Analysis

  • max time kernel
    149s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/10/2026, 04:25

General

  • Target
    2026-10-22_939d6fdcae1dc1f41665784a6a34a1ac_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
  • Size 1.1MB
  • Sample261024-e1646asvcv
  • SHA256 7d572e07d38422a4551b48529305851595da7d0daf346beecf81ae8c3ff23a55
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-22_939d6fdcae1dc1f41665784a6a34a1ac_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-22_939d6fdcae1dc1f41665784a6a34a1ac_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
    1⤵
    • Drops file in Program Files directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4920
    • C:\Users\Admin\AppData\Local\Temp\2026-10-22_939d6fdcae1dc1f41665784a6a34a1ac_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
      C:\Users\Admin\AppData\Local\Temp/2026-10-22_939d6fdcae1dc1f41665784a6a34a1ac_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2000
      • C:\Program Files\Java\jre-1.8\bin\javaws.exe
        C:\Users\Admin\AppData\Local\Temp/2026-10-22_939d6fdcae1dc1f41665784a6a34a1ac_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:764

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AcroLayoutRecognizer.exe

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe
        • Size 728KB
        • SHA256 84772234664d1a4123ede6d387ad72157909cc97fb7c9115c7ec10dcd0c46412
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LogTransport2.exe

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe
        • Size 1.0MB
        • SHA256 4400ccae8810cd041eec6f3c3c95504563cc63be78fcab5b5637a7d05de06ba6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AdobeARM.exe

        • Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
        • Size 1.8MB
        • SHA256 2220f90124d14600e0eb0eaff5583911d2c7d6d4fba1b26d0a19bba579b40503
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AdobeARMHelper.exe

        • Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
        • Size 1.1MB
        • SHA256 a31d343f5997e0b1134733b2500e7a3f9fc82cf771acb5173b19d7e6ff383c98
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AdobeARMHelper.exe.ico

        • Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe.ico
        • Size 3KB
        • SHA256 2f33dacaebb8bdf6d2d88550cce349c09b51dfeb4f499796f32bd30e14aab86c
        • MD5 SHA1 SHA512 TLSH

        msinfo32.exe.ico

        • Path C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.ico
        • Size 3KB
        • SHA256 5d7967695bef88a64140c541a09f22b45abe542c2df462d800e72e1d8e121d28
        • MD5 SHA1 SHA512 TLSH

        javaw.exe

        • Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_157859\javaw.exe
        • Size 1001KB
        • SHA256 6e2c44e2661c4205fb195c17814c657c9649adb17402a844ddb6d9f47db0a340
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DisabledGoogleUpdate.exe.ico

        • Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe.ico
        • Size 3KB
        • SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
        • MD5 SHA1 SHA512 TLSH

        msedge_proxy.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe
        • Size 1.8MB
        • SHA256 35d80869863c4e49d6cecdbb8225430a8028c60010e80ee03cde1568dabcb028
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msedgewebview2.exe.ico

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe.ico
        • Size 3KB
        • SHA256 61197ae03a1910353d202dffcc2271af59a9c26150652fbc6a84806cef420176
        • MD5 SHA1 SHA512 TLSH

        pwahelper.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe
        • Size 1.7MB
        • SHA256 6eb94e4f46ff2689b1e6f943f8d5c2fbef5ee1122fde1b23cc4ecb76ffd9537f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msedge.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe
        • Size 4.6MB
        • SHA256 17e7fe3c0358d82cfc900a8b06399abd384a9ab7312f5c945dbba6ca031972ec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cookie_exporter.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe
        • Size 837KB
        • SHA256 280be2a767b7ad4130ac0fafafd49cc0b32dc13ead30a87ac426bf54f615f689
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe
        • Size 2.5MB
        • SHA256 12e3a6280864fd3f8ad07b6a148f95cfb519b00b8d3cce2afee806da3c8a8c15
        • MD5 SHA1 SHA512 SSDEEP TLSH

        setup.exe

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        • Size 7.7MB
        • SHA256 3743606ef16ecedf44ba9640040b37fa62f3b47babd1b92a0ff98d21d11e1951
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msedge_proxy.exe

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe
        • Size 2.1MB
        • SHA256 711938c7795a5d6697d6cecf79ae8d35e56f8af44dd2b714fa7e84f6b7131543
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msedge_pwa_launcher.exe

