141d4dfc3a3da704ea94179321cd375a3c2f82e038b7d326278898e0f8f65c18

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 03:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 1.2MB
Sample260703-d1ymcaaz9z
SHA256 141d4dfc3a3da704ea94179321cd375a3c2f82e038b7d326278898e0f8f65c18
MD5 042c43b7979110a825d3df3ffd76330b
SHA1 a7c46340cf1d47232acdbf5118460ce61b8105f7
SHA512 8c510ceec1f082529229b7a54400338c89563b4f174f4f94b0f18e75d0b3bfaf3605035819f7ca2236fc536c7b711b35e144f6c1bd69fb9420f88d5a9b514718
SSDEEP 12288:2ozXfUdIm9Mbqn/fpI5ddEbCKr+wYAEc6jHw5iVFufi4e7WRdTfgwCHKy7GLbbdO:2ozPu9MbqXp913wEsK3Td9CHKy7GZO
TLSH
T1E2557CB4B7D184A8F07ADD354962CA50CB767F567A51870F42A8220F2EA3FB15C39B31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4452	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe.ico	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\RCXCD0.tmp	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe.exe	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.exe	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe.ico	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCXE829.tmp	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCXEFC7.tmp	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\RCX1104.tmp	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\RCX3370.tmp	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\RCXD25E.tmp	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.ico	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCXED5E.tmp	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.ico	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE.exe	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.exe	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\RCX131E.tmp	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe.ico	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe.ico	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCXF37F.tmp	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe.exe	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe.exe	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCXFAF5.tmp	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE.ico	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\RCX1BA6.tmp	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe.exe	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.exe	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX25F.tmp	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\RCX489.tmp	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe.exe	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCX14E9.tmp	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Defender\NisSrv.exe.exe	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe.exe	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXD507.tmp	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe.exe	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\RCX20AB.tmp	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCX3FFE.tmp	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe.exe	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCXF183.tmp	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.ico	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCXF42E.tmp	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE.ico	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Media Player\wmpnetwk.exe.ico	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe.exe	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe.ico	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2364	javaws.exe
2364	javaws.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1132	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
1132	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 4452	1132	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	89
PID 4452 wrote to memory of 2364	4452	2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Users\Admin\AppData\Local\Temp\2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Program Files\Java\jre-1.8\bin\javaws.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe
Size 1.9MB
SHA256 4eca0f1809ed88a16076c89caf23d36df082d8c00815765cabfea1a5d4915b30
MD5 fd635904ed318265f8f5159b1a6ff279
SHA1 b5d3963c7edc07f5dc29bbf479d1c27035fe68af
SHA512 c4375c8b6fda93c512422f5dc6f6aac00420bed0f197727c6092672fa8166749b398fbf549a486159641a51d3054ade6c1511aaa2693cbfdfafac70ce5ce6d83
SSDEEP 24576:+y55TpoWet30OIyLlkxiZkaogSZz5/Pem0+dl6ZVP5ozP5IVJXyxR:X5po5COIcIiZHAv/X0+d4/xozyVJO
TLSH
T15895AD87B6D942E8C06DD47C8B064071E933BC595FA356DF0790B26D2E3ADE42B3A760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe
Size 4.7MB
SHA256 77b6d7e0cc9d6a30a594a41ef53a7b4dd677c105e3b3d1eb18bbba809356ad52
MD5 ffb94e9f42a5bcfdc3c5bc11b281a0a8
SHA1 9802d7bae2184dc824750976967ea0acfe184256
SHA512 fe83220d7da31df3d9f857ce15cf3cde60938b7bf5ccf88a5f7b251c20821488c12fc595f3b92eadb80b118f88b9492991aed37264017f9a93ca0491c7aff6fc
SSDEEP 49152:gZwutgSveFEUjudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/Y:eeFNijnUdYd+RaAj
TLSH
T18C366B03B18940D4D099C674CE16D232EB627C8D8BF165EF3690B6DA2A73AD47B3D724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.6MB
SHA256 3d6c26723ddcb90f41f486444c764e0d501b5855e9a31fad8fa3ac8fbf649114
MD5 87aa9c8d8b51968bbac5557fed07fd73
SHA1 2363633845f55a48f12c62e1c66ca3f9dace3b1d
SHA512 b72e2b7c40c76a72456330a3d230b0b1a4a70d8bbd1c535e0c4d74e761268bf7e3e8df7d0ffc9736bf4e394518b7dcbd82f095f6891b0b2ea0a4d3d875e0715a
SSDEEP 49152:Efinh6hZGu6qG13O7Q7gLYduZrSdHBAVfb:Efkh4R6YjwA1b
TLSH
T1F2C59D47F79581E9C05DC278CAB64736AE627C504F2066DF17C07A292EB7AC48B393E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
Size 2.2MB
SHA256 c21f7417f48fb7753a1eeb20b73389ae629992195867699cc7c442622b5cc78b
MD5 14ef853760df5385940223bdb9b99e61
SHA1 d0a4ce1df294b0d5fc9b863882caf994ec304337
SHA512 449927cbcf4bdfd27cb1b90e4f234a477568e5a742a94b88e436053cbf3ba7ef333d8c9ba2df38faab23697ca3bfecd6a5e548446fcd8a53be6018bca936865a
SSDEEP 49152:UWKsGbN6RY2fF8FhmS86IUJWQn+6h27d6:oQRbOjjsts
TLSH
T1DBA5BF07BE89C0D6C02DC5B6CA52A1A5DDADBC854B2495DF0BA0B6153E37BD48F3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 1012KB
SHA256 ccabfeda04086e84ceff5aa206a70c4448e7c267dd7f8dfaeefec8343b868422
MD5 88ef7c0cc405403f01ab6116e4279bfe
SHA1 a06630b7b7fb37637cc37a8de11f7e523212f941
SHA512 771bdf8b36475e74f0da5c3d8aa90ef1d11e2b39c141f01f13459241019c9479c77272d4ea91f268dd617e7fc10b865814c35b0e570359140ec9b5cf5afd3175
SSDEEP 24576:6z7TurQeDVj5SfsUiLKzPAnXwPGBodnkMA35i6c0:6z70QKWfsUiLpXw1dngpX
TLSH
T1A225AF6D3CA884F2D032ED708A81196DD667E826DA0BC99BC7E04679ED3134E1C77D39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe
Size 1.3MB
SHA256 0b3c5d2b519687035a08ef7d560261ba5bea0a35da356e601837e763cea154cc
MD5 cda609a20c23fa01553b7beb8a7209dc
SHA1 2fbd00c834dd5d4f44d9733c56d07adbd1cbb66f
SHA512 ebcdaaf32a8aa82b465f600589462c9d40c06e677c7e337d5b7277296ed07051c8e93a22ccfbe32367f1290bf4012c6d3b7fec4ed17657d4a5fd22b1954f8473
SSDEEP 12288:NDDGeA9VDOlz+FIW1l1qVZ4/prGyFkxdw5iXWSYJI50k9mnRT0JIxQ4ObTM:taeAS2NMgGybmHUk9mR4qYbTM
TLSH
T1C755AE44B28871B8D0AD4C344F4E86A1C5727C764A4AF59B0BC0A27D9FB60951FFABF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
Size 4.2MB
SHA256 ec84682ae6f48723e14efc31a8663b429edd10b218598fdd118980e42b0f84b0
MD5 bb2c56d773be30eeb824d78f747b849b
SHA1 3a010053f1e7bbd05c5ccb542cc8dd4a646d9612
SHA512 8da5a314f1aa4bea7cff44949326413ed9b4b34a06add30da56e7614bcfbfed281915c08a5e06dc46da3916ea79defb027b25339bf1453fe80d263a7ea7fdca6
SSDEEP 49152:1lNPXZCdYS2aBW08mKqRXGPd39PyPvnkSN+EcrxA3vGCDlBYMO74U2y+PhC:1zP4dPbN/ki+EcF0pDeN2y/
TLSH
T120165A03E19500D9D089D075CE469636EB627C8D1BF262EF3690B6D53F76AE03B39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe
Size 1.9MB
SHA256 6ad234dedaa7d6eb08b96af6db0caa16ac7c4c1162ce73ec07a033e808d8a0a6
MD5 d8f7e02f0ec986c3ddae32f9dc025755
SHA1 f67fa86b6daf455d079dd754c60ffc24de1c4f54
SHA512 6f5280e082faee411fdbf7984dad5d7856d0652c0ac4da72ae186c6f544a8b0d23e031e31b90f974acb17d7f729eb665177337f1db7d8c30cf365cbbd43aa6e2
SSDEEP 49152:2JZo7dxQuhFB1XDQIpoPve5lp0L5xDzoMY91P27U:AW7dxXFBmvUpQrzoJA7U
TLSH
T1B395AF07F2D444F5C0DF85718B1686A5DA7ABC530B28A6DF0650B21A2E37BE41F3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe
Size 2.2MB
SHA256 ced6d3441e6cd8d6282279f21d169121a8bb1e7819a71af4f83a0b3b0051d64f
MD5 c20aee9bbd6dd9f5b941e4b39b5b5adc
SHA1 98c2f57cfd58313acd0d3ef2134f4d5a19085745
SHA512 d1ec047bbf6ff83d037bbc985c96d608d5f36706257154f23f1e18f79696d719c672e21266da04304a8fa91a16e804e3b0a4c4d69aa826ab02cf0207df505c7d
SSDEEP 49152:fOSOx9Y8JGBrZfehjvHHKTdfxINPEt99G2Bo7EukU1a:fO1x9Y8JGBrdyjvnORmE
TLSH
T120B59D03B28D80E9D02AE974C716A533DAB27C514B25A5EF17D4B6492E3BBD44F3E360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

MpCmdRun.exe.ico

Path C:\Program Files (x86)\Windows Defender\MpCmdRun.exe.ico
Size 3KB
SHA256 02221d573edefa486ba8fe5aee3c8a10c8c7e3188914c0f22df06bb1338db790
MD5 1272e6501512e471bddb879dea4b5800
SHA1 1c8b9489166959e6106095c0974a1825ac1179c6
SHA512 7ef9f685457532d84ba2ed316ec52a44acec151b92e563f6943f593d272745bad0f7c549867a723d2b3532cbcb76ea2b99a965b3b2412d5e7644570740bb4194
TLSH
T1CF6140A1F209FC58C45CD1744DC6C2CC18543D958C0A7273FADCBF8F69724E52E21181
MD5 SHA1 SHA512 TLSH

Submit Download

RCXD25E.tmp

Path C:\Program Files\7-Zip\RCXD25E.tmp
Size 792KB
SHA256 83c3f108cbcec201bf2fe37e48892b766665ee36b5bc99f0f2c6c453cf82f561
MD5 39b8e67f5ac1e6f51628f74881218437
SHA1 fa0b67a022d4c45a7b8302b32443a7e60efd6ec9
SHA512 427097d9829c73deae9f700b79fe6b86ce843416b56a7a852c275fe45ad51800778c3aa5a7202e9819f6d0e7174cc65d7c05e1bdc4656e7977bc01b92a8c7018
SSDEEP 12288:2ozXfUdIm9Mbqn/fpI5ddEbCKr+wYAEc6jHw5idFu:2ozPu9MbqXp913wEk
TLSH
T122058DB97792C86DF42DEC750A52CEA0C7668B177945030396AC630F2AD7F3A1C7A274
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.ico
Size 3KB
SHA256 463b6e99198762de39ea3c9156504527673355f452c17063d0fcc34caa3cfded
MD5 01f2c0d2e4df4e0ed544a4e4600d1457
SHA1 2bdf43857fcfeefcd37ee7a82d733ca4e4f1d871
SHA512 8238557d4075faf0d780ce775a6bc0121cf2da9b826cc49095fec9b35096809e5187f3027682db88d7358e21025c5d24d2ef784e9c2b0a8aa7021589ce68a8aa
TLSH
T13061D3A9E5052C3BFD5CDA7935B6DB60C2077ECA021680778809F58328F768B16ED974
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

iexplore.exe.ico

Path C:\Program Files\Internet Explorer\iexplore.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

lyncicon.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe
Size 1.6MB
SHA256 1bfae16347368fa2a5023b8ca626f20485b44f99f41e2e140acdc001a287019a
MD5 927e6d9fa934413304f92e117211bf1c
SHA1 1d473bc68ce7dd179e478c4f2649cca56441af41
SHA512 a6de04328145c1911622a334c4c3a4f8b0966d89c13b39da2e48f83d91f75d0e0d88c57c3ec17713914e00244c44f420f7d5eb33940bc7e74dc9ed396e9c196d
SSDEEP 12288:xrAoRlJIApm5pemKT1T6UGOnXYv8g23OVbe4NogLBGsddY2ZTfCtSw5i628znn+:sxemI9ZXYNb4yEtznn+
TLSH
T18F754AB5A8399925EF0D0F309423A436FA155CBFFE1E31062D01762A2DB74C668367B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
Size 1.0MB
SHA256 05fd3b729cecb9a5d4b1c2f19a7139d5d7d6f209ac03634594bad6527abd51e9
MD5 dc310bd71bc16f3b078395b2ff8dc01f
SHA1 b66124203c9054b7fd2b0463df22b00c7957fa89
SHA512 ac63f8f82dc1dc1336819955fd39fabf03fb1fe188104af28df38ab4d18ea54a9bc4c7c90e02e75fd2059b1b65926332fe9bcc0d8e69feb37b3b22a93074e671
SSDEEP 12288:/IE9h23/DF09GOV3z23moZY9KmxCbes16x+fWw2D4j+/iw5ixcEA27M1XLsswWkg:qrO36uK3osWHD4INEQXYfDtczAe
TLSH
T16A35ADC8F364B898EE2745749E935D748523BC008E1E998B0769ED2D2DE3AC4193E773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

OfflineScannerShell.exe.ico

Path C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe.ico
Size 3KB
SHA256 9e3f1f8e5166514df44b02a1e0bf7474708dafba161e263cff087af62ba89ae5
MD5 d8ef82bb84e2efe95de666f46d0c7ac6
SHA1 fcdd2f6ceacde21e1e38a687041138aa5bb0ef68
SHA512 61f7439ba615c3250701aeecb96ab8319f2d84ffa7e61076f6dbfce20ee3409d212e8d9deb274b145b7f0eeed2388681b929ba897bc85b4d3841f7003bc40afd
TLSH
T1C461FEC2D34610E8DA8268F34DB58DC487650CD540E4ED920EE6BCE39A745FDA93188F
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

VC_redist.x86.exe

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
Size 1.4MB
SHA256 878994e59754dde739fa46744adb2e3267ef0e4e8f9e6fc0361c0d62e3541f55
MD5 082c8b5833cac5165394fcab5fdd36fc
SHA1 6a550f8886f57e4958612ebbe14377f589693482
SHA512 e1552bce40c3bb158f1f376a2bdfc32d2384bc887ac3bf175f0ad5dfe8f3da13837eb561e9182c8055d5bf15f24c3676537653529c878056bb71ab7077a471b9
SSDEEP 24576:q6cFmyxqkTTQVg96PgxGQqMysZgjS1hqgSC/izGfU2JGlbhlAZ4/:q6cFVxqkTTQV2igxqRjvQo0nGH1
TLSH
T1F165B0E1F6B14231D9B501369C0865367E79E719B714482BE2F8FD7E6FB4080EAB3252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-7.0.16-win-x64.exe

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\windowsdesktop-runtime-7.0.16-win-x64.exe
Size 1.4MB
SHA256 9107bb86bf34fa7c1b95480a43b00b249e62bc0caa0aec84c390cc5a3abaa772
MD5 5e0f89630125360ea2b45f0cbc116a23
SHA1 57e9234fe0aa1517c6e2740a13fba1a3ce51e395
SHA512 bfb20e917f2bb009abf904c25c83316756ec7f0948f6d180e505a0a17d1f57f888e1ab6c9eba4fc961799ddfaf45c62e4771bfbeaad554f2d1134b4e97b63cd5
SSDEEP 24576:edAwcmMPYyz6m+gDMLbDjWdb5mWpI2jFM5sFzfTpi71R8dZd:2S2fWyb+db5BjBbTpi5R8d7
TLSH
T1B365CFB46150C3E3E5BC0132942A95326FAB94285B514DEFE3D8BD2E3D788A516F7332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe
Size 27.4MB
SHA256 66bc03759b5182a30638202f51d8f76306f12c39f16b9155ef3607c50fbf089d
MD5 e9f7fd219c6bd6f39f5f71983b91711e
SHA1 bc0cc1fa7175f598cea8fb8403e54f18009399c4
SHA512 49bd637788159528b61ad1350ad8de78de834d6f4f97b1daf83fa9ba50ab3ba6dbd6c404fc874ff9033cab1930e35c1189475b0971ce0fd20171154341d5aaee
SSDEEP 393216:5uw5ZbDO6RGmb8hFZtxwbTNXp3YCkxJoPMAvqkWgoj6RVFK+q3HvUUw0vXL:sWO1c877xqpyovvVWJ6VFK+q3cSvXL
TLSH
T1435722927BE8A031F4F70631BA78557D497BBC315B3181DF2292B21C1AB09D19A76B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 28KB
SHA256 d1a2986b7ce67ba12cb1c7b64ed3e80c235bb703dccf6a36af1709f3c27dab2a
MD5 3c840ad82aac47119be6475e7825ab5c
SHA1 27f20052a6e4b60529fad550c2c8333509d7987f
SHA512 b249bac46f2cc0d4ac6c2b0932692f6bc82a63cf4a6cc07864adfc29d79ff74cf04c9ede16c627e1e5b495ac7ff79691e16b9eb9ac121578e3300fefafc5b899
SSDEEP 96:5K7cpEj4ho0FBXKlk3bIS2r5AylPsoj2d/27i10E:5K7cpiviBXxkSSzFj2de7iaE
TLSH
T1E3D25356F544EA06DD0A2C36EFEAD8EC23313E21CD8A032335C5BB7F89B71C04968189
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 28KB
SHA256 6f113feb5acb9275398cf7c82312b8491aaee7893aca64d71b49e84f81ef534b
MD5 cb449017b6953d20bbaa3e2041f1a86f
SHA1 a949881d70a20054988d149b1e03b43b62c855b3
SHA512 15ec00f3212b285ecffe8f400756e73b2f38433259c14bba287d3a6c9af62221f8f0083fcf49327daabc14246749f6c23093d72ae20a727ee45830b1d73ccfd5
SSDEEP 96:HqK7ZqEo44EBonAFI0KkZoC30P5D2IBljAy2HPMWYjiDbpAnF3uxh110k2:HqK74tRWI0Aua5DXy0jiD8F3uT1ak2
TLSH
T1B8D28656B848EA06DD061D369FEBD4EC32713E26CD8B071375C1B77E89B71C14E68189
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-03_042c43b7979110a825d3df3ffd76330b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
Size 472KB
SHA256 fcea6bda35f376e7cb9ae2aacc5bf44df28e0b68dd50b1dff2f55630b8f2c3e0
MD5 5df56f6ccfd5b495f17f035cacbc40be
SHA1 a94ca440da178f87575d976e27e5c67c1cee36cb
SHA512 23fe198c26eb40b7b0549c8491fc38512df4e6589bcb2009b4f63e09b1646ca3cbf0401bde4cf6658e954f86d9c130a37a26f7b8e66a2285ff79998b5b374e28
SSDEEP 6144:ViYB2nEaKTRnXtTkCgwCzUg/HpjN4IBwu7QTLbpqmHdIvW:Vi4e7WRdTfgwCHKy7GLbbdIvW
TLSH
T17CA43A90F3E414E8F0B79A3589764511DAB67C5A1B71CE8F03A8661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1132-1151-0x0000000000400000-0x00000000004E8000-memory.dmp

Download

memory/1132-0-0x0000000000400000-0x00000000004E8000-memory.dmp

Download