8a3a6d30c3f30e6f35b084660bedb7fbdff3557c5d0397dc773cf1cd1ca88dc0

Analysis

max time kernel
149s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/07/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
Size 910KB
Sample260719-twvmwset2j
SHA256 8a3a6d30c3f30e6f35b084660bedb7fbdff3557c5d0397dc773cf1cd1ca88dc0
MD5 ef19f0d3cf5a1239cb33940abf2e3f06
SHA1 323ecd9bff6693333f0de7e1946a2692141af7bd
SHA512 46b45edfd866b4c6bcbe7a26d28a40838fb932edcc0c73f627ab9a72c1e5825ab070b23b20015b2505f2adc45c25044c65e5bfbee8e1843fbd249b37b9997d4b
SSDEEP 12288:Qu/txmZdDmfZNciP6y/8avb3QvKOIMVp9ROb2G/cw5iFOu1tEP5u6qDNT:Qu/tMyPT9bMVndGROOu1th6UT
TLSH
T1FA15AFCFF6C25CE2C13B4A34D9863AB84635F8054928CADF51886A5D6E61EC66CF3770
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4212	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\RCX86DA.tmp	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCXC5E5.tmp	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe.ico	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Windows Mail\wabmig.exe.ico	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe.ico	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe.ico	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe.ico	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\RCXC221.tmp	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe.ico	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.ico	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX7E13.tmp	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\RCX4F19.tmp	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\RCX6C57.tmp	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX7C69.tmp	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Windows NT\Accessories\wordpad.exe.ico	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe.ico	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.ico	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.ico	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe.ico	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCX8F5E.tmp	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe.ico	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.ico	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.ico	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX57E2.tmp	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe.exe	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5008	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
5008	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 4212	5008	2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Users\Admin\AppData\Local\Temp\2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe.exe
  2⤵
  - Executes dropped EXE
  PID:4212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

arh.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
Size 900KB
SHA256 8b7f2d2216bc7fcc3b503b0c89da3f5205e3658822e46615143b4880b9951c66
MD5 006250645f265568a46475f01f3adcd0
SHA1 05ec60bf71100753fd53138b93e1f4e6128c6834
SHA512 470c153a71743e77249bb441541c3d22366d2720b6e222e7f06499f907b6c799ad953efbd7f23f956bce7d9a4dcee0a342beaa4862ab48870713ecedce93ee5b
SSDEEP 12288:cKsgO0mZ7enY36gjAfCy4VPs1WbEthFq3Uv/w5iVEci2YmIjE72:Qg9mZyzgj3s1mEbTY0EcR72
TLSH
T11515BF8A26C27576E0F5D930D9860AAD411FBC234F018527DB68EBFDF8BCB236495670
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisabledGoogleUpdate.exe

Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
Size 6.5MB
SHA256 9daf9d2d4f5b580624b22e3c8da55d0e0cc79498bfbcf27209293e9e295d42d2
MD5 477b184de7dfb6d3c5530027446e01cf
SHA1 a3cf211fa12104e1d3a86a11193a3ee341473537
SHA512 32ea1c87d4df8752e4aa0c8faf3b37f03f1e685e130f79b00da17946e86a2ee41de5ec9cb6553e0aec79aa16a1611137bb87a41021d3cc37c769854420fcd42a
SSDEEP 98304:j3uog5HQ+hDHQTW6Af4fF7KkOuYO6IgF+IAMk/JexMXP8iuHG9XXYXQz7ws:Kog1P9fIlOuz6IgF+I3m2MXP6HG8Qzb
TLSH
T1F2668C23B9D08034E5F732356D2DA73959327BA29F3245CB86946C846FB42D3293936F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ieinstal.exe.ico

Path C:\Program Files (x86)\Internet Explorer\ieinstal.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

msedge.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 2.3MB
SHA256 282be8084d767d9333530ca2d43f226b13833714d7f7408d8a5eed9526cfc5cd
MD5 ed58faa12f7c9fef324e793415791dc9
SHA1 d62fac3121e0aa50c93678ebef6929a6053d2c97
SHA512 e06e20c3168b6bb7bdf6b9d138c1fab142226a09fec2c86aec7185e78a40c9aec4651aede240ed0acced3e4e937bd22e8593895e6f6cc7963f27ca82476c09c2
SSDEEP 24576:HXonobzieMktFvWOXXbOelXC7LxQOUJtUp90v1XFf3ng7d9+1UXJwhXCTi2Qlkkj:9ntFvZH/6QOitU/03nmdXa5o5QPQ+
TLSH
T15DB58D17F68A84A5C059C178CA368F70E663BCB14F1061DF0690BD5A3E7A7E4CA397E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 2.1MB
SHA256 c079c0c80cf6436f724487d93b23a0de0ecde9080a34542f2b631cbf6585e7b7
MD5 f7ab73cc5c81c6cc2b2f3c34faf985ce
SHA1 69568e128c19caa4e52823edd280163721706198
SHA512 9b820e189347a488f18e239211e77e0590cd1e71a671904ccb027dcda173d0b343f633e55b430b1cfabe86109904ac92c02e9d61adb7672385b287a40b8f2301
SSDEEP 49152:aJJfgs1JoacPSk65QIAru0WjiMgCv1jn1ChuADSi:kFgLv65lCWjN1jo
TLSH
T153A59E26B2AA81A9E05DC574C7418573DAF23C874B20A6DF0698B2891F77FD45F3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 1.3MB
SHA256 8401e1026a515b7502c7517c14779ee48cc647a9ca845233ed7ad1c4cfc051a0
MD5 5d952cb6da59c93f4a30b18d786315f5
SHA1 3850713c0a998891edbf3a663d645819a95b57be
SHA512 179d2d0a5d6950815b70ff2624fe0598d24e692c466744e59aabd17b4a8ee20652a83be7f429a24a13d4888bb830ff30da1d1a7a0ae2d3075150c1a22e363647
SSDEEP 12288:YYQDX77AZnmVuQKd042Ve0LV+w5ifDa2S86nHrUA9HVlK8SQBJ9t4f15rL:YYqnYnmrKdV0LVrqq86n9kAJ9tA3L
TLSH
T1B555BF067F948AF9D02A46B44D828D92D4A578F1CF2151BF037011E9AD3EFA9CEB6335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe
Size 2.2MB
SHA256 eca3898a2255d21ef015693e2d7a6dfe9e3bcb9169d5fa01b4da23ac217a7f53
MD5 43079cbcd51b1df0a2b07c6b05c1665f
SHA1 17f89d24b60168f543603327df267c16fb30a42d
SHA512 152ea77b0e2292a4c42ecf5a1d5bf485d13ed311d99acd620552262f3533e00375e488f7b34021eda194d304e26b35e919a83d90e32b94c61bc6fa0ccefd1b1c
SSDEEP 49152:gTtEOc+O+/PjZfehjvHHKTdfxINPEt99G2Bo7EukU1a:gGSNZyjvnORmE
TLSH
T18DB59D03B29810F6D019D178C65B8376D9A1BC890B64E6FF0B50BE492E7BFD45B7A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.6MB
SHA256 69f50ea6a4db70b8eef4c5102c99b32bd92e04495cd292101bdc13bc0413ed9a
MD5 e7a96d671ba1963f05e51d2566da3832
SHA1 b082cd7ce0e62e73f5651417342837a8baa54d16
SHA512 1f7a043acac97f1348d35bc6a4e2c47b2c9d90cf3b4ad245bef49fc1d18ca4f8f1a2b53e52aac77c46c8338249045fe7dc7a2fbdf792ec588606f995715b0fce
SSDEEP 49152:rfchlnKQXtbuhZGu6qG13O7Q7gLYduZrSdHBAVfb:rWtmR6YjwA1b
TLSH
T181C59D07F6CA82B5D049E178CA368776E6717C508F2467DF2280FA553EB7AD05B393A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
Size 2.2MB
SHA256 b78618647930e965148b17b01724aa6ff883a35b5a5da2a48e68b59b290ceba4
MD5 99d9a3886882f47b94579399cc9144b6
SHA1 5a1ee957c5ec0aada297f9e00d2329b1f3293bf6
SHA512 4a04c6e09c5681b39bd1e5924c55c2f8511d5af27eb649eaa0be4db5b7977887730449e1c39026d01069431a309dde28e3018f34b9207ccb327a97da431570b3
SSDEEP 24576:N1t9H5mFokKUxtQoknPA89AZUZGY26UEU3RyRPW+uSmS86IU8Gc7QGsVa4i6h27s:NfVaeP54Y2fF8FhmS86IUJWQn+6h27d6
TLSH
T1F0B59D27B28C48E9D81DDC7CCA16853ADAA27C450B3475EF0B50BA492E3BBD55B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeUpdateOnDemand.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe
Size 914KB
SHA256 c2319ca4618d7e9e1f787515bb20b162ab73e5b0e2cbff1f803b87c15a7afa98
MD5 0a3ed4bbade4397a4326ce2c4d0a871f
SHA1 65c948592ec4bddac997f2d2b031e8cf26acf307
SHA512 2e08e6f7de08c8d1b501e885ae69239a1a17e9cbfe645d94f3a2097d56eb8c46ea5f8e9990869a6b143b0e2d005168dc7b3c8ce2b989bfa682404aae67a39699
SSDEEP 24576:T+wcMx1bZ0JnRkSjz6zyYnai4bkPbxtW8MX7bBPzBAU:aHO13SMPbxY8QvBPVAU
TLSH
T10C15BFEB7487CF36D03D5A324661C6A1E4725FA0F41D3C1B12E8A18FE9F4646A7B0A71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe
Size 1.8MB
SHA256 861a41fc8844ce8ef9b5f77905639f52e72afbf6327eef7943f0b6ddc6dd43f8
MD5 d422484cad96ee25da1508ba3eae53e4
SHA1 ceb76b80282ced33b0ac74d5e9b200b226fd470c
SHA512 cb2ee8266181e5f9ee539a5b23128c8d9ee204029b9c5708bea01921d009e015ad01ac05e5f6029279c8bd88341c47fff91af946bf21472a0726acab0901ec6b
SSDEEP 24576:6mcN2kB+6MLru+nKA/dYmWHHo7fvqcXFudDJdWQCkvjZQqg+lIVprS7:6mcN2kcNhDdYzno7fvTqJdbPrCx9pG7
TLSH
T14795BE26B69450E5D02DD47886350639E671BC927B2366DF0694720EAF37AE8FF38334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 2.2MB
SHA256 5a19c893bcabe75ffc64aef6cf6680d1499699da25ad3a0f58d085e49f76e690
MD5 495ec8bb85ac4ad55e3bdbfd42d46fc6
SHA1 dc702cc98809f7bf77a98e4520b89c7f1c62c97e
SHA512 3cf83dba7dc1d89930502c33acbfaa9b7a46dfed8e37e0ac4f19b8aa963c54ebaa798859b435c636cadffea57352e1541cb2bcdca91aa19764c9b9ac5819d5c8
SSDEEP 49152:6MlQAu0/9QSPDvwZ2XuTjPb33g9gZLfCdW9HTlXrk9dBB:6MOAuzYI4Ds9Ol
TLSH
T1F4B5AE07B39980E9D01DCD74C6568935D9B2BC450B3C66FF0B90B6292E77BE5AB39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 4.2MB
SHA256 74779f75b6189223e13d198a41486344c7635e684866248d908359bab46be3d1
MD5 370392b37773c41a1f0283497761fc72
SHA1 6d0f15dd33bc4842a179f72c4857732e98c09cc0
SHA512 c684defd5ffb7a3380e912a363f6e8344231f90bb9da11c9462f97d183dc57979e844daab3ab672e6df8686260d735d4bbaed7bc067312455093b052aea8f839
SSDEEP 49152:/AebAOqqfuZgk07G0auOj85q7aGScYbb6YErz7z4AkOuaRoBISCaQZCLlrrZ:3AOHJo/Yhy8OnZy
TLSH
T166167B03B19940D5D159D278CF4A8132EBA2BC898BF162EF3650B6E53A37ED47B39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 2.2MB
SHA256 fcf5bcf5571dd3c239c9bbed1bb0045a8bee27b86e47a99af81e80f9ab39a3c2
MD5 ff8b0a0342d2487e5b310544d6d383a3
SHA1 aba439b902e8260337c0c4adba761218b2f3b76d
SHA512 5dc506a3af2137b62cf47bf57f1281e4359ec9e1178ee36c4dd4db3cf4329f1f9a0be6db9f727c1f0ebd5bea3bcc1ee9301530f097aa63c5d7413938209befa0
SSDEEP 49152:Qcvooe3e11111OlY2fF8FhmS86IUJWQn+6h27d6:QcgokbOjjsts
TLSH
T11AB58D07F39940F5C028C5B9C656C5B5DAF27C014B2AA7DF0A50B65A2E37AE41B3EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

RCX409E.tmp

Path C:\Program Files\7-Zip\RCX409E.tmp
Size 812KB
SHA256 be7e01abd91c8f4db5416fe34f8ab3448a297e546e7da1a20b125eaf1d33f8a1
MD5 ffab71dc180c79fe3a711b70921a2976
SHA1 1f57152c14605b33f36ca2309ed6723a2ae15712
SHA512 d6e9d597b51af6a2f7f16790f7761e1ef79732521e0b276922a94ae36ee7468dbb48c9df1ae199969122c6e6e7bd73915db8d1e3bf7ce8a61de7ddda9f04c9d8
SSDEEP 12288:Qu/txmZdDmfZNciP6y/8avb3QvKOIMVp9ROb2G/cw5iFOI1tE:Qu/tMyPT9bMVndGROOI1t
TLSH
T15A05AECFF9C25C52C23B4A38D98B3AB84525F8068C28C9DB91C86E5D6D65ED664F3370
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.ico
Size 3KB
SHA256 2a5c5c2bc95c18eded222f0a38752717c1a6ad20e31bcda6472bbba77ed22fe4
MD5 de1dbafd46ca8d953c93a1c89766a8c2
SHA1 41ec8c2a24317bba7a64f4b60341307033edcda0
SHA512 06a89f154036252f396a9f2ac515c5e03e8dd54eb7ba6c3bd0159f693d85846c4ba1b29c0fdc83f14d8c9128f18db3ee27c73111891dc66f81d4fd14361e6ce2
TLSH
T1D861565C04E3ACB1D6E548B83235B2C460D88A364424C867A89D7AD7CE7D8D473DEB0D
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

dbcicons.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe
Size 895KB
SHA256 7599872877bfefe9dfce64641ae36cce1e7c46223d17800a1c5fb18a747bdda4
MD5 18f1ad987154e084d4648afe335dcd9b
SHA1 5a305055079a39c26aeb7273c411b53ee6fd8128
SHA512 675f8c1a0c4120556062d9939a8f87cc7e4408166a7d575f7173feeb40e3a21eb53b618c7bffd575c1de078c063f4d39b603160a67fda6639e51fdf81fe850e6
SSDEEP 12288:x5BCw0u2a0WS1ZHjNnJ4AKZLGUb4chEyadJLM8ICJw5i88zVF:x5UNu2sS1xjN2AKZpb4chOpIXYF
TLSH
T18A156B5DF5BD8F29D6AD12774CBA8680B8E16E8128213CBF3E043F5DD93262636615F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 1.4MB
SHA256 5e05f4f32919500c2ebfc1ede2e34c50e3d938f691595d2ce72f16331bd1da45
MD5 b6f07d1255a67c9e4dc998867abdaa8c
SHA1 87ae971d88f139a9d1adf42061f3194c59f13a49
SHA512 9302cade699b9f4778892f18af8f5d5e3325a451d8969dfe9742b00a89defa15ab86e24c1268dfb7e55c2d1a7bbe6e010491dccddfb2ebf4a8d937babfd89133
SSDEEP 24576:/klxkqh/yvfUI5oumZm39PZfePv3r7fm6t+jqp+3l+zCM0D:/kavfUIpUgZ2HbbZt+jqpQ0CMO
TLSH
T11365AF33B050A076F6B00133B86793B5EEADD6178B448C5B93D56F0CA9A828D17F7672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
Size 1.4MB
SHA256 167470b5973f9c530773e30093dfa1c06d68bac88722dcccb97b244c642f2541
MD5 f3d49b1577be87d342c0e346f8012935
SHA1 daa805f15cd64a7875df7037740837d1740ee05b
SHA512 e09ed00ce4ba9dd6d390543aff1d21c7e20a8d319d1f2d0f8aef414232e93a9b8792e5bfc32ec1a94a09cdb8d98022f39fc9b220b8fb9621d550e2e9e3c1781f
SSDEEP 24576:TZfHxAIHEJRcemvpVNNp2NNx+bMysZgjS1hqgSC/izJfojymk4HM5yJ:TZfHyImRqLpWx+bRjvQotoy4F
TLSH
T17665C07175A0A0FAD5F00932ACD5BE3C6DA995643600843BE3F8E9BD3EB084565B3376
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x64.exe

Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
Size 1.2MB
SHA256 a61608749e3eff2edc16194fe2885570e270a99f11bde0add66ae6fd1d5fe038
MD5 8caa04c18ae60b38fc28af73f583ba17
SHA1 26b8c3bbe68397a85348e9ca4375fee795040320
SHA512 15e7faf079353766ced817e37f08a96f64351ebb1a355e049babfc4e2066f5c0c63f57c8e37221e8e86de95e0c8e895623196f5ecd17e1beeff7c782e43d782c
SSDEEP 24576:IAuLZIzeN55LlSOu+mMYenGJiKEbXWtfOkUy:I/Iz+nL/u+RPnRWtGkf
TLSH
T1D155BF2637C5C832C46D0733BA6681783E3A44276A284BA75651AE3D2F76C017AF73F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveStandaloneUpdater.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
Size 3.1MB
SHA256 f346660d4d43ca9b3c0e166186ac5544dcc1825ca27e301eb7b8c86e62e2e885
MD5 800e2fa7d5b85c2a957c29cf0bb442ec
SHA1 baca6080242ca9c6d07740007a36601c58b18f56
SHA512 7e4c44bcf5ae096b13e3b307d5724a0405c36e44453aed1eb8efd2abbf6a973ffc3c178b3c43d1172c11b96510a60489a2a227117451d6495e24f3f7173764e9
SSDEEP 98304:Zf0ZleIBnhnAjUt2jc8tzhYhMMFW8LMprG2:Zf0tBnmptNAFWba2
TLSH
T134E5BF21FBC1C036D57312724AADA7B8167DBC311B2181DFA3C4A76D1A758C26E3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 56KB
SHA256 fa8d02e83d432b8eac3797feb95122094910b119589b5d8b1cec4e3de2a5f65a
MD5 b6198a2c53ec156bbd21440f483b6c15
SHA1 d62d67da552ee4ca2f0822170be5c19445ac62e1
SHA512 5526b4b7a8e9a9fb013a2820e84fc5bed733b267ef68fb71c967e7eca097fe65409be394b9e7712fb359671061ad542ce8023f9df3cee7c73dae7fe715840474
SSDEEP 192:mC3m6FRDoT3IlWYuXZSOBnT75X2465Xaf8FiaSv9M7ZECGE00xz:e6XrlWYuJl7lz65KEpCM7ZECJ00d
TLSH
T1B243D392B848DA45DD095D365FEBD6EC72317E26CE6B421331C2BB3F9AB70C10A58285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-19_ef19f0d3cf5a1239cb33940abf2e3f06_cobalt-strike_elex_icedid_vidar.exe.exe
Size 104KB
SHA256 4a67df308182fd4361f15704e392df2db02ded0769d4007aaa664cbcc7043a03
MD5 017cdad21bf9cba73217f6ba7fae09a5
SHA1 e44ed8352532708d343d3d85efd9a8b1377fe9c9
SHA512 b31c4ef429716447caff31a62f3f0f511fb735cdbf9a5e9ed6a34817010aa195bca2dabcc921dde6678b48ba2ae28f4cbd9f4bff65d69dad8ecce706b6d9f8c1
SSDEEP 1536:Rt90alFHfRr4vkK/sTZSGJcXaDNUjVa51UysWqEdU9dldSGyBkcZ:D9R7fREvkgsTv6qDNUgzU7usKGuk
TLSH
T127A35C86B3A050D9F2734675C9A09605EB36F87107618FEF026483AA1F677D19E3DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4212-5-0x00007FF7260A0000-0x00007FF7260BD000-memory.dmp

Download

memory/5008-987-0x0000000000400000-0x00000000004ED000-memory.dmp

Download

memory/5008-0-0x0000000000400000-0x00000000004ED000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads