0533a237242c8f892601364f1cbb7d951d0b20789b6034da2e22efd9d4302b18

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/06/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 3.4MB
Sample260628-2desqagt2k
SHA256 0533a237242c8f892601364f1cbb7d951d0b20789b6034da2e22efd9d4302b18
MD5 59604b35e12ba7d3102d8f62abc8d560
SHA1 458869e29640ebfb758c5719ece63916bfd78404
SHA512 ba74f24f56ebdf8ca4b7edac27aee3a9ab957ae1abdd13c3a37d6119361334bc18aa0582d218b5875d0ab5148494f988ffa77348ffb0990585d4a94c59d7679a
SSDEEP 49152:PFBgWzjfRcNueuw9fWwagTNFsEd3p0uBjfKPh1pXqlzgyXMw7K6mwFK6Y3TbZ:PnnA7uw9eOTNSQBjgitA
TLSH
T195F58C17A19904E9D1A9C074CF068531EB31788E0BF6B5EF32989A553F77AE07B39720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3044	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.ico	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe.exe	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Media Player\wmpnetwk.exe.ico	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXDEAB.tmp	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\RCX95D8.tmp	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\RCXAA13.tmp	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe.exe	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe.exe	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\RCXEAEA.tmp	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe.exe	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe.ico	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe.ico	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.ico	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\RCXA955.tmp	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe.exe	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe.ico	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe.exe	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe.ico	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe.exe	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe.ico	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\RCXE417.tmp	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe.ico	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.exe	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe.ico	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe.exe	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe.exe	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.ico	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE.exe	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.exe	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe.exe	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Windows Media Player\wmplayer.exe.exe	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe.ico	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe.exe	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE.exe	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\RCXA915.tmp	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Media Player\wmlaunch.exe.exe	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Media Player\wmpconfig.exe.ico	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.exe	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe.ico	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\dotnet\dotnet.exe.ico	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe.exe	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe.exe	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe.ico	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXD638.tmp	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX789D.tmp	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX7ECE.tmp	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCXA24B.tmp	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe.ico	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX871B.tmp	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.exe	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4464	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
4464	2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4464
- C:\Users\Admin\AppData\Local\Temp\2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
  2⤵
  - Executes dropped EXE
  PID:3044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

arh.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
Size 804KB
SHA256 afd5c2fa80510ac98681ec39c1c4256e6f89dffaa0a0f9c5f5c612aec2d8a4b3
MD5 bf29a5792b1739c7173e4b9f37199c6f
SHA1 d4c552e77ad7d97a3d0e2e096041b4676e7b3a27
SHA512 4de868c0958f9749f12e36f3b82e78935b08a3c3a609bc1ae83d006ab527d45c98281f179e36b98e1259db73a83dfba901b80235511562b423af80133b671ad0
SSDEEP 12288:kl5EUsuEqlvHfyWXQdkm0FNZqZdk1jb6zUsKaX3GZ34Ow5iAy7ibZAbYmIjE72:sKuT8km0FKZ21UUsKY3GZUHE72
TLSH
T15905AE2439A6DAE6C4E40533CB8742B395F15F33DE7D1507EE21AE2D3921A6C2474EB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisabledGoogleUpdate.exe

Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
Size 6.4MB
SHA256 4870dc4389fda3b2d0a4c154236ae655762b2b011a350f821944625498aec935
MD5 58fa6d5eace0a7b7c2f9ff184d01e2cf
SHA1 85880c49edc1e22b1c0d22444f13607c8384cd42
SHA512 50bff2869de60cd62a2a26068439eea9a79fa31ab6028a5d95f57ad6261f7924ef35cc2c488599232650d6db2816d0350def31afd66e17903929f5f41ffb8672
SSDEEP 98304:gSQWog5HQ+hDHQTW6Af4fF7KkOuYO6IgF+IAMk/JexMXP8iuHG9XXYXQz7ws:Dog1P9fIlOuz6IgF+I3m2MXP6HG8Qzb
TLSH
T1AD668D23F4D04034E5F73235AC2CA7395A727BA29F3546CB86946C846FB46D2293936F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ieinstal.exe.ico

