akira | 00909a701df51bb5a456a0356c5a8bb07900ffc8ed8e1689a6d905bb1c2d80b3

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 590KB
Sample260718-2ndneaew2l
SHA256 00909a701df51bb5a456a0356c5a8bb07900ffc8ed8e1689a6d905bb1c2d80b3
MD5 91415cfa1b61e6521dd53fa3d6b8717d
SHA1 29fa86a9fa0e4561b98f70eec4e49d59b202b448
SHA512 99a9f5eb83326d3b295ede4ba19357502a827c5b5a5763b38e2b564f788ee508ff3ee64bd75ffc5436833cd7581c14474b5ce004755e852aa136efa045dff4c7
SSDEEP 12288:CV0qnXKTH2P6rxTcQpXDHgswvodgxAdAne:CV0EMm6rxTcQjos8e
TLSH
T12BD47D59B2AC47E4D0A7C17CC922850AE6B7784A137187FF039046762F2B6E45F3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution akira ransomware ransowmware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\fn.txt

akira

Ransom Note

Hi friends, Whatever who you are and what your title is if you're reading this it means the internal infrastructure of your company is fully or partially dead, all your backups - virtual, physical - everything that we managed to reach - are completely removed. Moreover, we have taken a great amount of your corporate data prior to encryption. Well, for now let's keep all the tears and resentment to ourselves and try to build a constructive dialogue. We're fully aware of what damage we caused by locking your internal sources. At the moment, you have to know: 1. Dealing with us you will save A LOT due to we are not interested in ruining your financially. We will study in depth your finance, bank & income statements, your savings, investments etc. and present our reasonable demand to you. If you have an active cyber insurance, let us know and we will guide you how to properly use it. Also, dragging out the negotiation process will lead to failing of a deal. 2. Paying us you save your TIME, MONEY, EFFORTS and be back on track within 24 hours approximately. Our decryptor works properly on any files or systems, so you will be able to check it by requesting a test decryption service from the beginning of our conversation. If you decide to recover on your own, keep in mind that you can permanently lose access to some files or accidently corrupt them - in this case we won't be able to help. 3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and download your data. 4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion. 5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us. If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions: 1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/. 2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/chats/+Zpc2knHfn5kgfeXpr7mP 3. Use this code - yONmGGmEvGDGdUwQWZ28U92H - to log into our chat. Keep in mind that the faster you will get in touch, the less damage we cause.

URLs

https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion
https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/chats/+Zpc2knHfn5kgfeXpr7mP

Signatures

Family: Akira
Akira is a ransomware first seen in March 2023 and targets several industries, including education, finance, real estate, manufacturing, and consulting.
ransomware akira

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3828	5848	powershell.exe	89

Renames multiple (9188) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell command to delete shadowcopy.

execution ransowmware

PowerShell

T1059.001

pid	Process
3828	powershell.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\desktop.ini	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\desktop.ini	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-pl.xrm-ms	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\Folder-48.png	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\fn.txt	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\lt.pak	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul.xrm-ms	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEOLEDB.DLL	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\STINTL.DLL	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\VBE7.DLL	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\WindowsSecuritySplashScreen.scale-100.png	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Simple\fn.txt	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Trust Protection Lists\Sigma\Fingerprinting	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ppd.xrm-ms	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ppd.xrm-ms	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\OUTLPERF.INI	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\REPORTS.ICO	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files\Windows Mail\fn.txt	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\fn.txt	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pt-br\fn.txt	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\ApproveWait.vbe	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\INTLDATE.DLL	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hu-hu\fn.txt	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\fn.txt	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hu-hu\ui-strings.js	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\fn.txt	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\Locales\mk.pak.DATA	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS\PREVIEW.GIF	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\fn.txt	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiBold.ttf	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONLNTCOMLIB.DLL	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fn.txt	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\fn.txt	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ppd.xrm-ms	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement_Uninstall.mfl	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PMAILEXT.ECF	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu\fn.txt	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sv-se\fn.txt	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\AdSelectionAttestationsPreloaded\ad-selection-attestations.dat	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-pl.xrm-ms	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PAPYRUS\PAPYRUS.ELM	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\vlc.mo	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ko-kr\ui-strings.js	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-il\ui-strings.js	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\Locales\fil.pak.DATA	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\FindRestore.ex_	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Office 2007 - 2010.xml	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-pl.xrm-ms	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NL7Data0011.DLL	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\TimelessResume.dotx	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\fn.txt	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\it-it\fn.txt	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ppd.xrm-ms	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\QuickTime.mpp	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\root\fn.txt	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hr-hr\fn.txt	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\fn.txt	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
3828	powershell.exe
3828	powershell.exe
3828	powershell.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1212	2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3828	powershell.exe
Token: SeBackupPrivilege	4412	vssvc.exe
Token: SeRestorePrivilege	4412	vssvc.exe
Token: SeAuditPrivilege	4412	vssvc.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_91415cfa1b61e6521dd53fa3d6b8717d_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1212

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -Command "Get-WmiObject Win32_Shadowcopy | Remove-WmiObject"
1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3828

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

s_remove_18.svg.akira

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_remove_18.svg.akira
Size 1KB
SHA256 ffd03664db668acd01c2b8c420d7402880c508817157141f776e97a2d67c9f7d
MD5 01f54924f34fe454ce541f8a794fd8c6
SHA1 fe546b27cc146bfa35bc83bdd0e5b63b1b64aecd
SHA512 e66b0957424b258e9bc039b30428f6822e564a222efe18d3fa1d895cc0de5cb078bd1158026246253d1e6abbdf5d175c3ce0f41a4cb8ffb98e4bbe35e12842ee
TLSH
T1AA21BAC2453F07EAC5153EF22637AC18B53114E05DCE040494A4212356F265976B5B81
MD5 SHA1 SHA512 TLSH

Submit Download

example_icons.png.akira

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons.png.akira
Size 1KB
SHA256 276686596c20c3aeb206aec30f7296759099ff4fc2e7a346263f402da320abc4
MD5 e9d01001dc5df45b3580a55c0e70e2b0
SHA1 89705f5cf068339ac78975b5e74a65a506bf3518
SHA512 d83bfdacd299ec99f55f7711d19f5c208096061a64952776b0fee22f8ed823232583a8d2ece6b165ce01c37162391dc25964dee57aa4f216aaeedd735e5c4114
TLSH
T1F721E70287EDBAF2EC1054F3B3229C7CF930C8D6231F4109A05016AB60B3B1AFA14405
MD5 SHA1 SHA512 TLSH

Submit Download

example_icons2x.png.akira

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons2x.png.akira
Size 1KB
SHA256 5ecdfbe8910f5cfbfd88a0e67f08a8867017b1c8962f93a967900a5ab335e2c8
MD5 1a8aaa90a2108232793439bc9030e46d
SHA1 9a15f9a48433a76a0a9d53ea36294e94e8abf624
SHA512 cdc4ec7be2da0cda87ea39465b7d71a54591c4d38ce44c8dec38b7328be8d56e2d198de9335907f5e81e63196172d26c7017fc37697911c8ed526766c8cec452
TLSH
T15431083082D8FEFBCAE5297323E18E247AF4D2B2748A1141F89819037116F66BB99409
MD5 SHA1 SHA512 TLSH

Submit Download

rhp_world_icon.png.akira

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png.akira
Size 979B
SHA256 ec21b7441ad3dc0851e14c3f1d28321b2c9fcc80f3fe1bdf1bab2cc89bb9b8b5
MD5 6aee102c7ca94c20f269f821ca17f7b6
SHA1 b1d95c58e10406d45adec26774bc21540d7299bf
SHA512 d1b51c4fffc2a778965ab58ebb1069473ad19a5be31b6deb0ddc54c83e780b74812c8b8a6cf45f68ad63cf192502f1beea7bb6c1ce8bdcd154d3a4da29d8dc42
TLSH
T13D1194E491CCDFF7C96876B337A30D7A76B950528359418AE051071734B2F57BAA0A01
MD5 SHA1 SHA512 TLSH

Submit Download

rhp_world_icon_2x.png.akira

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png.akira
Size 1KB
SHA256 57ae96cba6ec69c809ae766fd5ee0b21c31691482419873988d7d65527938d59
MD5 3cc58e455a1383aa03246928a78e8dde
SHA1 79726c72947dcb1de47c936fd765a752b3c75c06
SHA512 eedf50cd9a118fc941c1251fc31f34381b13fc75f5286b40d3d3bf5155b4a6a0a54b3100322b21806f8c736b61c72b749de767512c67bd15b45334f572aab814
TLSH
T1A621C6A946886AE7DAA131B327975E247B7924A3106C12D9F066533B70F2B2534E1942
MD5 SHA1 SHA512 TLSH

Submit Download

rhp_world_icon_hover.png.akira

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png.akira
Size 922B
SHA256 4929eec12a6c363558d641821ccfea34e1de5fbf1cffff33872a3f6446e220dd
MD5 d703a1f864a648f956c429cd9fc61f0e
SHA1 718a1b676b9e03ed1ad3428cdc882d60ff1d6b81
SHA512 874a6743cf3d7af3895c9b6e0fb57d1eb932649721d5aa32071d821225f5e17b248fd077ed776e0e804d1ccc214ba420db66422a700625b23915c20bec363f18
TLSH
T15D1188E042CC8AF6D900B5B33266495C73B401D2358E41889096032A34F7A497694A41
MD5 SHA1 SHA512 TLSH

Submit Download

rhp_world_icon_hover_2x.png.akira

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png.akira
Size 1KB
SHA256 d93c841f036f9cd1f867b13d9617c03883813122d4e2fcf838fb993178278566
MD5 a00aec821c5c2d75a265758617d660c6
SHA1 8d9533ea5d4264c4fbe59147e0f19271f14680bf
SHA512 13a782a90c475c2c97aafe82410b10d4c4ccb27505a4289560985f4f710e06eb66e6e3a82d34d5f443efe85c32d37f48a8aa7d2d5de6569645f5adbcba5b0851
TLSH
T13E11B6E0816CA3FBDF9204B3121B9F78F77800A2B2A99084D099020379336757BD8A41
MD5 SHA1 SHA512 TLSH

Submit Download

rhp_world_icon.png.akira

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png.akira
Size 922B
SHA256 504b9d68c914f577b1306346c88c78aef2fc6ccbeb058be839ee4013df244bea
MD5 ce61137b9cf4260b2f8080e5d9a65324
SHA1 7fd0ba0313e07b2225cf20665be72a160b3d67f8
SHA512 ebcd6fec531b8670467ed5f52f8ae2bb90c0b989b8761c3f06041e889b895dea41534c426a48ff9f301e6dfd030c2222c3644c03e3f112f3726c5e2780a23748
TLSH
T1011184D043EC9AE7DE01A5F333260EAE7BB102D225CE41849086022A3477A9A7781A52
MD5 SHA1 SHA512 TLSH

Submit Download

rhp_world_icon_2x.png.akira

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png.akira
Size 1KB
SHA256 e2cf7c73dc97d579ff6aebf1bb62ea5e2b010f955bc5b3c5d265d764d8e0f314
MD5 71e1f050da7cb4216ed537a7132a1e73
SHA1 4e0c350b0455e0374e5e78f637e4a59f2a5a29ab
SHA512 417b59dd719466bff06fbe7866c2e5655340b6ade8f1a896cbe9bfc28c063ddaa0f76b04c24b7e989b95fa2da3ee511db1ee66348030f2a570b0afd961bb46d0
TLSH
T17D1189E0815D66F3DFE20577111E6F68F63450E272B99044E05502437573A7D7798A01
MD5 SHA1 SHA512 TLSH

Submit Download

rhp_world_icon_hover.png.akira

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png.akira
Size 922B
SHA256 ac2eefe418d258ac257f2c21d2016724bfb61ef58c554039e32f4d3b5785836d
MD5 7785005146c279dd9c2fa4296aba8b3e
SHA1 b7bcd1322610f916ed20cb208f5c40d819f45ab4
SHA512 b127cecae4b575bc5b6865d4c742e34a56160ba0d4ccf1cbb555f88cfba62b5afe6300107012df0f62ea998b776f510c8648023fb2d8d5e1bc65ea54a4c45fc2
TLSH
T17A11B7D082EC99EBDE4066F3326A0A5EBB7102D236DF01889457032634B7A9E77C5A51
MD5 SHA1 SHA512 TLSH

Submit Download

rhp_world_icon_hover_2x.png.akira

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png.akira
Size 1KB
SHA256 e7bd327873b34a9dd57724b36477a1a965a603d6e3f73f07b95625b2a7cc5364
MD5 8bc22fcdffd224331ba6b27c17ba4f27
SHA1 a8896693a029cefc6bcb88143851c7505161f8b8
SHA512 0fb81d9ff9c52ed4511ff1d7385ca665cbda0781a502c4e7d4c4198b221443e183539377a31c4b561e0c318110d13a09de78a43cf63d676cf309c893f5e3bfc0
TLSH
T19911B9E0C19D56F7DFA105B3111A5E68F63440A162BA9044D45502437A3393D37D9600
MD5 SHA1 SHA512 TLSH

Submit Download

icons.png.akira

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons.png.akira
Size 8KB
SHA256 bc2460df9d990b659eb94c20cef47b3ccabf7a5d690ff7008ae76433a20b57c0
MD5 8482ea153953819a6f640fe3969cf4af
SHA1 7320ded36436acce0a76a410be0b393b6b87b18a
SHA512 6c349b6df47d9e4bdb2c4c120b2f65e867c74b2698db2bebc25cc9d09aae515f346989f12536f14626d9862ba515274309f88a94abf2bf97bf7ac702de7148c3
SSDEEP 192:pOxSQ6+mnMJVEPtNRiFSEyrQk2nAZho0MFL7eSAJ0bO0UY:sUrMfKNy0QklZpa7vAJ0blUY
TLSH
T1A3029E9EC9EC2CDB4EE1B033A02431EE9B7B5AC246475122C1A96B555D103BFA62498D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icons_ie8.gif.akira

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_ie8.gif.akira
Size 8KB
SHA256 fd95aa86a379cf797a707c9809604b91ce84e3b9bf6c5b39ca1d4893c38f6e77
MD5 a4aa16130a0af955ad59eb690b401770
SHA1 f122a2c8e684ce06a1071f08663095429fefd41b
SHA512 1681001840f1f2950587e8e9de69254309174d8d58ab88e8f4b37198555892284455d538234f42765c83732bfdfbf66534351682308972271b884806c206f148
SSDEEP 192:osCz7uyBiqt3j28ez/4ACK3rA8oIeUJjLd0VZyWtCmSUQ:o9z7uyBiqtvez/4FSPC3tSUQ
TLSH
T1AE02CFE8EC491EEBB725AD3C2A33852CA5014DC55FC8008A7CF8578B356F6D3609AEC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icons_retina.png.akira

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_retina.png.akira
Size 15KB
SHA256 8791152a49b25b2070791f30319d3aa7e0eee199d0a1eca1a45c996f1a6d26ec
MD5 522759f06909d852a70ad7a5d61d1340
SHA1 996002111f2f42f7cf6897e653cf7691f8a9dc6f
SHA512 677325f6c13315c3e636a56670f81d5c4a0f37bf3698c4f69f576b40cad2f2626e3354a8d3a4928e6270313758c3ebb4ffdcd83f6a3bc19ff6c4ba202e98f726
SSDEEP 384:JZfZXGD3AI89rIY2cWOj1n4PbclWhWeZ9I3D73sY8mgivkTTAiUk:JTXGE9U4yPAgWUC3sYJg/T0iUk
TLSH
T15472BEE386DF5849CF34E93AD07F051E3A7681436B9CC290492D0B2FE4276AD9613B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

new_icons.png.akira

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png.akira
Size 8KB
SHA256 42fdd59e94d1e29ebdbc1b41ebf0ce21a2ac5d9caf63d005aaf69bf44fe2cd91
MD5 f02003309e96aeb7a81d8feededff8bf
SHA1 6f46db324de9f0e14832bcbdb36e874884c85d93
SHA512 52fbc2d9d456c6102aac9880b381f4684267e2a0de670a57d9161db50f9d2ce5ae6a3cb9d49e6a577ebb3852132aab929e23c38a352ceabb00104d4ecf2c9021
SSDEEP 192:RM65uSVlFYs4KEBEHZOsujuUMtRwQO2VHjGK84JwWvpUq:RJ5hVUs8EssujPM7Vw4LvpUq
TLSH
T14002AF27807E82D4F1B523B94699C7D9DF50843838C6A307F1BC973ABD5A49CA3750B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

new_icons_retina.png.akira

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons_retina.png.akira
Size 17KB
SHA256 745fe9443038cdf7e17b6475220d84ef0daa719eaf624cb5858dfe60bf8bc3c6
MD5 29e96ef749eb909e018cf262ebb26caf
SHA1 54de3404ec97b148994be0342f48ff16ad1452f9
SHA512 3b74813a084a22ed59beeafea401f605f22734218d7431408f32257b22ce07008b9748b77a4923c3a4146e9e2845c64f6a6ff993f4a926e95663c2e1c97df79c
SSDEEP 384:FuQLECrnIjNXtCv6K4F7m2hDNWzpiyc7Z2dLvazU3:FuQYMIjNXtNK4F7m2h0zbA2dLizU3
TLSH
T13482D0994C648B1ACC4EEB3C53D5BEBB31AF93245A1C2505D94393AB2339BBBBD14170
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg_pattern_RHP.png.akira

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_pattern_RHP.png.akira
Size 713B
SHA256 fd22db89956654ae0273f0e9347643fd0838713ecb3dc49bd5a98388e2d6f90c
MD5 a919e7addec8a477887e43091e1a4356
SHA1 42b1796d156ccded31c7b0b1da85b2d205039a6f
SHA512 c683834084c1ae4f7b871598ee08340194e929a5c6d12ff91dd322c6be7e83e9ca340ec7a1cf146b6f62b83ae9ddde411ef4fc87b796e92836bb1157c674b2e9
TLSH
T1CB0110D1839C9EF7DA6259F333970D797B70409186990249D056022674B2B1E75B4A41
MD5 SHA1 SHA512 TLSH

Submit Download

bg_patterns_header.png.akira

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png.akira
Size 1KB
SHA256 86d73d7535eedb63f32d18a57f9e632d633f7223baa9d6260cfffc2f79343c4f
MD5 ddff8eede7b04fb320bb8b2a60769789
SHA1 e7b5829b35f23a34f9daa6bfae192248af24bd43
SHA512 3774cd540d6a1e46298db67c48a728515f573f23989d5bb45bf2edb423fd0ec2580841476bc3148793379435c03205e07074a1eafc62049220b9cf92c8c6a522
TLSH
T10421EAD2411DFEE7C6A07AB3335B5C6F3A3048B2545E0348C0561326F9E23B72AC6610
MD5 SHA1 SHA512 TLSH

