ee805c3ee8539e0a1b25d4037561cebd554760a2ca673de7aac2a65546d3e7af

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/07/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 1.2MB
Sample260721-e1hfssgs9x
SHA256 ee805c3ee8539e0a1b25d4037561cebd554760a2ca673de7aac2a65546d3e7af
MD5 086e7a7ecf5f9b69f7b61ada98353eec
SHA1 eda23aaf12e6b6a8db352bf232ab84a6e3d658fb
SHA512 bae7bfecc09c640b36d99d3e8b7a71e0d663e9a6bcc16a1c10b014f9db1a424331af955842c73b9cb8be176f35e9ddae12165189ecd9310b35661d118e2e0d00
SSDEEP 24576:GuKD53GQkkDNVUXfa2/FuRyyyynCs3Td9CHKy7GZO:GuG3G5ICXfaukRyyyynTd9CHKyao
TLSH
T149458D57E2902455D07F8E3088E1576AAB6AFC911E3096CF13E8355E3D32AF1A8F5B31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3004	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\RCX6363.tmp	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe.exe	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\RCX9A78.tmp	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe.exe	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.exe	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Media Player\setup_wm.exe.ico	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows NT\Accessories\wordpad.exe.exe	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe.ico	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe.ico	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe.ico	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\RCX27EA.tmp	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.ico	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe.exe	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE.ico	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\RCX6ADD.tmp	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe.exe	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCX3D7F.tmp	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe.exe	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Media Player\wmpnscfg.exe.ico	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCXA1A0.tmp	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe.ico	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.ico	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCX5C67.tmp	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\RCX6266.tmp	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe.exe	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe.ico	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Internet Explorer\ieinstal.exe.exe	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe.exe	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe.ico	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE.ico	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe.ico	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\RCX1F0D.tmp	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe.ico	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe.exe	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCX66E9.tmp	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe.exe	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCX8B35.tmp	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\RCX8C90.tmp	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.exe	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe.ico	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\RCX62C5.tmp	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe.ico	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe.exe	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe.ico	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.exe	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE.exe	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe.exe	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCX658D.tmp	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4612	javaws.exe
4612	javaws.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4764	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4764	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 3004	4764	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	85
PID 3004 wrote to memory of 4612	3004	2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Users\Admin\AppData\Local\Temp\2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Program Files\Java\jre-1.8\bin\javaws.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

arh.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
Size 872KB
SHA256 c79eb5c5ccd89631f95b74998f1bb2ef99dc66b5cd765348240963855e470360
MD5 934d5cd2508f57a2674f528ca8b67fcc
SHA1 f36071e2bb1c11615f306b1cd0fb79e55d1cbdf5
SHA512 f57c4dde52e8d26de8daba46eb5f7574c2a8cddf5d66d830e644cae5a37427bf4d8df7a34c404365500d8d51913627e5cdf178bb38e49d42eec9b23e62d9fbe1
SSDEEP 12288:3fXMdm0Z3mmY/rWgjWLVxJAHTw5iHVbYmIjE72:P8c05m71jAEHEA72
TLSH
T16D159E0DE7D0E017D8297F30DED682E11B366C13BA264D7B7588A92F3CA0D45DE92678
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisabledGoogleUpdate.exe

Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
Size 6.4MB
SHA256 71f37332f0d67af7df5430a33405c26fb780e7315b4a36721115866a5509a92a
MD5 a2642bd19becf935acd329836558da27
SHA1 186bcbfb043d37e040a7d35e7ad33bfa7c19669a
SHA512 cb9da7bdd942634df078147585a5f4716c317ae1a912ce12a5ced552fb7b6d1dc60a0341a3ab5a727a75e1de279b616671cc076a5e191d0def98ff48fa7f9cb6
SSDEEP 196608:kJnog1P9fIlOuz6IgF+I3m2MXP6HG8Qzb:mognqO86IgF+qbM/6HG8QH
TLSH
T137668C23B5E04030E5F732756D2DA73959327FE28F3546CB86906C946EB83D2293936B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ieinstal.exe.ico

