Analysis

  • max time kernel
    149s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/10/2026, 02:00

General

  • Target
    2026-10-22_a4ceb4ddb31563586a60bfdc66e9f6b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
  • Size 1.1MB
  • Sample261024-cff15a1zew
  • SHA256 37d01c934fd999c1cb22616a603f830741d2f5d3533cba2e4c47e69e99499e3b
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-22_a4ceb4ddb31563586a60bfdc66e9f6b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-22_a4ceb4ddb31563586a60bfdc66e9f6b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
    1⤵
    • Drops file in Program Files directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4864
    • C:\Users\Admin\AppData\Local\Temp\2026-10-22_a4ceb4ddb31563586a60bfdc66e9f6b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
      C:\Users\Admin\AppData\Local\Temp/2026-10-22_a4ceb4ddb31563586a60bfdc66e9f6b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1760
      • C:\Program Files\Java\jre-1.8\bin\javaws.exe
        C:\Users\Admin\AppData\Local\Temp/2026-10-22_a4ceb4ddb31563586a60bfdc66e9f6b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1748

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        64BitMAPIBroker.exe

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
        • Size 953KB
        • SHA256 620812a690d548d1982d56d79055b7de5855c2547beddeaba8a51b15a3094aed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AdobeARMHelper.exe.ico

        • Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe.ico
        • Size 3KB
        • SHA256 2f33dacaebb8bdf6d2d88550cce349c09b51dfeb4f499796f32bd30e14aab86c
        • MD5 SHA1 SHA512 TLSH

        jaureg.exe

        • Path C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe
        • Size 1.2MB
        • SHA256 b60366900543ad2241a2d9ee45e8a7c214916a442bcd1f5944122e25d0ba70dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msinfo32.exe.ico

        • Path C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.ico
        • Size 3KB
        • SHA256 5d7967695bef88a64140c541a09f22b45abe542c2df462d800e72e1d8e121d28
        • MD5 SHA1 SHA512 TLSH

        java.exe

        • Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_157859\java.exe
        • Size 1001KB
        • SHA256 66b6756f9eee928f3c89619a5b6ad9100ae1b9b89273724b15f582faa3be3dbf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_157859\javaw.exe
        • Size 1001KB
        • SHA256 56fe9779bf589a68108b412576476256b972414466b469c3eea36f95d9e6c0a9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DisabledGoogleUpdate.exe.ico

        • Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe.ico
        • Size 3KB
        • SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
        • MD5 SHA1 SHA512 TLSH

        msedgewebview2.exe.ico

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe.ico
        • Size 3KB
        • SHA256 61197ae03a1910353d202dffcc2271af59a9c26150652fbc6a84806cef420176
        • MD5 SHA1 SHA512 TLSH

        msedge.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe
        • Size 4.6MB
        • SHA256 08415499d5866f5b56331337985b5747e411785d6f725aedfc388a7a085cf30f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msedgewebview2.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe
        • Size 4.1MB
        • SHA256 a9911f6fe62df63610c5581f58230698a6bb9bfad44a913cefe80c894a4436f3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe
        • Size 2.3MB
        • SHA256 3b4a9cbe8f41247de2bf55c302e711b03d09fb5719fcc373176404a5506ff764
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MicrosoftEdgeComRegisterShellARM64.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe
        • Size 876KB
        • SHA256 2235fa620aacdb5d447484230d6fbb11227e088f0b78f83ab8828d0e0e2a6953
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MicrosoftEdgeUpdate.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe
        • Size 925KB
        • SHA256 2eb7f9c9bd2758226f34ce2388e2572b3b3ddbf9aafff386bfc2a147bb4c3542
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MicrosoftEdgeUpdateBroker.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
        • Size 814KB
        • SHA256 156c02612515f7446a8977661b2c0882478d9f8f5a6dc1e01e239b2d64ed8cd4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MicrosoftEdgeComRegisterShellARM64.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe
        • Size 898KB
        • SHA256 331b48b782b9e5fe150fbc9741469e7632fc066ea1736cb9828f29ad4df7e314
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MicrosoftEdgeUpdate.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe
        • Size 917KB
        • SHA256 5c59486bfda43ab58a6d0740e7f5d2b2d921dbaf437792aa6dd1b53c5d56f851
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe
        • Size 2.5MB
        • SHA256 1c900a2d3fac43f4994bd9a5e487426d5943cd903688ff2d8994d744562855b1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe
        • Size 2.0MB
        • SHA256 2554dc4702549bb2dbe5f6f34f1cb916a3d9fdcce56456c115c28ca09262d609
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msedge_pwa_launcher.exe.ico

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe.ico
        • Size 3KB
        • SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
        • MD5 SHA1 SHA512 TLSH

        pwahelper.exe

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe
        • Size 2.1MB
        • SHA256 ff9fadf57b84761a6a082b5bc0b8f541233757badd48e27c5a12bfd28dfc0434
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pwahelper.exe

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
        • Size 2.1MB
        • SHA256 43325b3889e50e098ea33ec2d144bb035a79ed37b2fd82bd61b7dcffc2165c5c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Uninstall.exe

        • Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
        • Size 816KB
        • SHA256 3c06bb7344b664e357018539c7bb572cd50ae7de22847ad0e1402435da5c8e4d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wab.exe.ico

        • Path C:\Program Files (x86)\Windows Mail\wab.exe.ico
        • Size 3KB
        • SHA256 ce19242fbf3efc4fe158fba6ad17e913a57a5fe53166f47dc8e5faa5a9f90a03
        • MD5 SHA1 SHA512 TLSH

        wabmig.exe.ico

        • Path C:\Program Files (x86)\Windows Mail\wabmig.exe.ico
        • Size 3KB
        • SHA256 88c0094fb49858d277e6e56c8c1023bf93356b7d3fc8e037b355d21aa1c7bd34
        • MD5 SHA1 SHA512 TLSH

        wordpad.exe.ico

        • Path C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe.ico
        • Size 3KB
        • SHA256 9948a7a97643b62f3496c08d5c06563d78e1a2eb7955a508cab6ccab402b33fd
        • MD5 SHA1 SHA512 TLSH

        ImagingDevices.exe.ico

        • Path C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe.ico
        • Size 3KB
        • SHA256 c76b2392ae75384d2097bd890c529cc5636350476c9a001ee1a055430c8f1c86
        • MD5 SHA1 SHA512 TLSH

        7z.exe.ico

        • Path C:\Program Files\7-Zip\7z.exe.ico
        • Size 3KB
        • SHA256 2a5c5c2bc95c18eded222f0a38752717c1a6ad20e31bcda6472bbba77ed22fe4
        • MD5 SHA1 SHA512 TLSH

        7zG.exe.ico

        • Path C:\Program Files\7-Zip\7zG.exe.ico
        • Size 3KB
        • SHA256 8cad493433ec34a34ca6f4fd49655aaf7cbb4337752743804db83ea6c050d1fe
        • MD5 SHA1 SHA512 TLSH

        OfficeC2RClient.exe.ico

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.ico
        • Size 3KB
        • SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
        • MD5 SHA1 SHA512 TLSH

        setup.exe.ico

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe.ico
        • Size 3KB
        • SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
        • MD5 SHA1 SHA512 TLSH

        ielowutil.exe.ico

        • Path C:\Program Files\Internet Explorer\ielowutil.exe.ico
        • Size 3KB
        • SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
        • MD5 SHA1 SHA512 TLSH

        javaw.exe.ico

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe.ico
        • Size 3KB
        • SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
        • MD5 SHA1 SHA512 TLSH

        OfficeClickToRun.exe

        • Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
        • Size 4.8MB
        • SHA256 ac88aea1619183f95f1f28900954ef97cea1e2482a9aa63f76ce314e9ac07c34
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppVLP.exe

        • Path C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
        • Size 1.2MB
        • SHA256 412abefad32d6f851eaed38ad276949d7301e98ba0e2e3932b03f1c7824edd5b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Microsoft.Mashup.Container.NetFX45.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe
        • Size 736KB
        • SHA256 037a577c7cd3fbb4039432d14e052b4a3883ddcccb95e91e4f32de4db1329eb3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CNFNOT32.EXE

        • Path C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE
        • Size 958KB
        • SHA256 8c93fb9febcf69525cd7aa879210862f9924e8aa71b6e7f282769aa0c90b921e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PPTICO.EXE.ico

        • Path C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE.ico
        • Size 3KB
        • SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
        • MD5 SHA1 SHA512 TLSH

        WORDICON.EXE.ico

        • Path C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE.ico
        • Size 3KB
        • SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
        • MD5 SHA1 SHA512 TLSH

        excelcnv.exe.ico

        • Path C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.ico
        • Size 3KB
        • SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
        • MD5 SHA1 SHA512 TLSH

        MSOICONS.EXE.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE.ico
        • Size 3KB
        • SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
        • MD5 SHA1 SHA512 TLSH

        MSOXMLED.EXE.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.ico
        • Size 3KB
        • SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
        • MD5 SHA1 SHA512 TLSH

        MSOHTMED.EXE

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE
        • Size 1.1MB
        • SHA256 c434282aefa3f42f732efcfdc4fb04c22f0357c91d8542ed3da352cc199a71ad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dbcicons.exe.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe.ico
        • Size 3KB
        • SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
        • MD5 SHA1 SHA512 TLSH

        joticon.exe.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe.ico
        • Size 3KB
        • SHA256 f4c419b2d60ebe6dc173b36b108855b1f4db9c28fda291f4d93ac38e6dd24389
        • MD5 SHA1 SHA512 TLSH

        osmclienticon.exe.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe.ico
        • Size 3KB
        • SHA256 b76444a386ad024bd78ee152f0f6ad2d5dd3b9ed478147014e5d804e7a9e6508
        • MD5 SHA1 SHA512 TLSH

        outicon.exe.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe.ico
        • Size 3KB
        • SHA256 98d0a0fe25fa36309c0bbe62f04a561a1e02d51a4dc2c8331b9b3c2e47387f5f
        • MD5 SHA1 SHA512 TLSH

        nmhproxy.exe

        • Path C:\Program Files\Mozilla Firefox\nmhproxy.exe
        • Size 1.3MB
        • SHA256 c3153ae9c35dc6a3ffe8d1fba447a7debd24d3e940aae7343c6594dc425b4fdd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        helper.exe.ico

        • Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe.ico
        • Size 3KB
        • SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
        • MD5 SHA1 SHA512 TLSH

        vlc-cache-gen.exe.ico

        • Path C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe.ico
        • Size 3KB
        • SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
        • MD5 SHA1 SHA512 TLSH

        WaitSelect.exe.exe

        • Path C:\Program Files\WaitSelect.exe.exe
        • Size 712KB
        • SHA256 bc6ecc278ef2f7b9aebd994cda8d5edf485f851f3924f6af7e619a42e76018b6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wmpconfig.exe.ico

        • Path C:\Program Files\Windows Media Player\wmpconfig.exe.ico
        • Size 3KB
        • SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
        • MD5 SHA1 SHA512 TLSH

        vcredist_x86.exe.ico

        • Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe.ico
        • Size 3KB
        • SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
        • MD5 SHA1 SHA512 TLSH

        VC_redist.x86.exe

        • Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        • Size 1.3MB
        • SHA256 3e1ec90e44766409160d2328ae52cd4b17424be5f9fb9c387967fecad8f25c8a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        windowsdesktop-runtime-8.0.15-win-x64.exe

        • Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
        • Size 1.3MB
        • SHA256 9395d560073af3554c8857ca147b6e49f8fab0b5b70434eb3e5a08ec7fb10799
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vcredist_x64.exe

        • Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
        • Size 1.1MB
        • SHA256 21f788ae6ab983c96be7eac6d63bb425148646aff527edb8a437285e740fbde4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        windowsdesktop-runtime-7.0.16-win-x64.exe

        • Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\windowsdesktop-runtime-7.0.16-win-x64.exe
        • Size 1.3MB
        • SHA256 24131b73169cf07475ff31d4ee23547c583644c052bfe606709a75532ff0b25a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneDrive.exe.ico

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe.ico
        • Size 3KB
        • SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
        • MD5 SHA1 SHA512 TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 77acbd1eaba369b04587ed751a984379e80e7417ff6ba6fb63b462db3bcfc499
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 e1edc48b0806b11fa1b960ccd29884c7a95e52ab1529cbe0734d2f85949ab8ae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 cccee20e4e321aa241f0601c5868489c6d0be36fd964e6a36e0b93dcf884a50c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 be85689bb3f73027bcd5ae15cb48ebaf541eec5c5819de830609a65549dbaa98
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 e6dfb6d48806917d78b953b147c6f9db2ee36a7803992acb36c52207b72a34ba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 6c12432861870fba1ddfb88026ac83a964413bcf5be77581c2d3aad3675ad8a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 47a4997029fe7d9d14fe9ccfebe381b6ae6abd95df23f92ec90d5bf9815238f5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 d841325cfa103f8195bbaf28ac03d3e76411ca545c66090f373261978ba3abd7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 f511d7caadb1189f9215bb591b8b3253f63ff0573d485bcabd6c0ce87052b3b6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 31bf1494cf3235a2c6ab170a0193b98b2e9c451b1f2b2b57e01bbd6294990463
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 0cc31fbf4c0ac354459c86de5888399ab96bfb4a4e593ccbea63adf7fb9725ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 658be3107440ebac6cc038bce1583d48b8f2d777ec8aa68e2f824e9fe3176851
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 ed1a74434910f2a553230a52db2d88a92d9255f1ba9a89fd9f5da519071b752a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 85a0dd4181b515ba71aeebff55d21dd99d5b5b48ab83a7320b6dd34d34059edb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 a6e6f3dd020766c06b38cf3440d3a6e93e8c2a8e2f0f8301f8dcb09264e084a9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 22e01cbfed9e392aaa433c52f92c6b684e142ccf0d144161e7144280d28188f0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 2d3d087df082e058bb24e8999282b13a4764034d98db73d7fd9600552fb76f45
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 827abf8864bd6314991e3b34a496127d4b5a9e14c47da5d45b4d520182a7beb8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 e9ef7b87c96110effc483d82fe67eb45f1215a40fb554f6c3352d922233fef7b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 f38c405b509797371d5a9317367f36e77ab19e5c58fc262d7bc1f2fc9f588a02
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 66a09546417f6a97c1f7a97a50d714f19e9bc07f9443a0341ffd1d16c0ef2465
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 25a332976bbfc9e5053bb1d735a49f90d710ffbe51e3fe817af05d5cb0f06412
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 ae1538254356a582c31fcd577119abfb1aad17f9568f66d82511098b363fd7b6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 72b162508d741b629eaf89cb71df6ffd38024e045a44f5ead0ed596fcd8eda99
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 53dce593407c5a76af24fb02b1cd412176f775716617e64ea0e40a13653bebc3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 9722f8409ffb9a590dde9569c5ad7c78d50fdb01145bc4f1408fba37d8e41866
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 8f873c7ab0b93d644096ec8b5f1adec754158529aa35adcebfb7993125f6b5c8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 5ea61cedfc74f66f7aa6dbe605123f50c9510bd5a401938d9bb76af07e7a1751
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 69801de65a3cc544d60581ba0efc7c1790b7aa709c8232e9c77d92a1f5318490
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 4172f693edb5267ed8db1c320e2a2c9021471f34ec418c018811a212af424ee5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 b8187f379f0a52ff6e093e9ed8fe57846429d4e70c19927de0d97eb7e61884d6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 acc3b59316b25754e7b37553c7edcdbd124e173cc8d85a271b7980f13506ad9d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 c89b46be2f3e92a3596cf03452b331bfb26d9cbab0cf2e529fab2f5cf040dbe4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 c322edb0c077c38d82fa083b8841d537d927673fb5ebf633e59d16dc9b255196
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 32c6694a29637127bcb8cddf214c5d7787272fc1b21f545688941393f48cbaff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 d476a135a65085807403c8b9603ad7598ad58858363943c708db02f12488289f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 b04a950e832cd615276cdf3c588bf5af6407af9347c677d338ea0e5f0e7d9b93
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 4850ee76a148626a9e4e5fba076a5e074e57152c53097416e244c3774268983b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 2dae6824ddeac5d395fe1e9ee02003aaa0c8b102aad1f57686052c10eeb84d24
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 109e70d2ec20d9d8dc1994f8602d5e042a3ae06f2003088bff04c38ab0cc3e3a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 194e36d2c299396517d965d2117cc1cade4c6696f0397f5b48b0f96201a4e2c9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 4a383abe9ac997d67437cde28cf2e170897ffbbe75f0775334f5209b08e7d6f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 d34158108a5de2e669be767efcd698407042949f5d924a980889248d27518950
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 a256819b44ea17181da701dcadc2ba8a325b39eeca24d6ce0bfe99f9aa6f0fd8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 9188bdc4a884111ead5fbf04218f039be635accdb84681aad5c1731c7fdcce8c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 db021115d6d28a0f5f4babff40bd112809f3d680dd21fe43f7e3b317cb6f409d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 d80c7053ee222ac0bff9eb6830ae3b7d3cca57eab6b4bdb4d1677bf553d5dbec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 c925a5f6d4a3ef654519153c19f9a25dd65817c84e6b9edc50ebb1a60107dd56
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 57a4b0823d1bf1a231be5fc124d0ec2525b652010b57641932e6c721419ddf8f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 ac354d1a74dac8f6cee25baa8762e367e82dd4521a76a50a03f73dd0019e6819
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 8e158422266e7e58dbb682de02c9eb196ea0064a0af140056bb0eeb2e84310f9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 2081574d568e260be6c01c18a7c23b0b3849131af8f2a87967d1aff5bf669ef3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 7a297de3a398ca8d1ca57181c1d0513693b8106f5350940118c77a74e7e1693d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 bc1314502c67cad82c20fb7621305803be06dc54e99c921ba1d042731dd79047
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 ae6c46aec7ef7959b3515b2f62bb70573e1f96576a1b474bdebe8b72aafcf9a6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 bc590f68978f58bfea4710bb61279cacc4cc6458d5ad000fd37d3e1de89f7e8a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 2cd12127fdce2828f9d85d17e1550d85ad0d3c5478a8f2a5571ca8bb0d15fcaa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 c63c8505eb2180652407ef4e3ccee592ba4ba44c1611544f38dfc884bab547bb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 980cdd9c8dba0f387cb1718ddee24d7ea0764720fb877a0b42a5a76bdb13197b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 d1c65ad07f28153b370ff744ba37f7ac838e815255be69616fd4e087de6432d1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 840eeda15ac5d70716ba8212116bc902741073f7b111395faa747804b076a800
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 ab38503e3cc40aa1a7eae2f6a328802b8873b5b667991e9fb84d466d935e22f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 254ccf4fe74ec1f60ace59a8bb3594a0b648cfcc82b40ebd926f9ee2048ca17f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 c1ecaeb3917b30b42ffa741cb46e4e2d2ce14518b8fc9913d25aae9b93ccb3a6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 2bcd8fd49fada1084253104f11778300e693cf1c0e5c8bd07bc7f3c65cc414ef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 2ddba06fc6631c2f00f23a45a3dbf7af6d4240c506604934ad04ffd70921e8ed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        2026-10-22_a4ceb4ddb31563586a60bfdc66e9f6b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-22_a4ceb4ddb31563586a60bfdc66e9f6b3_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
        • Size 472KB
        • SHA256 b590f02c2c3abc386a02d3da8d042191eb33ffc56b07e4da43fa3c4c1aa03879
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RCX1BB.tmp

        • Path C:\Users\Admin\Downloads\RCX1BB.tmp
        • Size 712KB
        • SHA256 2ac90ca4ea49ed0f42397c19800bbecb7f237edf5e294bed11ef25e23cda5386
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/4864-0-0x0000000000400000-0x00000000004D4000-memory.dmp

        memory/4864-1076-0x0000000000400000-0x00000000004D4000-memory.dmp