672508f38a58baa68f2c7fe0c7a517967660a58a3f52a5878f5daa69e09d7c73

Analysis

max time kernel
21s
max time network
161s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 1.2MB
Sample260628-wvtqbabs6x
SHA256 672508f38a58baa68f2c7fe0c7a517967660a58a3f52a5878f5daa69e09d7c73
MD5 e8b2aefb624db2eb3ad22740bc188ef6
SHA1 e5f81ba3d7af735911350af4b76025574aabe419
SHA512 68480231f0e0ed898f52fab67368e4d0e73c21a62559329b0829acf50b63fe5f910a71df4302234f5262fc45e1320aff0da369b674a67bbbf5a5ba473f7280db
SSDEEP 24576:zWSkSr0CQkrAo/lkga/krgICRcpzbH3Td9CHKy7GZO:SS6kBNevRATd9CHKyao
TLSH
T18D45AF43B2A5C0D1E0B2F974C96BC4D4D6F6BC25CA218A4F4E55270E2E32292793BF75
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5512	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.ico	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX8613.tmp	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX8AA7.tmp	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCX9536.tmp	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE.ico	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.ico	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.ico	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe.ico	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCX924D.tmp	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe.exe	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.exe	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE.exe	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\RCXAD63.tmp	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\RCXB81C.tmp	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.exe	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe.exe	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX8B25.tmp	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.ico	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE.ico	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.ico	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.ico	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE.exe	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCXA775.tmp	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.ico	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.exe	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.exe	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe.exe	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe.ico	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.ico	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCXA2A5.tmp	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCXA8B0.tmp	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE.ico	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe.exe	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCXAB88.tmp	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\RCXAF5C.tmp	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX79E3.tmp	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe.ico	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.exe	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.exe	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\RCXAEED.tmp	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe.exe	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX7EA5.tmp	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX80FF.tmp	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5768	javaws.exe
5768	javaws.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6476	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
6476	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6476 wrote to memory of 5512	6476	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	90
PID 5512 wrote to memory of 5768	5512	2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6476
- C:\Users\Admin\AppData\Local\Temp\2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5512
- - C:\Program Files\Java\jre-1.8\bin\javaws.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe
Size 1.9MB
SHA256 cc5feb73a1956367d872035711baa6094736820206599daf80ca111df50ac939
MD5 2a7215301b99f0b8a51fed16f9f86288
SHA1 797bdf3051cb2babbc438bf36297ed24fffeca06
SHA512 88356a6f2069f39e0693894c6ca5fbeabe5bc28deb0b864b6befa14e959c6782a6fd74e4be5ac9bc953886aa590fc56c26e0364aa280b74ca7ed5139a4b30389
SSDEEP 24576:2IknGwfEGrY4HN+T0kjd7uwJl3shz7NZyz5/Pem0+dl6ZVP5ozP5IVJXyxR:F0MWYCkD/3YfNc/X0+d4/xozyVJO
TLSH
T15395CF0BB7D14DFCD069C17497126171EAA2BC964F2062DF46D176282FB6AD42F3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe
Size 4.7MB
SHA256 09abf79bc8d46b021c391952b2958f9326e90356b3155fb43a7c49b252651a19
MD5 c99defbe3012803f229f817c962d74fa
SHA1 5651a1c057050e779041fe6f76a2a21d121167bf
SHA512 3ad620588ec53fca46e9f203057ae2438c269241a0f8aed428feac536e79537d61d5b70677b487414bef62f00b60d901e282dceeab4893e473ba12b32314b919
SSDEEP 49152:tDZo4xPBOd/+m3udQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2yA:pZo4V4RlijnUdYd+RaAj
TLSH
T1BB366A03B29940D5D059D074CE5AC232ABA17C8D47F162EF3690B7DA2A73EE47B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.6MB
SHA256 389bba0284fc1f1080b78c2d8855517c3d5b7cf34ad06f75cd71053e958f34a4
MD5 24edcc2d306cf3ca7ef64fc99c42eafc
SHA1 e208e42d006cdcf1bd832456bdc9ab8f53f13cbb
SHA512 f744f4c4b28866e01bf96d599987214f77defff7ecd96852f142f02631df57fe72600439b22c49da03fa501a33891feab047ddd844be062855face47577ca17e
SSDEEP 49152:iqi03zVUWZGu6qG13O7Q7gLYduZrSdHBAVfb:O03dR6YjwA1b
TLSH
T190C5AE83F69A80E4D059C178CA768729E671BC154F2876FF12887A192E77AD04F3D3E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
Size 2.1MB
SHA256 305fa7d2dd4765548cae4791e997f76b0c073d48901fb77e4a8ebb89d91b7622
MD5 8dae5a6bb67555b0f48e69e4b6e9ed52
SHA1 1ae7a0893db5fc2a7cfb7bc586aefaaa8f4454a2
SHA512 15a8d935b7459713134a39d00969b672648d3fb48d15f358c05d75a3811eb61fb10550dd40129a3a3ddc144a22cd450af289c7f6dc6d0cc156b8cbef322692f5
SSDEEP 49152:T4FWaEWglgLcMY2fF8FhmS86IUJWQn+6h27d6:laEIBbOjjsts
TLSH
T14EA59D07B28A80EAC019C470E7568676DAFABC455F25A6DF0794F7091F37AD41B3E328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 1004KB
SHA256 66955bd0640401987cbc0af35fa974c29ecc3f83c6b74f53ccf209bc11677b30
MD5 a75bfdb16bc2b07f0ac67da073c51748
SHA1 0a2400a00a3c87665397cf1463cb9c9228920ebf
SHA512 b8c012456e09f3e11fb76dc52a238ad96cf1c5fb407a04cc7b5707c0517626ee5105828e9960c2cedf3e37af1d8d7cd87049d0dd0fa44c2c3e1259c9ccfcee5f
SSDEEP 12288:82CHNL5rsymaszx+iE/F2x9Dk/uPdrPsHQgpO2Oow5iNLucWPjM35i6ows0:826eymaIx+Z/IDuuFGO2OljA35i6c0
TLSH
T1D7259E2C31E444E3C43E84F0BFCC87D1F3A2B87E575599EB5658E6895E34A01ED62A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe
Size 1.3MB
SHA256 a86b2cbbaf6b6d25b996fa71f9ee69300db6ddbd094532924c5c1ce65efbcb2a
MD5 0127bda9740231ef0842ed33c078a339
SHA1 4ddb5bf4dac2d352f92c62e57ca97729c6fb4992
SHA512 ede6758752959e7293671b74d917cda83032e206bed8fab6cc442d38fb6e4dece361fa272100aeb6bf76a3fce327f4f32e9562830214ce5fc6470697ff78eeb1
SSDEEP 12288:S7I6naPSRieUTppzzNBqhMurduIxLSKQAw5ilg9Z50k9mnRT0JIxQ4ObTM:QI6agXUT25drXQ9QgSk9mR4qYbTM
TLSH
T16E55AE562F849ABBE014853489674393B6B3F8460F65B39F8295976C2F3BED80E35730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
Size 4.2MB
SHA256 109847fb904759464db5d2865821ce4d26815c9f0660a59288ad52b0a4df85a2
MD5 4930e950df3e75c08d0b6b8027fec992
SHA1 565b999945c03182598e45090bddb764f681eca6
SHA512 d4f1a225ddcee8710d7fa472ef5ddb8455128ab85e0610a5233f8b192a80c87276d2bfebb6dc478f08440f2429d095b858b51e340f540b66350306f36657a8a7
SSDEEP 49152:iTRPuEMBwnS2aBW08mKqRXGPd39PyPvnkSN+EcrxA3vGCDlBYMO74U2y+PhC:4RmLySbN/ki+EcF0pDeN2y/
TLSH
T1AF165B03B29540E8D199C1B4CE469632EB72BC4D07F266EF225076E52E77AD43B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe
Size 1.9MB
SHA256 bbeecb52d930c6a55dabe4a1f2300e0a3a6647a5a8f9a3ff9d27e74342545f5c
MD5 f64fd37cfda7c711e18876a84aa7ee8d
SHA1 b7b762fb5e61d297b57a01b0f5c14ada123ec872
SHA512 e090ee62e88e4c32283a20376fc73a3d26cddae3f1599098461801f69f1d102583205fb5cdfc3c2771d76cad96a64e834004e67990c752bdbd0941831e4733c3
SSDEEP 24576:qrbExZ5exFh9ALcdfkpy/gXKCWPEOHlWk0eTy5xDz7EqnPATW41PcL3LU:qrbExC3CQIilp0L5xDzoMY91P27U
TLSH
T14D95BF17B59578E7D01DC0748B5209B1EA32BC591F3566EF2780B358AE37AD82F3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe
Size 2.2MB
SHA256 d44654b5c03ec39c51e4a4d9fe017a91b02093aeacdc9d47131edd2e43a77de0
MD5 8e6c1f2fd303fa78be4f9777a258b383
SHA1 60d2b3b5353e78d3b235ed453632c75b65d93e5d
SHA512 b1ca7a5460b8404210f5e964f9f2a38d44722dc5a6ca8a108f7837c3f7f102526f7218afe0cead2b696aa6a83a95275da9bfea568df7e66eb7c05fae57a542eb
SSDEEP 49152:cWTaiKegV7t6JBBfehjvHHKTdfxINPEt99G2Bo7EukU1a:cWWiK990xyjvnORmE
TLSH
T1B6B5AD43F38814E8D059D1F6CB468635DAB2FC814B28B6DF0690B66A1E37BD41B3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

