e40d0b930722bce2c01de077876a9b6665800629fc79d043c426f413d0801540

Analysis

max time kernel
149s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/06/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 1.2MB
Sample260629-ee43nscw21
SHA256 e40d0b930722bce2c01de077876a9b6665800629fc79d043c426f413d0801540
MD5 b04e16b57eef0dccf1c0f5cc51c85c50
SHA1 a18001e0b73bf986f05a3e84b6394360931b9513
SHA512 e6104bcfafb1d8678778d177d361eedabe3d4be4bf8bf99c4418038f3564a578bb5d79214156dd872c51d1a0e9a4e2456eb37da7408f630dca6271157562e444
SSDEEP 12288:SaT4Q1c1bxrMoj9h0pbX4Y6Mh9+fw3Zkxmw5iCT3Cgi4e7WRdTfgwCHKy7GLbbdO:7CBMahkr4Y6zw3ZozF3L3Td9CHKy7GZO
TLSH
T1A945AE17F6C105E2F17A453068B691559636BEFA3710877FC6E428883E7A2413EB8B36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1872	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.ico	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Media Player\wmpnscfg.exe.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe.ico	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\7-Zip\7zG.exe.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX598C.tmp	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX5CF5.tmp	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.ico	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCX6E45.tmp	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe.ico	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE.ico	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe.ico	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.ico	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCX6844.tmp	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\RCX85B7.tmp	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX7CEF.tmp	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Media Player\wmpnetwk.exe.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe.ico	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\RCX8518.tmp	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe.ico	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX618D.tmp	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCX68E2.tmp	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe.ico	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Internet Explorer\iexplore.exe.ico	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCXB814.tmp	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.ico	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe.ico	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Internet Explorer\ielowutil.exe.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\RCXB0FC.tmp	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe.exe	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
548	javaws.exe
548	javaws.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4452	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4452	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 1872	4452	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	85
PID 1872 wrote to memory of 548	1872	2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Users\Admin\AppData\Local\Temp\2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Program Files\Java\jre-1.8\bin\javaws.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

arh.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
Size 852KB
SHA256 5571a12373ad859ef5ba81836317c026e6247e56120d0228e0521edd20d092c3
MD5 b833a85f90da4d5b922ce9b24a573659
SHA1 2bf22d6128f0b8d19b8d6e76f8e8029f0e282d25
SHA512 79cd96649c32334a869b1d802e76b715e24c9fb2efecf899ac7a6549944158ddd4ad05d0f04b6199bb22546bf0719f88f94c7d1d126e7605d1214067cbd63940
SSDEEP 12288:Mqs+vUKPVpCZMcKYQRv0KN+Ni32KrWxh2fOw5iGQG5tikAzYmIjE72:MUvUKdsZrKMKNtSu79QGmkU72
TLSH
T19905AE1A7DD09033D89AC430AC6146BE716FBB119CAB0A0B61D47EEE0D7D2927F5663C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisabledGoogleUpdate.exe

Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
Size 6.4MB
SHA256 9cda3a822beab802bd1de8cee69b127061a3e54cb031ea4dde896591835e5af3
MD5 8a1a7d4ef20722e8cb0aab8025225825
SHA1 4fd58270ece95ec807cd263675f995c6d39c9e72
SHA512 7caecf7093252083ab660bbfa6cf9ba04a44964d6a91f760f78206588d31392dc0f332781a006018df2ad18628adb1e545a8be97806accc6c28086526f5c7b0b
SSDEEP 98304:eWog5HQ+hDHQTW6Af4fF7KkOuYO6IgF+IAMk/JexMXP8iuHG9XXYXQz7ws:Nog1P9fIlOuz6IgF+I3m2MXP6HG8Qzb
TLSH
T1B0668C23B4E09035E5F732756D2CA73959336BA39F3545CB86907C942FB42E2283936B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ieinstal.exe.ico

Path C:\Program Files (x86)\Internet Explorer\ieinstal.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

msedge.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 2.2MB
SHA256 3678bf5846a221195b1ffebd25751673d12cb5a1238330c4477a6757157b63c2
MD5 59b97f56aeb95610a8115fd63b5862f6
SHA1 ab94d10d069889282028c8018f264d70b5a4c6ec
SHA512 d7e38c1525cc025b02e99a82c68b52bb1c252146cc018559b2ab5df2dd5c53350b799a05eed27895b22199ca57f76c552c4345f0a7e28b3147d5954dc0fa54be
SSDEEP 49152:ujC7wyzcC5ZCI4wNLpAVQOitU/03nmdXa5o5QPQ+:uuV3NDLg/03mdX+PQ+
TLSH
T163B59D07F6DA82A6F05DC574CAF64770D671BC634F6056EB0294BB192E77AC00A3DBA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 2.0MB
SHA256 d90669d399f93762b1ff14bfcb481ba87a62cadedf863d1ce13afe63bcdf3506
MD5 ca1321302ac97b6ec8aa8c693c1ccd52
SHA1 289dbacc32fae2af7405f1ab276351eb1b5f8220
SHA512 c945afc7942ce0f6d50a62704d47e23c96cd258bae64693debcae21d0806d882ef43d5daf9f8d08833cab58d209cc0c1dd909fd6965e94d70becd412ff995ec2
SSDEEP 24576:pUAExp5NNcwL4h0tf+HVorgc3y0w9jfGX7yxgCJd1fbgqf1ChKRADe1qRAi:pUAK5oaqlaru0WjiMgCv1jn1ChuADSi
TLSH
T194A5AE07B29942E4D06DC0B4CA964179DA633C564B21A5DF03987ABE2E37FD47F3A324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 1.3MB
SHA256 abbb56953e52563a752a4a1e5ca1979c188e60252e9a5ec4b2dd420180fc88af
MD5 c2b25c39bd0248a4f05dcf7566436588
SHA1 69b4f76e2f755e82ec39acfcb86d4107eb67c229
SHA512 1f9bc47debd34cbd8abde1f4141ce6dab75be0339258a60ef5d27d394bcc70001a736504450afd30ff0c1f7af56df15f2c404afe2e61c01521f68db655a4a2d3
SSDEEP 12288:lamGrU5isfGvP6a032daO/hy0zu7c84H4PxR6t+8gejkRj+UBqw5iX8lhS86nHrY:AUKc2lhzpe6t9ge1SwF86n9kAJ9tA3L
TLSH
T18C55AE07B6C4B6E5D06AC0338D51C851D67FBBE82B60629B03A4537A7E72DD81A3B335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe
Size 2.2MB
SHA256 0de459082bd43e1ab6cf3d80bb1988beaba48f531df1256ea706ff58d1d51d60
MD5 0be073a7ecb4e60da1ee72f44438f4a4
SHA1 454006811d79b48937af4fc208856b419ed752c4
SHA512 1f730572216d253da7e9177349f96de6e1f58eac609c69a87f587c5cdacaa19b8b4425e6c2219823edb52357ddf1624360e149d198439eda5bc23bfe841a3bb5
SSDEEP 49152:NLRicCpW0f9fehjvHHKTdfxINPEt99G2Bo7EukU1a:Oc0WaByjvnORmE
TLSH
T16EB59D13B2D845E8D02DC174C6568E3ADAB27CA1CB2466DF0E5876091E77FE46F7A320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.6MB
SHA256 482f8ac670a4bcb2174bcd87e71eaf130bfc45543f7629e405354d0d9d6720ea
MD5 6d32d6da60a43a057b78b1fd2eafd6c0
SHA1 11a6dbe7b4afe3ad5294db2f06da954dfd070f89
SHA512 fe6ff0fa29167853423b636e3688c395ff66b26c836610f1fa34d58176fae368486fda5dc23778bf67875f9e0875fa8f95d16ab7f649a1063150a0830d3a0617
SSDEEP 49152:FXajL8DU9WrWZGu6qG13O7Q7gLYduZrSdHBAVfb:4H8DU6GR6YjwA1b
TLSH
T104C59D07F38680E5D85DE278CA325736E6A17C154F30B5DF06827A593EB6AC06B3D7A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
Size 2.1MB
SHA256 7962c7bb72df5c7e88eee64535963e15a8131a09a219a93c88f3a67e2e7086ce
MD5 b0b9f1e74c282ba4dd0192d71e6bed82
SHA1 1e0bce63304a7782d23b3d102b3459b9ade719a7
SHA512 0a06a5309924cad31355a0dcac0e94063ed04514ef2dfe39a168498b7896c08469e4d4a8b7d6f6d0aa2ae9a95ed69ee74d6b0a7c22a553dc9039559f440fdf1a
SSDEEP 49152:+AOAOFuOkghUGaaveEvCjIY2fF8FhmS86IUJWQn+6h27d6:i5PveEvyIbOjjsts
TLSH
T1F9A59D17B68548EBD01DC074C6468526E9B3BC510B34A6DF0A987B191E3BFD4EB3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeUpdateOnDemand.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe
Size 866KB
SHA256 cec3a1524ea2c3108604f9453032c95b8f4f3497538eb1dedfad138276d4a4de
MD5 40e38153252c4701814c6597e996a33d
SHA1 33a0c9de9a4241caca8410be46b0d9b2f00dfe7e
SHA512 74da2ee051c6257c7862ff0d5e07b2f6007dbbc10241635f56c7d41e47137b9ad98973e4ad1bd52615131243f22a49d0bcb5ebe69d50c86676ad5beacf05a7de
SSDEEP 24576:G+1bx54WiL1SEbyhsxCGK3ol4vx/KbBPzBAU:V1bUWiL1+sxv4vqBPVAU
TLSH
T12415BE6A75939896D4B80E70C478E6AD9AA32CF72B09C93FD724BE0D3E356130C17635
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe
Size 1.8MB
SHA256 2351c0cb9de10cee403d4a261fab78ba1b43720d56bff5e8cfe12b7b6bcfa558
MD5 aa4e514511145ac15a9732068b8f2c9c
SHA1 b68d2e0f7417972a6487781c11c490818dde4920
SHA512 25321e6f49fc44a95bea0bb47d14f9221b3932eec487642870b09b987a92b3a2c267761e96112835abda6344622517be853d2af686f795eeb8fc98ab31538ff0
SSDEEP 24576:3QAMdc8JjIi9ESrCQOIH8YmWHHo7fvqcXFudDJdWQCkvjZQqg+lIVprS7:3yc6sdZIcYzno7fvTqJdbPrCx9pG7
TLSH
T1E685BF86769580D9E03EC43886568535E9B27C5B0B26A6FF03B0F2581EF79F45F3A360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 2.1MB
SHA256 279f49b9040ba59dc34460c71b7f4406fbc633ba56efe9bedde437d6f3f0835c
MD5 dd4aefa71f00c7dc9080af4476150c58
SHA1 d8f3919fa4205fb823fd3f15712659472c8dbb05
SHA512 28bd1685024366a45a74ad4fb021f0ee6134d3ff5bb644eb56e2f3ded51b4dd661a6ca3813bc1dfa458c53b7ddad166bd2302b2f0d9329f3faf9028f23b82ad1
SSDEEP 49152:Ze/DpHsPDvwZ2XuTjPb33g9gZLfCdW9HTlXrk9dBB:Ze/DO7I4Ds9Ol
TLSH
T17DA59D0BBA8440ECD029C4F4C79B8976A6B5BC015B35B6DF0690B6A51E37BD85F3B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 4.1MB
SHA256 98b266d5861b44230cb8792734bbc948c6061bca2b8fa54b72c97a3aed9c9daa
MD5 89205bf481798ee086586d8351dea091
SHA1 07b2d3458932f7cfdddd15a4a72c25050a32c88d
SHA512 ff1e7ba574346bacc501ea109c11674868ff09ea443ddb6076cc1f2f0b6ae76bb0d4818294f35ee3e6dea70f58a88c9ae1a1ad7a1217ecc905eacf9d4a32378a
SSDEEP 49152:p9g0nTLIZlfSX/KyEkuZgk07G0auOj85q7aGScYbb6YErz7z4AkOuaRoBISCaQZy:pG0nQZ0jEso/Yhy8OnZy
TLSH
T102166A03A19940E4E459D474CE4A8233EB627C8C07F566EF3691B7DA2A73ED47B39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 2.1MB
SHA256 039b2289ce1b9a8a5cabba86218c091ee3fcb348738e20fbcf7adf4dd2f6a5a7
MD5 9b24d41e66b922274e74dd570439a73c
SHA1 9e1e03e7f19016ac727c603bb1dc5c2e711227bf
SHA512 ae62067884466a562b26358c166882e118e8ca322bebf068b86e71a16f0488bc7fae95a2508ebe766428cc23aaf01fff0e3afc60994bbb55027824cd3521fbf7
SSDEEP 49152:i16l4OQawXuY2fF8FhmS86IUJWQn+6h27d6:IawXubOjjsts
TLSH
T1BAA59D23F68904E9D069C170C756853A9AB67C010B25F6DF1761B7DA3E73AE42B3E324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

RCX4ED7.tmp

Path C:\Program Files\7-Zip\RCX4ED7.tmp
Size 764KB
SHA256 372e92109e08f26204541ad9ba5edb5ade0fb6c0a524ef7dc8a42bc574312cfe
MD5 b0f27d560f0b3844e789efd7ed403123
SHA1 5ebe529e34bccfee75404782d18c6d15f64bf815
SHA512 f833258631bf7ebdb6ce28eb21ddc88bc0f4702c4cc8714e05697cf2ff441d685ab0e576ef526c2036e61a185656e6231810d637647281a27a44bb7fce14d071
SSDEEP 12288:SaT4Q1c1bxrMoj9h0pbX4Y6Mh9+fw3Zkxmw5iCT38:7CBMahkr4Y6zw3ZozF3
TLSH
T1CFF48D1BF5C28693F159003038FAA299661A9FF67705533FDCE66888BDDC1153FA423A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.ico
Size 3KB
SHA256 2a5c5c2bc95c18eded222f0a38752717c1a6ad20e31bcda6472bbba77ed22fe4
MD5 de1dbafd46ca8d953c93a1c89766a8c2
SHA1 41ec8c2a24317bba7a64f4b60341307033edcda0
SHA512 06a89f154036252f396a9f2ac515c5e03e8dd54eb7ba6c3bd0159f693d85846c4ba1b29c0fdc83f14d8c9128f18db3ee27c73111891dc66f81d4fd14361e6ce2
TLSH
T1D861565C04E3ACB1D6E548B83235B2C460D88A364424C867A89D7AD7CE7D8D473DEB0D
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

dbcicons.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe
Size 847KB
SHA256 60ccfa034bdba26cf9110599270ea584a85879d7395cc649a2abc52ded3287de
MD5 63f7eb37c2805fdbf99d882d2d3f5f11
SHA1 788928d346c28dee72d491fd8f07ce12413849ad
SHA512 094eec41954d10b026a492cf431fe7098f86fd66fbd2a20ba31d7c6e4e639afbc4c8f8ba5898f269fb0b7e4bc5ee1b2a175be2d1e6f776fb349290d293629b40
SSDEEP 12288:6HDgvYpETYTGolIs6MOUgFO1gUAjIe4GNsn/ljJcNfVSSw5isBmXGeNF:AIRUilpFO1gtR4Ga/ljwfobmlF
TLSH
T16D056A5F28CE9EE5CC2619345DCAA362BE929ECD1C42097BDA54BB3E28F14443355E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 1.3MB
SHA256 2a0dae498e7c980f8bf3c50e39a1cd276fe001074a95574758ec26ca0cfe2536
MD5 99ff0ac272a94c0c748aafb66f5f9c26
SHA1 c9bfa60981a3f2f6aaf356397115a633b79a1f2c
SHA512 ca4ffb3b910e9f573027c9f19dc9da58224e7a379d06313a0855511cf7c71eac51c6469362d3fdcd7ca01cbffe000b61672d97b9af7f5b64040597e573d7036d
SSDEEP 24576:EdmXBfEqJ8ZYDcIyPGbt0Um39PZfePv3r7fm6t+jqp+3l+zCM0D:R2qSI5gZ2HbbZt+jqpQ0CMO
TLSH
T1F765C071A5A18436E6F901325A11A1303F7DA7384BD14F6BE6F4E85D3F28C426BB72E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
Size 1.4MB
SHA256 32d34c2eb375d7b84063dcc1bbbd6220252eb7d0fe805d5e6fe5d6851d18b16e
MD5 51c87718699680adf45cdacedbdc0524
SHA1 bfa555a3648a7cfa48e6415755b07e3d41179ad9
SHA512 9537ff10ff244f39a31c8dc4bda83d7da163b5d2a1e2c8c95be1467d370756e1423db6c332764425d678e9ebad4ab979b569a6c6e03c7d58333ece942b0a2110
SSDEEP 24576:7pvRwOOnrHR4OOjbxMysZgjS1hqgSC/izJfojymk4HM5yJ:7pvanrxn+RjvQotoy4F
TLSH
T11165BF72A481D032E2BB81F258DDB2347E7CE9149740C85B53D6ED093EF807526FBA66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x64.exe

Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
Size 1.2MB
SHA256 a59991bff1c839a937f11e955f908aa598f5fafce398f863c389c6e48545de46
MD5 86bfb6edfa0d404f84a23d944f60f168
SHA1 f90b7e38f9d6d73586fe7c3be8c03617fef0cad0
SHA512 241376fae3f0918f7c6d59b20e9e7487a8b8c5515886d1ae8eb05f9d52ce751cd973c9b920af5849270d25949b14676b8d6418a80e15bc414421ceeb93b82ef9
SSDEEP 24576:tc0cM0JdC2/UXgjjTGm//xA2GMYenGJiKEbXWtfOkUy:Z0bC4DGmJxPnRWtGkf
TLSH
T13445BF613395ACF3C1610872B6278D756E39A4461B71CCE74E74AD1FE938C822BF6326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveStandaloneUpdater.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
Size 3.1MB
SHA256 076740ef15637931cdf20e26bab9a235e8ac8a7fa70f29476509d5fb666cb1dd
MD5 c76bc6f714fcda4f3bda96549fd03fb8
SHA1 79187d34f54cca9f35edd263bc9a181650c622e8
SHA512 2c1d6955ffcbb3f7cad32d381baaf065c933c97a249b452049a0b336be35fadb952193d7266a56c1094fc5e481da93c5fc4014920d9953470eae378c9012f8e3
SSDEEP 98304:exYySO2YnAjUt2jc8tzhYhMMFW8LMprG2:Ryj2XptNAFWba2
TLSH
T1E6E5CF31BBC5C032D977123186AE6679577AF9322B22C1DB63C4178D1B705C26E3AB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-06-27_b04e16b57eef0dccf1c0f5cc51c85c50_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
Size 472KB
SHA256 c250f96baf87e25548716391ebd4e180d1c322c037b0e5a0e9bba6297a52ef07
MD5 446b0d18d6ed16c595a38c01ae42658f
SHA1 92139cb5dc0db5076ec2040c33275bc5ab639c89
SHA512 a30eaf1be495d5e5472126afb53b12f5b0d045f3eaf555135817d7cc3c28230be459c48ddf8e46222461afdc5d157a8468a9b684d77640c331c8f0052de4a8ce
SSDEEP 6144:ViYB2nEaKTRnXtTkCgwCzUg/HpjN4IBwu7QTLbpqmHdIvW:Vi4e7WRdTfgwCHKy7GLbbdIvW
TLSH
T1E8A43A90F3E414E8F0B79A3589764511DAB67C5A1B71CE8F03A8661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4452-1165-0x0000000000400000-0x00000000004E1000-memory.dmp

Download

memory/4452-0-0x0000000000400000-0x00000000004E1000-memory.dmp

Download