f15d3b6a7e4f29323c1ce3365debaa7e449260787710d824f7374ae9cf165433

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 02:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
Size 918KB
Sample260718-cw9clsgz21
SHA256 f15d3b6a7e4f29323c1ce3365debaa7e449260787710d824f7374ae9cf165433
MD5 b442d33319994dd56624e52788096024
SHA1 fd6fea4e66fa013c0027cffe9c01923c4c44239b
SHA512 f75755cc2237681f8e20c3bfd6f61e1a307e9e73374358b14463aea284c2b4cd5bb391ab8172bc7d193e8bc86b9f31f8d0721b19ab6337f1a0a833cdd8eac435
SSDEEP 12288:RFP6XyhGMmHgjwsBdNHyjzz6w5ihaD8hCKf5u6qDNT:Rp6ChCHgUsBdNHyjf6vO6UT
TLSH
T19715BFD7740680A9DEF55CF39B929EAE8B397C590D11658B466E1D3E2CB12C03C27A33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4296	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCX3095.tmp	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\RCX3AE7.tmp	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE.ico	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe.exe	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe.exe	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.ico	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\RCX4F79.tmp	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCX99D8.tmp	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\7-Zip\7zG.exe.ico	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.exe	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe.ico	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.exe	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.exe	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe.exe	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe.exe	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\RCX9538.tmp	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.exe	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.exe	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE.exe	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.54\RCX935E.tmp	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.ico	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCX3016.tmp	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe.ico	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.exe	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.exe	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe.exe	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Windows Media Player\wmprph.exe.ico	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe.ico	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe.exe	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe.exe	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\RCX7CD8.tmp	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.exe	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX1A45.tmp	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe.exe	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe.exe	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe.ico	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\RCX1C4E.tmp	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX2BC3.tmp	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe.ico	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe.exe	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe.ico	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe.exe	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe.ico	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files (x86)\Internet Explorer\ielowutil.exe.ico	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files (x86)\Windows Media Player\wmprph.exe.ico	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.exe	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX4355.tmp	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCX53FD.tmp	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe.exe	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4032	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
4032	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 4296	4032	2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Users\Admin\AppData\Local\Temp\2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe.exe
  2⤵
  - Executes dropped EXE
  PID:4296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

arh.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
Size 908KB
SHA256 813e65a02e4c18efd1c86a688f984be5d3f11399032cd17acaae7f9515c2dac1
MD5 f2a40554c1da585ab214bafeedd52a76
SHA1 b12cad9191365b0498cf95980bc7ce24a1d96945
SHA512 11066b7364a8881b97d68a3ad2b2e7a53aa7fe85d2788a820e2d002dc8fdd585ec75e445ec6c85f17e217e4b1a883fe0665d2b5e766ba6c8a94b274d319eeae2
SSDEEP 12288:uCh0oR2QK0J1oznlj0jAZrwLp5ZkYfYVUbg317AAvwvDow5imfRGYmIjE72:uCyA17NxkYfYRl7AwwvDlNfI72
TLSH
T172159EA8F192C56AD4AD1CB047588D94FD3DFC735C1A27BBEE2D6A6C6967000313A3E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisabledGoogleUpdate.exe

Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
Size 6.5MB
SHA256 f8de26464521a5931f6646f2dc7ad775144fc4b0807d881cac5a2f66ba6a9f3b
MD5 f86eeb5de55b41d178de53e052b8c541
SHA1 610acae969166a5035d972d26cee6d48bf44a496
SHA512 5129d227382a97ab291b3449139dde161b2efb6c8e1b370b4439163a16854df31a942600d0e4e44995d3f8f12de096d23943b26b519f1bc9ba361d00b80462cc
SSDEEP 98304:Z8Yraog5HQ+hDHQTW6Af4fF7KkOuYO6IgF+IAMk/JexMXP8iuHG9XXYXQz7ws:9aog1P9fIlOuz6IgF+I3m2MXP6HG8Qzb
TLSH
T11C669D23B4E08035F5FB32756D2C67395A327BA29B3145CB86946C882FB43D3653936B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ieinstal.exe.ico

Path C:\Program Files (x86)\Internet Explorer\ieinstal.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

msedge.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 2.3MB
SHA256 84a3ba2d320e6ff28345b3ebc6d7f23ee691605a5a7f11a73bdad3f20b3ec6cd
MD5 009f0ec6e2a574d473354b52d82559d4
SHA1 c287b428587ee6f464369f89d59fea722b20be6a
SHA512 9c1586f0f15c545eedd92e8be2782bf9c42ff629ac7e0a67b2f7d7ccb5a2a2b7b5c3702cd48b0a5ddc6719272e8cc3b56090625ddd834c4b2b2ccbe34f431de6
SSDEEP 24576:synzMhxj5y3MkkjLxQOUJtUp90v1XFf3ng7d9+1UXJwhXCTi2Qlkkkkkkkl0T3gO:xghrQMrQOitU/03nmdXa5o5QPQ+
TLSH
T1D9B59F07F69981A5C09EC174CA754775F6717CE0BF2099EB0690BB183EF6AE05A393E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 2.1MB
SHA256 bc5c5f61148c4606880baf8da64a5f38892081362c618a7f3d4424f5676576e9
MD5 ec150fb926cf956f1aa1fe9ce93e8615
SHA1 a5277f89f4dad8def7d85d2970d82bdef27cbe95
SHA512 3dad5760f20c3a6e87fc8b92bbd66020b2bc06e3873b12f0417e3085a14bc73b4c1536690fb543a21a161b6b7d4a097017171a0a8df8acd9da86e61cf6756aab
SSDEEP 49152:7FwEH6JHK0xbQoegru0WjiMgCv1jn1ChuADSi:7FwEH6Jqsb6iWjN1jo
TLSH
T16FA5AE0FBAD980E4C06CDA34E60E8535D6667C430B79A3DF0799B6682E77ED41B39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 1.3MB
SHA256 3a7ee210bb399147015f81e38e60a06f39fd73f47c550b2b968e96416565c86f
MD5 15fdde9558b5b4616b1cd6050cedd470
SHA1 ab9583c10de02210eadd4cd34c7af51e823a3182
SHA512 23d0f91a327e2d1adab6db8025b81bb66ce6e61b07594904a721962e5ddab72d32bfef4642b97b882c8ef2f5e562b642fd10506bc77ea25a28494a3d4a16b98a
SSDEEP 24576:6ZJDI6zMbzK4jiL5gpVCfgj+Nk7fw86n9kAJ9tA3L:6ZhzMbW4jeuefgj+8wT9t2
TLSH
T13A55AE0EB6B496E9D92AB4344F12C351D671BC412BF295BF026C662E1F2E1F51E3A370
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe
Size 2.2MB
SHA256 cba105c24a03bed446b9d3861fc2163ddee4a72ddc175e59573b2a287e6c9ed1
MD5 9d889491bf551df439a6713cc6b2182e
SHA1 eb7c968bd9e9e25e33ac55a20361fa7dbd9e2695
SHA512 90c2a7f5b7a05e5855d79825db3d7474ccd1f255e5ed3370d2a3c8893564eba0227f4fdb5d6950b481a583d2a91f242a984a60e0d469e7fcf23ac91478c0e23f
SSDEEP 49152:gFANF+E/HZoeXrfehjvHHKTdfxINPEt99G2Bo7EukU1a:gFAvf/HZNTyjvnORmE
TLSH
T150B59D03F68880D5E029D574C6874639DAB2BC950B29A6DF0680B7492F77BE45F3F728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.6MB
SHA256 65853a42dcf68cc5f269a33e8fbffcd3d58def1a5bba0cda62881dbdaa102446
MD5 290880ce8f832ceee5b357f7ffa44a3d
SHA1 090ae1630e01201fb606f41ca94aab3036bf9cf0
SHA512 8832ee9f45b0998ae95e67c40ec15c98ac79a3416771c3f94cdd23228076741288c0d8a647c2f727742489ee8935701e864a9660b73479a0df5be8e2e39d0fae
SSDEEP 49152:ULbzFWPWc9jZGu6qG13O7Q7gLYduZrSdHBAVfb:w47lR6YjwA1b
TLSH
T166C59E07FAA580A5D0DEC274CB268B35E6757C168F6095FF12807A5D3E7BAD00B393A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
Size 2.2MB
SHA256 a9c2e89f75687ef416328ef841be6f4027a986240a8602587e50ea365b8024c6
MD5 4bbd535687b58b235cc9889cac0eb70c
SHA1 cbcf4ca8c3868187fe545c6c829ff0524f6741ad
