dd86c4296a3aaa421ee726f086d0ec55b208b83c3693dd49b8ad76d1c48fb589

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/07/2026, 06:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 2.3MB
Sample260710-gr2jesfs8x
SHA256 dd86c4296a3aaa421ee726f086d0ec55b208b83c3693dd49b8ad76d1c48fb589
MD5 a3f8303cda633b6402057b3263950387
SHA1 d1ad1fef2167612cf2a088ca2da9f5d1d9e52b1a
SHA512 0fbbc3e1b9eb125b1870fd8801d15c52000109bda8fcc49f282169f999ef27a73324dfbbf6122f29d991ea68591360eeba71d4fec436fdb4e43c177bc77de9b6
SSDEEP 49152:SZZn6+1cFJDH92yv4VrRHYlArPlrl/ohdTUzw:uirF4VFFo
TLSH
T187B5AE07F58541E8C06DCA7ADB4AD232E972B8621F31B5DF03A196196E37AE05B3D730
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3344	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe.exe	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe.exe	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe.ico	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe.ico	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCXA59D.tmp	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE.exe	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\RCXD739.tmp	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\RCXDA3F.tmp	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\RCXE39D.tmp	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe.ico	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe.ico	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE.exe	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\RCXECDB.tmp	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\RCX1FAD.tmp	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE.ico	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe.ico	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe.ico	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\RCX201B.tmp	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX99F4.tmp	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe.ico	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe.ico	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\RCXBDD1.tmp	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\RCXE710.tmp	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\RCX3553.tmp	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCXA7E6.tmp	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.exe	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe.exe	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe.ico	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe.exe	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCXAC49.tmp	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCXAF50.tmp	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe.ico	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe.ico	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.ico	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\RCXDE9F.tmp	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\VideoLAN\VLC\vlc.exe.exe	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.ico	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX98F8.tmp	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe.exe	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE.ico	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\VideoLAN\VLC\vlc.exe.ico	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCXA374.tmp	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe.exe	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Media Player\setup_wm.exe.ico	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe.exe	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3472	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
3472	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 3344	3472	2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Users\Admin\AppData\Local\Temp\2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
  2⤵
  - Executes dropped EXE
  PID:3344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

arh.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
Size 864KB
SHA256 505ad2176b682b0404abd8fd74d6e0eafd3a1b3cd4c33de3266979c022bb1910
MD5 6fb356ecfb8c9e693a404d4c1380ae08
SHA1 984383c30eb315fdb86ae136a49c9cda36091967
SHA512 48d674d83e776dd477baff0f91d81e4c045e8a20fa29e03e73cd7d068d9c5362b689e84714d82b03472e2f21f80a37cc60f14e71166326795ba721c0c1af0d5f
SSDEEP 12288:YXLodYhAgusJZuC0ooIF0006qct+YP89wQhoV/bYfw5ihnseOLYmIjE72:YXcWAgu0uC0oo2rvtmw4oFbYAuseO72
TLSH
T196159D85769C883BC4DA06F18F8586B17FA34EB197B1084763997D097CA428F3C96F78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisabledGoogleUpdate.exe

Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
Size 6.4MB
SHA256 79b267be8339606e8e4aeb98e78b468e73a5be6878cf2141230851414ef30b48
MD5 e1f44ec71f9eda9c775dbd2afe45fedc
SHA1 86eded2a84406a91cade848e30209c6fd424df01
SHA512 5af1c13d8189cf59edfebfdd121014b51c00c6cd1233fa65526c476ee5e0a5692927a7f9b88f550023875737cd5686a90c4376971ee19181c9102d9617583d5d
SSDEEP 98304:kxICog5HQ+hDHQTW6Af4fF7KkOuYO6IgF+IAMk/JexMXP8iuHG9XXYXQz7ws:Aog1P9fIlOuz6IgF+I3m2MXP6HG8Qzb
TLSH
T13D668C23B9E08035F5F732756C2D67395A327BA28F3585CB86946C846FB42D3243936B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ieinstal.exe.ico

Path C:\Program Files (x86)\Internet Explorer\ieinstal.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

msedge.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 2.2MB
SHA256 e34d2b7cd4ee78b2b19e090887f04e0f175afd05e1ab6a1e7e6fccb79fd7bbfc
MD5 d25234c7b73779b80f0cc393f9407afe
SHA1 d582c764d647000d7a94ca24400345df3a33a3b5
SHA512 3e259368c67ad0eca75015b3e1662358e920a4d4aeb08b595fe420d20c4c10971dc2d8020ab5f3b827b82ab880fff1f595a77a42ba74b8d1b68b2c94127d0a0f
SSDEEP 49152:JUBT7NqYSVqtGANQOitU/03nmdXa5o5QPQ+:JUBT7NqYS8Qa/03mdX+PQ+
TLSH
T18CB5AE03F699C1E1D05CC778CA7A4760B6717DA24FA056FF12907A192EBAED05B3C3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 2.0MB
SHA256 375b5f2b5027157646b5f922fad87fbb9ce1524e15dbd77197aed5f20911f040
MD5 a8631dcd25cf210cca83f0379525a7f0
SHA1 768451b8e902ad8e0f91c5344f3d496c24183503
SHA512 3479ee0b90413f648137ba4cbf14b6dc22294749249879104ea551ba6dfda484626454a8e3d25d3013308f122e9b9dc36fb82526610163ecadab32793473db72
SSDEEP 49152:Ad5GIWDidl1Liiru0WjiMgCv1jn1ChuADSi:i5GK3WjN1jo
TLSH
T1D5A5BF27B28941E9D46CC4B4C6168671EAE1BC026B2059EF02C872596F37FD65BBD33C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 1.3MB
SHA256 adc1db47948444125ee2cfe124c78f530cbe1881f771b145bccec97af163eae4
MD5 27b2fad4166546e9dce8987e77bb0820
SHA1 1ade5902ef03e63e2410480835e3d92a94c68b9e
SHA512 7630e016aa1740cda66543d8173e9093c2545aa25c779b4a3f86e05a8680ae914559ddbbdb84c92eb7683bec1b9b60e9f911cb38d4c3bca0100cac795a3d8a16
SSDEEP 24576:2MoQn90U2E08iuDz0kJBOroge1mU86n9kAJ9tA3L:sQn90UV0puD2kgecUT9t2
TLSH
T175559F42B3BCA655D06F8F30C7518E51EDB238D21FB072CBC2645A7D6E325D89B6A324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe
Size 2.2MB
SHA256 c59d5e553a4308a9a2cfeb472b3520b424ae120da5dea05f0c79df724015fb60
MD5 20bd85fb1250403e46323a1575f3f38a
SHA1 a8d993e6a69aaf66ba13cda21d62436e82359a6c
SHA512 f0cbcb73161f736ec4cd69218f54fcdc231d4af08db74145dfb5aff7e9d7815a455903c3137552385ece6ec5bc4f1660fd8dc3a63ce9ed50f4cb1990106bc4d0
SSDEEP 49152:3h31YEYo4rfehjvHHKTdfxINPEt99G2Bo7EukU1a:3ETyjvnORmE
TLSH
T1ABB59D17B2C840E9D059C5B4C75A4525D5B2FC530F38AADF0A90F64A2E37AE83B7E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.6MB
SHA256 a1dbf6eadb120fa33410956f98e2f692c80a765c1227ca7a82868f43da8f6024
MD5 06eca5a351483616401ce5cf3147a460
SHA1 02bf360053a4dab81b18376c1821bef100bb819c
SHA512 1a963fab6aab198093393afe06a6aaee72cf621c4c384cced35c86aad15f4bbf1c3d0b963720700cd9ba57be8ee45119eb936484e6ed0f41e7d10fc56a31589c
SSDEEP 49152:c8dIRvSnZGu6qG13O7Q7gLYduZrSdHBAVfb:XYvIR6YjwA1b
TLSH
T1E2C59D13F6C5C6B5D0ADD1B8CB6747B5A6637C654F20E5DF0280BA282E77AC04B393A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
Size 2.1MB
SHA256 07e6dd580ac6be4f0e6a94a5098edb089115716fa44e99d434b390435448a547
MD5 b2bb906923f08f3f2bc6e4d8761e2cb8
SHA1 b6a1d009000f1d344ddea5dc8b56c10c43492987
SHA512 b112557aae8f3669b611d81960bc713956cf80f04e43558edf1e2d4a7f6f110736ef041c790827ef7477d0a8555e60f5e04179855e1ebef37d6146da4248e1cd
SSDEEP 49152:YSBzF69YTztG24Y2fF8FhmS86IUJWQn+6h27d6:9zF6iTY24bOjjsts
TLSH
T177A5AE07B29C80E5F0EDD075CB568929B6B27C414B2465DF0B90B6562E3FAD86B3F321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeUpdateOnDemand.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe
Size 878KB
SHA256 cd5e9575f78a2298b028a55e07e2e5b6744f1481b5428408d0f78a51977dc457
MD5 e2f2f5326d63981e7e74a644dfa67eea
SHA1 4bd83084ce7dccd65a37d9db662143c35fc18d0f
SHA512 bda426c58573abdf734f23587796178896b052bcddeeb1aeea4df46e07ef421d3462e82b13e349ff0cedf1bdb928ade22f48e13cfc5c775a85f56a1e29f3452e
SSDEEP 12288:xFgCviHVWxFHp85ST0FSZ9R3mBO2IZW2w5in9G3bbrNPzB+NU:xFg2DJ85IM23PZMjbbBPzBAU
TLSH
T11315AE56FD8CA8FAF4B98930CF5EDDA09D32E921D9810E1B370C71192D3545AAC2B6F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe
Size 1.8MB
SHA256 4076f59e66df8b54cdb390a2d3ca153296b3f99e6f47a34ef9b95f293741bb31
MD5 016090b67ee8b8c0c33f45b13ecca034
SHA1 ef94a4b92cba8e5d50bb9ebc090fb63e4a2bec57
SHA512 08ed78ef3bae8dc528eb14d893eff82790c86b089d8b9c5da5477a43b0563d649874364e41ccb5044d2f060d5f46f2d1411b854c77cba9b4983e4e1f6695d660
SSDEEP 49152:LvZOSfC2B+ZKqmNsVgR7MYzno7fvTqJdbPrCx9pG7:Lv0vbKBw7fv0dbWG
TLSH
T166959D1BE69C80E6D02DC4B78656C271EB637C524B2159DB06E0BA497E37BF44F3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 2.2MB
SHA256 635d20d75bc6ed20abd09ed1b9c7b7d023e8a0ecad7d086082cc08d19ff8910a
MD5 ec8b2b0d14e93e27347ef86403f5f07f
SHA1 a5225cc8dca45067fa340cfaeffccae16cee903b
SHA512 99995053034f0b6432825d9a5188bce0f9847267ae5ac47e50cc31f98865c7fde9839cc4bc75877c308584113c6b2f27f3511ca363233a7ebb95824416ad58f5
SSDEEP 49152:gSJ3HOLUk+CkRDvwZ2XuTjPb33g9gZLfCdW9HTlXrk9dBB:ZZOLU3CkBI4Ds9Ol
TLSH
T107A58D03B2991EA5D02BC1B4C64788B1FB727C464B2256DF07A072192F37EE85B3E725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 4.1MB
SHA256 bc0a39b95d1f937db0f8d60123207ba8aa1249aabc479c7dd164625fea7f9d6f
MD5 1ba66c3fba2249519ca64e22ccf14e27
SHA1 8d90731659859f220452863dd1bfd04ddec2cdb7
SHA512 48132c79542b2c4387a3f394f7e6bab46210db0be93b2c0d4f8d7356c2835f0e0832a476648494f5aa727cc21e1451974663f36e074fd60c2ed5c5399933e01b
SSDEEP 49152:jlekqoq6ey+K57EbmuZgk07G0auOj85q7aGScYbb6YErz7z4AkOuaRoBISCaQZCD:E2q6ey+G7Lo/Yhy8OnZy
TLSH
T100165907B2D900D4D09AC474CE5A9623EBA27C8D47F562EF3240B6D52A7BAD47B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 2.1MB
SHA256 e7408ab47c0ad9c9abe05b80324f2b7b87fce0589b02bb638f6b0305d4421130
MD5 fd9a10211f5a72e7d1cb07c2d295d767
SHA1 4d5822e89b5d177589296a2846af30dd6a4a96a7
SHA512 623c2072ab31ab26495d203f7795334cc19a64eb243e61ebac42cbc1cdc34378b6df2c47a2c52d68412c0d077627aff885b195bb2322b191c67d8235306ea91b
SSDEEP 49152:nPcERi2UXNINY2fF8FhmS86IUJWQn+6h27d6:nPRikbOjjsts
TLSH
T145A5AD13BBD544E5D039D0B5C61A853DEA627C430B25AAEF0B80BA051E77ED49B7EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

RCX8BB1.tmp

Path C:\Program Files\7-Zip\RCX8BB1.tmp
Size 776KB
SHA256 c8828b3142ed32fde94ba793885e3cf6e60c250ac1939c93f5eaa971eaa5ef7a
MD5 1451984fcae751092d4b598602bf3780
SHA1 19fe0a94eaa526b3943ee6b66960852a83e9232b
SHA512 32fed5518b0c8dcf70cae95fed536033c8de018108ba93e64cacc906103e682b3dfd411d1159516251f27fb99782ac2db2b3bb1f800208e8908ada793fe91a8f
SSDEEP 12288:qlE+ZEDiNw2t6vQdl/q52+u9WGcuJTSCMq1SufIw5iLlK2Sz:qlfZEDiNw2l/eqIGcuJTSCb1jFe
TLSH
T150F49D4A3E468879C62CCFBFED4EC3B825B299336992605F97B69E08FC3601117755B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.ico
Size 3KB
SHA256 2a5c5c2bc95c18eded222f0a38752717c1a6ad20e31bcda6472bbba77ed22fe4
MD5 de1dbafd46ca8d953c93a1c89766a8c2
SHA1 41ec8c2a24317bba7a64f4b60341307033edcda0
SHA512 06a89f154036252f396a9f2ac515c5e03e8dd54eb7ba6c3bd0159f693d85846c4ba1b29c0fdc83f14d8c9128f18db3ee27c73111891dc66f81d4fd14361e6ce2
TLSH
T1D861565C04E3ACB1D6E548B83235B2C460D88A364424C867A89D7AD7CE7D8D473DEB0D
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

dbcicons.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe
Size 859KB
SHA256 cc92e7236c3ab73bf74ea9efcd8e1516749a3912a79c651ed109e2507aa871c0
MD5 6ba966771b9456fa7f986623af274c0f
SHA1 7cb3e8739ce713f9c3c515ef420778104276ddd8
SHA512 36e4000ab9dc14b5b903afd4f137ae8c9629445b471c5ad64c592d2c7d43d1472aa208a7d15a17da719d4f732b831b4fd3a4408437fd56f8ce98a2739f6407e7
SSDEEP 12288:lvD424hAHiUV4M8bwR+KrBxOpBGmVi9ibJBER580w5ifz4pF:ZD42QAwwR+KmBZrJBERuRQIF
TLSH
T113158D4C7A9EDAE4C6864C308C6F4E9847252D8C3D870CA7E264FB6C6D7F540EBA6534
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 1.4MB
SHA256 72a8147ad3331ebcfe0191c827cd0dcad0f928b8868cebd2096a1beeae358907
MD5 1e7b8a3aceed666bcf17bf0c63749a70
SHA1 43ef47e01eaecce285b183f616473eccbbe4d78d
SHA512 115f701caea88c7b5d4f600d2e0bb33160d469a7c2b962e1defba1c794cfef7d42022d85fdf141d29d9c1a62294694d95f097dcd8c86c620370a7dd119896825
SSDEEP 24576:d0fzedMwyfSWe0dm39PZfePv3r7fm6t+jqp+3l+zCM0D:d0VndgZ2HbbZt+jqpQ0CMO
TLSH
T11565AE337410C47EE2B9073259688670292BB614AF24596BE7F0AD3D3D715861BBB3B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
Size 1.4MB
SHA256 6b55aa83419a266bb197473ead0fe215d0723e0a11a88d4cf4c6bb7286c48518
MD5 20ac1dabe7b019c3ee24aae506365829
SHA1 993277435629bfdc621e9fbfd15257692f5a9f38
SHA512 fef4f9a7bf83622eb66668990fe502f8f8d1ff6d6214d6494cebce3aea96afb3e81d09c40325def4e9ff28aeebedfcf8eef46de85a46bb4750ecfba2f276af74
SSDEEP 24576:LV+mB+P5K2VW12+48MysZgjS1hqgSC/izJfojymk4HM5yJ:ZXB+PtUYCRjvQotoy4F
TLSH
T16265BF2FA2D18035D6F8D272A9D5E2302F3BB5351B15495B66F4E82D38A06806FF7363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x64.exe

Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
Size 1.2MB
SHA256 10e143e13d462a305b9bfabd83ea5c34c6b17496a58d0547f3c8a39a56050a28
MD5 5936636e9c81c7b46a200b0c45b17ced
SHA1 d83864d9ce39086a26cbc1fa26f33754e75fee6d
SHA512 184f552ce063193db8363475c778700ad975605bef603affb49c2c8233c092e96db63c6301f98e649b39f58022f4db35c2d64874e08c02592be1820c97583a23
SSDEEP 24576:/tjPWvinMRJJ8dSusLiMYenGJiKEbXWtfOkUy:VdnGJJKsJPnRWtGkf
TLSH
T1EC45AD3975748471C27F4431F9C18370FE79AF09EB60902B5660AD0E2FB54866EF62BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveStandaloneUpdater.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
Size 3.1MB
SHA256 9b65a3ff5b868118e78ccd850bdd74c075b75d21bd8ec327eb601ad031c877ff
MD5 dd3bc2c98a802fddeb59cd6f75d96487
SHA1 142a2f559c0def89fdb90af129899f88ce788c5a
SHA512 d244ef367b9cb52f302e14f4d6ad92e48058a1d106f598d02cf176948f2bc10f7bd4bb69cbb1f4315807d6de16fb54b6baa1fc346e69ccdaf1ccf5539a7da0ac
SSDEEP 98304:EZRrNQVD8XD+Yx2nAjUt2jc8tzhYhMMFW8LMprG2:+RKD38ptNAFWba2
TLSH
T18EE5CF21B6D0C432E06711314ABF67F85639B9311B2281DBA3C71B5D1AB85C27A3BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 56KB
SHA256 bd0f400518c6f2d31e2b49ef3f92bcfb63676115e50c2137a353da85b278177d
MD5 2ba3b6dbe4539f23e9d221535b12a448
SHA1 8abfac9a907cafeb64d03482c71369cbbeec7c23
SHA512 cfd5f068f1b0336084f045bfc9b115c3f5cf1bcc03e06e12f6f95c24fa05cef0a02e1cf00dadf3e1e62cc322d6c06c70e18425166b295ad5aa995ee69906fa3c
SSDEEP 192:D7/bBoT6YpYYlDd1zPSXyZxGXOyXh5iv6zNjG5xGQsJA78F3S6GG3ix:DbiYYlDzBuOyX+YjmxGQkAwF3z/u
TLSH
T1DC43A3A6B804D615EE0A1D76AFEBEAEC3331BD16CE6B421336C1B73F96B70C10955184
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
Size 2.3MB
SHA256 335f81e7a6bd7f490daced34185d83323cb891437a4c422361c35d3c5d65e3e8
MD5 66395ee3aeae91fedef6bce14e6b495d
SHA1 4c25058545de7cdc36432742a0cf4c872b78842d
SHA512 31c62ff50dfc2d71f0834646e00fc403477dbd3e7d3a4bbc57584dea36435665215405cb17e890869336e116cfb8486e126f808e667c5df83588febbfa642d35
SSDEEP 49152:XJDH92yv4VrRHYlJJDH92yv4VrRHYlArPlrl/ohdTUz:BF4VFCF4VFF
TLSH
T1C6B58D07F6D502D8D06EC1748746A533E972B85A1F34BADF03A092662E77EE09B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-10_a3f8303cda633b6402057b3263950387_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
Size 1.5MB
SHA256 8d4dd15321f03a652079ade2dad3a4c8622fc48643aa6065b6ea6a686d6d579f
MD5 f1fee4502d59fc1e26e66991dc266460
SHA1 89ce30e7da33f570353acebe5a4d83de3726d9ab
SHA512 06be84971a8d8146019a03bdaf0aa344a3ef94bdd3e73a4f213697afce7ad6afb9bb6e3a075d3310df329e6fc36e2a1a95c5b9578745e2ca3e2a3105e9af4e83
SSDEEP 24576:XJtrFXHlSIL6/yv4Y6r+jurjYlfnIrPTpxVl/ohNXrTUzOozUnxC:XJDH92yv4VrRHYlArPlrl/ohdTUz
TLSH
T1D0758D07F6D542D8D06AC1748746A533E932B85A1F34BAEF0391926A2E77EE09F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3472-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/3472-815-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads