12ce5adc\XblGameSaveTask.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.0.19041.1_none_8a11dbe22c9bf6e1\msfeedssync.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.19041.84_none_8a067925a612632c\f\ApproveChildRequest.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runlegacycplelevated_31bf3856ad364e35_10.0.19041.1_none_d151c6f3c90b1e0b\RunLegacyCPLElevated.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:960
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 11.2MB
- SHA256 0ee09ac5604777b8aa7f9dbb61226f37f03ac428318ec420dd6bd54c5d76094e
- MD5 bf7337bf500ac286d78924bff1b7e9ea
- SHA1 89196f40dfef7e98f80b3caf64635be0b16cbc66
- SHA512 bf63e71eb2509985815a8db1d6cc6ac67575ca3325d973c68e168b8e48bfae6876c4ecaee611984a4e37919aadbf283427386df6fc13be9ae48c03f4468d051a
- SSDEEP 196608:ZaHxXMZ6466HtItoKWyZ/K0ttYVAATLoF:ERXMoB6YoFyZ/K0ttYZT0F
- TLSH T1C2C62A03F263546ED246D53485198A32A6213F6D47F358FFB848F2E4EA365E37638B21
- MD5 SHA1 SHA512 SSDEEP TLSH