Submit Download

illustrations.png.akira

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations.png.akira
Size 9KB
SHA256 9a93bfa0fca6a998320a06830dbec28f34edf9862caa479664e116acbc457045
MD5 970e879e7279d5247a5dd200df7e1f7c
SHA1 3e23da2ac55655d6f4e280f6fdf06a38ca894b0f
SHA512 4d2ae95c6adbcabd7b2b1c9aa2001719f826c6f4ae51ded333e8be3d23ed4570607635bb9aca778dd2e35e6c6cdd41c9f7aa808b8fd66e69cd45352c98c1a1d8
SSDEEP 192:AFEySsxOsY3QhXXfCZOnOS9049aolkLN5FJGBtxf7qTF/jrUa:AeHsQeHfIOnXw1alfO//Ua
TLSH
T126129CC798CC6C3384F13737BA7B9602F6898222E1C406A0C49381A36DE7C17EF462D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

illustrations_retina.png.akira

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations_retina.png.akira
Size 19KB
SHA256 869da27e22adc5efddfe64257389c043ee52ad2c18401777aee8e627738b2130
MD5 497d9ce261cc7552a9a8927f87267d03
SHA1 966b16093e099d2a37682c23000e58f362e700bb
SHA512 2b3c87b1700f9cd1443a63280a0b7d4d421ed220ea2dfa382c40b30041417282092e128a8f433708d7706f43821a3a997395cc70733febcf02774dec06257789
SSDEEP 384:S92+Nr1FkzjR0Wm0hNNapau2JjhlBT2i4upBDWudqWnUW:sNTkHR0P0r4ghjhlByiZv5djUW
TLSH
T10D92AE5B32AD198E90122C9850209207B9B7B734E33F358C9D8B9223D5A9552FEAE91D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui-strings.js.akira

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js.akira
Size 1KB
SHA256 c088f9b46fed64b28eff18db4a955fb5a701ca8ac95d2ac3ec0acd2f453497af
MD5 418822b085e00c8fc5b7600881a58415
SHA1 da69744e857507226e5bdd1a694ee7f446884a9f
SHA512 6063bdb1b782910d098de7c3e303160057dec5da58f08f7198e2bebb4b53be9bc1960bd7d0b2757d90a73f9d22ac434f925d7bd0ca4c71cbc6041d4a46488742
TLSH
T15321EA51D65E2DE3CD0961F33B7A6FDCAB70495005DA200854ADB2163AFDA257338B0C
MD5 SHA1 SHA512 TLSH

Submit Download

ui-strings.js.akira

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js.akira
Size 1KB
SHA256 c0fe8c905782ae1ef014a13d2a03263c245cc4f41b5607d16ab64d0c42152be9
MD5 6235ba1127728d80217e3af8d34066e3
SHA1 ff9642ef30033b9f7c65bf81cb6ce2b0a37af508
SHA512 ea606bea2adb28fbf0d5148db2df04f51506114de79b3aedbd4e5e454a63f1cdec8a3b4b4c7986f5bbc290a2ba1c945ad058e9afc6280ea03d1010ec34e763b0
TLSH
T1C231B481C1CD2DF6ED1B6EF32A67EEDDD2E18A2849CD2204641DF52A38FF60523E4644
MD5 SHA1 SHA512 TLSH

Submit Download

ui-strings.js.akira

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js.akira
Size 1KB
SHA256 d7f769fd4748f417b64ad5891aecb1d01ce0ad3ba6f6c77e12ed52b4f3ffc745
MD5 99f8c34d26a252e3660303371c6c209c
SHA1 3776aa0357249d744674b831b0c95f5453171ac0
SHA512 53a94f485aa8fd2e2f84ab628ff0e108f08ce3be569738895f01a205411ed9b0222a83011171b58d14e441d37397c985de34cbdff2cd234810aeab7f5faf039a
TLSH
T174310752C0DD2EE2EC172EB32A6BFFDC83E0852009CA120564A8F41639FF61563F4A48
MD5 SHA1 SHA512 TLSH

Submit Download

main.css.akira

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\main.css.akira
Size 1KB
SHA256 afe2373d08f9282a10fcb783cfef7ee7e984e319002e88772e14c7060e6e554c
MD5 e058b72dcb05fd2c9f3ce24f4cd3a3ae
SHA1 7b432190e18ed1ff908381301822a8d615bc69a0
SHA512 dccf3e6d591e3e167c2247112dbfff413cad3f1394164e0d5532f657059dca9d6d2b23bdc0ae9481d3d597c7913406e79faccdb19615cf8789520cad13a9ce46
TLSH
T136219521E38C5EFBD42AA0B336B1ADDCAB3558B1149E114D54CD320A75FD82B3738B05
MD5 SHA1 SHA512 TLSH

Submit Download

bun.png.akira

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png.akira
Size 3KB
SHA256 f7c1da26d7cfdbab06dbd09d5d25824901234b6bad8a46fc1208f35723b26b84
MD5 dc6b90a301a6b872df9e0d3fd83f95cb
SHA1 18a3d174736c44f167e1a0a284567c9ddfb5e08b
SHA512 b2be7b8585976407c666b46e4a331a60f450496a78635baf70406ed01b9b8a62c0c63081cbc8ea073d14c81290d7cff283eed01ca4a4d256cfadc83ff09b76e4
TLSH
T12D615CD2AC5C16E3C96E73E542C11CEAF2A2C0A65D5A5002FCAC1A6137A44D128BB252
MD5 SHA1 SHA512 TLSH

Submit Download

cstm_brand_preview.png.akira

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png.akira
Size 2KB
SHA256 573c3d91f7d331a7d9e7292a98e6a221b8e634e9a59a8c77f80c63c54fc746ca
MD5 745e906bb785de03a2c9121d9992b030
SHA1 6c76f32275dd9193fa01f2748a95dd157d93e18b
SHA512 09ba94952f66189fa623025296eac19e64f41c0af4fd7199407b13b22ce236434e67f39f77588dc291a46268ee81620fd77015cbefabf14d1951eedf3a8e2415
TLSH
T1B4515CE8624DFFF9CEE44AB35B771CBC6133421513893044B094235B744A36F719080B
MD5 SHA1 SHA512 TLSH

Submit Download

cstm_brand_preview2x.png.akira

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png.akira
Size 5KB
SHA256 3bad23b6cc21428150ef720f5153fc18f14812b78e4564ae2bc9f32e9b231437
MD5 641591f962fd682c7e187189523b1932
SHA1 a1cded83583be8e7ac6b5244f31d788f61198634
SHA512 83d5f34002b560936b9a90e3dfd4a4446a19667377dcfb9b9b3015526af94cc8b64ca57ca5d95fb6937f56e7f66184b627a23e39fae4dde488e483ca0476e97f
SSDEEP 96:Gq5ORxZEuMAK3sSkG47PkVoJIrXFeQ1lPdZFEZOUp:GQnuM9+G4pJaVpFZCZOUp
TLSH
T125B16DD4D0A8ECEDE9305BF05329BD6CABB6B1512EDD2424933F120D98D5F7C5A61002
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_arrow_small.png.akira

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png.akira
Size 823B
SHA256 163908ab0a25ee239ccc2441fe59c5b253a1b14418951fa6d92b450dae621ecb
MD5 b4893a44f037cb5ffbedffa61b2ac344
SHA1 267d1dc46a327f1ee2e02a06653b706a2ad708a6
SHA512 fd3f3bafcdf770a30945b412d4c97d91904737fe352b32ee3978fe9b07cb30b3e738c603047616a8bc78ffe4042b76124ab25ce2a767ff801c7c9bbfe5fec132
TLSH
T1020146F1414DCEFBCD5456F3335F1DAFB73044A1574E5004C455125A38B196A7655B42
MD5 SHA1 SHA512 TLSH

Submit Download

dd_arrow_small2x.png.akira

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png.akira
Size 919B
SHA256 c3c73b627ab9cf854334a2143f2788a659fe35077f76102923e9a7754426e611
MD5 0ac17ec43e699ee60e909e4375f5808c
SHA1 9a4610b3455556aab8004bc8c0272d4454f043bc
SHA512 93cfd0f7c97961886205fcda54225e00d121dd96c2dc57043b5d6fb87d05b98be2d1e493113fb4c6d3c7e64b43003773d887da42f583454d3093dfe0457fe3c7
TLSH
T11D1144E183A8F6E6CD551DB3B2079D39733004615AD72148E046515AB8B7A16B9907C1
MD5 SHA1 SHA512 TLSH

Submit Download

nub.png.akira

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png.akira
Size 1KB
SHA256 a558ab67ae8a01739ec7469b09d0e4b30cb819ec53a68c53e903b9a5bfe32eba
MD5 1947358d7857791a0132dcd94148bf44
SHA1 57992543ec5e61f34868800271a8be8a6bc19b05
SHA512 6c65ee5dcf0130f463049667d7edde66895ed40f84e3a4e7707c20c4512342f786e37d38cdbc5452d247a87f3a36f6ef7115968bbd2229818348dce1183c74c3
TLSH
T1BB3107E1E25E86DF8F5E0E7232536C6479728EA0488B2005B4279163F4F670FBA60D06
MD5 SHA1 SHA512 TLSH

Submit Download

share_icons.png.akira

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png.akira
Size 1KB
SHA256 0b8e56f6678eef40ba8c4878f28f154365713b365b985b43488a2fac80018298
MD5 d08da296af1f2454999491bce7a2e2d1
SHA1 80e8592947ec6c0f7d4ddc496f1d9485a36560d6
SHA512 effed480bd58905371acf864cf85d412df3dd9fa7e973eda559067d07a30213870acf6062c276aad9f5bc2a2a6046e3960f7e91a04df87672fdfe8244739a7be
TLSH
T1D441196492845DE3D95507F252DF0E9E7F70C0D590A98204F9650B0394B2B3AB8E0284
MD5 SHA1 SHA512 TLSH

Submit Download

share_icons2x.png.akira

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png.akira
Size 3KB
SHA256 1e2ea84791537047e838b5ef67590ad67272085d3994e0fd0465e0f63853e67b
MD5 7f282d8af7070cab1b03f9c8369cae49
SHA1 2ed6f14fcce8d94de04f1aed44a2ac48c4a0bbb3
SHA512 f1747717ae2d1a3fc4271dd8dbd9affff82f131132e54734d11e73d71c1ba47958e5db6dbafbf591382bf474fbca55d4c96e4e89c7ef9252364a39ca10858717
TLSH
T1A1613D0E024419EFE646D4FA67C13E075AB861B7E42D62EF18A42BF5A2F791EF5A4400
MD5 SHA1 SHA512 TLSH

Submit Download

ui-strings.js.akira

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js.akira
Size 1KB
SHA256 0336539239e787f9ddd4e520b3a4504dbf24ad2e7aac73b411224050ebb54489
MD5 a784d8e0fdf286fd3abab79eb3ee09cf
SHA1 2e7ff6548d1d77262ffce0a6417c04085eed5649
SHA512 1015f82652345b42e70705f0dc128a147b7b8b441bbf4d22aa66aa88153b3e29bcce7f66cb27d967e603e762c4a4beaf7499e6d3a70dcf4584219185baa5a809
TLSH
T1F521C852D69E2DE7CD09A1F33B7A6FDCAB70492005DB210854ADB6063AFD9257378B0C
MD5 SHA1 SHA512 TLSH

Submit Download

DisplayLanguageNames.en_GB.txt.akira

Path C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt.akira
Size 33KB
SHA256 e7d61803124a58f7ac2874a38d5b901f16e8e419d71db4dc9a15a85390e9b666
MD5 5bb7812dfb8eacaebb7a6380bec5ea09
SHA1 52605fe3c628107b02aacc2610b1f9f31b31e7ab
SHA512 abf954f545eaa536afbf4ab9fc58b5638188e6975fd7ad6ca30462db153e1e9b9aebdec0531e149104db7d58b6fecc795f5e6729b677ee349fc81c45e7adc219
SSDEEP 384:wT/FXbok5irDdgR6o0sHTkkMElOzzQ0T9FlQMWQbl8WgY7cgzfrQlf/VQP0EetU3:q/9bCobukuk0T9nQDY8tazfrQlHVyUU3
TLSH
T1F0F2FCA125E8718DF5F32A0CBE3C0496877EFF516E16F89D2574490F41E1810AA2D6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.Sparse.Stable.msix.DATA.akira

Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\identity_proxy\win11\identity_helper.Sparse.Stable.msix.DATA.akira
Size 57KB
SHA256 2321af0d54c8d9df110f1f1841d37cc0cccf52146ee83683361380495bd2af18
MD5 6ac40ad91a5b3959862419a46921c1a1
SHA1 15ff25d4b8c67145e3ed84360a0a0f6b34e4be9e
SHA512 b52229233eb6e87f91ca2b65f57989e68dc9f03b824feac80ccdb1ab0596095cecd2348571034f6c52511d1c33ef11f582c7f11a9dcde318df68d823bd4028e1
SSDEEP 1536:iYTSLnUqj4oSf8zMDjyn0DHYOpMGCKtY+iUA:aLnUq08IDjyn0DHY23Mz
TLSH
T11A4302B6D1BEA811CCC01B3AC9A67BA8175AFA122AC96749F283949C55F500D6F3139C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json.akira

Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\vk_swiftshader_icd.json.akira
Size 640B
SHA256 3e5c119248dd6a8e490435ecf52c67915153335a021f960b220d84359c1c61e1
MD5 917ec331e1b3187da6c0897c636d9d11
SHA1 ec6c8a4c771b9bb80509dc39a0620f281e9e68c4
SHA512 9a275408553ba3085210ad155f875eb586d5a0765ac1d59f3426f62958ed0c4cff0b6c9d2c5b17aca38b32ec3d8a06f10d66dd57db9a3eb30d88049119f4687a
TLSH
T1AAF06265828D1EF7D9192AF327975DAC773081E06A8A0004E022231B78B3F2777A1741
MD5 SHA1 SHA512 TLSH

Submit Download

preloaded_data.pb.akira

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\MEIPreload\preloaded_data.pb.akira
Size 9KB
SHA256 7f2fb6f96c7da5e3fd5a3e762ba6a84f5d3f180fa3d44cdcddd6b886de0aed0c
MD5 84b8c5bcb27c591e5ada1ae2182d5ec8
SHA1 5ab15ffc0be2a7c69911185697cb9fa6b31f387f
SHA512 5ddd560495843eb19df6eaa2dee9af584921b367a56bf95f75dc52f8c3df42f071ab09d0c33db227a1a9a24d16b42c8c1b44ce6fe0fea9639cd30e315dec06e6
SSDEEP 192:7b1is74LtLDllayFinr5jjKVcOmQppXavFbeLfzrLyvUkUYU8:Eswt/LayYnr5jjK+5QppXaBebzrLyvUg
TLSH
T14212AF68C3941AFB8D7906B316E22B9C337126E476CE1184E3660317FC67F1A399590A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

delegatedWebFeatures.sccd.akira

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\delegatedWebFeatures.sccd.akira
Size 19KB
SHA256 be9060207c3e4c783267a7abf273b8f76aef42624d4e7dfe028a49862ec311b3
MD5 3f475683a98848024e366070e4216aa7
SHA1 c9ea6582865fce7976be7781557553f67fc06091
SHA512 6608b14dac72bcf859d85b88e57ba76d2dfdb48294db2f784fe7bd4dc470565e59c1a8bf31998af967ad1ed3a4aa939f3639a97c6b1113607976b732d81e5a29
SSDEEP 384:NhrqBDIqd0iTD5uzBMF9aQBb+ZIo1PCCZAhy9gI9dNJ+6b/U4UEUg:rG0yD5kGF9lS2oVCC1g+46jU4UEUg
TLSH
T12292CFB39B0215C340AF19A4B1BE9E7EE37488242BE19686E4A238034065753B7E39C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.Sparse.Internal.msix.akira

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_proxy\win11\identity_helper.Sparse.Internal.msix.akira
Size 58KB
SHA256 fbd456d2af3887ec70494d973cd664f9074079b687281a14811762e27194b7ee
MD5 a1ea8823aecfae5a75d669dd515bcc01
SHA1 b0b506a235b52232ed7fe61a57fe0888388dde7f
SHA512 720978cfc6e9f7fac0c8604f77578254cc92b602b0a8805d92ae51e129d2d71a769069de367da968b289f5d9540528b5bb4da590d802abdc8467051e269aba7f
SSDEEP 1536:tYTSLnU1j4oSf8zMLjyn0DHYOpgatOvLsvUJURUj:lLnU108ILjyn0DHY2gaUvgG
TLSH
T17E43016AF06D6431D8D01B3BCBE73A256769E9122DD5220EF68718DC6AF440DAF3421C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.Sparse.Internal.msix.DATA.akira

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\identity_proxy\win11\identity_helper.Sparse.Internal.msix.DATA.akira
Size 57KB
SHA256 8010a046c81cafe220ebd21a9ba1ef95a1d41f24ad800cea1cfbf09ede1fde85
MD5 07967f180969632dc15abced4e6fd419
SHA1 6072c104948314ccba6d19d8b269d2db4881db9d
SHA512 aeaaf0e4acfceb6f0b3606b37eb12b8ad7efb6e6889c18860362ac2ad746c250b0ed1105db46875c2ba2eac6ff90fb5d0be07a4a9878a013b1c705a988aec292
SSDEEP 1536:5G3I+1YDr5J7Xplmg/L6RPjyn0DHYOp15vFm1XfUPUF:w37YfnT6RPjyn0DHY215vFcR
TLSH
T17C430179A3ACEE24CF682536527E790E203C67113D64C44EAF103DA8C6F1E8C6E61758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe.manifest.akira

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe.manifest.akira
Size 2KB
SHA256 73a10afdd3e10095fa384e32cd4001e91eec5dbb63e445921c6c7f6fe390cafd
MD5 e587661164a6cc5bfb17d0366c48bd31
SHA1 be0c9be551c3601d3fd62b830b1a3d1a158b9ccf
SHA512 9bd79bdc3d8ccd41a9c7f0508d5bd0c6075bed3a2076f677a3836146b5be1a1fdde95264d583b8d76a98a0b507952af4e8ada153ecfc35c2b5b502eaf3b1f7c0
TLSH
T19651A691C1989AF3DA3511F333B2AC68FB7853B3098E0588B09D575B6B37A42D783241
MD5 SHA1 SHA512 TLSH

Submit Download

identity_helper.Sparse.Stable.msix.DATA.akira

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\identity_proxy\win11\identity_helper.Sparse.Stable.msix.DATA.akira
Size 57KB
SHA256 0dbc9249f65fd6a583fda96f68b5fe09b11af7472dc4263f83bb9b898e303b2b
MD5 76877776441201f13c006c16140da4b9
SHA1 a961a959cc69380fd3a2edcd14be53032f28d11e
SHA512 9cf246e6d4bdb43ae73a96aecb4d5034e20be61ef34bf1c923406027ac8909269a696533f2419854ea6c8882c0971f10c330f846d58431464ef4674ef1c0b703
SSDEEP 1536:YG3I+1YDr5J7XplJg/L6Rdjyn0DHYOpfEe+sUkUA:337YfuT6Rdjyn0DHY2t
TLSH
T1CB43F179F3A8A634CF18343292797D0F262967053DD4C95EAF107C9886F9A4C5F20BA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil_NEUTER.pak.akira

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\fil_NEUTER.pak.akira
Size 552B
SHA256 0a9316dc16fa29854307c186cc6316cbeefbc9d4bb525a9cf527331b44ee795a
MD5 78c709e35eb5d8c0489ac75e01ebc4bd
SHA1 339d2126edfa61ea88cf6206a97fd82e0dc83208
SHA512 f378aa950be305a1e965e42338ac2dce94bf9f81e27cc4a0510fe0090656724e6d025a669b32ba6022c5f090ee9bbe2c1da2d005187387957ff30d9e1f9dc2a6
TLSH
T1BBF020A1828D2FF7CD647AF333A71D7CBB3040E0998E1005E466122775B2B1B7BA4B00
MD5 SHA1 SHA512 TLSH

Submit Download

win32_CopyNoDrop32x32.gif.akira

Path C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyNoDrop32x32.gif.akira
Size 687B
SHA256 086460fb67b0a693ba50e5b2ec62f0db1b2d15b1176662bba8b19ca1b9cefc73
MD5 892d04224356611d2ab0abd8532b3ba8
SHA1 219abdaf2fff6e443c22b262f5868fccceaab977
SHA512 8747d090144c56b794443f68124af6087a3504c083666884717f445be00ea13b0a3946812dc73cd15080eaf341722646ea357d3f25d093b18f6b22982e33df90
TLSH
T15D019451834C9AE3CE21A9B322631D7CBB3080A148C90241D0920327F2B3E267BD0F01
MD5 SHA1 SHA512 TLSH

Submit Download

OUTLOOK_F_COL.HXK.akira

Path C:\Program Files\Microsoft Office\root\Office16\1033\OUTLOOK_F_COL.HXK.akira
Size 648B
SHA256 8e5e523a691afc66e36cc6f912f2957921c67b4e3802766b442d37d35a440d27
MD5 f685866a771597139a58b0c5dafcff13
SHA1 214a69ae3564b621c7639ab9eaeaa1a779a503e0
SHA512 25bac9424c83ba283147763f52d09b9212e598c570674c253c7a9361883f4fc0c985c9592206e60c2555f3d8b526da23d66942b90e1a2d0f283a7a04181e8670
TLSH
T1EEF02361424D2FF7C9201FB373531DAD7B3005A0A68D01449463151B74F6A0B7B64B04
MD5 SHA1 SHA512 TLSH

Submit Download

OUTLOOK_K_COL.HXK.akira

Path C:\Program Files\Microsoft Office\root\Office16\1033\OUTLOOK_K_COL.HXK.akira
Size 647B
SHA256 7df6eac0ea1dee7fea6723dc7c8d44fc1a227dce60daf6d488b5c947d46252cb
MD5 c6765920c5ef0bbc76df3c03daf6a1fc
SHA1 dc8cfdb01332a5857ee4b15f118c47401b841dd2
SHA512 a0e30c80fb0d980b7249f41fb714eba243fd0d9379c5ed450c0e697e2e93d05bdbc9c915a1c410d4f9073cdd0acf7f567a0773cb0aaa22a8123f173a0be0459f
TLSH
T156F02D65424D2FF3C9202EB373931DBD6B3005E0AA8E0044E4A3221B74F2A0BBBA4B00
MD5 SHA1 SHA512 TLSH

Submit Download

YAHOO.NO.XML.akira

Path C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.NO.XML.akira
Size 1KB
SHA256 733e8f3bc66d77243a62161d38c00050aa0d88c1a1d09824334cef43db5d5382
MD5 8396d03aced258864465cd4321e3beea
SHA1 6bddf2163aea9b8b4dd7375f06d706d77bcfec97
SHA512 bc99eaf0a2973a82a3a7186ddfb8f06edd322420775ef42fc5902def5a2a9f9357b88f0d1dccfe580b37c64af2fcd6bdf0d0a8d490a4f18937aaad345f378796
TLSH
T17521482146CF5EEBCA3061F353125668D770C1A25F0C0346F58C12577FB6A556AD7E11
MD5 SHA1 SHA512 TLSH

Submit Download

vlc.mo.akira

Path C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\vlc.mo.akira
Size 607KB
SHA256 88e1854f9f7f213d88cf7b8a601eb924b37725e1f6f146679e67746f46c840e1
MD5 dfa4f901f2cb1c1e375a8a7698ff7806
SHA1 90f07cba66e1f463afe6e5d57420de35d113ac81
SHA512 d804fafa30c54b2e8f929e283ea905c6552b169388039d647c946b72037073c437fe657e70c9f331af018685aedbfa8f4e7c3d9d59dea14503713d398bbff4b0
SSDEEP 12288:ZstRQ0k+49cq+a7LOB6hgRwCQMOvcfQ4AggY9Gx:ZstRj49SkCJyCBVnS
TLSH
T192D4BE131AC6722AC79A337477048DEB3B6DF3BF8349A24B7C9DC49A03475B1819D2A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fn.txt

Path C:\Program Files\fn.txt
Size 2KB
SHA256 25f8c16280ab68bc7c5122e475cab12f9a96e8f7369b3899e4ee344c72a158ca
MD5 82b56c15961d59d5343354191d25ed15
SHA1 5c12f593321996bd70a384a0c3c3deeb596da9ee
SHA512 e176e9922b2eb95d3ba666f188e0e3a35658f8c7e5c42506926f634c1cc881ea57cedf8f049de24c496bb30b19754e326d63150ff35a07789e6f47e582bde2c3
TLSH
T10A51862FB748312595A111413B5F77B6F72A902C63B6C1B64CB5E27C3334FAA633A184
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT.akira

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\CURRENT.akira
Size 550B
SHA256 f60917cbb57c72a42945dcc7724048b81d488c87004606ac2ecd23d8c9ea00ef
MD5 0b59cb0e0307ed84addbcbf305716015
SHA1 65b8bac5edda6b80d38bee0fdf9e941256cafce2
SHA512 5d5b92c52f74d666ccda14a42c2a727735dab85586d3f5b9a140c7a29333da30e98f23718213bdcb694b137aa3e8d617453407d272c49bad3f59c159a637498c
TLSH
T196F0EBA1828D6AF7CA2469F323A71D6D773064A199CE1109E4621217B4B2B0ABBA0A00
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001.akira

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\MANIFEST-000001.akira
Size 575B
SHA256 79af9a9981c7ae0def149c2b945776d3b35e9d012ee72ead6df484212ae886f6
MD5 d5598f5d9b24872cea579cd51802c72a
SHA1 7a254f70f688ab9e27d391b66c799294f8d27db5
SHA512 12a86c169e6bf77fe9d111199a04faf7ae81395572a2bbefe744df61c9e7da28d9e7797b13507cd91bc110b25650b9a9d077b07ff0dd168dc9982ae9adb9b3df
TLSH
T19AF04191828D1BF3CD2429F333671D7C77304191A68E1005E066121774B2B1B7BA1600
MD5 SHA1 SHA512 TLSH

Submit Download

data_0.akira

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0.akira
Size 8KB
SHA256 317e432c6744bef23b741b45c4ef74365d0fddabf9ad7202f77eb8072439ae77
MD5 6c47dda050cc2fd7ca5c84b0c77c20c3
SHA1 387181a9c3007a5a258705ed82cfd4501a578afd
SHA512 1c0ea3cd096168de188ea8f2cf7c7c15ed8ed401ea59428a521c5671e869557604a522e73c0687e4cf23679656d18fa0c1da6c5b57b8aa1124ef921e4c46ffb3
SSDEEP 96:Qtd3goQO38SnAPqbVOX7oa/Mc+85PhX084RaUW:Qt12ofVaxZ+mX08nUW
TLSH
T10E025D60869B5DA1CB7C3670245E7D4DFE5794F1628C9105A1B660607EC398FDAE2814
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2.akira

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_2.akira
Size 8KB
SHA256 2bb6d118d7086d01db0f7f8f3dbac9b61c45630238df03dd89f7da5f54fdad89
MD5 29d102e3721c2d26691570c8c2745aac
SHA1 e0869f639f64166473c202b2deae97c7d3d4391c
SHA512 b40281b16656dcfb05ae95addeac3a2bf1a000e9421034d8b40e586835d8aad9204d83630382b9da7082421a2236617225600eac0c46b4124143648ee01b1a10
SSDEEP 96:Gtd3goQO38SnAPqbVOX7oa/Mc+85PhX084RaUW:Gt12ofVaxZ+mX08nUW
TLSH
T1CF025D60869F5DA1CF7C3670245ABD4DFA5794B1628C9105A1B660607EC798FDAE2804
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3.akira

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3.akira
Size 8KB
SHA256 edee0e82ba9d29b6fc88beeaec37214d20a66e20eb6d43a0c71dcac9a57413d8
MD5 8b9e1685bf9c6ca80b9434250d325067
SHA1 d496d6e01303052a474f345c94f9fd7af34a8209
SHA512 db3ff6512b4d8a1d7a5e96f3c4bd7c34745f6cd446090a732f150e1467f4048590fec7fc261c4e0071c07f00963987282580c7fc47c462e9b5aeb2afb0878037
SSDEEP 96:Vtd3goQO38SnAPqbVOX7oa/Mc+85PhX084RaUW:Vt12ofVaxZ+mX08nUW
TLSH
T162026D60869F5DA1CBBC3670245A7D4DFA5790B1628C9005A1B660607EC398FDAE2804
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1.akira

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1.akira
Size 264KB
SHA256 a9f0406858ad41b27f790558092385e73d8e07ecad1a3106a37d6c12a945fc86
MD5 71a4d924a2dcb5fb17566fccbeeb179b
SHA1 e1fe8a48657778e03e5c980eebf32a6e370df0a2
SHA512 1a4ab972a59dc1dd83ffdbdf58e61c18926a657f6c077cc16636d8570ffee2d25c46d33154375849adb3e21e8121cf0b977e3f0b71e549f69fb60b72d4a2c6bf
SSDEEP 3072:yZafaOvlbRpu1cqmkqvY+MSLciSgpvWydfRkh50t2+:ygf5b6F7qv4pgVWat
TLSH
T1F94412E2CB61819FFDF667FA8476BF7F95C6D07B40F911E20362B4F8518A65E2408250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.akira

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index.akira
Size 558B
SHA256 7b32d9753bb0460cbdadea605306e5426d4c95db3d51f34c9772977492b3145f
MD5 48d171b820581e262365b2916910a48f
SHA1 e340b7cb4cb246c64257194f8777f6eba11f5f6b
SHA512 14770089ba9ed1621145a1c0984290f7545d9aeb2a74dc482dc772bd914f7f115bc98cbddcb778d0247738121ac668aea2ec61ace74315023e4c07007ef271e4
TLSH
T1DCF026A1824D1FF7CD1469F333571D7C7B30409055CD1049D451121774B3B1777A1A00
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3828-10-0x00007FFB9D560000-0x00007FFB9DF04000-memory.dmp

Download

memory/3828-8-0x00007FFB9D560000-0x00007FFB9DF04000-memory.dmp

Download

memory/3828-7-0x00007FFB9D560000-0x00007FFB9DF04000-memory.dmp

Download

memory/3828-6-0x00007FFB9D560000-0x00007FFB9DF04000-memory.dmp

Download

memory/3828-5-0x00007FFB9D560000-0x00007FFB9DF04000-memory.dmp

Download

memory/3828-4-0x000001D9C8090000-0x000001D9C80B2000-memory.dmp

Download

memory/3828-9-0x00007FFB9D560000-0x00007FFB9DF04000-memory.dmp

Download

memory/3828-1-0x00007FFB9D560000-0x00007FFB9DF04000-memory.dmp

Download

memory/3828-11-0x00007FFB9D560000-0x00007FFB9DF04000-memory.dmp

Download

memory/3828-13-0x00007FFB9D560000-0x00007FFB9DF04000-memory.dmp

Download

memory/3828-0-0x00007FFB9D6EF000-0x00007FFB9D6F0000-memory.dmp

Download