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe
        • Size 2.5MB
        • SHA256 5d8e6a66659cf50a2ff32fe8f3d57d018a9f740ac176d6ae5ea3eb47f70ce380
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msedge_pwa_launcher.exe.ico

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe.ico
        • Size 3KB
        • SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
        • MD5 SHA1 SHA512 TLSH

        notification_helper.exe

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe
        • Size 2.3MB
        • SHA256 c72bf3366b52271f78df0e899748d9d6c0b89c6ddcbdd9a9352e264471f8fd82
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msedge_proxy.exe

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
        • Size 2.1MB
        • SHA256 b96334403d0ea1e143ffdeb2e41f12e37cac56042064938371c62b5463c5add0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        maintenanceservice.exe

        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 988KB
        • SHA256 44915b8c7b70bf8d39980cfcf4b9ae44c8881b87803b30b2b68150ae32e70b50
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wab.exe.ico

        • Path C:\Program Files (x86)\Windows Mail\wab.exe.ico
        • Size 3KB
        • SHA256 ce19242fbf3efc4fe158fba6ad17e913a57a5fe53166f47dc8e5faa5a9f90a03
        • MD5 SHA1 SHA512 TLSH

        wabmig.exe.ico

        • Path C:\Program Files (x86)\Windows Mail\wabmig.exe.ico
        • Size 3KB
        • SHA256 88c0094fb49858d277e6e56c8c1023bf93356b7d3fc8e037b355d21aa1c7bd34
        • MD5 SHA1 SHA512 TLSH

        wordpad.exe.ico

        • Path C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe.ico
        • Size 3KB
        • SHA256 9948a7a97643b62f3496c08d5c06563d78e1a2eb7955a508cab6ccab402b33fd
        • MD5 SHA1 SHA512 TLSH

        ImagingDevices.exe.ico

        • Path C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe.ico
        • Size 3KB
        • SHA256 c76b2392ae75384d2097bd890c529cc5636350476c9a001ee1a055430c8f1c86
        • MD5 SHA1 SHA512 TLSH

        7z.exe.exe

        • Path C:\Program Files\7-Zip\7z.exe.exe
        • Size 712KB
        • SHA256 69d59aab9f447b0ded445ee4fa5871409166cd9ec2ce90c542c8b8c21b61687b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zG.exe.ico

        • Path C:\Program Files\7-Zip\7zG.exe.ico
        • Size 3KB
        • SHA256 8cad493433ec34a34ca6f4fd49655aaf7cbb4337752743804db83ea6c050d1fe
        • MD5 SHA1 SHA512 TLSH

        OfficeC2RClient.exe.ico

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.ico
        • Size 3KB
        • SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
        • MD5 SHA1 SHA512 TLSH

        appvcleaner.exe.ico

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.ico
        • Size 3KB
        • SHA256 2a5c5c2bc95c18eded222f0a38752717c1a6ad20e31bcda6472bbba77ed22fe4
        • MD5 SHA1 SHA512 TLSH

        setup.exe.ico

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe.ico
        • Size 3KB
        • SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
        • MD5 SHA1 SHA512 TLSH

        ielowutil.exe.ico

        • Path C:\Program Files\Internet Explorer\ielowutil.exe.ico
        • Size 3KB
        • SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
        • MD5 SHA1 SHA512 TLSH

        javaw.exe.ico

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe.ico
        • Size 3KB
        • SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
        • MD5 SHA1 SHA512 TLSH

        Integrator.exe

        • Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
        • Size 7.3MB
        • SHA256 77552829745b79a60edb4701844feda1be06b74f5dac75181b7fb8cb95199d07
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PPTICO.EXE.ico

        • Path C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE.ico
        • Size 3KB
        • SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
        • MD5 SHA1 SHA512 TLSH

        SKYPESERVER.EXE

        • Path C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE
        • Size 827KB
        • SHA256 682b631a0a724b9a2bca7b208f127420e9f30869fac82d261520752c25ac49b1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WORDICON.EXE.ico

        • Path C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE.ico
        • Size 3KB
        • SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
        • MD5 SHA1 SHA512 TLSH

        excelcnv.exe.ico

        • Path C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.ico
        • Size 3KB
        • SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
        • MD5 SHA1 SHA512 TLSH

        MSOICONS.EXE.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE.ico
        • Size 3KB
        • SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
        • MD5 SHA1 SHA512 TLSH

        MSOXMLED.EXE.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.ico
        • Size 3KB
        • SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
        • MD5 SHA1 SHA512 TLSH

        Common.DBConnection.exe

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe
        • Size 763KB
        • SHA256 d83c4ea232eda5cf4482a168b64f6b4cc2824507b3a2e49265df8d03d5b7fd8d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dbcicons.exe.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe.ico
        • Size 3KB
        • SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
        • MD5 SHA1 SHA512 TLSH

        joticon.exe.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe.ico
        • Size 3KB
        • SHA256 f4c419b2d60ebe6dc173b36b108855b1f4db9c28fda291f4d93ac38e6dd24389
        • MD5 SHA1 SHA512 TLSH

        osmclienticon.exe.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe.ico
        • Size 3KB
        • SHA256 b76444a386ad024bd78ee152f0f6ad2d5dd3b9ed478147014e5d804e7a9e6508
        • MD5 SHA1 SHA512 TLSH

        outicon.exe.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe.ico
        • Size 3KB
        • SHA256 98d0a0fe25fa36309c0bbe62f04a561a1e02d51a4dc2c8331b9b3c2e47387f5f
        • MD5 SHA1 SHA512 TLSH

        crashreporter.exe

        • Path C:\Program Files\Mozilla Firefox\crashreporter.exe
        • Size 4.1MB
        • SHA256 ed45330b3961bebc68cd2ff443ccfc34658b7eaad18924fdf9163918bd3b2248
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pingsender.exe

        • Path C:\Program Files\Mozilla Firefox\pingsender.exe
        • Size 799KB
        • SHA256 8ad4dc4552be81ef52ea2226d75a7f3af282605348ae961a7b16735d4fbb2e3f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        helper.exe.ico

        • Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe.ico
        • Size 3KB
        • SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
        • MD5 SHA1 SHA512 TLSH

        vlc-cache-gen.exe.ico

        • Path C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe.ico
        • Size 3KB
        • SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
        • MD5 SHA1 SHA512 TLSH

        wmpconfig.exe.ico

        • Path C:\Program Files\Windows Media Player\wmpconfig.exe.ico
        • Size 3KB
        • SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
        • MD5 SHA1 SHA512 TLSH

        integrator.exe

        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe
        • Size 7.3MB
        • SHA256 b3bdc5e66c74b816daffced3dc9fb9d5b6246efcacea51e2e3a52720da7df871
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vcredist_x86.exe

        • Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
        • Size 1.1MB
        • SHA256 58a5be6ba7c15ffff9656aa74558cd01f58efab36e7b4c339ec1363b1dfc9519
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vcredist_x86.exe.ico

        • Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe.ico
        • Size 3KB
        • SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
        • MD5 SHA1 SHA512 TLSH

        VC_redist.x86.exe

        • Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        • Size 1.3MB
        • SHA256 726bd1d421d35f89e72e365c544f744af34b051d7b41c2ee11f1348fc368b283
        • MD5 SHA1 SHA512 SSDEEP TLSH

        windowsdesktop-runtime-8.0.15-win-x64.exe

        • Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
        • Size 1.3MB
        • SHA256 a161c4b1f99dd8c00d25d5054e680471c6ea562b6d3b1e8e066bf810cc57c541
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VC_redist.x64.exe

        • Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        • Size 1.3MB
        • SHA256 40e20e702eb8ed3edf7c9af17a344739d1f0c16e1e430158c2c92926a992eab2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        windowsdesktop-runtime-6.0.27-win-x64.exe

        • Path C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe
        • Size 1.3MB
        • SHA256 161edbd421153e2e8aee25bd9e5bc3d7fda616fd016b75d80a9202bad5cd2a95
        • MD5 SHA1 SHA512 SSDEEP TLSH

        windowsdesktop-runtime-7.0.16-win-x64.exe

        • Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\windowsdesktop-runtime-7.0.16-win-x64.exe
        • Size 1.3MB
        • SHA256 2fefbb0eea3e0c045209cfcad0eeb57b570c74b19606422154a8d9a6d1ad9c64
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vcredist_x64.exe

        • Path C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
        • Size 1.1MB
        • SHA256 e5d669d06ee468d583def9b3c509d1255976ae2e4f0e1f626695f85f91299621
        • MD5 SHA1 SHA512 SSDEEP TLSH

        FileCoAuth.exe

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
        • Size 1.1MB
        • SHA256 51c8069a969fb4895473efdbd31b94dc41e4326f7ee0737b84cb251aaf701aa6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneDriveSetup.exe

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe
        • Size 27.3MB
        • SHA256 cf089d76565a717fc23fa1e884ef3429944f2c6e033bb49bdb64e666031b105d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneDrive.exe.ico

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe.ico
        • Size 3KB
        • SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
        • MD5 SHA1 SHA512 TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 daa031d61976a1c94bf1e7de93341e384bb1d01fc5340e7f40ed278d7dbf38d4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 4c3b6e8b9701392ff8eac7ee1fb2e428020075d739f63b5544634de3b86ff430
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 e54681ac232815f6f163b79233e6e480b37081fa69958c30d3c35ae8cdb3163b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 6718fd28d27add17f40a20c9c46ffc707ffb69ff5254f7dfcd612ab283e35789
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 ee4255f9f71ec84463a676c9065ab6a488866c4e4cdbb53710127280172f9fd3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 1a40ce64b75277193c3a9c27d1b0ef83f6993a0e2c9f99216327e11f145c9a1f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 3f77d420589dfcddeeb2e3df0fcac6c8c76637d4193cccf141b28be3809b34a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 bf21783d6376156f83f559111ae5cbbbeaba0c3deb2b81375977ae21557db913
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 7b74aba9064919c7c3cdb9aad45d0aee367f8b26c6f1a3e86fa4a587d1735804
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 f04a462ca8b4a3ef4c282e408c9c6178d469ad8ec22ca12b882ef2ca63a8a517
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 81910c4c6cf4ac588457a8ef5e9f2edab6c965e25449029d4271aa7543389551
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 28d82939f0bea16ace02b6f1fe0bed40847b0b4339ea8819e6dbf9e6aa3bb343
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 bf15969874bba138a88e7c7babd1f6a89eae643ef3b0c692e4c8ccbf1d7d7495
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 48c229714693ac4fd7f2b9143d85fcf2f0914ef7c756c6815f339696fb06468e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 89ce83f73763d9cea2fa538cee59c5268d9a8145ad7b2724e728818726c0b1da
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 f7bc37c2a33138930c5e85d9a6230af7a6de4aca93a1168ab839d4de455ccf3f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 5ec3eb6583352f38298099be253df6d499bc46192206843a2635309d7f1e4a82
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 7e4cbeeac83f058bfc5e88d9f40bb1cd0de5c468ba19a0a96906d94f167fc34c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 3bbebc9ffd19985c1e3a829af43b7753a626883b919b64983713862b3c7e9580
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 b9d19598b21720c30b4b809a32341e4718f8fa2f523aec06d0af521f07d7334f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 0ea62bae42f7d54cd11d617a41fc1c6a58efa6d3caa414877fbc0ecfafd03000
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 20c37320dcbe15b91caef0a75bfe118b55c59a82fa293b89740fb9bd92042d98
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 91295789ad2d2ae989b48a802a01e30d48041124fcab641f216bbc9ba09049c7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 3146c5c9a13867a5556b9acbe71d30d7e7818696f5a3997cc9e133600ef0dd0f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 105ab3599df8e07070691bf1f663b93a8b5178ffb2415397f5031ffb264f4330
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 146207bc500d6ad7f43a1e53855d95532e2e542aeab74734c564ba9aa64ff462
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 f50c3538db266fd14a5d21bd55897b6e7a2623dc41c0ed7d1e287ef1f3e79e04
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 800d93908dd135b8749bba69bc5e8f035192a4765f77730725e2aa10f226f9bb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 5810af36b9d5f5a9d0a8755383e0c69132b81e23e8cb69eb7c2f0d2dd35604d5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 2bad4527696ebe1c724eaa0008d066e902e7fa7a474097e71352aa90cab9d409
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 b367733ce6bce07c45ac80c97c40c8937a5a0e2714b1c3f2ab964828cd246855
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 83d1888fff74c5e3d0e6bb2604f9ed643f386ce6f7b24b8b3d8a2976ca07590e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 1d5b06f6f8171410ecb675a1609869d71620be4b16d908a5c8270cb1a9c283e0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 94d443e7cc4e2389d262ca356fad78d93227a5a046091aab503cbf558b535902
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 313f4b86e5099e2053547f8d88fd553240597ed037fb502e80ade0f3c726e8e3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 38ae21c79ead5610281cc4d2d71ae635f15c290115246d58674ece823d8ca60a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 d96db6fa322dddaae103bfea13e52d4c24a99f5b9e938f3f1890fe943ec97f2f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 d902e4adcd835319b9bb73e9ac56abd1c8a6976b8af568141fa6f98b99bc4f82
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 c8fb8d1a361449fbe5097f8a4dd646d35bde56581702c038dce4af09ab811721
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 c30df021e0cc0ed814ee0b2acd01cfbfd50351c29d06475a1e918b28a0648aa2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 e2c4059bff2db1365bbe68e05533d96ea8011ee241fd65e49b7cad8c0b0b26c4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 9e1a6416f36d1d5c5b4c5a3d0c8b72ebc319a041df805efde8734bc4a7893d35
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 2068d202ea40e5f1f404658bf238120c8af0429117d7c7e2aa3995f2fda7d564
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 2a2b94c650eda065b5ae95903b9f23317d6eb9859d4df5189f35bbe9e4600183
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 c1fbae0caf193023353358dd89fad709af8a2814810ce8a57b6b961170289793
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 56fae88219822f52c9897f152344f6c64419faf297bf98765b84765b47013a88
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 e816f36648064c676a15524a5555c6861bd018aefcb6bc05aa4402cec80ff16b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 1ffb53217d216bafc4049a3fe81b0ab92a6fa69d4d2ce169fac6285fb894bd3b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 d6e518c20dc636f10df2f9b05a3f59f877adbc744b8d26d719e656af53af3786
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 e9ebaaae733a203f44547839cd655e09e99ebbb5889dcfbbfe2a56b669c106c8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 0b64c662e854236e246cb9554bbd849e1a749be183d2f22bbd114ec0d1473c30
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 379070f31b3d02f48173e919d4a8aa0402baa47f432027dde6e97be47bc6cc2e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 f12045c5014b1ac8fb05e250ec14b8aab68698f376def5840bf3f165abba2eaa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 01dc0ba79a3d1080e88e2a9030a9fa2ced60f48c461798476ca723f0aded52ad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 4d597334e884fc1f19f308dca7a0fb5265118314bd137a622252d7c882ccbea8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 2a3c2f105387c6c2e62855612c0cf077868aa0339fb299723cf8ea6a4dee9f62
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 1188393963113572ee88b8369709f9b637f79b93da939f1b46e51003a0e8ca60
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 c5e73cfb4f542065da5324844107b035d1eb9275292cece4c6fc619e213cbffe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 d536c8f35b732971a17c5ecb9bda98937a70056c7ac0e78c96ba60a6fc2a241f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 75537b5ddb3f26786578d2212931f2279492e59a417595e4051774138046a7d2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 cf646ed7c2d65b4a3c6f96b21a3f19ee16d5412fc4d6afb49b92c180b9c33bcc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        2026-10-22_939d6fdcae1dc1f41665784a6a34a1ac_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-22_939d6fdcae1dc1f41665784a6a34a1ac_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
        • Size 1.2MB
        • SHA256 1d9959565b58f038ccd6268b8713192fe7323a9eadb81ef1857665817dc4f95f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        2026-10-22_939d6fdcae1dc1f41665784a6a34a1ac_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-22_939d6fdcae1dc1f41665784a6a34a1ac_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
        • Size 472KB
        • SHA256 bb34b0bb6920305733aaba55b81dc088a17dd581c53d941e6aad4ca75f3ce88f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LimitEnable.exe

        • Path C:\Users\Admin\AppData\Roaming\PopUse\LimitEnable.exe
        • Size 1.2MB
        • SHA256 14ae5bab4c6d956ec71a8f4a1146100267b1e4d5f344683fe78fbbd18534cb7e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/4920-0-0x0000000000400000-0x00000000004D4000-memory.dmp

        memory/4920-1044-0x0000000000400000-0x00000000004D4000-memory.dmp