SHA512 101151616858e02c361398cda9046f5781c53e525dfe1a65119cb4496bfb3b83a5619314b261ae21cc85c13355dd35590c6d71dc002ed6224df52388d5939446
SSDEEP 49152:fxGI3b1wWUB/Y2fF8FhmS86IUJWQn+6h27d6:x1wWYbOjjsts
TLSH
T10DB5AD03B2C642E4D03DE0B3C76685BAE667BC051B2566EF0744B6592E3BBD45F3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeComRegisterShellARM64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe
Size 1006KB
SHA256 d7d0bd2717deb0c52bc4d787eb67ccd9c913dc2acfd278b3a27b032874009db8
MD5 3cc0c98d2c02fba3e47aca15c3368d2b
SHA1 0feab11752865b9d5f429a51020afa735c1381dc
SHA512 3cce942f353938e18528dc62fa64d650db58daeec8007d8861a281871e57d42c30746ac204dc39810e082cb3629c1c0aa23fb618238c33806bb3cb501e99bb71
SSDEEP 24576:s83W6Zdb+TrgUg3jO7hlqMXAamj9olnxpEEbS3g:E7hlqMXLmydP
TLSH
T1A825AE2C61E475BFC0EF537C5AEE46616E6BEE72A73004B3A2E1E28CBC615500EE5534
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe
Size 1.8MB
SHA256 3ad2d9ba7e910ced34944edcddf3e4f48daff3cb695a1e6d9749440c1e33fe99
MD5 adc9fe76ccec9687e52b1540ea87ef8d
SHA1 d5126c203aeff9e6ec99a5cfe66e86de665211b9
SHA512 b5b14138dc65ed8889da8b1d46b71d560490ea8c04aa1c888acc960b373d8c341e707e8cb46c14f5ee622fa2a274e5085d2709a42177226b887a5137553a6b18
SSDEEP 24576:cS3yAEk7TRwj4VeUbYmWHHo7fvqcXFudDJdWQCkvjZQqg+lIVprS7:c4/hYzno7fvTqJdbPrCx9pG7
TLSH
T15295AE0AF69854F9D0BDC5348BDE4175FA727C460BA062DF06D4B21A1E7EAE09F39321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 2.2MB
SHA256 0dade99cf756a28e599e74c70f9739cc9da5f20e81fcd0e95f62a7fc166e1b85
MD5 18cb0784e59b7a9a2493ff6467304e07
SHA1 74f34b6c7b011478df16553f1925a66c98ece0c3
SHA512 48358e8c9f91e77ea0cc36b66316b4d7d53e226078ed7856614e075a64c4525361b2a934b950beeb555cadbd19d6ff54335a16f55b43bf514b8384579def45f1
SSDEEP 49152:Y05LSNJhDvwZ2XuTjPb33g9gZLfCdW9HTlXrk9dBB:HuBI4Ds9Ol
TLSH
T1A2B58D13B69840E8D019C174C756C532EAB3BCC54B24A6DF06A4B65A1F37AFC6B7A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 4.2MB
SHA256 5e2517bb80f7849a58050ac198af4d2d990379991fd269339c574da7893e1330
MD5 44d6a31fedc95641c9a71fbf44082a06
SHA1 d88f876cb42bb79f7a5537616450331328b39789
SHA512 2fec9c79b152749a840e8c97f82d75ff21ab9fe3da07200b0cb5a9cd057d733dda02c66c1af98a57b31556b9998359ce90d0c0706e32496c9b3e6d4cd8aa6ab3
SSDEEP 49152:iTDZkSBngQRqC9cxQwYZuZgk07G0auOj85q7aGScYbb6YErz7z4AkOuaRoBISCaT:gIC9WQro/Yhy8OnZy
TLSH
T135165A03F29900D4D099C075CF569232EBA27C8D47F166EF3690B6D62A77AD87B39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 2.2MB
SHA256 080522c5205d0cd7f5028ebb33e1e6658aed061967d5f501fa51f40802c27d08
MD5 56946d7371e7074374be84085d010380
SHA1 d71ff031b174db4766f7456174d6e2d1b52de816
SHA512 66d7c144bcf1713212e88d1d5ccc2c8523e8b94148d31729cdb03442b34b7c46e921ef2ba50863ccada6f51569a35d82d81483135145652f7fc9f9d4cb61ab56
SSDEEP 49152:hfRekPgBQnY2fF8FhmS86IUJWQn+6h27d6:hpekPtbOjjsts
TLSH
T1A0B59D83B2CAC0D4D059C274D6B2857BEA62FC514B2462DF0B90B6B51E37BD45F3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

RCXEFF.tmp

Path C:\Program Files\7-Zip\RCXEFF.tmp
Size 820KB
SHA256 a4be415dfe3e10add5f955b294a53870cc8d5f34f1d1c566bbcca42085204555
MD5 f68daf955ab825a12e8cbe08cdc7df21
SHA1 a8a263f8907cd66518eced9b98c39d8fc9fa1599
SHA512 b53c156d79de220e7f9f2410107ad79d503bc5330f729d1349c4a1def7f1f7c2f4a75e158a24eceb54be0ee969222d0f6466226aa929f4a67052e8502cd7c192
SSDEEP 12288:RFP6XyhGMmHgjwsBdNHyjzz6w5ihSD8hCK:Rp6ChCHgUsBdNHyjf63
TLSH
T1F505AEE77807802ADEE59CF35B929EFE8A6D6C5D0C15744B866E2D3E28B11C43817633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.ico
Size 3KB
SHA256 2a5c5c2bc95c18eded222f0a38752717c1a6ad20e31bcda6472bbba77ed22fe4
MD5 de1dbafd46ca8d953c93a1c89766a8c2
SHA1 41ec8c2a24317bba7a64f4b60341307033edcda0
SHA512 06a89f154036252f396a9f2ac515c5e03e8dd54eb7ba6c3bd0159f693d85846c4ba1b29c0fdc83f14d8c9128f18db3ee27c73111891dc66f81d4fd14361e6ce2
TLSH
T1D861565C04E3ACB1D6E548B83235B2C460D88A364424C867A89D7AD7CE7D8D473DEB0D
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

dbcicons.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe
Size 903KB
SHA256 c641f185b8dc78bee890026af4a3f0e5911d498166c88eee0887e96d80e7faee
MD5 44eff326944885b7a312aa73b8e6d53e
SHA1 a83f9862372152c1ad2d1f87318fa3a2c0e26987
SHA512 55bf09e426dc16dff5c73cd39ddbabbcef66bdf47db453bd6586530dd7c55dd617e6d4c244f8f24ed26d80d965072a097861bf75d3fae9923ba80efb915c5f63
SSDEEP 12288:ejLVprWyiEUVl4V6QUL/ieFCsrQ/1aVhhqVeHMFw5iPOHvd9KF:e/VpSyiHVl4V6XL7UsrIihhZsGeOHrKF
TLSH
T154157E4DB79AA522CA9D1470CC8D8EE12E5A2DD30432047B5D5C7FAD6830EA8BFD5633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 1.2MB
SHA256 ec9d095fc3ae3e4276080ceb5142f488c8b43f6296307488d075a06b22653bc6
MD5 33fb71ab0c4dbf4a845cda0daf1fd6a0
SHA1 0bc95356a36cded5bb95b86f87b3803c3872c143
SHA512 c87569983f349c16590adffe0d4075c69deefdc7fe0781cc2c8068c8d78cdbef9d4ff202446da7761b65f16fd42e590dc74c816e92d3e974e9d4a275b76067d9
SSDEEP 12288:caaRTLpX21axe5RRAJbeO79Srt3XYcISzvN+VjXMVWa2zdw5iigZypdX85bM3np7:kRV3Wll6daRsw3npi63iC
TLSH
T139557D92B2D58039F5F31A315E7593942A767C615DB6B22F3380E90D18B3D88CA73B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
Size 1.2MB
SHA256 3bff13093426e5beab4b48b107b0abb0149860d735793ed18755aba97dce552a
MD5 9448daac8778eb7a9dba5ead8bdb791e
SHA1 68354328d5c55b3296a2f5f3212ee546507806d7
SHA512 051cdc8477c08f0d478d1dc91b5c54666345b91fda0b1525e57aa42b7195b4ce0216152ccd3d730975ced9798550acee05bca4fcf1be5f4ffb9b31ccf9b68e03
SSDEEP 24576:Qn2jM5+BJkg4m9XPEJ2DKMYenGJiKEbXWtpOLl8:Q2jM5+z+usJ4PnRWt4G
TLSH
T19955DF73759AC13ED0711071AC6E813C3F78A535AF34565BA38BBD1C2FB80955ABA328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

vcredist_x64.exe

Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
Size 1.2MB
SHA256 377d47ed64c1971aa036a431d37069224eeb3e77ebb6c3c81a81889b795d4b8c
MD5 c198fa40fa7c1ff270d0f3fd3b705467
SHA1 f4f91f668ee5b2b59e601f83e34782ffe7f0f353
SHA512 7758a9af827ba5c476631ef7f79484e7155a0a1572c9330776b925cb616811a08907770d9a6e2512d3729c73b078eb6fcaefa137182825bcce06ba830598de73
SSDEEP 12288:Q9TCbetuZt8QJo1Ambv+nbzAtAJ/31jZw5ivJ9IbZc0IursYCYQeSnyZJiqlEbXI:/ewfJmz5iYQrITMYenGJiKEbXWtfOkUy
TLSH
T1B555BF22374190F6C079047EF25AC2733FADF61ABE04806F5744AA1C29B4595FBB636B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-6.0.27-win-x64.exe

Path C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe
Size 1.4MB
SHA256 9c1afa0f98dbf9b45154ac7b5ea4b7d3e54ccf185d7348c1a73faed2ae69f7e1
MD5 a37c1f21539e52214b3eb9c0da274738
SHA1 16ae44bc92ff3f236593b32a8f7aae874f1380e3
SHA512 61d687dd89cf83a85b5b7f0da54765acc3f7ccf3cfe4c53ef38f2af8f6e108a41b13dce426f11f08d8c6233b62a929db90c055114e04d7e91a1c1791519ddaf1
SSDEEP 24576:wBkvDeSf5Wa11PdlulSdGVh5mWpI2jFM5sFzfTpil15Z+M6qTX:CRe5p111lZMz5BjBbTpi75Zr62
TLSH
T18A65BF30A422833EE1F416726DA8D5322EBD5611471AC96BD2F8FA0C3E79453F6B7163
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x64.exe

Path C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
Size 1.2MB
SHA256 e7a7ab32da3f6a7fde7e73476f201f7f1e5fd2abf7e39fac01b212d1acbb806e
MD5 2598aaad77a22cff26d199276f7b1909
SHA1 93bcd23736f2e7d0d8c579ae72a8458167a1c4e6
SHA512 5f442ad19c9f16243b04f7442a31cd1651e03327b02200b4dd2ad625e203e853e19e323f3080049473a94f82e06c66dad95982d93d29977504874870dd8a929b
SSDEEP 24576:v6ZWfamA8XpZ7AuQLfOvykF0BOkUhMXcBwcy0G:vooavsdPQL2zgUasqci
TLSH
T12F55AE297555853BF6F601F1A825BBE42F39A71D2BA1C02FC7D0EA0D2CE454229F7362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-17_b442d33319994dd56624e52788096024_cobalt-strike_elex_icedid_vidar.exe.exe
Size 104KB
SHA256 a724652438a0addddb9ca68c77b0634adc5f91a53573cced5dc69a95b4a78a92
MD5 ede122c1100833bfebf5d4eafcbb69b3
SHA1 65ee7d87931ae0f77fe629e1bc892e459b62f076
SHA512 1101ed601fec6229e394f1e15f010f5c1ab160666fba6fd93e1397d1cef7b343d5a9e6049b2888a6b2f357d7ae6d4a5f4e614d73164eb6c3f3170d9575e5c2c2
SSDEEP 1536:Rt90alFHfRr4vkK/sTZSGJcXaDNUjVa51UysWqEdU9dldSGyBkc:D9R7fREvkgsTv6qDNUgzU7usKGuk
TLSH
T191A35C86B3A050D9F2734675C9609A05EB36F8710B618FEF026483AA1F677D19E3DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4032-0-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4032-1005-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4296-5-0x00007FF781940000-0x00007FF78195D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads