c91078f1704c885da1a1ea9d377fdcb1f75647843126e2b32cd1e71c48030ab6

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 09:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
Size 914KB
Sample260701-lezxaacy4w
SHA256 c91078f1704c885da1a1ea9d377fdcb1f75647843126e2b32cd1e71c48030ab6
MD5 70fc9c84e67fa06d86cced9ef38b61d0
SHA1 0acb0efe1f09abbeebaa93ebb205f173bae0ba55
SHA512 8cd4b654b2d8e3958f74b8131c4f45b271d83dcf2831a406cbd0149346323f078ddb57d75127bc1661ea5971730c2fadd5fb7f1cb3d0d83ca603e5f4d319a068
SSDEEP 24576:aLoFYDBjjW5MW/C4o+7PXl8lcfY6RGWUp6UT:aDBjjIMqPX21F60
TLSH
T19515ADCD30ACC8B1D1E8D93B3A56C461CA2BED11D68D838F2B94665CBF6598C9C39371
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1680	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\RCXBA67.tmp	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files (x86)\Windows Mail\wab.exe.exe	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.exe	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.exe	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe.ico	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe.exe	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe.exe	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe.exe	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.exe	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe.ico	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe.exe	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files (x86)\Internet Explorer\ExtExport.exe.ico	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe.ico	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe.ico	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe.exe	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXC1A0.tmp	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCXD28B.tmp	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ktab.exe.ico	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe.exe	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.exe	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.exe	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.exe	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe.exe	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\setup_wm.exe	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.exe	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE.exe	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\RCX98EB.tmp	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe.ico	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe.ico	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe.ico	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe.exe	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe.ico	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE.ico	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe.ico	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\dotnet\RCX57B4.tmp	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX6698.tmp	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCX6F72.tmp	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.ico	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.exe	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE.exe	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE.ico	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\RCX8ED7.tmp	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Time.exe	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe.ico	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe.ico	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3848	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
3848	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 1680	3848	2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Users\Admin\AppData\Local\Temp\2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe.exe
  2⤵
  - Executes dropped EXE
  PID:1680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

arh.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
Size 904KB
SHA256 c2261c955ba4fc99050074d009708641f6f8579ac0e978443217b510ae5bf2db
MD5 ade972b117f7593176e3c789d1635fac
SHA1 1d91f0f971077426e9dfd586633bb8008d34f710
SHA512 f63016b9d11c1a97137d918aac784e339945d944ca903dd94a72eaa81b5e706acc9586503a5b592515d66bc77bcb7dffb03284dd4b4ba26f4c667e60409c8c33
SSDEEP 12288:oIH1BsICyIly6wab7Ea0B9NgnSjAszw5i49Kc+9MeYmIjE72:oKLCyV6TYH6Stk2D572
TLSH
T19715AF0B6B91AC72C85C2FFD5CA7AFA25A72A9371116052B377C33071962A8D7473738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisabledGoogleUpdate.exe

Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
Size 6.5MB
SHA256 2062f98a7069c64d6d2a02b05914ba9a74c419da5aa3d470ca30d05622397c48
MD5 2b32a59508a804087b97422f12e871b8
SHA1 842ffe478d2e517d56295b4c91d5889d1360b569
SHA512 67713d9c4ea703898b13c91d9ca5e575a53529c9ebce7b04033f14cfcf60f3bde9afe9fb2a67da7b77e704e2fe9149a6994055e5a35c326fa78f44414500bef1
SSDEEP 196608:++dsog1P9fIlOuz6IgF+I3m2MXP6HG8Qzb:++dsognqO86IgF+qbM/6HG8QH
TLSH
T14B668D23B5E08031E5F73235AC2C677959327BE29F3546CB8A946C942FB42D3253936B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ieinstal.exe.ico

Path C:\Program Files (x86)\Internet Explorer\ieinstal.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

msedge.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 2.3MB
SHA256 40860947930b433692fe157d752acf397b4cb013eb686b18dd4350b588d9a2d9
MD5 fc6ebc4c83366a4f5d0197ab6564370b
SHA1 ccc0f5447a607c63130bb753d7a8b480c9788c60
SHA512 dd7d05749480dad5030ca5cb17e9fc38045747dc999e3172fac503d8d307f452ea3b60a1091fc27786db7984e28ba38b382a1fd08a2dff59e1873fd6153d5c8f
SSDEEP 24576:z5PkqwB40B4ZX95Rw8LxQOUJtUp90v1XFf3ng7d9+1UXJwhXCTi2Qlkkkkkkkl0r:VjwB40B4ZrnQOitU/03nmdXa5o5QPQ+
TLSH
T195B5AD03F38681A5D05DD578CB72873996B27C59DF205ADF02D0BA163E72AD06F3A3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 2.1MB
SHA256 ded89f36f16f89ff365d4ef855e99c2993026062106a555ad859677bfa6877e1
MD5 9a72ea8a914ce32b53fadcdafcf3bcbc
SHA1 2fc077a38d8f35af18fff2396afe1b70606a6a90
SHA512 83220a3206709d900cf2f7adba7e68f2c21091c0f173a45a9b11584593b5a6f38b934366784aebedd91dda6a86c125d7a367cc21744f08675069537e2fcd3d22
SSDEEP 49152:t2n1vMS+Sx2J0Cru0WjiMgCv1jn1ChuADSi:tSJ+SoJ7WjN1jo
TLSH
T177A59D43B6E941E8D05DCCB4C66A4D66E9B27C614B21A5DF0298720B2E77FD47F3A320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 1.3MB
SHA256 ac8219b7a62b68bdd2dc858a521f424b2f28d0be4033f6ecaad67b0067b76e44
MD5 45b61cefbccbaf5d8625f2f06c055538
SHA1 d5b951ec71363b7b2a6c3535af140d10b83ef8e5
SHA512 5dd8c84b769131c36178bf0fd7d93982302f13d3c6bf41d44f1a63451f8f8cf1ed9242aea2ae53a28a05d86842f0e9288e2835443506195a5bc0d22721700950
SSDEEP 12288:wlubshdIBqIKWdN/KwzIFzp7emgGpPxenrkW0z2/v7w5ijHokZwRS86nHrUA9HVC:7K4qE2QjQ2/EWHow986n9kAJ9tA3L
TLSH
T1D255C08D72A4BAF0D06EB770C95DC2F4C961B8828B49A5DF126852791F325F44E7E3B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe
Size 2.2MB
SHA256 c5c6f597febd6ccf2b5ed607a3cabd4717d2f6595ed46be5cd961f3027dcdf3a
MD5 c853a0bde53768f5691985f55d9576a0
SHA1 7e25b5bae52b11e651617b4883297c1a609d5f05
SHA512 04765a03609d0971d68a9d139ceb463281ed075923a67032906fac4deab2bd311045ad5449180a56bc93a0a024e545ee22853556e97e24cb986aa9da18fe95f3
SSDEEP 49152:2Frz60qzfehjvHHKTdfxINPEt99G2Bo7EukU1a:2FrY7yjvnORmE
TLSH
T11DB5AE0FF69848E8D06BD575C2968632DAA27C510B28F6DF0640B7092E37BE55F3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.6MB
SHA256 0a1163dfbd9c8b248a6867422783824ccc6e0efbf2da324a5949c4af9e5e96ec
MD5 64757e49f9cb8a65e814678104abbe74
SHA1 988d15cc334ce4c482509a43a2d61a83182c3869
SHA512 c614f24254343ade9bd474c9546a4eec5b5b8b9c93cd703a49f83b0632a987161fa4d2750a7aa459a5320b356d6d58a501984f55792444a113c5c35e012ec618
SSDEEP 49152:r8AGPkFg2S48fV4yzZGu6qG13O7Q7gLYduZrSdHBAVfb:452S48f3VR6YjwA1b
TLSH
T1CFC59D07F6AA81E9D05DC1B88B364725D5E2BC544F20A1DF0A847E562E77BD80B3DBE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
Size 2.2MB
SHA256 6b1292f5debed8f023aa599862de19ede37c11d1e5dd67464b3853e6fc97a350
MD5 c6e11a99794740f6c1a46be0f517c4c4
SHA1 fd548ec273390bf7d62a34c98196f1d82291f087
SHA512 6ad0354773c5904fb27b0f03e43256210d1a6e8d561d81b152e1fcf5434fdd52c073e76e58d5f6197871bc658bf107c9945cc408874b87fb08bad9e46a9fbdab
SSDEEP 49152:q+nA5sd32IY2fF8FhmS86IUJWQn+6h27d6:NA5srbOjjsts
TLSH
T10BB59DA7EB9A41E8D019C0B486C2A426D969BC070B34A7DF0B50F75F1E77AEC5B39311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeUpdateOnDemand.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe
Size 918KB
SHA256 7df3dd0b6ca74b98011eb79867675dd0dbc345d8e7371fc37cd4fdc401ca826c
MD5 8226e063f8b578a0e3d91d33fbad70b5
SHA1 c2046cf0f06139587ba4b6e8020056d0cd86b5b8
SHA512 0e7dc79447d4cf0c95e5272c129f841638783018aa51ae74df4749a38bffbf0ce9bfe01ff592ab4cd4a7fbc29f516a8f01318b49784529c4937361c35eed61c5
SSDEEP 24576:RdkfVTBtMODsqsR1aYDjwOfkctjaEbBPzBAU:GM6YSOfkCBPVAU
TLSH
T14B159D8A718ECE75C39F073065940D7C7796FAB28660442B1AA83BDD1839FBC986357C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe
Size 1.8MB
SHA256 13bea3a3baca514db519ef3339c6295d935c57a68d423bd62fb330ccefcf9e4d
MD5 1d026bfb79b769352334165392ef28ba
SHA1 06c5657e766861ba58aca7b72798b7599cf785a1
SHA512 4c064c3246a145cd0900a99305b8c07ff21dea20a0016da615fa4f6d9e97b2710baf932159e809926e90600b2bbabcdef8fd128eef49f13f0210762129556278
SSDEEP 49152:ho1ZzgoDwsDfjZOPai996Yzno7fvTqJdbPrCx9pG7:hiTDfjli3+7fv0dbWG
TLSH
T11195AE06B78480D5C069C830D627CA71DA627C110B6476DF02D1B6F93EBBAE69FB9770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 2.2MB
SHA256 d40a3436accb91ccef921892be0373d996db32e845b56da1c8717a01b71f56ea
MD5 7a413ea20c2b7d566da227e116d4548c
SHA1 7e02bf1d50716f7619d6e416042037d3f85bc1f7
SHA512 0a440845011380a71caa3a2e3619a2f7452dee6020a12f735501d4d96d4ebe5cd6899ac99a63cca20d24e8193b67e768541566a900ee37425bf103bf78093ba5
SSDEEP 49152:N3sywBnDvwZ2XuTjPb33g9gZLfCdW9HTlXrk9dBB:VsFDI4Ds9Ol
TLSH
T187B58C03B29940E8C419C274C6564E669EF27C560B34E6DF0E94F21A2E37BDD6F3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 4.2MB
SHA256 260efecfbe9409f73072a5210ccab991458419da2c31b345c3dcf0d6c408f504
MD5 8bec640c869e86560b6ce87b56d16806
SHA1 b997507d4f061b48c13f964875c791b12cf1a56c
SHA512 5164040f3093a5b13fd2185278edb20ed22e7689efa347db53c107507408045627481d1ac924c19882c6ecf84813078cc625b02f39d15aefbeff15faed5be7dc
SSDEEP 49152:KH62M6/+cvuZgk07G0auOj85q7aGScYbb6YErz7z4AkOuaRoBISCaQZCLlrrZ:KHDtZo/Yhy8OnZy
TLSH
T12D166A03B29A40D9D169C078CF468622EB627C8847F576EF3780B6D53A77AD47B39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 2.2MB
SHA256 26836f7a15048ecaa1c1a9eaf13b450b7429c88c836fa1cd4f8e1be50604a7ae
MD5 f7b7d8467b0063bb1a3daba961b6224b
SHA1 bff7173bd177e64e49ad3a0b760a1005f9e02024
SHA512 5aec1046f1d56adabc8bc21640d083cbd4cc122eab9557ebaf8896e7c346a240379bc32661067fe63388b76a118da0e25c4593231e90bab86d373d9cc7f80bda
SSDEEP 49152:2wtq26JRU89UY2fF8FhmS86IUJWQn+6h27d6:G2kBCbOjjsts
TLSH
T1B9B5AE07B28AC0D4D05CC474C696A566EAB27C560F20A6DF8750BF093E77EE45B3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

7z.exe.exe

Path C:\Program Files\7-Zip\7z.exe.exe
Size 816KB
SHA256 bc1f7ffc66cb2b5af5cb3a0b0f9301766a6b9ceb4d61b72d3788be1b90b042b1
MD5 8221c1873c01e300b1d7231c05c584db
SHA1 4aca4a721ee0c27df1670a93e129c857b3f85230
SHA512 74ac4db9ec43e1f9c28b88bb31f8c4c7c68fd778e18be3c5fa75a15a1dda78d5c6937edff178b98af53abb1867ce7002f9fd6d050aba9f674c577cf6cd7a6cdf
SSDEEP 24576:aLoFYDBjjW5MW/C4o+7PXl8lcfY6RGW2:aDBjjIMqPX21
TLSH
T10305AECD34ACC821D5E8E93B3A5AC461C92BED11D68D828F6B94275CBF58C9C9C353B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.ico
Size 3KB
SHA256 2a5c5c2bc95c18eded222f0a38752717c1a6ad20e31bcda6472bbba77ed22fe4
MD5 de1dbafd46ca8d953c93a1c89766a8c2
SHA1 41ec8c2a24317bba7a64f4b60341307033edcda0
SHA512 06a89f154036252f396a9f2ac515c5e03e8dd54eb7ba6c3bd0159f693d85846c4ba1b29c0fdc83f14d8c9128f18db3ee27c73111891dc66f81d4fd14361e6ce2
TLSH
T1D861565C04E3ACB1D6E548B83235B2C460D88A364424C867A89D7AD7CE7D8D473DEB0D
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

dbcicons.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe
Size 899KB
SHA256 cee4b5335332984471a310b2fc7b59d298f5f6a3809961fcf8df2054bf6fb998
MD5 37b1bd77f32297ff28eba32e25cf588f
SHA1 d48ec751f17e4eee24c7f1966858ee347cc51bf8
SHA512 86638cf346d3d88c25dd4cb1d82f405e984f5e854d1e92da11103195d605bd7b0c916c0ee4181dc222be5a8fa085a76a54c66119db46fd2eb71f1cda1d88e72e
SSDEEP 12288:xf6B2fCCK+lE7gyPXP7Rd1ZXB+4LZoOHXiiw5i/2WbReJyyF:xf6B2fy+uFPfX1v+kZoOyPGRuLF
TLSH
T164159D87E8EF8D70CBB849309C5A67BA1E0C7D920852596B6E4C775ECA3D31934E3670
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 1.4MB
SHA256 e78df4672c234e6e1649abe025c56d4e01465b8d75f17df7c8711b5dea46560d
MD5 f351d8c45fb72030ee349239bcd30050
SHA1 acfb459ad812ebe7a34550c46935e4fe14c744a6
SHA512 8a3788fa12ab2f2ed567036d5edc26e150bff1ad05e9719e5a9cd177899ce6a3d2143a19ddac67c4f0661f96d55bbeaa533149b87f41240df58e16158e640427
SSDEEP 24576:yFUwYibSXgCy6uTJUESn9RSvV9Dim39PZfePv3r7fm6t+jqp+3l+zCM0D:2jkgz6uTIi9DigZ2HbbZt+jqpQ0CMO
TLSH
T11265BF36A3155332E6B181B7E8F9C2B01E7C9A655B508D7AD3C4BA0D3D7C88166F7232
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
Size 1.4MB
SHA256 f3ddc1da498c4589a35bc94f4f388faa0c0863ee5043d519d6a1035939c4b479
MD5 03b3f891bf5b172f5b9826e2f319bcfa
SHA1 c9f29ca4a0f725c7210fe540e685ee2b19a6869b
SHA512 29b525a3b523eb6aaa6427d2d3636c58d54d4ea1deab7c41199ded41102b54aa9effd0f76399ec2bb9794e4629541d464eb9b87fa57878adce5ebccfdacbc98a
SSDEEP 24576:VCCCviPTRo5EuS5Va+uXLkBMysZgjS1hqgSC/izJfojymk4HM5yJ:ySloxQRjvQotoy4F
TLSH
T1A365AE2C70208723C1A5CA33B9559E34AFB994745E05471A93ECB9ED3BAC0C166F7E72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x64.exe

Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
Size 1.2MB
SHA256 3ce1210fbcb5b12e8df919a2cd569f78356515145053e922462ff80d67d2b6b4
MD5 ab5f45cd6a7f18a2bad11fb532601e30
SHA1 caba38a472cd11442b8568608f4f84073da33173
SHA512 dd2ae14e734ec359cc02f1fed85d50706cf593b411745bb02d1627706f5d307d72a0c4953b0d51945cee23947891eb36df9852f3ae7792a6a5f3a2b62adf6270
SSDEEP 24576:CJfVRMwP6h4x4wngssjHfqCBOqZA0YKMYenGJiKEbXWtfOkUy:AVbP242ersjxBOX5NPnRWtGkf
TLSH
T10655AF247210D073D136B1B3BC2BC7B02D3E6C6B7E19445B8370AA6D6F796412FBA1A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveStandaloneUpdater.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
Size 3.1MB
SHA256 eca622af91e95f3e5f8a63e57703f0454a63823f1824349cdf622bade51f1461
MD5 f77e1007c7b8d7ab98a77c23aa0dcc47
SHA1 4aa458df35046d885fb6d521a889a71663dc6ed2
SHA512 cc441a77a6f8b79cb4382b726d04d40a42d93bd4383436c885f3a7b017eed7f1b3b6e8a88a4c98a07a92cfe7568f287afeb151fdf8f81ab238459c5df015cbf8
SSDEEP 49152:SetuermVt8NVAjXR6t2jgZ8tzPFASjYhMleFLyJwXP9L8vzbtu14BCNbTc7FBHG2:SsuermAnAjUt2jc8tzhYhMMFW8LMprG2
TLSH
T1BAE5BF21BB91C432D16312319ABE67B95D38B9722F2385CF73C4274D1A704D2BE36A67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 56KB
SHA256 a926545e28eae04d4a7dfd8d6828ec9df67650d937a3f300ed28dc92c66d4d0d
MD5 315ce1995b82fedc5a92212d13b4f083
SHA1 4df78f1ac1098aa19f6e2415bd1a8f1160484e5e
SHA512 f169709cae5953c4964a600d560f7e154b87d14c6ec680851db3a5d9ed5d06f4707265a1c69501b73d765e8bcb4702917479334d749d3d0373a37cb5775c4c77
SSDEEP 192:CC/w7oTfGtlDd1tPSr2fXzwq8di9kwPvG4LG5mKhlJAGz8F3PGUE3iJ:UhtlDt7MqZ9kALimKhXAGYF/dEG
TLSH
T18A43B396B804DA48D90D5D369EEBEAEC3331BD26CE5B421335C1B73F96B71C00A69285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe.exe
Size 924KB
SHA256 91e2d6335a561a15b712d3f34c90bf50917805d879635d024c2bffdf91d26bf1
MD5 f5cd35a557b0e7f3c74bd7cdc2231a0b
SHA1 7b0d1f7584270baf45c15842f1c26edb2768c712
SHA512 2597dc96aaae333a70eff109bc91e878bc727dea09ac68c89ff416d0bfa12a61bf494569f7c94e54f15e56a97b7fb15c02470202fefe1c8232ab63f512b3caa4
SSDEEP 12288:e5u6qDND9+wNNNcro7nFBLO/Rr25iub3en/w5ilMuj311H5u6qDN:d6UD97yo7nvuijegWF1Q6U
TLSH
T10D15AD6E3390F8FDF068083288427694CE79EC119B6D765FA1846E4E1F729E85D36B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-01_70fc9c84e67fa06d86cced9ef38b61d0_cobalt-strike_elex_icedid_vidar.exe.exe
Size 104KB
SHA256 2ca892ca735ffb2e88806f5b6016c7ae01355cd12d640586a41272a394338929
MD5 beddafa38fe326a73a97cf2b81491613
SHA1 c0874162acfa1d765246f958ffe309218ef7332b
SHA512 78020c5e92199841442f6492da3fa464e22e3c533bf1da2e094b28fae38606088bec043143955b148c1ae92ad9e809ebd84fa99870c109ba9720f07692da329a
SSDEEP 1536:Rt90alFHfRr4vkK/sTZSGJcXaDNUjVa51UysWqEdU9dldSGyBkc:D9R7fREvkgsTv6qDNUgzU7usKGuk
TLSH
T1E7A36C86B3A050E9F2734675C9609A05EB36F87107618FEF026483AA1F677D19E3DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1680-5-0x00007FF7E65A0000-0x00007FF7E65BD000-memory.dmp

Download

memory/3848-1104-0x0000000000400000-0x00000000004EE000-memory.dmp

Download

memory/3848-0-0x0000000000400000-0x00000000004EE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads