3aaa406767e75f2e2fb95e62f3dffe2976ab106cb9803919702cc999a1f5a7a2

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 22:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Size 4.2MB
Sample260724-2rrpfagn21
SHA256 3aaa406767e75f2e2fb95e62f3dffe2976ab106cb9803919702cc999a1f5a7a2
MD5 acfa8249c0eaec4892b8c60538b4363d
SHA1 c019b3511977b0fcbda9210aa45ed9cc2827dd0a
SHA512 812620bc5bc9af83662d46d6b2a507fcb0cf8a0b3e67c161c6a9f2536799beefd26b4971de308e747835e5c12e1534852bbc41f0b897102a6fb63978512af038
SSDEEP 49152:nxh/WgSw46uh/+/PivcpfQvdaKYXf3CUeyjc4t2vLemGa2pcPVx7EhI2AM7/0XOv:HTuc/PvOAjcXvvOOc5
TLSH
T1ED166B1E735884E9D1A6D1BC8A42C586E371F801C77156CF2AA4875E2FBB7E34E3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5108	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.exe	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE.exe	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe.ico	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files (x86)\Windows Mail\wab.exe.ico	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCXBDD3.tmp	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX6496.tmp	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX6661.tmp	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe.ico	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe.ico	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe.exe	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe.exe	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXD219.tmp	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.ico	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe.ico	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX78A7.tmp	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\RCX9634.tmp	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe.exe	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.ico	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Windows Mail\wab.exe.exe	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Windows Media Player\wmpconfig.exe.ico	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXD287.tmp	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe.exe	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCX712F.tmp	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe.ico	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Windows Mail\wab.exe.ico	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXC443.tmp	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX679D.tmp	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX7FDA.tmp	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE.ico	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe.ico	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Windows Media Player\wmpnetwk.exe.ico	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe.ico	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe.exe	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.exe	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE.exe	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Mail\RCXB204.tmp	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe.ico	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX63B8.tmp	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.ico	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\RCX76AF.tmp	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe.ico	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Windows Defender\MpDlpCmd.exe.ico	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files (x86)\Internet Explorer\ielowutil.exe.ico	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe.ico	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe.exe	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCX717E.tmp	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE.ico	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4736	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
4736	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 5108	4736	2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Users\Admin\AppData\Local\Temp\2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe.exe
  2⤵
  - Executes dropped EXE
  PID:5108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe
Size 1.9MB
SHA256 797db5390cadce977a18575f49f826a10f30b2c310b3ef13522887d437801c6b
MD5 506338ed1fe93fdd0889aa911ba07c3d
SHA1 03c7fd114759861efbff69dfdd1a863bdb6b972a
SHA512 d605d1e7dc17b3ec22985704ee43c2faaf80bc32d0c12419f911dda8981a1c9b6727708a1e7adb792aa3542182150340f24a5ff061b8ba2e52a30c5a8cbf58ef
SSDEEP 49152:hgiNVFIa/0bgkFjDTP1ULA/X0+d4/xozyVJO:nNVTy9ldULAXd4/v
TLSH
T16995AE07B29880E9C06DC17486A78375D572BC551F24B6CF1692B33D3EB6AE41B3A72C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe
Size 4.6MB
SHA256 eb98a8db57b1b332fc85a3c7f748bb3247c91013e2706aa2bf15683c560e2b94
MD5 09e085ab229ccabbc58a6773df847f32
SHA1 d81b318da9702f5382cec7d52193913c45214d4b
SHA512 10b238e437c49a44c5f317c9f34571a69d5b683363f36905ebaf1bbb9a8991b090bcfe5d165db784303acfb79cf0fd7f0cf0c77b60764bb97046c52da48cbb0b
SSDEEP 49152:i3CQbIUrJG8yudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/BG:kCO9uijnUdYd+RaAj
TLSH
T102366A03B29940D4E149C034CF5A9272ABA17C8987F561EF3A90B7DA2A73ED43B3D751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.5MB
SHA256 5f87e6b09f9d916f0027b1e25e6c830bc1512abc7317facffa58ab53de60b143
MD5 d78fec26688e9b625021ab3b8ef344a9
SHA1 eef12fbc88691b90c88b60b3bf76614a535961cf
SHA512 5453dfb3609cc9623a82b5a2eb993b85cb15f484369ab9c447c64e15ecb78b8525d7e916a95cc79eb591a22b9a010f474f171939e526a0d41c3de7813d9db9fc
SSDEEP 49152:gthpK3lI1r1L4GJZGu6qG13O7Q7gLYduZrSdHBAVfb:epKSRuGTR6YjwA1b
TLSH
T155C59E03F58680E9E099C278CA7B8B25E671BC554F6065DF024CFA6D2E77AD44F393A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
Size 2.1MB
SHA256 3b00fc58a7368242c70c587e53f436a5831f3ebd79d1f1dc14177209866d6945
MD5 0db58ee462c7b6be57f2f26c8b3880dd
SHA1 6e619982342bfdbf45fb3711ae8683c830f83cf1
SHA512 72e50ceb31b77d188f7ecb12c51d590278a084cbe5a7806cc5038ded7204846f069ac0798e075e040bd3ed381dec496acc25d5e340ce5ee7b69d33cdb413cf45
SSDEEP 49152:j31Zq57NjI2XthR69pY2fF8FhmS86IUJWQn+6h27d6:RmBI29K9pbOjjsts
TLSH
T140A59D03B6A940D4F0AEC07886328579DD627C094B25B2DF2E70B6592E77AD45F3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 952KB
SHA256 0fb9650d9f479a137a6ca97f92c7c61e97c250d3eaf71b522cc6fbc85862a405
MD5 a3aaf3f2cb7f864dbe4f443233acde00
SHA1 81e3482a15d473461a436e9cf19934f6f05ca0e8
SHA512 c808c0be32ec54e251c92b4069465dc9250bee3cea8bbe07f0e68ed65a25d6535d3f28429a89b56755ddca0b4dfd76a636e0b06051b021ac08f3abefa0a0bdec
SSDEEP 24576:EQNkOrinoNFnkKaIsNzhflGC9PD6DA35i6c0:/5YMu/pX
TLSH
T18225AD3EB1E5A4B2C8128CB54BF1C3DDE2A1D652C18895AB7270364D2D7241E1E37AF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe
Size 1.2MB
SHA256 b19e11f82b329554fee9e7085393dd9d718af5d0a08243432aa8b6d34c054609
MD5 8930f678581dba5be8bee0c503b00348
SHA1 292efe77fa1671c4e3158241853bebc4905a5ec4
SHA512 a7a7fac8e6b0a3a85b6e361f0ff679073cabaeb827ccad742545a6bc3b6e4072b74de43e030ab06777d45330a8891dedb3c9b62ba17c23c1e1ae75113bc673dd
SSDEEP 24576:iEBySzkYYO6NYPjzZ+WMapT57wn5k9mR4qYbTM:ievwYYi5+WMapTKnCmWD
TLSH
T1C645AE0D73E581A4D4BB44318D668374E9637C572A51A6AF13A0E1FE2E721D3AE3E730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
Size 4.2MB
SHA256 38551a082b8e0eb20952f6b86a1232acee434a0defa80e3e60ca55cf53a7bebf
MD5 3e99c586c2ce351cd9753ec388ae26c9
SHA1 cf6ee5e22a949f30a04f8485eb686312829ba9d9
SHA512 39036707a4996d3f2532a0f94b6e74ae98cd0c941cd08e2f578642b0010d3c171f0e4a745799dc96d85ecc6c3bbaf262cea2efbaa293a34a35f7eb2102e91e82
SSDEEP 49152:9IRpJZCOmPjpS2aBW08mKqRXGPd39PyPvnkSN+EcrxA3vGCDlBYMO74U2y+PhC:9IREOm4bN/ki+EcF0pDeN2y/
TLSH
T132165B07A19540D9E449C174CF4A9232EB62BC8A0BF166FF3A4076E52E77AD03B3DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe
Size 1.8MB
SHA256 2987a391cc4b29f4b0fdc3fb4e9e6b2927fb9627579e3f4363b2a254edf46486
MD5 7901d02362ebac17ae4a70ae1e3e6d91
SHA1 91ffd7788d00e77dd7005f4f4a4555e2849bf51d
SHA512 e7e1d35689699c4ab261419532f26e967c7d0e47244de4709bc20abb6b7052d6f9c9dbe1a913fa6d6bb9d3d090c36eab7afc734b7a5facfec8c6349a01279075
SSDEEP 24576:ZzAawertwrJU1sDpWi9/UZlWk0eTy5xDz7EqnPATW41PcL3LU:ZzbftwrNDf/Clp0L5xDzoMY91P27U
TLSH
T19895BF1FF68854E6E02EC2718A6681B1D972BC871F3667DF0750B2092F779D41B3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe
Size 2.1MB
SHA256 779b354ad90da62d7897d11be4ac4d251a7cbb09b3c5c8c1e8c31eeafe9ed329
MD5 a6852a5e0a5be497547fc148f957d5d6
SHA1 63ddc7b2b08507e447c495ad061d19bce60b84f6
SHA512 84f2b35ad896cfa833bcd67885e70fd6b427bb66f83853950abc95e23cb0ec531f7106109a66d1ea94a06be08efec5f8f52a39699b6c5aae3490c62741ebaca0
SSDEEP 49152:M7sAc0ti6fehjvHHKTdfxINPEt99G2Bo7EukU1a:M7sAcwhyjvnORmE
TLSH
T167A5AE07B6D840E4D05DE174EA4A4631E9B2BC4B0B2467FF0791B6191E3BFD44B3AB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

MpCmdRun.exe.ico

Path C:\Program Files (x86)\Windows Defender\MpCmdRun.exe.ico
Size 3KB
SHA256 02221d573edefa486ba8fe5aee3c8a10c8c7e3188914c0f22df06bb1338db790
MD5 1272e6501512e471bddb879dea4b5800
SHA1 1c8b9489166959e6106095c0974a1825ac1179c6
SHA512 7ef9f685457532d84ba2ed316ec52a44acec151b92e563f6943f593d272745bad0f7c549867a723d2b3532cbcb76ea2b99a965b3b2412d5e7644570740bb4194
TLSH
T1CF6140A1F209FC58C45CD1744DC6C2CC18543D958C0A7273FADCBF8F69724E52E21181
MD5 SHA1 SHA512 TLSH

Submit Download

RCX4CBF.tmp

Path C:\Program Files\7-Zip\RCX4CBF.tmp
Size 732KB
SHA256 8789129c59cfe4e0b44dc9e72a3d2d3da81cca7e34176c9c41f3fbf470bc5902
MD5 950ccb438921c6938d04a66f5450e744
SHA1 d2956f1af25c49863898c6fd21a6843ed7c31b91
SHA512 2ce035d5184e26ba33289c3b8f030de73c52f2049bca1e55234eb0568c195ed39cc5fffbe071563170289a97143c729c33974094d29dc5d72d701b20c4c37c99
SSDEEP 12288:nxh97x47anG45SqpnMyQS98h6mJoMw5iq1VHB0:nxhdxWaTSB/S92jWJHXh
TLSH
T123F4AE187621ECA6C3D802305A75BEF41FB36C0358F4051BDE3B959E28609BDD9E86B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.ico
Size 3KB
SHA256 463b6e99198762de39ea3c9156504527673355f452c17063d0fcc34caa3cfded
MD5 01f2c0d2e4df4e0ed544a4e4600d1457
SHA1 2bdf43857fcfeefcd37ee7a82d733ca4e4f1d871
SHA512 8238557d4075faf0d780ce775a6bc0121cf2da9b826cc49095fec9b35096809e5187f3027682db88d7358e21025c5d24d2ef784e9c2b0a8aa7021589ce68a8aa
TLSH
T13061D3A9E5052C3BFD5CDA7935B6DB60C2077ECA021680778809F58328F768B16ED974
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

iexplore.exe.ico

Path C:\Program Files\Internet Explorer\iexplore.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

lyncicon.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe
Size 1.5MB
SHA256 572d8a5df4df7d0e1218d5c12968e00e1119e596f2426652e26206f6fb2b23be
MD5 97c31ae2cb2f3ac67784e66eac5d2077
SHA1 622b00f37135e30cc6ba10d2830f601f40de7ae9
SHA512 dc373c3f8910ae655aad3804bd481bc245a0b3000e9e8fe6951b6fc7e57997d499996bf29898502cd28d02ce293716b666439c39952dd03726a5ada4f92ddadc
SSDEEP 24576:9vgM9wCjcN+ZrjZp55RJKAz3eGlOusHPyiE+:9vg0IN+ZJp55DKAzcvyW
TLSH
T1D5752866B44F8509EC2D5E708A51E171F9E95C9FBC1FF106EE48763A36BB1C428201B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
Size 1008KB
SHA256 8f03dc6f9464f752169f3244cd330462d94b032c5556f4b07bcde8c3a79d6593
MD5 1a541f5a8828bd5dccf6e80ff5948f72
SHA1 3f501e13ea5a8d48b1f4caef89bac926a294d7ad
SHA512 713f6762692d4ac48c1afb307c9833f4b59214c0cb1ffef4654f4f8e69b4eeafc229fb5cf9675fff78297a3f5a6ddbedd3421b7fc683d1642458363f3205718d
SSDEEP 24576:P4MAf7+xiD2Hf5eXcxPjm4NWXYfDtczAe:Psf7+S2HEsxPXVtcv
TLSH
T16E25AE4D3142C7F7F96902B859B6E6E076A22D524D11B28787E4E91CBD232F81D3DAF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

OfflineScannerShell.exe.ico

Path C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe.ico
Size 3KB
SHA256 9e3f1f8e5166514df44b02a1e0bf7474708dafba161e263cff087af62ba89ae5
MD5 d8ef82bb84e2efe95de666f46d0c7ac6
SHA1 fcdd2f6ceacde21e1e38a687041138aa5bb0ef68
SHA512 61f7439ba615c3250701aeecb96ab8319f2d84ffa7e61076f6dbfce20ee3409d212e8d9deb274b145b7f0eeed2388681b929ba897bc85b4d3841f7003bc40afd
TLSH
T1C461FEC2D34610E8DA8268F34DB58DC487650CD540E4ED920EE6BCE39A745FDA93188F
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

VC_redist.x86.exe

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
Size 1.3MB
SHA256 d35c75ffb8cdfba618e308bf3f5ee41047637ce302efbd4f56f21f4037445296
MD5 f731ac71b3bb9eb2d353003d432de982
SHA1 f45866b2970869922e3ec2b0102519aa67364a75
SHA512 b19460b90e1347445744327dc9a6911e4c24d23001fa6b274fc6c5578bed614578768f6f38e0fbae1a1bb73c8bc21a8196c9675e745dd85435f42923337c7459
SSDEEP 24576:TpqQby++2mGseMysZgjS1hqgSC/izGfU2JGlbhlAZ4/:Tp/w4RjvQo0nGH1
TLSH
T1CE55CF32F0D14A25D5B44536AE69A1F36F3CDA1C0A058C5EB3D4AA0E6EA7450377BF32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-7.0.16-win-x64.exe

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\windowsdesktop-runtime-7.0.16-win-x64.exe
Size 1.3MB
SHA256 385433d07a761f3eaab14227b36420a24d01d3f0948787fb3812ad60ac48ed4d
MD5 a6d9f49bd05643501536788a3c57f664
SHA1 ff8e0056e94b0a43b1ff3ec3845f8797e0380693
SHA512 14814f281ec7a52233c04ee7cfdd278f129120e44f569d348d88c17b395587a2506317a37e08a582eb55116d7f81db5158511b440fd47707a03de41e30dca513
SSDEEP 24576:9m4PfDU+s84or4C27t7qhqpV8wS/5mWpI2jFM5sFzfTpi71R8dZd:c+sh8hqpc5BjBbTpi5R8d7
TLSH
T1F255BF75A140C432D6F40A736929C1B03D79AA209F94C9A7DBD0AE1EFD325875AFB133
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe
Size 27.3MB
SHA256 74b5c8a48df2e75b302abad65a5e9fd80e6d706ca614c6699f4282893c23c8eb
MD5 5e49f1bbfead0928ef8fb19bc5d980fd
SHA1 2bf4abe59ce89840ddc279a2c476e198034f0c38
SHA512 7c2e389058a7e16c6326996d4e5c1762f93f5e3e977196587d3908cf0b0fbe4e1ac84ac64dea4e5fd55dff93990bef9993972e1364cbbac7d6dbde645614bd4a
SSDEEP 393216:YMw5ZbDO6RGmb8hFZtxwbTNXp3YCkxJoPMAvqkWgoj6RVFK+q3HvUUw0vXL:YMWO1c877xqpyovvVWJ6VFK+q3cSvXL
TLSH
T1245712927BE89071F0E70630BA78267D857B7C725B7181DF6292F21C19709C19E7AB23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-24_acfa8249c0eaec4892b8c60538b4363d_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe.exe
Size 3.5MB
SHA256 a5a226e35f5c9616a96e33621495c7a86a5b33507aad83a14a45e545995ecc9b
MD5 7021ec1b68f3d4f256af26818e8aef16
SHA1 db1852efb85a47294d4ace624b4ad86161b025c8
SHA512 491c0dda694227d201fc35f746c5a52759e76b2d2f0687bc808c8bb12b10e7f5bc20baae6e4ea11e34f3e09eb9db1b2ba5f94937749f73c51e6ed0788422780e
SSDEEP 49152:f+/PivcpfQvdaKYXf3CUeyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJU1QqpN755:2/PvOAjcXvvOOc5
TLSH
T19106391E735885E9D5A6D1BD8A428506F271F801C73266CF26A4875E2FFB7E34E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4736-0-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/4736-972-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads