Analysis

  • max time kernel
    149s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/11/2026, 12:43

General

  • Target
    2026-11-01_a5ebc35cb453b14a3bbf3d4233468b71_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
  • Size 1.2MB
  • Sample261102-px85fswt7j
  • SHA256 5a07b0721b87b186d49018b8cbd3d8ea4f3913fa407c05b574ed31c58153c1f1
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_a5ebc35cb453b14a3bbf3d4233468b71_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_a5ebc35cb453b14a3bbf3d4233468b71_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
    1⤵
    • Drops file in Program Files directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1540
    • C:\Users\Admin\AppData\Local\Temp\2026-11-01_a5ebc35cb453b14a3bbf3d4233468b71_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
      C:\Users\Admin\AppData\Local\Temp/2026-11-01_a5ebc35cb453b14a3bbf3d4233468b71_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3788
      • C:\Program Files\Java\jre-1.8\bin\javaws.exe
        C:\Users\Admin\AppData\Local\Temp/2026-11-01_a5ebc35cb453b14a3bbf3d4233468b71_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3684

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        64BitMAPIBroker.exe

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
        • Size 957KB
        • SHA256 c2708b362e9344cf3d22597508e00b06040ce66342f5972708129f9b7b0bf54b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AdobeARMHelper.exe.ico

        • Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe.ico
        • Size 3KB
        • SHA256 2f33dacaebb8bdf6d2d88550cce349c09b51dfeb4f499796f32bd30e14aab86c
        • MD5 SHA1 SHA512 TLSH

        jaureg.exe

        • Path C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe
        • Size 1.2MB
        • SHA256 73ab35eacb5f8714b40bfd6482fb0208bc58fb36a5675b483daa4700928658c1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msinfo32.exe.ico

        • Path C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.ico
        • Size 3KB
        • SHA256 5d7967695bef88a64140c541a09f22b45abe542c2df462d800e72e1d8e121d28
        • MD5 SHA1 SHA512 TLSH

        java.exe

        • Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_157859\java.exe
        • Size 1005KB
        • SHA256 9b75b8aab5410a53c1f02e9b9852ee07ef738331ad9a56231ab1aed2a3881025
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_157859\javaw.exe
        • Size 1005KB
        • SHA256 85a2c1dc70fed748ec65bcffd631f43a2bb039f94c99bf95497fb6ede034f2c6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DisabledGoogleUpdate.exe.ico

        • Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe.ico
        • Size 3KB
        • SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
        • MD5 SHA1 SHA512 TLSH

        msedgewebview2.exe.ico

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe.ico
        • Size 3KB
        • SHA256 61197ae03a1910353d202dffcc2271af59a9c26150652fbc6a84806cef420176
        • MD5 SHA1 SHA512 TLSH

        msedge.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe
        • Size 4.6MB
        • SHA256 07b2f5417ebfbfde90aca227fa512a04233ca201a88e04195c54fe8a924fc5ce
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msedgewebview2.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe
        • Size 4.1MB
        • SHA256 3ff4d7f567fa3483e5e2663a81f2eb8fb9ee23702b3f907b8819862807b008ac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe
        • Size 2.3MB
        • SHA256 23435ce8291ef03887b464fb2e80eb8f2c837dc7030b4f11c80e20d3c9910cc8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MicrosoftEdgeComRegisterShellARM64.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe
        • Size 880KB
        • SHA256 65957fcfd499642661005003aebf61037c2914f32ba55ce0d2aab71b8115f6c2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MicrosoftEdgeUpdate.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe
        • Size 929KB
        • SHA256 c5b55913f90ef900203d37985411455c0565b4388b29a38db396eccf835076ee
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MicrosoftEdgeUpdateBroker.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
        • Size 818KB
        • SHA256 53fdcdb211b5634eb79b7c3c42bb2822c6a81cd3126697fe28e1ee9f29eb4e0d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MicrosoftEdgeComRegisterShellARM64.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe
        • Size 902KB
        • SHA256 218457a3e073336b6d4c3d331ece3da79d88c99b10b5631a7e1ce9bda29e3b0e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MicrosoftEdgeUpdate.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe
        • Size 921KB
        • SHA256 7b4429c0c12eb1fedecaa4a01abec01ca14f015a0eb5ad2cfeeca62cea417fb5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe
        • Size 2.5MB
        • SHA256 3d98f89dbf910e18ce1d82d383d3fd02254bd090e1e369344081a254af90db15
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe
        • Size 2.0MB
        • SHA256 f0b9e63e2d46f5f763a1585548ee6705684662f4e1633c674a303d6c3411a8fb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msedge_pwa_launcher.exe.ico

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe.ico
        • Size 3KB
        • SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
        • MD5 SHA1 SHA512 TLSH

        pwahelper.exe

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe
        • Size 2.1MB
        • SHA256 9ab83ff367cd0aa3b6faded3feb12dcb22696a94f68c101c0b6d50553f01481e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pwahelper.exe

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
        • Size 2.1MB
        • SHA256 9780a37f01e295f288d730126d7f16cea7a8c74a6a7d353f2e043179cc03b0de
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Uninstall.exe

        • Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
        • Size 820KB
        • SHA256 f281fdf0814f873c86bf4377681ad3ae4d48b2a678261ae4a8cd75eb5595dedf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wab.exe.ico

        • Path C:\Program Files (x86)\Windows Mail\wab.exe.ico
        • Size 3KB
        • SHA256 ce19242fbf3efc4fe158fba6ad17e913a57a5fe53166f47dc8e5faa5a9f90a03
        • MD5 SHA1 SHA512 TLSH

        wabmig.exe.ico

        • Path C:\Program Files (x86)\Windows Mail\wabmig.exe.ico
        • Size 3KB
        • SHA256 88c0094fb49858d277e6e56c8c1023bf93356b7d3fc8e037b355d21aa1c7bd34
        • MD5 SHA1 SHA512 TLSH

        wordpad.exe.ico

        • Path C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe.ico
        • Size 3KB
        • SHA256 9948a7a97643b62f3496c08d5c06563d78e1a2eb7955a508cab6ccab402b33fd
        • MD5 SHA1 SHA512 TLSH

        ImagingDevices.exe.ico

        • Path C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe.ico
        • Size 3KB
        • SHA256 c76b2392ae75384d2097bd890c529cc5636350476c9a001ee1a055430c8f1c86
        • MD5 SHA1 SHA512 TLSH

        7z.exe.ico

        • Path C:\Program Files\7-Zip\7z.exe.ico
        • Size 3KB
        • SHA256 2a5c5c2bc95c18eded222f0a38752717c1a6ad20e31bcda6472bbba77ed22fe4
        • MD5 SHA1 SHA512 TLSH

        7zG.exe.ico

        • Path C:\Program Files\7-Zip\7zG.exe.ico
        • Size 3KB
        • SHA256 8cad493433ec34a34ca6f4fd49655aaf7cbb4337752743804db83ea6c050d1fe
        • MD5 SHA1 SHA512 TLSH

        OfficeC2RClient.exe.ico

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.ico
        • Size 3KB
        • SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
        • MD5 SHA1 SHA512 TLSH

        setup.exe.ico

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe.ico
        • Size 3KB
        • SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
        • MD5 SHA1 SHA512 TLSH

        HideRequest.exe.exe

        • Path C:\Program Files\HideRequest.exe.exe
        • Size 716KB
        • SHA256 fae77bebc7b381071aa472e6661c3f478c289c2c9d79b3e518236b8793227c3c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ielowutil.exe.ico

        • Path C:\Program Files\Internet Explorer\ielowutil.exe.ico
        • Size 3KB
        • SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
        • MD5 SHA1 SHA512 TLSH

        javaw.exe.ico

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe.ico
        • Size 3KB
        • SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
        • MD5 SHA1 SHA512 TLSH

        OfficeClickToRun.exe

        • Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
        • Size 4.8MB
        • SHA256 8efc52c97589b306c73af32afd90593935176f366e3404da23e6c6ab4eebbd34
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppVLP.exe

        • Path C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
        • Size 1.2MB
        • SHA256 6e8a7be6dceca5763880735f41ab24543879d33122a8b5e894ea83927febe47f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Microsoft.Mashup.Container.NetFX45.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe
        • Size 740KB
        • SHA256 8ae476574156fa760dfab29bd0880bf7d53faedbfaa30e1d1c940c9553ae0a0b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CNFNOT32.EXE

        • Path C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE
        • Size 962KB
        • SHA256 214985614045f70daf4e9b065a01510ea979ba082641c985eb9c3bdc00cbf4e9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PPTICO.EXE.ico

        • Path C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE.ico
        • Size 3KB
        • SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
        • MD5 SHA1 SHA512 TLSH

        WORDICON.EXE.ico

        • Path C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE.ico
        • Size 3KB
        • SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
        • MD5 SHA1 SHA512 TLSH

        excelcnv.exe.ico

        • Path C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.ico
        • Size 3KB
        • SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
        • MD5 SHA1 SHA512 TLSH

        MSOICONS.EXE.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE.ico
        • Size 3KB
        • SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
        • MD5 SHA1 SHA512 TLSH

        MSOXMLED.EXE.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.ico
        • Size 3KB
        • SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
        • MD5 SHA1 SHA512 TLSH

        MSOHTMED.EXE

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE
        • Size 1.1MB
        • SHA256 143cb72bb6a6f6bb2c1f819517380a479edb64810c87c8205bbd36bc904048e7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dbcicons.exe.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe.ico
        • Size 3KB
        • SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
        • MD5 SHA1 SHA512 TLSH

        joticon.exe.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe.ico
        • Size 3KB
        • SHA256 f4c419b2d60ebe6dc173b36b108855b1f4db9c28fda291f4d93ac38e6dd24389
        • MD5 SHA1 SHA512 TLSH

        osmclienticon.exe.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe.ico
        • Size 3KB
        • SHA256 b76444a386ad024bd78ee152f0f6ad2d5dd3b9ed478147014e5d804e7a9e6508
        • MD5 SHA1 SHA512 TLSH

        outicon.exe.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe.ico
        • Size 3KB
        • SHA256 98d0a0fe25fa36309c0bbe62f04a561a1e02d51a4dc2c8331b9b3c2e47387f5f
        • MD5 SHA1 SHA512 TLSH

        nmhproxy.exe

        • Path C:\Program Files\Mozilla Firefox\nmhproxy.exe
        • Size 1.3MB
        • SHA256 6f863aa316a35643096dd6caf35474ee5bf4e43194d385a4f3fdb8be232dfd7f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        helper.exe.ico

        • Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe.ico
        • Size 3KB
        • SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
        • MD5 SHA1 SHA512 TLSH

        vlc-cache-gen.exe.ico

        • Path C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe.ico
        • Size 3KB
        • SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
        • MD5 SHA1 SHA512 TLSH

        wmpconfig.exe.ico

        • Path C:\Program Files\Windows Media Player\wmpconfig.exe.ico
        • Size 3KB
        • SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
        • MD5 SHA1 SHA512 TLSH

        vcredist_x86.exe.ico

        • Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe.ico
        • Size 3KB
        • SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
        • MD5 SHA1 SHA512 TLSH

        VC_redist.x86.exe

        • Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        • Size 1.3MB
        • SHA256 061d11e5f96811f5710504f5f46860075dfece9c9d32c52bfc2a14487273c87a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        windowsdesktop-runtime-8.0.15-win-x64.exe

        • Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
        • Size 1.3MB
        • SHA256 f4cdeda0b89029e59b3c8450574c63a5d9327b9ea9bad4c0fdc01028daa6345a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vcredist_x64.exe

        • Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
        • Size 1.1MB
        • SHA256 3bfd235275ac2b93e60e99e85c83ed6a1c6d4db48d4964568cc699539b9ea9c6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        windowsdesktop-runtime-7.0.16-win-x64.exe

        • Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\windowsdesktop-runtime-7.0.16-win-x64.exe
        • Size 1.3MB
        • SHA256 b231b045ecf9a43dcb88d692db0dc96200975eff90e9a505f87d79e0a9b88d5b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneDrive.exe.ico

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe.ico
        • Size 3KB
        • SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
        • MD5 SHA1 SHA512 TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 d6c625718608ac3e3cf14020060a48e94aec2f65ad1722af98916a78bffc8041
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 8bf33199cb576c6d6877c526a1ee507b439f5c38afa1b1b90a7e2960ab7a0f21
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 486187cb99cd4d3d14e384e068520f50e9f59ec2d47266e8ac3d8c81dcc9ef37
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 b9cd60ebec915be10ed0e12067036fa2182e221543a1430acce05b26fb778af5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 2ee8e15808f77a1e311055c09fd8fe21b1fa04337767192e17e62bbb4a3ae24e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 6cec2e349b1ed7f7b0aa0fe7ded176d3fbd1a9a0dd6653145e9bb032204237b3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 f807b9ac06c8e039647b78a1eadc94d96043644669bca97d65494ba1b12c285c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 6e1db90ff3000d5ab21d5b405959d2df74dbf37c743aeec262b4b09423177e1b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 75373322e0c0539c2754f75b5852896eb3f96063ff9b0b9f4a795844f6de5ed6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 ec05442ba1f47f3fb5da8047cadb13cfd3e8eea4423d855c0c180439c4c90c0b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 c28619140a6e60ece5effcf0a0450c68f17bd3346d6b0d0ad858789ad9bd1114
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 9f86fc401790ec7e22b03203e38f55cf34a74632a8d9d427fc783e30282dfd7d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 56b728c6ca16ae35092779eda787a38e0de175c1d8dd8c5580eaa6a46f09fe37
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 06e7326f3e5a049af8b41870f236ea6303ec0b3ce9792a2240c3cbc2669136e2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 6f22150791b7ff74c2f548c146c2ccc1b7279014f32556232292b1eba8fd1ced
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 0b63a625e5712be1bb21ade1aafc2d59d6dada99972505156dbe2f7f9a1486a9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 7384d0c10fc2cf075b20763a3db869e38d9eafd9fb4a79eca4de7625e35ce75b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 d8c4f1ecd0f1d6f2a751c5fb2ff64681f623b0ee69d461c36d50fd35b135fd9b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 8f0c6676360589b3c5c9ea160ad75c6cd42484f0a1a23f4bdc7f65c7d14a11e8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 5acd1e3ee2cbde843761caa4e25165581fabed3732a022f5228953c8dbb86b66
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 fe55c7e3d01097a39bda41bee645ba3d19956512bb2caecf706aa5c3e7e7a779
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 35f48f133e96b51b1d7a76f719c466e3cd47fa09337f9eec7047c76c83b62448
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 5a12d42cfd352041084f07eae9547d51c7b7e069fb4983f96e324206ba0cb333
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 ece5229dba6e5a132407f071b3272bf2ad5edce80c73da69d44aca0ccbc88c36
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 82684eb6f1da73c9e217899e03ba94bb00c1449a054445f9636d349879657165
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 7191a26a7ec150121669b3c0ddc6c03d4bac2d1cc06d8000cb2208d860b603e8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 bfb327320b098d461269d75277cf525d14c35ffcf4f7beb8bbcd0bc354e87369
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 c63ef836fff95bc55e792e883cfc3a36ca68b311c38803ed0a98c58609ae3a05
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 88933051398523fa8e66f0f5b980796582900524002c3492ca2d7ebcc7c4dafd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 255f67737492e99bbb4d9cbe1e090563549d2c93e74f676dcae3efdc71853635
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 dceb0906c3279791088c91153cc757e7c5d4a5f294c43c1cc2e0465725d73105
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 dc99e9a4c8b22b2be2375cf22dc98f9625f3a7a6d93d7a892066991fdd4c2f9f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 a3be1be8e41787dfe3c0d3855efb3903538c5012ce73df880fa1ab3cf1ae8a15
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 8e6d5cca38f367cbe156653742e52433d8ac526609aac14730cda971e74ead39
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 d3c44dec6b60f5527c3697fb51fc69756481af27a2e57de3047cf1020a2d94db
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 5e135536ae22fb58dc9466d40c5e5d5ef7855b64c7efaa831edaec9da39a7924
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 a1631593245e47a57ea9d71c0508c59ab915630a7727114d0a9e69ebf35cfc23
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 d6116a4cf9c7aac2d35ffdfd07ffb2c80cf7ab353134d663562b53a541ba2b91
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 9b1114f711970f2bcf6e97cef0a09919d8fece65f7d1ad7cbc8a0101c63a2cac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 8f349b82c880f80cb49c645a36728d808f37cd3da8641f3a7246079ab0d0ede0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 ee7cbefc20872f3c1301b2c12b02f534b148381a44db0be1b0c7d21435ba76c8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 312d4e121e392bc5a2ad445cfbe34b892bf9221af6ff513752a4b8c80caad431
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 ee95c4008a239ce9ffb17f0391de4974909881dae70da43539b53dfed5e710e7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 473dc59c1e5b48e41c6ff8559ad3d9ad8275e8de36788175d65b760ce22fe3e6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 1e6cf0350291558e63fbc9bb0cf7b587ce4cbeae1313f700387bfbe71afec6aa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 3e0ac57be2ecf401c2d7fe8adbfda91b587f7d9ad06b2893c032a728c89ceae2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 7c7f5ede2bfc9d16049df95aaf6533e0b16e923b851f8d21795de7338675d7bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 bb3a34f8c421239b96edca165ced8bbbda33b6d48e186cd2ed769ebd2c782ffb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 c8358b8bf7f93aedfaf313567532305bb6ada3d55df26906649e270648c47754
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 a562ebbf1214935538365be0bee4425b4467762d0a7d7091bbcb5ee36e408cd0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 e41f21cb22dba2f55d9c5c812a5afcaa12736bcdd432e38f9806aa7c383a62f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 c1b7424621e762783809f8acc8062729d436a8ac028de6cdd769108274643cb4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 ad8f257b31b2c1d8c8366dde6400757fc2dde24239e9b95d94545c07183fa6b0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 df8e6f3bd20f03b84a844242381324388bba70a9d71153842a023901155d5255
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 bc65ecde1fa2602e26df4b756c3d2164bb07753b9c134f21583c3545ebcd0f9c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 1f277bff740309ca690eba25fd988157df267570ff7586935e97cde1632f8d22
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 461d1a102504aa3bb2e854e5352d824f30116f9abeb5b59127efa2a48d69ba16
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 faa6003a072400cc14209a429eafa37ba2f7d517a09a6b9e674c42e0001dbc6c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 9bfe199a8ed46bfd54e850860ab31984970de337b56710f70925cd5280e0af91
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 fc8e557dd5541b051303dd72b0074dff89c96462c18057608d7fb04b083077f8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 178f9a095b8f049f9131e3b603cf7721acb68cd681fdce4064f56023df294c9a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 69febb0cef95e74796dcb3003bff0033d54d9858b9b2bbbbf32204be12b1e778
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 3bd67fa697575cddb88f030cefa5058319fe90bbaf2532311d33ddadf4d84cf2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 69b5854db6b89493fe3593e0d5004be39b764264142a60d4ff126006d96973bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 1a6f08ce8abf5904009c8796e6d58552ece0dced7701a246181e6b099279b405
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 fafae4acc009fcea67186e1b4b9bcc5c0b09256092fa460dfc90d1fe1042db5d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 bb5dd893e094115d971dd2b20c605fbc5dc705bde9b21a31479f2dbe47818060
        • MD5 SHA1 SHA512 SSDEEP TLSH

        2026-11-01_a5ebc35cb453b14a3bbf3d4233468b71_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

        • Path C:\Users\Admin\AppData\Local\Temp\2026-11-01_a5ebc35cb453b14a3bbf3d4233468b71_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
        • Size 472KB
        • SHA256 b306b8d9f6c46078195dc3737d35cc8c96edfd69fe3d6ba4cb438c0a19fbc6d2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/1540-0-0x0000000000400000-0x00000000004D5000-memory.dmp

        memory/1540-1039-0x0000000000400000-0x00000000004D5000-memory.dmp