48ab10e358dcb60f6f9b44deb19af529edf12b5fcd3898149ea4f4ab468a8b57

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/07/2026, 22:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 1.2MB
Sample260710-1ybfcset7v
SHA256 48ab10e358dcb60f6f9b44deb19af529edf12b5fcd3898149ea4f4ab468a8b57
MD5 bc90a62cdc5f592fa5e3d7953edb6a63
SHA1 5fae317de43ba2f61f02fbf40b1f24f83ee97ea5
SHA512 ad1f4f3549ff8cdaecff09bcdb69a95aeb32366de7bff7674b76efa5361e538c4faf3692fe2f40dbcf30778149b4d5b5e8c972604e2191899738a51510e1fdf1
SSDEEP 24576:zTvgj4zJPwgyMiRngoyS2Ecjg3Td9CHKy7GZO:z7gjBgyPngonIjqTd9CHKyao
TLSH
T19B45AE46F2D12CA6E3B64BF4992585E0BAF17C665AA1C59F23B0251D2E732D0CC35F31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4232	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe.exe	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX631C.tmp	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX6469.tmp	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe.ico	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe.ico	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe.ico	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\RCX8E0B.tmp	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCX9F8E.tmp	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe.ico	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.ico	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.exe	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe.exe	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe.exe	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCXBBDC.tmp	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.exe	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe.ico	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe.exe	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe.ico	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe.exe	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX3DDB.tmp	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX4A9A.tmp	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\RCX5B9B.tmp	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX6750.tmp	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe.ico	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.ico	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE.exe	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE.exe	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe.ico	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe.ico	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mip.exe.exe	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe.ico	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\RCX779F.tmp	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe.exe	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\VideoLAN\VLC\vlc.exe.ico	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe.ico	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX3701.tmp	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.exe	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.ico	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe.exe	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCXA07B.tmp	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCXBC6B.tmp	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe.ico	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3300	javaws.exe
3300	javaws.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3456	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
3456	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 4232	3456	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	84
PID 4232 wrote to memory of 3300	4232	2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Users\Admin\AppData\Local\Temp\2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4232
- - C:\Program Files\Java\jre-1.8\bin\javaws.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

arh.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
Size 872KB
SHA256 97908e767bbeef0f9b21b5a928d337fc9619914447b1238d3bc8647fc7c0f29e
MD5 8fb2639ff7183d93c53f024f0c997189
SHA1 9214df99b1ebe45699b3b16a08363d5c7311a85e
SHA512 8cf78f8ebcec9f39e064c171fe1f188d7a1058de2e5a1ef757e893333ef800dce0bef3f4e5bec71d54475fb49557454fcef7bbc3bb3c0e431ac3376157bd37f7
SSDEEP 24576:wxa82CHUKNOlED8O2yVoRiY/LBr06K8vhF424fB72:aHG3sV0/MChizp72
TLSH
T15815CF163590D5FBCADA00B09B19E7EDBB21BF0E68CA210B11D076597F34178E9A7378
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisabledGoogleUpdate.exe

Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
Size 6.4MB
SHA256 4b5c76509775e748f971c1e649a162f0d9e5c900e69876995128541c271c3e5e
MD5 00e6640263a653ba269776ad02e0d4b2
SHA1 dd7c078c7b2b084ffc1fa9fa9c839fa2346ad98b
SHA512 53cc86cdaa132d18163d6ddb31e14b7e017b5290ef51fdab62f9b03f3ada5a15a6e8651df5b7d76722c31ea238ff005dec25f9a4bd58aa1b9bf1db7886c87b92
SSDEEP 196608:bIPfR4e3og1P9fIlOuz6IgF+I3m2MXP6HG8Qzb:bIPfR4sognqO86IgF+qbM/6HG8QH
TLSH
T1A6668D23B4D08025E5F732756D2CA7395A327FA29F3545CB86A0AC942FB43D3253936B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ieinstal.exe.ico

Path C:\Program Files (x86)\Internet Explorer\ieinstal.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

msedge.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 2.2MB
SHA256 2e377d1b2d1b5c1357a63948225015b41bcf7aa81894fdf7efd52a2ffff7c25c
MD5 92ff8d4a655f180d55089b89368dcb5a
SHA1 8c3e7af5cea1c66e99654e856a969fef5e0ba7b8
SHA512 f6a8527a3c40ab89201d4fc5510ce830e9fa461bcb711112b78dac66854dad04cb8797df1254d8ba62d1d98eb337c370127d76cd59181a5cf110047613231a3f
SSDEEP 24576:Fm3i6BTORxUEFQNrKRLxQOUJtUp90v1XFf3ng7d9+1UXJwhXCTi2Qlkkkkkkkl0r:ui6BwaEaNeHQOitU/03nmdXa5o5QPQ+
TLSH
T1ADB59C07F689C0A5D04EC678CB3797A4D6723D205F6E62DF1B917A152E72AD4CA383B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 2.1MB
SHA256 69dc6eb40a25f10aed874df7aa1857afa5ae353fae515da606ffe85872799c03
MD5 53f5995d1c762c245352fad1790fb1cf
SHA1 ce5864522f8bb7465beb7839d9b511670df6f568
SHA512 07e935217d5d05e52b2219073cc22ad4a99b702de52542dd7ecf53e820b11172158c845e3963b9cc83ea976bfdff8104a218d8fcc704a16498a28a695514b914
SSDEEP 49152:fbrzLeUX35bqEaYPghXSBru0WjiMgCv1jn1ChuADSi:fzLeUXpbq+P5WjN1jo
TLSH
T16FA5AE8BB29A41E4D01DC034CA668E76D9727C414B36A6DF035CB6192EBBAF49F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 1.3MB
SHA256 b80628e9fd89deb31287846745e646135cb533deb5983fdd363e6b49724284da
MD5 6c2038982edf372a17c6ee72d06372d2
SHA1 c0b47813c8e03f30e7f4b588995dc5a2161fbfd7
SHA512 3bd7e83797d2890b7d655482e097f29e2ba6ff7dd2d072465cb384fb712a947801391521c61cf0205fd9fe5f576c21117743a2bc0e3e8fcd0a94cedb9d88c680
SSDEEP 24576:iEStv2VLCgD/TtuRG1RyvrrbFv86n9kAJ9tA3L:dS+WgD/TQG1Ry5vT9t2
TLSH
T1EB55AD0EB78FC1E5E02A88B448738657A532B9550F7091AF1390236E7E72DED5E393B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe
Size 2.2MB
SHA256 bc1890f1fc1aa3f791d8a8e1ddbdee4ccaf962cb858685d22fd9a44f3a481809
MD5 acb324e92865e95c830c28ac861fef13
SHA1 7373cbc3911b599e2b6c078cd12a91ae3c4d1675
SHA512 50e7b962f4d6a9a90f0c7656ec595179092c7b84f31ff898d802388f920b51af367b321086427083a51b79d49ed41b7a055e61a09e32945128ac6efd0c87993f
SSDEEP 49152:PtuqEWfS7fehjvHHKTdfxINPEt99G2Bo7EukU1a:GWfSjyjvnORmE
TLSH
T18BB5AE03BA8942D4D058D3B8DB068975DBB1BC620FA4A1FF0794B75A1E37BD45B3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.6MB
SHA256 6119a26a9ab5a37d1c6e8ebb76f14013259dde162a52510d4fc8e740cc4bcefe
MD5 f32884c8b269ec8085e476c86c4737b5
SHA1 b4cf22facbf17b98f9ae3d9e664dcbcef7fc82c1
SHA512 b5763d8a96dab8aac57772f2c41e7f04716ebc6060dfd78910faca4b0ca050241c10be4a43585261b2c04fc41233f2574f3cfd1cab0839d9bf383ea2126d17d9
SSDEEP 49152:znc4mKOX1PIB9mfLHqZGu6qG13O7Q7gLYduZrSdHBAVfb:WdOR6YjwA1b
TLSH
T12EC58C07F685C0E5D059C2BCCB7A8765DA71BC614F60A6DF02A17A652FB7AC04B3D3A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
Size 2.1MB
SHA256 97805c37622955eaea61f70008ab085d2f029173ea58780515510de7622b9827
MD5 3d6d01462e6609321575fa03fe9a7d84
SHA1 a1316260708c31b7b9ed0ee397c1cb1bd1f0ef67
SHA512 c26c2473f461e4381836c369788d4d1ea9f1f35853a900659180e1bc79f66e415ee63da79884d61769b0fa959c76f5c24c10c0c0830d970317a80d6773400387
SSDEEP 49152:m+3D3Z7WkTujZY2fF8FhmS86IUJWQn+6h27d6:m+3zZSkQZbOjjsts
TLSH
T1EDA5AE03F2A98CD6E01CD4B8C7568139E9A27C454B2566EF0B607B563E77ED42B3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeUpdateOnDemand.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe
Size 886KB
SHA256 15931604dbd8b58541e45e199842fd5ce40180a70f3752a37913087549e8728f
MD5 7dfa11baad8db9af807158f97296e832
SHA1 4aaa97bba69909d5cd20d6220fcbcb10f792574f
SHA512 8248efb7d1fc158d19a46965fa90410b74a1bef313a9d980a9393d934eef35fc0e5ad538794d9618a6c70ea43dccbfa3194ead7bfcd57a3cfcc538ae855523b0
SSDEEP 24576:LUI17pnLBMvHPB/E1Sn853zJLvoOitS6JbBPzBAU:LZMvvB/E8ne+3zdBPVAU
TLSH
T11A158C1673E3C0EEC5E94DF4444C8EE876A6EC00995921031792F5DE1E7AF12BA297BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe
Size 1.8MB
SHA256 785e37a06fffe654bb9403f409206f1e960f27361a6d5a2ce7e4259724b735d2
MD5 e1517950a18583b7048dcaae2d9ecd64
SHA1 0c7d273577b2ec9e9408aca80f9581096c836248
SHA512 fc539abb25e8c5adacdb615cde3834efb62a84e00371ffb2cd4f61329849612a2e011359af3754bda553bef354889d797a39ec48f6efbfe40e7a121dfcd09c8b
SSDEEP 49152:0W1fhVbqR7M7XYzno7fvTqJdbPrCx9pG7:vhMK7B7fv0dbWG
TLSH
T11695AE0FB648C0D6F06984748E4242B2EEE17C995BE252DF4791BE1C2E779D46B3E360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 2.2MB
SHA256 82ffbb06cc8e712a04c2f4eb1df820d390e2d3d7a53fd7a216b4723f2de8ec15
MD5 17391cb0a687df8f4677616a6161f3d0
SHA1 f5753039042a243eb71243b576053d36f70da75b
SHA512 b24718c51834bfe51698077b8e634ad6fa168c2de8e8bd0cdf4c6d56d7af40f7eedec84e0e173335f72736568fea0f0a3223ba1becd7ded41eb8752e4d7833c8
SSDEEP 49152:TAgc5N7lIDvwZ2XuTjPb33g9gZLfCdW9HTlXrk9dBB:gN7lGI4Ds9Ol
TLSH
T1EEB59D07B29F80DCD069D074C756893AD9B27C410FA566EF8B90B72A1E37AD45B3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 4.1MB
SHA256 2e0e8165d6c35aae517a7c2efb66e906ec2532c19820fa2effa71b19f4c4a913
MD5 9d80398cb8a1dd2393ede62af197d565
SHA1 b3f6464888496bcfe050dd77d87b52340f602699
SHA512 25c53d27163bce4faf66ce2161cb3ff5c4f9690b660f4954d293c1410de703282e815739570040865ec37a5245857caa444b442a43dd05416e861ec140ab08ce
SSDEEP 49152:XOPxujduZgk07G0auOj85q7aGScYbb6YErz7z4AkOuaRoBISCaQZCLlrrZ:XOPAj/o/Yhy8OnZy
TLSH
T1B1166B03F29908D5D059C074CF469232EBA2BC8907F562EF3650B6D92A77ED47B39B18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 2.1MB
SHA256 fb5de5a55a65dfc6addf97ab52ff9e0e54735c6c7058ee9949b6f62d5f36222d
MD5 a6f571dd47949d6f8ba560a5ec5f6829
SHA1 4acf3aa483931826a996ac636976a459d89fad34
SHA512 3c878169661992487238d47601de906bf9e706ac978828f9ba8b2ae6f769c043e6eaa6653257b9bfcc7b744f42e4fbe2ea7781b7aac5ec14026ed9509b3eeb9b
SSDEEP 49152:zdHSnNKEDwfHYXJoztY2fF8FhmS86IUJWQn+6h27d6:zdHwNKEDLXWtbOjjsts
TLSH
T160A59D07F6D8C0E4E819C476DA97852999B27C450B28B6DF07A0B7091EF7AD41F3E728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