Path C:\Program Files (x86)\Internet Explorer\ieinstal.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

msedge.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 2.2MB
SHA256 efa8a57c0b2556f93342552478b14c62aed535024ea63ed6f1c9f05c31ace599
MD5 3998af7c2e8736cdb64983d1dede17f8
SHA1 8babf11b7c00338e6793bdae64c58e1a445fe96e
SHA512 7261ae58eb0943c86f946ed200ee2ab0e34e622b279183b76943f53fbf34b7b90992337f18ee42be1234950846593d7c236df7358d7b6fc29f745ebc0ad5ef4c
SSDEEP 24576:JQ9yP6GMV8kW7kNOjwLxQOUJtUp90v1XFf3ng7d9+1UXJwhXCTi2Qlkkkkkkkl0r:ZHTkNIEQOitU/03nmdXa5o5QPQ+
TLSH
T141B58D0FF69582A5D06FC17CCE7A4730AA61BC654F1155DB1280BA5B2D7AAD00E3FBB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 2.0MB
SHA256 35d72f7a1abc90a27914e62a228b7f5fd71878efc24a70d075949055b525e8fb
MD5 f167915e87faee8de7408d8ddbb1317a
SHA1 7a2a0cf38438f323dd8f4dc714e544df07485cf6
SHA512 1977bd808b60f3a1e883d6a410625e1ab87f010f1cf1243d9a35635d49d56e1012c827f6475368cd78cfb9288408841c94cfd8c4513fda8d90b9b03fc4d19bcd
SSDEEP 49152:ZGFV0LmemI/2/cdXpMo59xPedru0WjiMgCv1jn1ChuADSi:ZGFyz7rXpMAfeZWjN1jo
TLSH
T120A5AE13F2EB41D6D06ED47882668275EE61BC750F21A2DF0798720A2E3BAD45F3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 1.2MB
SHA256 4cc7293467337f03c1a166a4f6047e10ce50cfd1ed3424a81322c145ed27b251
MD5 9b30c649331647b21ed76d45be63ce91
SHA1 945d8d85dd484b7855feedb0f01c13be26e339e4
SHA512 772b0d7bd1d75f2b674222e9b69ec2184289968a04c73018b461e16caf1e70215f8a2de4043dd54174c2336a9f6497f88ddd5472d1e130adb32c2f7c898f0f3b
SSDEEP 24576:l8u9/w2ELLuPwhDYKV9VQl2Sw4y86n9kAJ9tA3L:ngLuYmKV9VQkSw4yT9t2
TLSH
T1A845AEC2B297C9A7E13DD9309D014E619776FCF50B20928F06909B692E725F1EE39B70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe
Size 2.1MB
SHA256 7116737edded62ded8e2b7cd415a5835cac984185642cd05db3447e4ba6a0e15
MD5 2fc8d7692fb3baafd76c361a575cc7fd
SHA1 b4ca9cdba9128ef1560cc33cfe347d3544527e22
SHA512 441849a8450357decb07f36208310257fc06dafb2a1841f70e07ce0992290609974b036d56dc061a82b9072e2fe51e090a9ed91c95727ea3b6310c581e6f284a
SSDEEP 49152:dNudkBlCouo7DMWfehjvHHKTdfxINPEt99G2Bo7EukU1a:OdGuSDMgyjvnORmE
TLSH
T1BEA58C17B2D841E8D06CD579D65EC935DAF2BC020B646EEF0790B2491E37BE46B3A324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.5MB
SHA256 5ebd80785ad3933d3aef7f90ddf7fa94017c064d3a3a850a4f77d5bb97f5d591
MD5 6695cca61a3d2cc2b218d9a8d8e6a9fb
SHA1 78f555729674dd13555121bd62deabde807bab7b
SHA512 647b43732cfe6f09478e0fcf6e7b33a7da84a4521bfdc5be470ede927eb068c05410424ce414dd9206d71e190b05ed8e932a94ff252e218dd9c005be1bfdfce3
SSDEEP 49152:BYvtvynFZGu6qG13O7Q7gLYduZrSdHBAVfb:yQR6YjwA1b
TLSH
T154C5AE03F6A580AAD05DC5B8AA328BB7FAF1BC104F7155EF13807A552D77AD00B397A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
Size 2.1MB
SHA256 302acef2115a4f44966272f7af17ad1d5ee24f22b16cb4eb8f479ef2fbb41fac
MD5 a825f60103a32449eb6e9762fcf3754e
SHA1 8342dfd738113b50890824b299584bf5e4ad5c93
SHA512 eefd18080ce2ba640f1cc27cb13318321ad6ed48fb900821ccddd041dd351b36a9eaa8ca3b0a485b2e8d9fefdf4c34ddcae732d8a4f4ef9a76d8f34a4d42073f
SSDEEP 49152:IBP/9vg8toTY2fF8FhmS86IUJWQn+6h27d6:Unl1tSbOjjsts
TLSH
T1C7A59D17F2A940D9D06CD170D6DA8636E5713C018B2AA6DF0790BE292E77BE45F3E360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeUpdateOnDemand.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe
Size 818KB
SHA256 658699180024030c6cca9c263dd0b69d794f6e235b7d80fb1df699ba72e0f0d0
MD5 9d6e34292b7677e5a2ddb63a32420f1b
SHA1 f9259ea291c82eb266be0b9610c15faa558aac28
SHA512 606ee668a5d85bdf2e40a016b7908c1d1cb3f353268425f143801272e53eefe570655a563b69ca675fd87c409bdf55777e8d815c63c642d5e4aca65d4b2af572
SSDEEP 12288:hoHod5r2DRVTogRgJi4M3f26yiXzI8/o8s2t75mZemyw5ilunbrNPzB+NU:2HmY/ogR2cPz7XzN/Hjt7ytbBPzBAU
TLSH
T19A059E8E75E1E897CA6D0C7CAE9988F0D1E63C027A091F0B71717F6C286F3D569A1235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe
Size 1.7MB
SHA256 5bdb16fbe2a3b299b64bd6d49e5b45e410374a3c6efc31155d884b0d515d3354
MD5 8add8c7e56ab20a54b62c4dc9e274dc9
SHA1 6f2d3b5e59f1440a5b12e11c7b4c4296bc7bcf9c
SHA512 7929ac11020640c9d4c21b396aed282f34c9bf12f9c70a215b6b7f5e695a26749e26886180900c781d28a90999f72cba8ba8467e2e875ffe73c77ee06079d4ed
SSDEEP 24576:NncayVcJY4YWOUoTfvYmWHHo7fvqcXFudDJdWQCkvjZQqg+lIVprS7:ahVmxYYqYzno7fvTqJdbPrCx9pG7
TLSH
T1A785AE1EB29544D5C02CE4B6BA56C931FA317C620B3559DF06A0F21A2F7EAE03F39764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 2.1MB
SHA256 3fd6be67d717ee93fe3084cfdeea36a27e63dd9893ceae2fbab0cd8a0a4490bf
MD5 61e1091cd00b302ee8fffcc1c2b33a48
SHA1 7891e3caeaa39f0e13574a591d29608dd82e7057
SHA512 14316a5c02e3814adb2fe156e25b02cc95486025315fb746c3b2da50af1d3a41a0360f0fa10604d7e6bb1cca66d9b48990fef8c5268e1fff41c6fddae19f2fa0
SSDEEP 49152:M8tm9QSo/0OC8P+DvwZ2XuTjPb33g9gZLfCdW9HTlXrk9dBB:M8tBMI4Ds9Ol
TLSH
T1B2A59D07B79900E9D06AD0B4C6924531D9B6BC410BE4A6EF1B90B3492E77BE46F3D738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 4.1MB
SHA256 3f037cee8d648a40a5dc203b6e94a3335ceadfdfde910b42e80a0d7c02afedde
MD5 5c77a139de35eee2d550369ed6ca81b3
SHA1 10229e15fa41f1c6a34f834b1922ed3e03ced8bc
SHA512 0eb45ab1ad08915b507c65217a4fa9fa45439cd2b84e0b3dc7e612a99bbc00e18f56ba351d617ef7b611e524f094944526ce1ecd003ad818d6c4a012612ad9fc
SSDEEP 49152:vO6EutwBJuZgk07G0auOj85q7aGScYbb6YErz7z4AkOuaRoBISCaQZCLlrrZ:vThWzo/Yhy8OnZy
TLSH
T1E2166B03A29900D5D059C474CF4A8232EB627C894BF566EF3760B6D52A77EE47B3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 2.1MB
SHA256 c9b0959c88b22b8655edf8da1864f522bc6f8a9faeeb75826923061a8425f030
MD5 f724de40585e3d11e01672692b674f5d
SHA1 efa7b4241dedd4c6c244347050c2e2719b591a49
SHA512 64aabf1813c2d2cad06cfd9a916c11db34918b124063ea83590d4879c72ff97db4e9981315192690bb64a85f814a1aec10b61ab634b5a78a1e42c7c6be09c5d9
SSDEEP 24576:OnF/+bDXDYgZVITnldSAqEUFrNWrZGY26UEU3RyRPW+uSmS86IU8Gc7QGsVa4i6n:OnDqAzxkY2fF8FhmS86IUJWQn+6h27d6
TLSH
T1D7A59E03BB9E80D5E05DC0B4C7124536FAE27C214B2566EF0B51B61A1E77EE49B3E728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

7z.exe.exe

Path C:\Program Files\7-Zip\7z.exe.exe
Size 716KB
SHA256 22de49094114a2cc2fa0bd6b02ac54757aac02279bbfa69b7be5db0c2f741f65
MD5 85f3b3e6205557aa98e60f84b41d6edc
SHA1 f1a8972aa2ac90a031c102b60ee8f02e0de1ec12
SHA512 433d0c03032a56590809c1a2709f6a546750cb5c0a7f7cb9a146bd40739a0ecbc5b3f38f330bfe2c17ae3afa9da80b2966e37d785277be45da7a3e0bb9204ccb
SSDEEP 12288:kCFLjRBicIsuNW2qWQgolrdRsqgLY+wAUT3Suf49PBw5iv2:PjRB/uNW2CjfRbgL5wAUTSuw9K
TLSH
T101F49D3D7A4E8E77C8341870CA1356D1ED211C9F6CE13647602DFEA82B7897B39259B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.ico
Size 3KB
SHA256 2a5c5c2bc95c18eded222f0a38752717c1a6ad20e31bcda6472bbba77ed22fe4
MD5 de1dbafd46ca8d953c93a1c89766a8c2
SHA1 41ec8c2a24317bba7a64f4b60341307033edcda0
SHA512 06a89f154036252f396a9f2ac515c5e03e8dd54eb7ba6c3bd0159f693d85846c4ba1b29c0fdc83f14d8c9128f18db3ee27c73111891dc66f81d4fd14361e6ce2
TLSH
T1D861565C04E3ACB1D6E548B83235B2C460D88A364424C867A89D7AD7CE7D8D473DEB0D
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