MpCmdRun.exe.ico

Path C:\Program Files (x86)\Windows Defender\MpCmdRun.exe.ico
Size 3KB
SHA256 02221d573edefa486ba8fe5aee3c8a10c8c7e3188914c0f22df06bb1338db790
MD5 1272e6501512e471bddb879dea4b5800
SHA1 1c8b9489166959e6106095c0974a1825ac1179c6
SHA512 7ef9f685457532d84ba2ed316ec52a44acec151b92e563f6943f593d272745bad0f7c549867a723d2b3532cbcb76ea2b99a965b3b2412d5e7644570740bb4194
TLSH
T1CF6140A1F209FC58C45CD1744DC6C2CC18543D958C0A7273FADCBF8F69724E52E21181
MD5 SHA1 SHA512 TLSH

Submit Download

RCX71A1.tmp

Path C:\Program Files\7-Zip\RCX71A1.tmp
Size 784KB
SHA256 5aec817a7380d701ee41625c5485f0beba12c74c6ffdf8f8a94334691ad0ad58
MD5 481e47e612b09fd5e762c5576733bf7b
SHA1 5fb72e80bcfbe8e2044fea56ea90976edb8e865c
SHA512 210baa84a66d916ff3f468b44cbeb18759eda1ba312369ddbdba3d5e1a023cfeca9bdc20f25ed37792a5187a97671f1d879c9f063a30f1c59cbc2938105e5677
SSDEEP 12288:zWdAW3Ff6r0zCxQkthcRje/If7o/vNkgdEs1sAvUegq1KMCRTeUSy8L2w5igM8bE:zWSkSr0CQkrAo/lkga/krgICRcpfb
TLSH
T13305BF47B523C8D2E9A0F8B8C65BC8E8E2D5AD31C9215507DD26274E393409B397F7B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.ico
Size 3KB
SHA256 463b6e99198762de39ea3c9156504527673355f452c17063d0fcc34caa3cfded
MD5 01f2c0d2e4df4e0ed544a4e4600d1457
SHA1 2bdf43857fcfeefcd37ee7a82d733ca4e4f1d871
SHA512 8238557d4075faf0d780ce775a6bc0121cf2da9b826cc49095fec9b35096809e5187f3027682db88d7358e21025c5d24d2ef784e9c2b0a8aa7021589ce68a8aa
TLSH
T13061D3A9E5052C3BFD5CDA7935B6DB60C2077ECA021680778809F58328F768B16ED974
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

iexplore.exe.ico

Path C:\Program Files\Internet Explorer\iexplore.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

lyncicon.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe
Size 1.6MB
SHA256 38dc1d8ef87e67856c9ceb151092c47954eab3bb35208e8bd62c54d375762043
MD5 9bdf54d0e753a07b27ac305afdb5087a
SHA1 8a01ca2032212adc53339cb9812f03f4c05fc36f
SHA512 f81e8c82a33a0ed51384339dd0f00fab77ca6a3040bcb07b292a9ea591e69a94edb57d21b362211dee6a8d9eade749b022a52c5dec0b7cedaf342ff4ff858935
SSDEEP 12288:dq/vjg0yIjV9Hg8UDmyxhE31nFCpIusJiDKjZ+1B7aw5ipea8Bn+:+s0yI/TUDmyx2RusJiDm+3T1n+
TLSH
T18C755948B86DC551DD8E8E709683A97AF83EAC9FFD1E315A6C017A2E9DB70C17421073
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
Size 1.0MB
SHA256 90d22462f2d294106982b0709dccf350b9bc4d94e3287c77ee28f00bfc6bf334
MD5 57206674f4b5755522e39b034f495d84
SHA1 136ba21f9733d26dcb1ffaa205e8f1e252821bf6
SHA512 f29f1c8a71678bcf7f12881ad91a0204908d8f307bae0ae19ff242f66215a2f4a6db5363e0ee7dbb2e4714fa7137472af7421cd65a3dc56fefa3a9c09826aeaa
SSDEEP 24576:bB9oF9esyw/6B2HTupp9TBVggzXYfDtczAe:bnoKbM6kCDdStcv
TLSH
T19535AE0AB6B68AE9CA27453458DCC52595EA3C304774CA1B0F48FB1AEDB3A5C1D3C67C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

OfflineScannerShell.exe.ico

Path C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe.ico
Size 3KB
SHA256 9e3f1f8e5166514df44b02a1e0bf7474708dafba161e263cff087af62ba89ae5
MD5 d8ef82bb84e2efe95de666f46d0c7ac6
SHA1 fcdd2f6ceacde21e1e38a687041138aa5bb0ef68
SHA512 61f7439ba615c3250701aeecb96ab8319f2d84ffa7e61076f6dbfce20ee3409d212e8d9deb274b145b7f0eeed2388681b929ba897bc85b4d3841f7003bc40afd
TLSH
T1C461FEC2D34610E8DA8268F34DB58DC487650CD540E4ED920EE6BCE39A745FDA93188F
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

VC_redist.x86.exe

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
Size 1.4MB
SHA256 142359ba5d811bee377ee162fb00d5afcc704b21d8cbd83cc00fcae73d7f0f35
MD5 45e6a26ae042c81a027a99daee6fcf17
SHA1 6e4b69c5e839dc90fea0b7a51e1533ed7e561d94
SHA512 7aab67d3772a035dcd2572df1bfde940e49b962299fa7db19a651240de68b846fbf9690e58fd142f247534d8c4388dcca302a15bb46fe3dc02023a13a69283f4
SSDEEP 24576:awllN+yNoLIgRYI0TQoWMysZgjS1hqgSC/izGfU2JGlbhlAZ4/:aS6XRYpTYRjvQo0nGH1
TLSH
T11365C021B1608026C1FD26336CD99134ED75D904DB128B1FDAD8AE3FBEB4895267F623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-7.0.16-win-x64.exe

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\windowsdesktop-runtime-7.0.16-win-x64.exe
Size 1.4MB
SHA256 0c186b04fb4f1974880c6e0ab71d01c4f9be50e6bcbd9986e5c03d9922a7a65d
MD5 87d5b49167050a6b4511395bf7af3779
SHA1 cabc96cdd9d8b0732f720eb43d8ddb651eadff04
SHA512 071b9656da13bcc8400367f107cc37e0a42537b45406190c840651af4583bd501c4ad15e7744b0c3fa5e93c6fc086abef43fa2d16be3b9a462e581bee604d79c
SSDEEP 24576:sqg9lbNJg6XAB+7D5mWpI2jFM5sFzfTpi71R8dZd:sq6lbNJVX5BjBbTpi5R8d7
TLSH
T10365BF225183C722EEFD0533985A563CBD29DA147F104A6BF2C8BE0E297445727B76B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe
Size 4.4MB
SHA256 f1de40e5f795d3033419e4cbf3f79b570f76bd2b01a324d61b8a17808de448d8
MD5 53e1f8f316074f72459ed0de1b701b50
SHA1 5dba8bedafa6797abc8ca2699657c567570b869c
SHA512 c1346f0c71e39b1f78d2dc178298948567b001b169142a154a7e79c2b20e0fe7c03cc99669ede6cdddfbc4986f9df3c1b83cd4a69808b3c253e01f6b3dfc5b6f
SSDEEP 98304:6gV5KkAdmbu/vsC4wL4Mjz1DbuXAlv9ZINeEia:BYp4wLVZbDWNeEia
TLSH
T1DB26CF157BD88036E0B702315E7C42A91679BD335B3281DF7B94671D2A706C2AA3FB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 28KB
SHA256 0f22de101b3ef0f535091ed83a2de151f08c87e4811ec683168a886ae78d875f
MD5 1a99635d9c61f7db28bc1cd56ff38347
SHA1 8c80f976bc2b4b71ab092a1e77b55582dc0c93a4
SHA512 9dff5623ede21e37e88f803114c3b1b55c5290a48793c267382ebe0465908fe705560d4cabe3ddd55c107a56e898806b7b282b7d69a323539b2cbbad925c62dd
SSDEEP 96:RiKXYHzE/N4ycKscFvfPP8fFCbHhAumGs2inKA4QP5LhuAGi0IWxC10kb:RiKXSUzFvfPPOBGsHnvnuAkIWEakb
TLSH
T196D28456B848EA06DD096D369FEBD4ED32713E26CD8B031379C1BB3E49B70C14E28189
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-06-28_e8b2aefb624db2eb3ad22740bc188ef6_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
Size 472KB
SHA256 74e3183815297ab22dca4b3445d01cf4e9b2ea620ccae9e6da9a792d4ce10bff
MD5 533cc6eb319c3723e8d5328611188ffd
SHA1 21c827ea7c9d3699ec96238f4f56a31d7a27c00e
SHA512 1b56e611a9c01d53af33df17cfc29e01558e9e4b634a27ed871aa7a5bdbf8f1f431f786b332274aa64eb5f078a507938ef15cc804f953fe3eee0fd5518477611
SSDEEP 6144:ViYB2nEaKTRnXtTkCgwCzUg/HpjN4IBwu7QTLbpqmHdIvW:Vi4e7WRdTfgwCHKy7GLbbdIvW
TLSH
T101A43A90F3E414E8F0B79A3589764511DAB67C5A1B71CE8F03A8661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6476-940-0x0000000000400000-0x00000000004E6000-memory.dmp

Download

memory/6476-0-0x0000000000400000-0x00000000004E6000-memory.dmp

Download