RCX3311.tmp

Path C:\Program Files\7-Zip\RCX3311.tmp
Size 784KB
SHA256 90478cbbc322c11af9c0719e8b7e075d37f46ab0d2f799742714e2818c9775ab
MD5 2f6eb92a2abd91c86ccd52e1084901e6
SHA1 6ad0d9cee40370e35c9fcb0f21392181c72dae5c
SHA512 87b1defc43947c08114a6d1fbed53741b5caeeda56c009b5b56479117f5ed5b4b19e56d4824742db3a0ecb7bf0d5752d8b8e46eb9362b75558c49e03de87e7bf
SSDEEP 12288:1ZYsvg6C9Lkc0fJJFobgyslujPmKBn/uJoYOES2Tw5iLj:zTvgj4zJPwgyMiRngoyS2Ecj
TLSH
T18005AF4FB152BC23D3980BF4BA2595F07BE05DA295C2C1A3BBB1651D38B62D8CC617B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.ico
Size 3KB
SHA256 2a5c5c2bc95c18eded222f0a38752717c1a6ad20e31bcda6472bbba77ed22fe4
MD5 de1dbafd46ca8d953c93a1c89766a8c2
SHA1 41ec8c2a24317bba7a64f4b60341307033edcda0
SHA512 06a89f154036252f396a9f2ac515c5e03e8dd54eb7ba6c3bd0159f693d85846c4ba1b29c0fdc83f14d8c9128f18db3ee27c73111891dc66f81d4fd14361e6ce2
TLSH
T1D861565C04E3ACB1D6E548B83235B2C460D88A364424C867A89D7AD7CE7D8D473DEB0D
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

dbcicons.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe
Size 867KB
SHA256 81d9c26f57afea1ca4812cf9c0ddddd9ae9353de602cae90e34e070e4378834f
MD5 da7f8d78a2ee645cacbf5d152dcd46bc
SHA1 a0dadf41d66ccade8fcdd8f06a497e5635e50c2f
SHA512 45b8605950d34910a36648df5bd48b3def0b1302482fd6ae399e5656b22594388f70f618247875d3e6c954a50058b78e4556ee885ecc3c346000c01460cc1ac1
SSDEEP 12288:XmIUAfPGxYl5PUX5J+m9csRc4+1ZmAtw5i5TlpW+F:XvPveHSZmB0G+F
TLSH
T1EB156A99E4B78725C944193CCC47BAC361D4EFA24C11DB3A706C7B5EB8B2168E4E9DB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 1.4MB
SHA256 3c00867df053b7e5d68ddb53733bdfd231c4d869e2f661d722bb8a21a57c8057
MD5 50ac59ef25f1513c1f235928c981deb4
SHA1 9597cf24c43c0d188a8b3124b4dcd1cdc278d637
SHA512 8f21168fd13868bba57c5eac7e84bb011f746e9bf1859d47aecd15cb44b7727b1fe75b380d2ab904eba44ea84ff8676f45e01b596f88971c2cd667959dbafc4c
SSDEEP 24576:Yla2J74QjbNtbnkJNOStpySLrvm39PZfePv3r7fm6t+jqp+3l+zCM0D:oEOSt/HvgZ2HbbZt+jqpQ0CMO
TLSH
T1EC65BD2574E0B432D2B00D369955C2B07E2BAEF85F11485BA2CCAE1DEDB1CC516F726E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
Size 1.4MB
SHA256 37d4eb06f09bcad0aa37d374e232fed4a439aa90eedbc87a90b1e70a58a2a3fb
MD5 127293f45280a0819e1c765d8878f1d7
SHA1 9cc214950f7a1c33f0a2143fb536f9293bfacd9d
SHA512 8b2aeb2f7151e7b1dae25d09ef5c187c02f3fc63823bc40f2e27036ed73f2396f0ac30fff12bb6ccddd7346127ab304376a3c65d165cb9393120c4eede855225
SSDEEP 24576:orSjBzwC3QZQmX09NrgVVoPRoCMysZgjS1hqgSC/izJfojymk4HM5yJ:ddzwC3yJX0vrgIRvRjvQotoy4F
TLSH
T10765CF36B41C4022D1F50273E93493B5EF78EE676A80155EB6E0BE4E3D780942AF7276
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x64.exe

Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
Size 1.2MB
SHA256 bfe4209f53a03f426ebf20738c31ad900ad9b8d1d6b621cafccbb69c39cad045
MD5 7afd1500f8f724ee8d1b5b57d86af663
SHA1 bd65322e29352261c95b0666ae957e915a4171fa
SHA512 70ea68cf71b5c9377fa78ac55a03269c49c0d2d8298f8ac0ed3414718895880f45da667d99d7df48205eec06c5ebd24dfea6aef420e3c5fbcc6aa939d909e82b
SSDEEP 24576:vmrCBnm80hvSkUnmMYenGJiKEbXWtfOkUy:+eD7PnRWtGkf
TLSH
T18445CFA4A250D4F2C0190FF2ED7582B0BD3E9B441B6455DB47B2BE2E3E34505EAB6339
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveStandaloneUpdater.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
Size 3.1MB
SHA256 eb400bde0169a7747068796d00371d19b268d0824b06da548cefd6835d711abc
MD5 cdd99e8fe6a186e63545edef470c0cc9
SHA1 8a87f2502c01d198255996ade43679466e5319dd
SHA512 de6708b78a89ef627474b6da150a99f6ba08f86cfd3a33461b2765077d58d5c59bcc61d3100d6a6f1c958c38e52419b52e061e13b35623bf58165bd5afd96866
SSDEEP 98304:79qA9wanZYnAjUt2jc8tzhYhMMFW8LMprG2:7VptNAFWba2
TLSH
T11BE5CF227BC1C072D1B711314ABD67796639BD311F2245CB63C42B8E1A70AD27A3BB67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 56KB
SHA256 51f411485e6751108bdea346b85f95b433edd1d42f658e845ce12a2a2c352427
MD5 71e2114bc521cf7930eedfd02d4dea21
SHA1 b9910ed81c805f2aca82ac93bf9b1efed20e7a2e
SHA512 ac0abe50ea76934f5570e6e4e8fa4a75579f6bfc56e56862a5b292ffa96630bc4c56fce1bb23c4fe8d46ddc294a1f7a7309df3bfd8c9f3ae81fec52c64d3eabe
SSDEEP 192:SCA9E82DoTisVXblWSWGyo1SArT/xUhzwFdXaOiP8JO4JSvZj8ZE3n7GJXwa:eEXLsVrlWS+SN/GyFdKOnPWj8ZE37AXz
TLSH
T14643F592B844DA41DD0A5D325FEBD6EC7331BD26CE5B460334C2BB3F8AB30C10A58285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-10_bc90a62cdc5f592fa5e3d7953edb6a63_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
Size 472KB
SHA256 0a5a9c2fe4ce6e3c36ead129198f6b629ad77797e21718e36b6ae71e60962886
MD5 cad5a8190e6559e00e8ae939d90beb5f
SHA1 e31821efe188884a9ab27ad17cf40eaf711a90f8
SHA512 cf8e4ea7b63a6a7080028de70f242272cc6e5462c6333ecc36967874fe277368844d7201341b87deceb49bbe64fade1a572bad41007700662901f65d58b62511
SSDEEP 6144:ViYB2nEaKTRnXtTkCgwCzUg/HpjN4IBwu7QTLbpqmHdIvW:Vi4e7WRdTfgwCHKy7GLbbdIvW
TLSH
T12BA43A90F3E414E8F0B79A3589764511DAB67C5A1B31DE8F03A8661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3456-0-0x0000000000400000-0x00000000004E6000-memory.dmp

Download

memory/3456-896-0x0000000000400000-0x00000000004E6000-memory.dmp

Download