dbcicons.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe
Size 799KB
SHA256 5d35c343d2a5bc821f842cd43d3055c2becf81d9e21048beb52c15d8a0637b36
MD5 9317a16e01f2e1ff3091b6c54eed0ac1
SHA1 d59a5e0ca817e26d34e80eab7b66ec5437676815
SHA512 4f66ff30b63d9a4f02d61983dbc08b52de1c52057090c9d72013c36c73283027b9719d243e678f45f47a0884fcbb5543622f8be3b696ad9fb773eb1264a15ae7
SSDEEP 12288:N7SHRep/pQX1FjbiWtN7ZDRxYr2IgmYGWSY+o/qXwTZcEiKz3uw5ij4F:N/pQfjbiWP5RCrCmvTYtR6Kz3bQ4F
TLSH
T12A056B19B1808113CAD906305DABF7E0683DEF8418127A9F6225FF18BDF0695675EAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 1.3MB
SHA256 025e2639311e87f98e5006b0d28f595ebfb772d6642c1c69285be655dea562d8
MD5 2e1924b2cde04aa275b6d5657ac7d169
SHA1 0a7a7b54b9227ffbd4d93971fea05a26eae36e28
SHA512 72fd4300b213112dd543978ce16c8f53f63f2b85a1b59d69d1c5aa1e284d0bcefb76997fa5004060f4b7eed73d9946676f3b4ccad4998c0ecf863e1e3edb841c
SSDEEP 24576:7csKBzVwU9SUxons3Vtg2a+c4lpApJm39PZfePv3r7fm6t+jqp+3l+zCM0D:7c1wv1nUgQccqgZ2HbbZt+jqpQ0CMO
TLSH
T17A55AE31B6E14922F3F401739577BA306D3CAD146B02B5EA93E4AF4E2F683D55A73221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
Size 1.3MB
SHA256 30192a857b8c009d8d4a28a4652e39b80b559ceeee7b5ebd5b993f23a2865ad2
MD5 1a874adcdfad35887079dd23b17cc69c
SHA1 542a5c4cbc13bbe1423476f695ed9fce8648905a
SHA512 67935a2d4c6022119aff389ff40c58078bc75c34d487e9087bfd6d66d9572d717b483135f2c3d30eb72ebeca989a23055ac76beeaae46b7aa7b08f394adf8ed1
SSDEEP 24576:ma/NjHRwTMKjmFQMei4nvUwVyMysZgjS1hqgSC/izJfojymk4HM5yJ:maVPImFQPi4nMwVyRjvQotoy4F
TLSH
T1FF55CF39F052C063D5B11D72E5485271B9B9E6180B3D481EA2FAED0CBEBC4412B77FA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x64.exe

Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
Size 1.1MB
SHA256 287b2a71593b89297f6bf658b4a47fd694859cd0d4610435b3a140c6eb6dc5ac
MD5 2cfb5b3b8e97c68a2ab93d45e3f73b17
SHA1 857459d68a5ed87633548d3009873a1a0106e8e6
SHA512 21a0db19e6b809e8e1800b67bd7da090a0542f0d77a79b5fc333d4d9c1ec87a94878fa9e5734efb4a0739f15d462120934cc2f31a8e16683c77792804cd83349
SSDEEP 24576:ioWJOkt8/fT0UCmyQyktFN1Uku1FaImlMrMYenGJiKEbXWtfOkUy:irH1myM92aImnPnRWtGkf
TLSH
T15445CF2275F4C03AC1A00C3A7564EA742E3E94046E636A675FC5ED3D3D7C0B57ABA236
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveStandaloneUpdater.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
Size 3.0MB
SHA256 7563ecad84e3040b37f19a2d87e6f6b666f15201583fae9e332555cb80b17c34
MD5 72038b1ec5eda0a296f82646fa2e136a
SHA1 35c72891b5507fdc2e90b13de41abb8d374305bb
SHA512 e53c1095cda39edb15cefae57a5cc214410bbc2e7283248b7911bd08bf84fa784375e681aad918d1920d8b151d7046cc3e731258964328c17fe28d09bfc25679
SSDEEP 49152:4QKYd05Vr5vLt8NVAjXR6t2jgZ8tzPFASjYhMleFLyJwXP9L8vzbtu14BCNbTc7R:aYdmFCnAjUt2jc8tzhYhMMFW8LMprG2
TLSH
T1C9E5C021B7C1C077E1B311338ABDA6B61A3DB9311B2641DB7384575E2A704C27A3B76B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 56KB
SHA256 95fbc1715d5994bbbee342f7f1d9afa3fe780230f7c1622baf940481ef15c9b5
MD5 ea13e31b75121ce5603edd223f7edd93
SHA1 8ddbf99c0ce9f4ae2d3c684202a6fd19befce325
SHA512 9e83013504be0fe34c3cce97ded00fab0769e4a430eb1c0989aac9aa12a53628a1a5f4373b01179646ab6b3887f3ad7498b40e38b3de2066ad8111039301d226
SSDEEP 192:oGayUsWijj2l9lClShPdBL0DzoIfs21lgCOuSFnb0M/q4ZY:oGaSu9QlIIfZ1+COfSQqb
TLSH
T19243B4A2B804DA04D9095C369FEBDAEC7231BD16DE6B425335C1BB3F86771C10E2A685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
Size 3.4MB
SHA256 8c9a646a92f51822b286da810c8a0374d063a0585e43bf3943d8fe574cd317c0
MD5 d0b761ab86d31ffdac7197b4a4efde9b
SHA1 e34489f5b401ec10bd0903f81dee85c4c76e1c0f
SHA512 ea05cd23a9de767d8b4aa41e1c89e960c5c8c60a2c977e3ef21d74dc1a9714d4eba2ca5a835a09a9d4e513c62167a4fdcfbd8544f05ebdefa7658ac0dca22633
SSDEEP 49152:9WwLT42q5EWwagTNFsEd3p0uBjfKPh1pXqlzgyXMw7K6mwFK6Y3Tb:kOT4Z5HOTNSQBjgit
TLSH
T139F58C03E29500D9D299C174CF168631EB72B88D0BF6A5FF329496592E77AD07B3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
Size 2.7MB
SHA256 0b7ed4332c75ae6c773d337e09481b06e489fb32d9cffe9deccb8a875e6852f4
MD5 f66cf6eea9c65172c3512f9d762efd3f
SHA1 4f359723fa805b8696bfe2835a77de3bfa7379ab
SHA512 63438f9b667f74dc8eb7df554b9bd64d5da08eed184ea03551c4e4d065e1b04201a056d8e96bbdee8e8164b69d7036e9a6b3a3f1fb6b09c3113ea891b3e1bc6c
SSDEEP 49152:9WwagTNFsEd3p0uBjfKPh1pXqlzgyXMw7K6mwFK6Y3Tb:kOTNSQBjgit
TLSH
T124D55A03E19500D9D199C174DF46C632EB72B88E0BF6A5FF369096152E67AE07B3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe.ico

Path C:\Users\Admin\AppData\Local\Temp\2026-06-28_59604b35e12ba7d3102d8f62abc8d560_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe.ico
Size 3KB
SHA256 61197ae03a1910353d202dffcc2271af59a9c26150652fbc6a84806cef420176
MD5 a51ce92e581ba4b957d045df35c63586
SHA1 d1d8568aa271584df960c4e249f123989f12bdf7
SHA512 3cf7c5a1692e441fac481dea56cfba42b66d6f3e73884d05afe8ae94b83b9e21d07da69607ccecd53d1a8ed37d9e11fbba466e6b46e3f3c45ab8d267441f636c
TLSH
T14D61FE945B0F55BCE3D63FFA02195B0465522E7F18AACE4F73B130322638F4D2968A1D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4464-0-0x0000000000400000-0x00000000004D5000-memory.dmp

Download

memory/4464-1139-0x0000000000400000-0x00000000004D5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads