Analysis
- max time kernel
149s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 07:51
Behavioral task
behavioral1
Sample
2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
- Size 9.2MB
- Sample261002-jpvdfazwf1
- SHA256 660fb029a116faef03373e78329baa3a76c9b738cf696b3911b88794ecc7f1eb
- MD5 9c1ba3e488f50abb32aef61441390174
- SHA1 0a0c63c469983b736d3e82b0d00a3d87b935ffdf
- SHA512 e9cacc08a489320bfb77cbd47e340720d51c332f3b5ac9e2740de1b6fcb4bb741cbe2fd96a99fc1b6511d8c12d116b6a91be12819a06cec9cb13f9540c12c49f
- SSDEEP 196608:ski9XwgwAMtPdX6eWyZ/K0ttYVAATtoVcI0:j+AjxkZyZ/K0ttYZTiG5
- TLSH T14DA66B13F2E501A5D06AD175CF6293219BB27C694BF1A2DF224472D82F73AD07B39722
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Futurax 3 IoCs
resource yara_rule behavioral2/memory/4756-0-0x0000000000400000-0x0000000000413000-memory.dmp family_futurax behavioral2/files/0x000d00000001c556-4.dat family_futurax behavioral2/memory/4756-264-0x0000000000400000-0x0000000000413000-memory.dmp family_futurax - Detects executables packed with MEW 3 IoCs
resource yara_rule behavioral2/memory/4756-0-0x0000000000400000-0x0000000000413000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral2/files/0x000d00000001c556-4.dat INDICATOR_EXE_Packed_MEW behavioral2/memory/4756-264-0x0000000000400000-0x0000000000413000-memory.dmp INDICATOR_EXE_Packed_MEW - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ati display driver = "ÔN@" 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
ioc Process \??\F:\ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Fondue.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\instnm.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mspaint.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SearchIndexer.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\gpscript.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mode.com- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\newdev.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RmClient.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cmdl32.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\help.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mstsc.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RmClient.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wowreg32.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\chkntfs.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mfpmp.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\F12\IEChooser.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PATHPING.EXE_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wsmprovhost.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\eudcedit.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TpmInit.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\winrshost.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\DWWIN.EXE_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\shrpubw.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\colorcpl.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dpapimig.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\regedt32.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\regini.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tcmsetup.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\isoburn.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\recover.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\srdelayed.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sxstrace.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tzutil.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\verifiergui.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\comp.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\OposHost.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RpcPing.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\control.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\hh.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\reg.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Mail\wab.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\MpDlpService.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Mail\wab.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Mail\wab.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\show_third_party_software_licenses.bat 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssadmin_31bf3856ad364e35_10.0.26100.1150_none_6064a5e6e18d90dc\vssadmin.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsmanager_31bf3856ad364e35_10.0.26100.1591_none_b7cec9dc382cb5f1\WmsManager.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_10.0.26100.1_none_6b60acbaf3301f6c\_isdel.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..pertiescomputername_31bf3856ad364e35_10.0.26100.1_none_37bb8503d92b5a7e\SystemPropertiesComputerName.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.26100.1591_none_2177acc33f68854a\r\IMESEARCH.EXE- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.26100.1591_none_38d18bb2a54a6d36\WUDFCompanionHost.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.26100.1591_none_f467d2d98b46d418\r\mighost.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.26100.1591_none_300773bc06dfa2f0\NarratorQuickStart.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ngc-trustlet_31bf3856ad364e35_10.0.26100.1591_none_819ed9883e248be5\NgcIso.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.26100.1150_none_ff5cc17171576ed5\RdpSaProxy.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1000_none_5f95cc5803dfafcd\r\WMIADAP.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..utermanagerlauncher_31bf3856ad364e35_10.0.26100.1150_none_29fcc30aa43c0df5\CompMgmtLauncher.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_installutil_b03f5f7f11d50a3a_10.0.26100.1_none_1fb74192d4a9efd6\InstallUtil.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.26100.1150_none_48349abe916de6bd\PasswordOnWakeSettingFlyout.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.26100.1591_none_67fcd9ee18eb970e\upnpcont.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.26100.1591_none_052b2ae1ad719889\r\FileExplorer.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\r\rmttpmvscmgrsvr.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..on-filedialogbroker_31bf3856ad364e35_10.0.26100.1150_none_76334e5b2ee0ae62\FileDialogBroker.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_netfx4-servicemodelreg_exe_b03f5f7f11d50a3a_4.0.15912.0_none_1695d375c2f4d597\ServiceModelReg.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.26100.1150_none_24124d3c551588ce\r\bcdedit.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.26100.1150_none_c0871c4af90b9611\r\ImagingDevices.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..pture-wmiv2provider_31bf3856ad364e35_10.0.26100.1591_none_8055c40aa3ab24a2\NetEvtFwdr.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printdialog.appxmain_31bf3856ad364e35_10.0.26100.1591_none_20d2a02f892fa68f\PrintDialog.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unattendedjoin_31bf3856ad364e35_10.0.26100.1_none_b0088cffd56138b1\djoin.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx35linq-csharp_31bf3856ad364e35_10.0.26100.1_none_141f576a7cb67351\csc.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_netfx-ngen_exe_b03f5f7f11d50a3a_10.0.26100.1_none_1bfc8ab3fe2cc7ba\ngen.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_wp.exe 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.26100.1591_none_ffa10fa7b29d4d78\r\hvsiproxyapp.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runonce_31bf3856ad364e35_10.0.26100.1591_none_b17acfc36f0ec944\r\runonce.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.26100.1150_none_35ab52a6398cdc65\SnippingTool.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsuseragent_31bf3856ad364e35_10.0.26100.1150_none_fcc2db11075b9319\WmsUserAgent.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.26100.1591_none_e2b02f289d06cfcc\IMEWDBLD.EXE_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\ROUTE.EXE_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.26100.1301_none_b74a2f61ab292fb3\WPDShextAutoplay.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.26100.1591_none_80585f5752dd6955\r\EoAExperiences.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.26100.1591_none_37c9b95250fac754\resmon.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\unsecapp.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.26100.1_none_9187ca465243b700\schtasks.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.26100.1591_none_08d4e4725982e790\EaseOfAccessDialog.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winhstb_31bf3856ad364e35_10.0.26100.1_none_304e610ba6542e51\winhlp32.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_caspol_b03f5f7f11d50a3a_4.0.15912.0_none_c8bf902cd831831a\CasPol.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_multimedia-windows-..n-playready-desktop_31bf3856ad364e35_10.0.26100.1150_none_d50cb16c6bb0fec5\prproc.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssvc_31bf3856ad364e35_10.0.26100.1591_none_5c83ef5441ff2734\WmsSvc.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_10.0.26100.1_none_554fc0a594820cda\WFServicesReg.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseCM.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_wpf-presentationfontcache_31bf3856ad364e35_10.0.26100.1_none_028d3f2f7abaac3f\PresentationFontCache.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_9345e45e568242fb\r\IMJPDCT.EXE- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-newdev_31bf3856ad364e35_10.0.26100.1_none_18be9e06ed967433\newdev.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxmain_31bf3856ad364e35_10.0.26100.1591_none_5e31b7c284234e98\r\FilePicker.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.26100.1150_none_1da178eaf53e7c4d\PrintBrmEngine.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.26100.1591_none_38f087fa4098616b\ctfmon.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1591_none_ee7cf88ee4c18aba\wscript.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_10.0.26100.1591_none_269260d4786a1186\wpnpinst.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-secinit_31bf3856ad364e35_10.0.26100.1_none_84ab98d8358ad394\secinit.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsselfhealingsvc_31bf3856ad364e35_10.0.26100.1150_none_17cfd41bb43a934d\WmsSelfHealingSvc.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_54e0c846cffbbd55\LaunchTM.exe- 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe_ 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4144 msedge.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" IEXPLORE.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1704430598-3087477806-3297458608-1000\{A6BBBFFE-8789-48CB-83B3-242F9834304C} msedge.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2724 msedge.exe 2724 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 5472 msedge.exe 5472 msedge.exe 5472 msedge.exe 5472 msedge.exe 5472 msedge.exe 5472 msedge.exe 5472 msedge.exe 5472 msedge.exe 5472 msedge.exe 5472 msedge.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5472 msedge.exe - Suspicious use of WriteProcessMemory 61 IoCs
description pid Process procid_target PID 4756 wrote to memory of 3372 4756 2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe 89 PID 3372 wrote to memory of 5472 3372 IEXPLORE.exe 90 PID 5472 wrote to memory of 3360 5472 msedge.exe 91 PID 5472 wrote to memory of 4144 5472 msedge.exe 92 PID 5472 wrote to memory of 1032 5472 msedge.exe 93 PID 5472 wrote to memory of 6008 5472 msedge.exe 94 PID 5472 wrote to memory of 1032 5472 msedge.exe 93 PID 5472 wrote to memory of 1032 5472 msedge.exe 93 PID 5472 wrote to memory of 6008 5472 msedge.exe 94 PID 5472 wrote to memory of 3876 5472 msedge.exe 96 PID 5472 wrote to memory of 3876 5472 msedge.exe 96 PID 5472 wrote to memory of 3876 5472 msedge.exe 96 PID 5472 wrote to memory of 5536 5472 msedge.exe 97 PID 5472 wrote to memory of 5536 5472 msedge.exe 97 PID 5472 wrote to memory of 5536 5472 msedge.exe 97 PID 5472 wrote to memory of 4676 5472 msedge.exe 98 PID 5472 wrote to memory of 4676 5472 msedge.exe 98 PID 5472 wrote to memory of 4676 5472 msedge.exe 98 PID 5472 wrote to memory of 1960 5472 msedge.exe 99 PID 5472 wrote to memory of 1960 5472 msedge.exe 99 PID 5472 wrote to memory of 1960 5472 msedge.exe 99 PID 5472 wrote to memory of 1388 5472 msedge.exe 100 PID 5472 wrote to memory of 1388 5472 msedge.exe 100 PID 5472 wrote to memory of 1812 5472 msedge.exe 102 PID 5472 wrote to memory of 2968 5472 msedge.exe 103 PID 5472 wrote to memory of 1812 5472 msedge.exe 102 PID 5472 wrote to memory of 2968 5472 msedge.exe 103 PID 5472 wrote to memory of 4580 5472 msedge.exe 105 PID 5472 wrote to memory of 4688 5472 msedge.exe 106 PID 5472 wrote to memory of 4688 5472 msedge.exe 106 PID 5472 wrote to memory of 3116 5472 msedge.exe 109 PID 5472 wrote to memory of 3116 5472 msedge.exe 109 PID 5472 wrote to memory of 3116 5472 msedge.exe 109 PID 5472 wrote to memory of 2344 5472 msedge.exe 110 PID 5472 wrote to memory of 2344 5472 msedge.exe 110 PID 5472 wrote to memory of 5488 5472 msedge.exe 111 PID 5472 wrote to memory of 5488 5472 msedge.exe 111 PID 5472 wrote to memory of 5488 5472 msedge.exe 111 PID 5472 wrote to memory of 2644 5472 msedge.exe 112 PID 5472 wrote to memory of 2644 5472 msedge.exe 112 PID 5472 wrote to memory of 2644 5472 msedge.exe 112 PID 5472 wrote to memory of 6032 5472 msedge.exe 114 PID 5472 wrote to memory of 3304 5472 msedge.exe 115 PID 5472 wrote to memory of 2920 5472 msedge.exe 116 PID 5472 wrote to memory of 4448 5472 msedge.exe 117 PID 5472 wrote to memory of 4448 5472 msedge.exe 117 PID 5472 wrote to memory of 4448 5472 msedge.exe 117 PID 5472 wrote to memory of 3892 5472 msedge.exe 118 PID 5472 wrote to memory of 3892 5472 msedge.exe 118 PID 5472 wrote to memory of 5476 5472 msedge.exe 122 PID 5472 wrote to memory of 5476 5472 msedge.exe 122 PID 5472 wrote to memory of 3032 5472 msedge.exe 123 PID 5472 wrote to memory of 3032 5472 msedge.exe 123 PID 5472 wrote to memory of 1476 5472 msedge.exe 124 PID 5472 wrote to memory of 1476 5472 msedge.exe 124 PID 5472 wrote to memory of 2724 5472 msedge.exe 125 PID 5472 wrote to memory of 1412 5472 msedge.exe 126 PID 5472 wrote to memory of 1412 5472 msedge.exe 126 PID 5472 wrote to memory of 1412 5472 msedge.exe 126 PID 5472 wrote to memory of 1772 5472 msedge.exe 127 PID 5472 wrote to memory of 1772 5472 msedge.exe 127
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_9c1ba3e488f50abb32aef61441390174_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Program Files\Internet Explorer\IEXPLORE.exe"C:\Program Files\Internet Explorer\IEXPLORE" 212.33.237.86/images/1/report.php2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://212.33.237.86/images/1/report.php"3⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x358,0x7fff3a2ec188,0x7fff3a2ec194,0x7fff3a2ec1a04⤵PID:3360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1700,i,6043258613935432699,10468352187227389628,524288 --field-trial-handle=2252,i,4666340255700905006,1399237564582949744,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:114⤵
- System Time Discovery
PID:4144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,9936611722611633373,4911705153734724272,262144 --field-trial-handle=2252,i,4666340255700905006,1399237564582949744,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:24⤵PID:1032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,1580714128259838034,13565226558117542991,524288 --field-trial-handle=2252,i,4666340255700905006,1399237564582949744,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:134⤵PID:6008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,3904324243451778343,4533005966630920202,2097152 --field-trial-handle=2252,i,4666340255700905006,1399237564582949744,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14⤵PID:3876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,3814261751843598267,1805011667631742728,2097152 --field-trial-handle=2252,i,4666340255700905006,1399237564582949744,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14⤵PID:5536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4420,i,4759703588143984745,794791806879088639,2097152 --field-trial-handle=2252,i,4666340255700905006,1399237564582949744,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14⤵PID:4676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4416,i,11851258626342169179,104606713142668184,2097152 --field-trial-handle=2252,i,4666340255700905006,1399237564582949744,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:94⤵PID:1960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,7345050144109954873,13928125067470729840,524288 --field-trial-handle=2252,i,4666340255700905006,1399237564582949744,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:144⤵PID:1388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,13542603470856343695,17585346073604066295,524288 --field-trial-handle=2252,i,4666340255700905006,1399237564582949744,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:144⤵PID:1812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,5492866279513545215,8723747430088625412,524288 --field-trial-handle=2252,i,4666340255700905006,1399237564582949744,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:144⤵PID:2968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,15149631295432079166,600104329319477864,524288 --field-trial-handle=2252,i,4666340255700905006,1399237564582949744,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:144⤵PID:948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,15149631295432079166,600104329319477864,524288 --field-trial-handle=2252,i,4666340255700905006,1399237564582949744,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:144⤵PID:4580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,4148088734704961187,2836783496756667028,524288 --field-trial-handle=2252,i,4666340255700905006,1399237564582949744,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:144⤵PID:4688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6492,i,8082579291689693124,9024258493173866381,2097152 --field-trial-handle=2252,i,4666340255700905006,1399237564582949744,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14⤵PID:3116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,7899777350699003680,8926296852869076183,524288 --field-trial-handle=2252,i,4666340255700905006,1399237564582949744,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:144⤵PID:2344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6480,i,14901372011508856994,6573874565244278691,2097152 --field-trial-handle=2252,i,4666340255700905006,1399237564582949744,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14⤵PID:5488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6164,i,786283274899095798,11337914377924583170,2097152 --field-trial-handle=2252,i,4666340255700905006,1399237564582949744,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14⤵PID:2644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,15413434347059361031,9828347993491972933,524288 --field-trial-handle=2252,i,4666340255700905006,1399237564582949744,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:144⤵PID:6032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,10063808452496236656,15101180708026753678,524288 --field-trial-handle=2252,i,4666340255700905006,1399237564582949744,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:144⤵PID:3304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,7883097512997269065,17741902897213522746,524288 --field-trial-handle=2252,i,4666340255700905006,1399237564582949744,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:144⤵PID:2920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6240,i,6164295204801242596,8114285330647726882,2097152 --field-trial-handle=2252,i,4666340255700905006,1399237564582949744,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14⤵PID:4448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,8486400059814653270,11150050520749263814,524288 --field-trial-handle=2252,i,4666340255700905006,1399237564582949744,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:144⤵PID:3892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,13202527545206949652,6288099431797184595,524288 --field-trial-handle=2252,i,4666340255700905006,1399237564582949744,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:144⤵PID:5476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,3269883300762900723,1297116146958018288,524288 --field-trial-handle=2252,i,4666340255700905006,1399237564582949744,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:144⤵PID:3032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7100,i,16730117565645571427,2506115936861988834,524288 --field-trial-handle=2252,i,4666340255700905006,1399237564582949744,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:144⤵PID:1476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6300,i,1866690956004214394,73895133319296142,262144 --field-trial-handle=2252,i,4666340255700905006,1399237564582949744,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:104⤵
- Suspicious behavior: EnumeratesProcesses
PID:2724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7136,i,9414212603209163290,12910699507565519229,2097152 --field-trial-handle=2252,i,4666340255700905006,1399237564582949744,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14⤵PID:1412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,15577961110215710870,8995436710296469949,524288 --field-trial-handle=2252,i,4666340255700905006,1399237564582949744,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:144⤵PID:1772
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:108
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵PID:4780
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 10.2MB
- SHA256 271aabf0e4c271d01bb2d266dc0ed9c0a8c080145fd740c29cf64ccd7615d7c5
- MD5 3386422bd4931957e85dfb0ea02968ef
- SHA1 a94eb873e29bd04ce280aa889577f56ba0faa329
- SHA512 bc17cf59353bb5edbf94744556a903f74215d5dfee81180a19234142960c2a7b334ace3f6e94573cf347d20345e7b242294fd24e756c8a4dca958f7c7a4ac759
- SSDEEP 196608:ski9XwgwAMtPdX6eWyZ/K0ttYVAATtoVcIqj:j+AjxkZyZ/K0ttYZTiGl
- TLSH T190B67C13F2E441A5D0AAD175CFA29721EBB27C554BF096DF224473D82E33AD07A39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0fff4136-5db4-4ac9-b20a-972b67cbf047.tmp
- Size 34KB
- SHA256 9f69f76a79a49f9dc46c5c7908fab1c7ac2046f873ad6bfd49bb0d90805da5c3
- MD5 59b0b639d781da6c20e3750da4b464d4
- SHA1 4c570fdaf5753100569e15f6c47092a478c7eb4f
- SHA512 30cfa7a2f1b50cb95007ad4b3c9a9c4e77905d4e48e9551abd807ff30fcc756a0b8de25a6dcea68f93dcfacc73914786e46125452a76402ae14fabb5f20a9f81
- SSDEEP 768:Hy3t8onieOIkdot6AnUPO4Qp7cPAiSm2eo4w4cciGrTFl/2sGnm:Hy36c6jAwQpYoimeoR4ccFFt2ssm
- TLSH T198F2AEB099E8DE73ACFB928576597342BFF0116398C58F48DAEE5B0D01436AA071BC17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\565ed338-254b-455e-ba54-66935cd62249.tmp
- Size 37KB
- SHA256 dc3f9e0c5844c687466e9d1eb10708e97fcefa14106ee85b8904eab28e80ccd0
- MD5 af5582b28463e85e38839ef9ffaf75db
- SHA1 2d21b7482bc3294a7f1d3805acd42c0056252553
- SHA512 9e861dc79ac04ace726a915a4b299bb626ce5d7fde470ea3bc766a09f2d8d6cb0283067fc24463a7e6866ba8944f2b7bff2fcb3251c18bc9e0db3afc3a23c760
- SSDEEP 768:RFQN3Jwgv8oVuOIkdotrtnUPO4Qp7cPAiSm2eo4w4cciGrTFl/2sGnm:gN38ICtwQpYoimeoR4ccFFt2ssm
- TLSH T1DE038C71D8A4DE6BACF79785BB487742AFF001A388C99ED4DAD91E4C01836DE070BC16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6a89ad67-f1c4-4fe9-9689-b3aa83a43eb0.tmp
- Size 37KB
- SHA256 94153694a658f779b8b1aa4644a7df66aa2f1d0059ddf34d5bfc2daebb10caef
- MD5 88c136da5f21f743d566382596407023
- SHA1 84cf54f438bd4044cf24fd0f345ad413b9e54113
- SHA512 a30b99ebf80270620cfccc03c364df61849d19914ccd682bd6a43333770da6a5dd325328f08eaa38605dc363ca7d19db08f6b697622dfdab80ffe087e9c61a2c
- SSDEEP 768:vw/UxvxjgC+5j3QVdd8nieOIkMjFnUPO4Qp7cPAiSm2eo4w4cciGrTF5rAgZbCMc:vdZj3+5j3QHd86MjFwQpYoimeoR4ccFG
- TLSH T16603CF75E8A8AE77DCF397843A1D6346EFF0416395C12AA4CAED1E0D42873AD430BC46
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7834057f-2f90-4331-9b1b-cf462f486271.tmp
- Size 34KB
- SHA256 170d9499f35ca4fd0bef74b424b431d9878e2376e0457b3c380ba10e14883a10
- MD5 489e50c118ee98ebaafcf3666009c66c
- SHA1 1e04d99e73fe4af01f24c0b1c7977877cc3c473b
- SHA512 a22bf328deda087b8f679074a1ff05f443c9515df7ae2859b69f4d5a01b29dfa2a973612b8d76f16b7d4eb85b1fc4ebfed6b9f4a4cf428f7c4b11a69c6d20b88
- SSDEEP 768:3ky3UqMnieOIkdot6DnUPO4Qp7cPAiSm2eo4w4cciGrTFl/2sGnm:3ky3/g6jDwQpYoimeoR4ccFFt2ssm
- TLSH T12EF2BFB0D9E8DE736CFB928576597742BFF0116398C58F44D9EA1B0D02436AA071BC17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\ab303a06-e55d-4960-a199-a2fe85c84e7f.tmp
- Size 105KB
- SHA256 0526a2a51e51d4fabd0b1d17ef03f5340c42a3dfcb2119ece19ca3fb7900a64d
- MD5 844a3eca2c89c5806ce623a8aaa667a4
- SHA1 92425b0bd5ebe6baf101dd06c4c2d65b1cabbe97
- SHA512 19fb4fa602526e6121d2bbb2984c8130d972906c815cef03a10d6c046e88bc013fabfd2daed35ac6fc10b90eb453c529c4fb4c4b465fb957c45a55ec67aa247f
- SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7u:fwUQC5VwBIiElEd2K57P7u
- TLSH T1D2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 68f353a62995fc87917d7d1eef768abe00ffab02e1d3e469100f99b6987f6488
- MD5 5ba62d3fe2ddefdf87e8dd139f3e421b
- SHA1 1986deda7bda2ac5b490eacb9fe2784fb6d01648
- SHA512 4e6a767b24298d2e01c8dbefa41509e1bc67cf2c2f34fd0bf866fc1017e1d15a470a5a95feb8ee1cccf4b8ccf5fa9054bcbb93919c00de89eeffec199b68baf9
- TLSH T19CD02BB5DFFCCC62D54820B802518E116085B41519490040DA03FC04DD110814D03555
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 648887a89dac8888df245d8758dcd78e85ae79931c9464f19b0967fcd69c3d2f
- MD5 b053e18c94ac6f6c60a9e0a281e1687b
- SHA1 17ed2d8ae6844c2878132336a2fea7d044381f8b
- SHA512 abf3d05979a55f573445c0c7a95529a5899c0d9f55f350b3eb35132d8502e23e6c764ffc98e92f4374754aa22e9292fd03f8e6e8113c0e919f428e797e339bfa
- TLSH T151D02BB9DFECCD62D54820B402508E116095B4156D490040D903BC04DD110814D03569
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\39836530-75a8-441d-a0bf-8969feaaeb44.tmp
- Size 11KB
- SHA256 7ee569986cde6f026cc6117dded3c35051f22d4acd7cf17023714d27682c3a81
- MD5 fc536f10dad48fab04831ea83f93ccf2
- SHA1 b7c62b5780220a25c043f3b74cfd82619ca9109d
- SHA512 e6736a7dc0a63f20111972945a56d3519b4f2f2bdbf3172310cc84177d1bd43e4c6467c7ef31910b6f1ee55aa8134eb2a37dc9734bba41bdbfceb313580cbd76
- SSDEEP 192:sxR+kR/Ci/fezs7IZmMNzoA8pMU/tF6+WNIYckXtiTrGyIgDeKJ:sxR+kIi/fezs729AV/EIE9iTnt
- TLSH T1CE42C815AD28A97B4CCBD21DBB55BF13D2F91132A0D55F48B6FC8A2C05EB6DD220780B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8688176a-8654-40c5-896e-99f2c73510e6.tmp
- Size 11KB
- SHA256 9c36f6a185f562874d88052e6f7d114c3ae42cf9f408de37931b60bb3b514878
- MD5 a50c2da05012070ca55aedfd90262df9
- SHA1 fe84474051f9b8aeafd399ff2765b8ce119bed9a
- SHA512 79dfe0737a72d4a0566f07200c5b0a9e0ef91c2c75c2fbfbbe0f5ef6c94c8ab6a5ee5aa5875b4bcc66cdc1682b59c0b4ffc12be98d8af25760259876b867d352
- SSDEEP 192:sxR+bR/Ci/fezsUIZzfAzoA8pMU/t16+WNIYckXtiTrGyIgVKJ:sxR+bIi/fezsUSxV/kIE9iTns
- TLSH T18432B815AE28A97B8CDBD20DBB55BF13D2F91132A0D15E48B6FC8A1C05EB6DD120780B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\97042611-c7d3-43e6-b07a-0362244c137e.tmp
- Size 11KB
- SHA256 f4a1c3cb34f73c139cac216ab4604acf30766bd7f821875fbe8af96b5252b08d
- MD5 d8495943817a0dae3d8ac4b894b92b98
- SHA1 6fa656fec2b6abcb9e87a1d64da731eea4ab6b50
- SHA512 ad30d1d0bdb2bd5f240bf9c73e5ce5818e333de82a0528fcbb30d9fae97fa16ea7fdd9b19850b5788c7f4af1ec0fd4f41861d313a966f29567fcdc11f65d14e1
- SSDEEP 192:sxR+kR/Ci/fezsIIZmMNzoA8pMU/tx6+WNIYch+XtiTrGyIgDEKJ:sxR+kIi/fezsI29AV/oIB+9iTnT
- TLSH T1DD42D715AD28A97B4CCBD21DBB55BF13D2F95132A0D11F48AAFC8A1C05EB6DD220780B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 1e802f9047eb3d4a66d4333ee0261746fb7b9a5eb3ece40701a5975f0231f58d
- MD5 62c5e1656e3ffdd0b88f06c5b1ee057d
- SHA1 9f03ccb74b676441ee8c41d2dffff1bdcb9bb8ff
- SHA512 d7e1146d78f4f5d7d6ee10fdde1da35782c3dcd7cbe00b9507931b2ccbd9f475451f8e5889676e00bbb2150655ba7ab1ed887351be14e692ddf80f10d69f8088
- TLSH T141615F8D43BCA25FF7942231A8D02E8F763C69BC53A39DD207E8D4B9788A3E5817105C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 1e3e425cc8144459b26d53d094d360016e86cf422de175f8a5aa52ed09b00e98
- MD5 04384ddb1a615154ab0db958ee8602d6
- SHA1 bf5836c4c96f6e9f0bb250efd47cee961feff06b
- SHA512 3e9d030fd26ecb148da188c25be2f83c333edbe2f61030a8eb5b1f2ba69037d1f8353acd6f1cdfb6a2fc6cac3bd4a427538f64f81b666529426307f996f35a05
- TLSH T10C61608D43BCA25FF7A42231A8D02E8F767C69BC53A39DD207E8D4B5788A3E5817101C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\6f5641ed-5a31-4f29-a5ea-f1fb74f18b4b.tmp
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\21f9320e-8a5f-42f6-83cc-df061dbee393.tmp
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6f205ce0-3a04-48fd-b908-cef66a3ccda2.tmp
- Size 2KB
- SHA256 a3620065d23c6ef871a7bdc01112edd85289522a52039891ec2e0ed593831515
- MD5 ccb1baef57b80dec9d40eef1d630d698
- SHA1 92b98767536f52acbbb8b7eafa656cd08faea1cd
- SHA512 bbb45ea010e563e25b8262e60d136e7eb93ae7d3b60fcbc15f561ccabb56ad8b7a051d5d5abfa159954006901e4cf30e4c2c98a5dd6af4a30941d968c79b906a
- TLSH T18A518CF3C7E8866D8A0195F4AA143E1BCE2D0964532C3D5AC8E4DE2B93E24B1E14199F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d02ac025-a393-4d05-b9f4-e2a0fd75337b.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 29KB
- SHA256 f2f0a294bf2afe26739ced8bc9e9370086ef14ba66d44b2af576a6587ae7aa53
- MD5 b2fb16a8ebeaca8506c985f0906f087c
- SHA1 8b506abff748a135bbbbb1fb8a7b920fdbba6173
- SHA512 97bac3bf9b49d834e40910ce8af03ae9b0d2938b719d846d0b326d48796f291091086362886455dd6ae834e183170e03f22f75b2ffa9389e2d4aa14a7dadbc3f
- SSDEEP 768:DFak74yG7pLuLbs5Wg1Bf9t8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsAJ97ghroMQ6:DFak74ymEbs5Wg1Bf9tu1jafAJxgaM/F
- TLSH T190D2FB7B744CCB7E4F800A9DDC197E9F6DA802CB9598C94047FE941D03C67EA521A4DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 4KB
- SHA256 467a3f335d255d7e45e9168601ea9c0cf7bf31167e20b11e01d76c8b136d2c33
- MD5 4f802d2d3fb7c028f383493608a428fd
- SHA1 246be2be6cd86081d72e8ae1a144c15a8a6ef78f
- SHA512 7493cde5203bf2d1758a0d4d344ea786b6ac253bacf39b9b72e29003f03ee05c20f8f3b45b660f7c0cee49ab47ca1b5b0199ea7064101ae1392b802377e5b32e
- SSDEEP 24:K6MvsM+IhKshk1qSxCVyXj0zE8aINKQhg1OS9aFyXCIbwEyIRKohE1iSF2twHfUo:KQBIhK6kEbyF1INKGgQvyM1IRKeE0c
- TLSH T1C1912522723B1A02393E7D5872D0B79A174571A37478EA6B7BE501528D5EF040CBC6FD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a1df7ed0-3916-4276-9783-0cd61d0800c1.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d22de2de-6621-4cda-b2a8-493b88c87b34.tmp
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\98e7bdfc-8430-4d56-9698-02cf8c622f8a.tmp
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
- Size 3KB
- SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
- MD5 904e6e94a1d46374c8630cfd86cc729f
- SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
- SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
- TLSH T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\5547e66d-716b-45e6-a324-d61087e4fbee.tmp
- Size 492B
- SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
- MD5 c1bec3bc77db46888e279f8b3eeb18fc
- SHA1 c2d14f387c796193ddc6378267768745c10dae14
- SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
- TLSH T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\61966d0f-b5fb-4c21-9c9a-f99c0832510f.tmp
- Size 252B
- SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
- MD5 880fe67d2d8def8a73d1f09d09f8f2ff
- SHA1 adad7fdd0652919461f89bfe36b449081489052b
- SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
- TLSH T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\669cec6e-d1a4-41d9-b884-4371339d7408.tmp
- Size 372B
- SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
- MD5 80c2dfaf9affc09798a4976ae70f1b0b
- SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
- SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
- TLSH T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\a2cc2ed1-a282-4651-937a-8abf1c012b09.tmp
- Size 132B
- SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
- MD5 f5a3b29f9a977e23d6ca4eb728238f9f
- SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
- SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
- TLSH T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fcc13ed2-db30-4dc6-96bb-78007dab0bf0.tmp
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\1f961070-20d9-4a3f-8d4c-255dfc461640.tmp
- Size 10KB
- SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
- MD5 78e47dda17341bed7be45dccfd89ac87
- SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
- SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
- SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
- TLSH T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\554279e9-afe4-4b95-8577-0f19d59207a0.tmp
- Size 1B
- SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
- MD5 5058f1af8388633f609cadb75a75dc9d
- SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
- SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5472_2102298476\CRX_INSTALL\content.js
- Size 9KB
- SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
- MD5 3d20584f7f6c8eac79e17cca4207fb79
- SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
- SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
- SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
- TLSH T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1127945777\manifest.json
- Size 43B
- SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
- MD5 af3a9104ca46f35bb5f6123d89c25966
- SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
- SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
- MD5 SHA1 SHA512
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_2088674978\manifest.json
- Size 135B
- SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
- MD5 616eb6b585f16811dc5db5063e088cd7
- SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
- SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
- TLSH T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_874540491\manifest.json
- Size 165B
- SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
- MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
- SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
- SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
- TLSH T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_885141854\manifest.json
- Size 160B
- SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
- MD5 c3911ceb35539db42e5654bdd60ac956
- SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
- SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
- TLSH T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
- MD5 SHA1 SHA512 TLSH