Path C:\Program Files (x86)\Internet Explorer\ieinstal.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

msedge.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 2.2MB
SHA256 faed79fe0e3925a492628467866d12a9ed599b4ef52e4f7b4526294d51b587c7
MD5 ef76feeb47e48dc49de940a2492ee751
SHA1 b282374e04672c732c0e17947d1591f2bf584467
SHA512 dbacebb1dd6e398824bfa7c6cb257be04b53e6225d91920e49d3cc725836a39f8153f44287a35416b40f2cd46106de75a576cf7830a87ba14691833e4db3107d
SSDEEP 49152:5mMmLhubKKIOUWd4BDWDQOitU/03nmdXa5o5QPQ+:5HHuc0A/03mdX+PQ+
TLSH
T19AB5AE03F5AD81A5D059C378FA734F61EB613C119F219BCF0290BA993E72AD41B397A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 2.1MB
SHA256 7941353650be0bc81a76c562448993b3941c92025734f56b6d60d84f36c4e711
MD5 607e9e28f30f910ffb944258d190f247
SHA1 82f47fb40d41483947dea1478ff036f96e34b9a1
SHA512 91f8cfd175c7691c987b6fa81373649fe9493dd32ec1642674e0c1c41453af1bc17239d0568b8fb8a5c06cdfe99863e1ed9c377e7fa725f8d34a9d318a70a2b6
SSDEEP 24576:lHJq5yeNfTkrbH9oU2RlMghorgc3y0w9jfGX7yxgCJd1fbgqf1ChKRADe1qRAi:l9rbHS1lYru0WjiMgCv1jn1ChuADSi
TLSH
T16AA5AD27B29B40F5D02DC474C6664275F9A13CA28B3062EF465876693F33AD8DF39728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 1.3MB
SHA256 52bc104833db6d69ae5a87e9b552be9308447e0958692d76d3fbf42e3007dd24
MD5 84c7d1cbddc5ab0231515d163a5a5f94
SHA1 f45a8855cee7c6e631bbc41ae249815a90640fd8
SHA512 db45c916548c93f4e860321be8b897e4a29ab3c7a0e13a7003f2ce9fc2a7f3a721966acf5d6653916da7b9ca84efb32d5948c16db936951a038e5002d3e3b100
SSDEEP 24576:8MnwXBtV0Jsl6ndIuT36uS86n9kAJ9tA3L:8MnweJsl6ndIuT3wT9t2
TLSH
T1F855AD5A7EFC82E4D06A753088C28094EBB7785A0F91D19F6E531E692E733D1CB39325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe
Size 2.2MB
SHA256 a6b1809c01abc10368ca7ec8301e5d5535cce2b59730784d3077990b7663ff06
MD5 4e840488a42a4ec01c1f5cabc1f65d03
SHA1 6d7e9f17a611071a38df47d9cc3a7b4b58cdf8b9
SHA512 cadf602c3cb8ab8baa76251e1d14ee46e34a8dee570210a07f958185543faccb7529ab891e66c312097943883c029bb0b7494b5d772af32bf372b23a3753aafc
SSDEEP 49152:u8P1GNM6UcuPopfehjvHHKTdfxINPEt99G2Bo7EukU1a:Zn6TuwtyjvnORmE
TLSH
T192B59D03B29861EAD06DC8B0CB664A23E5A37C41472566DF06D0B6192F77FD57B3AB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.6MB
SHA256 4a28c839252bd5634d330c1ff4ca9819a313c58a306c10402875776cb1fa6ad8
MD5 55880580fff0e246aa5ac29a42408e2d
SHA1 a0008979e0a8b33d5b0c24b1fe8d8ec708ffe883
SHA512 8e73acb2c780c7f801ee7f5f4ab01d4ac724023071cce45ae500b3b79369c3e9b007208ffaf14ee477779e03e0c1b3f6a063293eef0c345195055ecc3b1c799a
SSDEEP 49152:zM0tbIt/iCVc6MHZLerXv/xZGu6qG13O7Q7gLYduZrSdHBAVfb:zMobI97V+Zer/jR6YjwA1b
TLSH
T17BC5AE83F68581A5D01DD279CB62873099627C616F2069FF13887A572F7BAD00B3B7E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
Size 2.1MB
SHA256 820e56f9e7ff2f8fc30b17d48b9650e2c695cd23b92750242c1187c5c711a404
MD5 4319b6c99ee5baf7a71f5f12a6870ae4
SHA1 90e7e28e2a688e680281333e5404c0b4e63dee24
SHA512 6053d1f8b5194e14b05a89c2003cfeeeaba1d553ed0291bd26c1a2449f7f00229a6aaf7ddf777ee31fc6ca100fc9fa9981e75ccd4df9d9ab00262733117c826d
SSDEEP 49152:eXp/CP9MooY2fF8FhmS86IUJWQn+6h27d6:e5/4wbOjjsts
TLSH
T1B4A5BE57B38A90D4F82DE6B4C6269A75EAA17C420B21B5DF07907B482E37FD44B3D360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeUpdateOnDemand.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe
Size 886KB
SHA256 3f3f0039aefc9ced693feb4d7e2a9a0d53d392f6ee41e82b13e5c62d566ae876
MD5 6e8c43885254301a3efc37c57d059b97
SHA1 9d190039b075f964a3761692008c35a09e6486d6
SHA512 2e869846c66cf0aa4fbc0b381bf51c21f5dcfcb92d96c3d952dc73370395016d93b64b388d637c13748ca4340948715cd407176a42826d5c4d9499fc3e42855d
SSDEEP 12288:IEHyzeV++Rb5r8ClX+6AMKECglw5i5555N+R/pnD2brNPzB+NU:pHyzeIm1vIMzCgme555jbBPzBAU
TLSH
T14615BF793A84CEADF0681070DAD36BB243653C03F9250E3B55CA76BD0EB065269B9737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe
Size 1.8MB
SHA256 abe1d90291b21c4a98db77a06cc58e4b182e77ebc21a589e5cfe32ad3c1f0e06
MD5 09e603483fd8458c3af5f9b8c48a64c5
SHA1 5838753bf1a038c3b45f7be3eac20090580de734
SHA512 97c2bd2ae1ef89f052d9bd957cb64f04ae7a07c0386ca55ff4063797ed5f5e59a92e16c11642654bf6b7f8f2c8405435df2753f1e857494dd1e144b186c38591
SSDEEP 24576:8WtGtdMDErJodi//YmWHHo7fvqcXFudDJdWQCkvjZQqg+lIVprS7:8WGXyErJo6/Yzno7fvTqJdbPrCx9pG7
TLSH
T17895BF0FB29940D5D02CD4748A668A79ED71BC420B6175CF02A1B74D1E3FAEA2F397B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 2.2MB
SHA256 721a18f337d3203bf015987d1b0ef1f19606e7439f8679411784af077fc2672c
MD5 237b03b00b44ea61b168cbd64258768d
SHA1 d53a10ad4d466a0764719d14b6884da8fffbf44a
SHA512 b9c018fc39bb976a0d592ec65cd3dc9877bd3e053f4a3c6a8777e39049d44cf75903cb4898cc3f8da9076ec85cc0342527945a04ee18756bde98a07b98834647
SSDEEP 49152:iCr1MHRAjDvwZ2XuTjPb33g9gZLfCdW9HTlXrk9dBB:JrsSI4Ds9Ol
TLSH
T1C6B5AD07B39852E9D058D074CB568236DEB27C895B24A2FF0764BA152E3BBD41F397E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 4.1MB
SHA256 84b4e1780e43b1c236b7f5a1a685eea9b07a2f25434df308713139a81c5922fa
MD5 080a16d00753c6b6f477af3f8e79bee5
SHA1 38dd2b10158143a4c7b5fba2caf978ad1a0610e7
SHA512 a6fefe58b61cd303062a94a6612f84c7b5b0d558baecdf616ad2ef798ef61b12c231ddf2e6b8092bc9f4c9114d6fdcb8fcfaa028ec5cc7d2b583e5ee65b9f6e3
SSDEEP 49152:vHYnD6XaVwuZgk07G0auOj85q7aGScYbb6YErz7z4AkOuaRoBISCaQZCLlrrZ:vKBwo/Yhy8OnZy
TLSH
T14C166A03A2D980D4D059C074DE8E8622EB627C8907F562EF7690B6E52F77ED47B39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 2.1MB
SHA256 cb5a559bcce55beb9bc317e80fe54a2fb8ab597923d59d4b917a3e6d2f99f66e
MD5 7bac2c2088b93f8e77afb07e0c9093ff
SHA1 fc372b96cf5221be02c4b667964ada78d5c4a0a3
SHA512 c97d975f2a67bf1b5d5d196db3d7c0334fc4a79a62e907d16daf11aa5a6f3b487845097d98b26bb1da458d77d402bc6567301435f7fc03ce1e0a6755be372782
SSDEEP 24576:eCo4ceSyVQHvOfXgnDTZGY26UEU3RyRPW+uSmS86IU8Gc7QGsVa4i6h27d3WlN:7zhQoY2fF8FhmS86IUJWQn+6h27d6
TLSH
T104A5BF07B28940E9D4BDC97DCE4E4536DAA2BC550F2066DF0790B6E92E37AE41B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

RCX197E.tmp

Path C:\Program Files\7-Zip\RCX197E.tmp
Size 784KB
SHA256 783c196d0c357647d0eeee1bf53f5baf0b9db428883ee55f0c7c46b2bdcc4b8a
MD5 f7907d6f1ca5aace8f94c321b2a6c3a4
SHA1 5a09f1b03058f07bb894e279ececa2102d4d4e0b
SHA512 e6e77774f5af7a91f5ad749aedd34518e35ec9427d7ef973da07521ac5c39f6e9af0cf298d95bddf1b436e706eaa73db4a8042d619a6f5c9f088181d532a5be6
SSDEEP 12288:GSDUTqR79OtD6+3GQkkFhkoDSSkYJzwPXfa2/Iw5ibRyyyygJog:GuKD53GQkkDNVUXfa2/FuRyyyyng
TLSH
T1A1058E2BE4516806C10E9F7084D527BF2B5ECC905E3162C763E9799E7876AF2B4F2630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.ico
Size 3KB
SHA256 2a5c5c2bc95c18eded222f0a38752717c1a6ad20e31bcda6472bbba77ed22fe4
MD5 de1dbafd46ca8d953c93a1c89766a8c2
SHA1 41ec8c2a24317bba7a64f4b60341307033edcda0
SHA512 06a89f154036252f396a9f2ac515c5e03e8dd54eb7ba6c3bd0159f693d85846c4ba1b29c0fdc83f14d8c9128f18db3ee27c73111891dc66f81d4fd14361e6ce2
TLSH
T1D861565C04E3ACB1D6E548B83235B2C460D88A364424C867A89D7AD7CE7D8D473DEB0D
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

dbcicons.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe
Size 867KB
SHA256 0ab5e8354be1d5b604ee4acced2a9007a9d9d948a00f53d7c7445a855db47415
MD5 d3d6dc3c5fd3bc65ad742c775e8ef923
SHA1 4a3ef764bc582c54f775c92735c68d6170f623d6
SHA512 1e930954e64ab88b0cf59ca4fa4315843f71349a651bf1b27504a166918cb83e6dde59ea015ea80338ed357455644aa20a7dec634bbe33429f4abb624aa61ac9
SSDEEP 12288:bDEW74VW1Q+t1e4426ZFkX6KCDaw5ifCPsiEuF:3EW74CzeM6Pkm7QijF
TLSH
T161158C59B0DE7162D27C1538AD4656F0E635FE602CD31AAB22F07B3FE474D086CA2A74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 1.4MB
SHA256 c7676cbc9ca3af7d5f8695ecdfbbfbf143420e1be14ac241a37dc6ed510fedc6
MD5 a727a77b56e3764dab8bc283403f1e5c
SHA1 981f780e69bc1b1a1dea17676b247e2905110ee6
SHA512 67440f9bb37d1ddc1716f95bb5f2932600b57f6ea83d8d18907aa2a0f832ddb5334b947328baca133464a2894e4c26d0d4f475894b0f291358a85309c0ce5f42
SSDEEP 24576:iiprYx/jKGKskZgxlaUm39PZfePv3r7fm6t+jqp+3l+zCM0D:RprK/jas1JgZ2HbbZt+jqpQ0CMO
TLSH
T16465AF25A253802BE374C1F3692AD530AA7DB9305B21445F92C3B93DE97485D3AB3B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
Size 1.4MB
SHA256 414cc26dc1d2b34a6ad86d9e85c37e8ffe026dec9c196f3f53e179553366bfd9
MD5 a94c8cf1a7e1272cdd96bcc87d9e3e06
SHA1 3d3754f369fb687b56ecd619fbbd7b99f65021ee
SHA512 c9c2a899743b9b4fe5633778c227341c12b8745fe0b6e545d749d02482a3ba870d80214f09b077b9e379ddd95ad0fa97d35bb0362ebd6eb620fbfde7f6aa0480
SSDEEP 24576:M49Fbn0q+KE0MJnoqoB6P8MysZgjS1hqgSC/izJfojymk4HM5yJ:BYClvtRjvQotoy4F
TLSH
T1FB65BF36A190802ECAB11DB39D7993786D3FE5142FF4C41AE2D9F90D7978161AA73332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x64.exe

Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
Size 1.2MB
SHA256 f95f003ad3c2c663b0d89879e3b9347ec852089f47bfbdeeca6be88339f4c735
MD5 9be21d154ff2342c1392b416f8cc83a7
SHA1 6709f0f4c803e15d478769095cf2f5d53b91e46e
SHA512 24056538b155e79929c4e65744cc5923a2366d1397cf7040f678ca3dad301341209c7f8899978f68ae30ee717751ade849c64c836bf4baf6248b19029227cb15
SSDEEP 24576:PLDLDCZgYUxgCwB4sXizCcjVMYenGJiKEbXWtfOkUy:PLzCUg/BlXi1GPnRWtGkf
TLSH
T18745BFF626018732D17508F798C7D2E02D3B98244E34351B528CFAAD257D5C6F6FBAA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveStandaloneUpdater.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
Size 3.1MB
SHA256 68c8db74534cbfc73e261b9d1ed584157f86baed99bb7a12a7768361c5a2ba8d
MD5 966643286bcc09c4b82727f4f4ed3b18
SHA1 65d9184af8829590899cb5b7b7051ef677b33dee
SHA512 5a337acbc1bcfb6da07af82bd8efe5aec2280c4e289cfa08be1c0d91a87683e7f43393c5e03780527d71270d7306afa52a691db6a803f604d74d1b78cd076c3a
SSDEEP 49152:uGpdnwHtt8NVAjXR6t2jgZ8tzPFASjYhMleFLyJwXP9L8vzbtu14BCNbTc7FBHG2:GHonAjUt2jc8tzhYhMMFW8LMprG2
TLSH
T106E5BE21B682C437D16311318FBD76A96779BD311B2184DF63CC278D2A704D2BB36AB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 56KB
SHA256 68f5f0b6537e69b204e700f188a20e39a4f532eadcfb6438710cb24b6511cc8b
MD5 dad0aaeb50fb64564db34167f9ec86cd
SHA1 e69890f2b13d22c765aab3799b0cbdec009a762d
SHA512 7f6e432869ab9f2fc13ce754d47629942c68ab8d69df4c65f753b1730284533904a5702a7812008e1d3e01cdbf0285d4d6ea27b6b70c94463b68d68444422a00
SSDEEP 192:CCnRv/XOoT1B4pl6tTs8SrU8rRXkSCDyjt73Cxv61HQdJzZF30G9Jd+:Nv/X94pl6hnl8tkSMy1CshQ/zZF30er+
TLSH
T11243D496B848DA45DD095D369FEBDAEC7331BD26CE5B421335C1BB3F9AB30C00A19285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-21_086e7a7ecf5f9b69f7b61ada98353eec_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
Size 472KB
SHA256 be76d87d31df3a28997f34ce8242df9d19ec51e92b1f219cc07979154d5e48f4
MD5 63ac1d35eb70f98947a08661ab9455c2
SHA1 20a752c99bdf849b87385da27d47368fc6e3cda1
SHA512 49f85946526d13318342c4b70d97f7f1328d2203ddd8b87a7a162ff3d1ba0214c2f55692c2bcc6aae30ccb04d24c0208ea67cb224ba3117ac5fa9896278d73f1
SSDEEP 6144:ViYB2nEaKTRnXtTkCgwCzUg/HpjN4IBwu7QTLbpqmHdIvW:Vi4e7WRdTfgwCHKy7GLbbdIvW
TLSH
T18EA43A90F3E414E8F0B79A3589764511DAB67C5A1B71CE8F03A8661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4764-0-0x0000000000400000-0x00000000004E6000-memory.dmp

Download

memory/4764-860-0x0000000000400000-0x00000000004E6000-memory.dmp

Download