56f46d816eb500983e2c40642c8691c1266bff9c1a9e855366098b0ac636e376

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 05:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 3.9MB
Sample260727-fr9pcsv1dy
SHA256 56f46d816eb500983e2c40642c8691c1266bff9c1a9e855366098b0ac636e376
MD5 bfaeda566725fe118bfcb58829798335
SHA1 4f782bef68feb9da5c256c4c1475e62aec158c46
SHA512 0397d601e23a8ca8c61e93aa47fb364c15b60233f1d172d6ae80f2606e8d2aa6ec5b1878aea1ec583073db2405e7f6379eb616169057b30690f3c24ece230946
SSDEEP 49152:Lg4cB+6QFR18MAFpnnJH9BUfKn+95lRVfAa0Vg76Lo2E2T8avTl2y/Bw:KScMA3vBUGHo+m
TLSH
T186166B03B19545E9E15EC135CE0AC271AB21BC894BF566EF3690B72A2E73AD03B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4932	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe.ico	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\RCXF7D7.tmp	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCX29BD.tmp	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCXBA81.tmp	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCXBB00.tmp	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe.exe	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe.exe	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe.ico	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCXDDB.tmp	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.ico	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe.exe	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCXC065.tmp	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.exe	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.exe	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE.ico	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe.ico	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Windows Media Player\wmplayer.exe.exe	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCXBC2E.tmp	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe.exe	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe.exe	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe.ico	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe.exe	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\RCXF826.tmp	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe.ico	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe.exe	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\RCXE73F.tmp	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe.exe	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe.ico	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\RCXF55.tmp	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.ico	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\RCXEC4F.tmp	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe.ico	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe.ico	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe.exe	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe.ico	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCXC1E2.tmp	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.exe	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe.exe	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\RCXFCC6.tmp	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe.exe	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCXC7B5.tmp	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.exe	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe.ico	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.exe	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCXBE0A.tmp	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.exe	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCXCD38.tmp	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCXE91A.tmp	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCXF63C.tmp	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe.ico	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE.ico	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe.ico	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe.exe	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.ico	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1700	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
1700	2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1700
- C:\Users\Admin\AppData\Local\Temp\2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
  2⤵
  - Executes dropped EXE
  PID:4932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

arh.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
Size 828KB
SHA256 b6675ea1bc799317df243a41678ccbb1db5c0bedfc197f19fc5be4bab427e0ca
MD5 32213842e838700f4c6fb7643a8269b4
SHA1 60cf567746890ee37e137e06ab848e442004e95f
SHA512 283158c0b3256e0b0386ba4567b0a802aa3f9ca8c6d85fc92c72190563aa535c405c76aaac07eee04f48bd2636836c73d5785aaefda1c32692c471a4c36aec52
SSDEEP 12288:3xPv18vQ3GdvpAouDiWv+wpu3Y7WJw05jxt+8ho97W1Vw5iMAHLYmIjE72:3NzGtGD/v+wpu3Y7sw8jxtYq1WZAp72
TLSH
T17005AEFCB05F5477FC3505F0B19405E8B21A6CFA490291E79AE8AB3E3CA6971553A338
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisabledGoogleUpdate.exe

Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
Size 6.4MB
SHA256 c14cfb6a16843bd2ed26086ebab1eff311b9fe2ce1948de2e6d3ce1bc675c0cf
MD5 d84fadb6cd3ecbc23a12107e5ffa6877
SHA1 76c5b8dddfe5a82fcb15532a13c9ee1c2a7b7fb1
SHA512 317b5a543e163c26e44fc8e610a82e30178799fa6f4e600e2f7afe3001734cbef6e7e7ee9e825bc1db1270b2d248c60436c5f7a5f81c8b69793404abb0dd5ba8
SSDEEP 196608:ZZbqog1P9fIlOuz6IgF+I3m2MXP6HG8Qzb:OognqO86IgF+qbM/6HG8QH
TLSH
T149668D23F4D08030E5F732766D2C573959327BA69F3546CB86946C982FB83D2293936B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ieinstal.exe.ico

Path C:\Program Files (x86)\Internet Explorer\ieinstal.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

msedge.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 2.2MB
SHA256 8379666bb2f49a5a6299dcba446f21b94c4c61f9c34b91d05f13fbaeb4b7fe02
MD5 2364f8bbba15375c463b492c69e39b7a
SHA1 1a980e35a4891a2dfc2b28b242f07e2d734b64bc
SHA512 839bd8d6025b6f181b766796d52590b156a0cbb79d56189653c987149ffbae2a1e828301ee0c7353c2083f349360114ba96d3f08938076177fb7358997f62117
SSDEEP 24576:zWy5gcq9X5P6tU4EELxQOUJtUp90v1XFf3ng7d9+1UXJwhXCTi2Qlkkkkkkkl0Tv:to9JoQOitU/03nmdXa5o5QPQ+
TLSH
T104B59E07F6C980A1C09DC978CA374768A67A7C654F2161DF41A4FE192EB3BD44B3A3E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 2.0MB
SHA256 6e23004b1cb7f986c93c5c4a038e1466bd7237c133e2f181eaa5ad3f00761dd5
MD5 190157afec152dbff4ca9c9704455f64
SHA1 6d9ef4866211f6647fa7064645aa1d17b6f9766b
SHA512 b647d600c2c040c3bb1e771653a307e4cad7f12db5db755c4514f6ccc5d5a2a8e5ac0fda031b7ddc7bdd56b182b8ced5d2049a521d2c182657dc9cb8c818a418
SSDEEP 24576:bN88yu2l7/EBDjC6LxwzoMJorgc3y0w9jfGX7yxgCJd1fbgqf1ChKRADe1qRAi:588yJd6OKru0WjiMgCv1jn1ChuADSi
TLSH
T108A5AE03B6BE81E5C07DD43886225526EA72BC427B31B6DF029476091E37FD87B79722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 1.2MB
SHA256 fcbb8d7aa97858d721f1071382935c3727680c541bff7141b8d152ee6d44800b
MD5 894f64a356d3fd8de3986fc3816d544e
SHA1 85b6a99901ecc10b36eaf992ca1de91df5458abe
SHA512 64438517fdcfd74e67eeb21c0d4837668732970aaaa0f06f33d8bbcd665a2b2f4a976d7ac8e709c9adc72a424c38ec3aca14b38c6c244e75c3dd877775f0487f
SSDEEP 24576:B19/IkZ9Av+C2Gn6hp9k4u9eep386n9kAJ9tA3L:pQn6hp9k4u9xpT9t2
TLSH
T12455AE4276C586B7E0199130CD01639994EBFD430B3CA3DF42E8696DAE3ADE25A37734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe
Size 2.1MB
SHA256 a5a46a7a953cd70610b807fca7bbe2010ce6c0dd47b139dc507f3a0fe379a3a4
MD5 1f093b53e5188a37f7d68c0d2fb06b06
SHA1 c52dbed5c759feee8ab27160c8398a3d558d0752
SHA512 855632aba6a2a59a43c4896c04bdadb2f72d7baf7246ccb81dcce1fcb8f977e8f576134e78f7c3e61743d7e4aaf19055a065a37ed1bf8a7ee45634fd76e6fef5
SSDEEP 49152:qJo2UsKwHvPxrAEYLT+9htRRDJjsg54i+pRsY9dvRfehjvHHKTdfxINPEt99G2B7:qJo2KwPPxrAEYv+dRRDJjsg54i+pRsY1
TLSH
T161A59D07B288D2F5D059C077C71685B1AAE2BC2147A865EF4690F2691E7BFD44F3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.5MB
SHA256 a503f4b1087697a3d0ac1c97fd1ead4a00895aa1da731c3ce86c54eaf904a389
MD5 4d0d8fb18bcec77be4aa80c0e578799c
SHA1 9a65fb3e3e632f18c66e317e17136d179ec51967
SHA512 034c0ff322b7669e8e3d50df33c2dae6903ba3bcda2324278cc3e122ed566b292f91ab120d42378709541e90c71729d58f6e1fe0b5e62e4d05a83e75bef30070
SSDEEP 49152:31RPtB1mBK/38BZGu6qG13O7Q7gLYduZrSdHBAVfb:31RPZI+MbR6YjwA1b
TLSH
T1ECC59D0BF6C980A5E04EE274CB2E8725D6B1BC514F7095DF0E907A292E77BD40B393A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
Size 2.1MB
SHA256 eeec29560141db4e8f7b03b0a1dc85be984fd56976bb53d99bad439b09311bd2
MD5 ee4655dafab32d6d1da499103e7206b6
SHA1 a5c58783e07ad26c05d750927d27deb1c97140aa
SHA512 bf93115547fb647fb54768055a849c0c60703cfc9edd0932834742869e2dfcc61bf2e451e17b0459b459e802bb3f5431e62ccaf95353c81741099e3e9db326a9
SSDEEP 49152:Rd3ndNjgwtCY2fF8FhmS86IUJWQn+6h27d6:Rd3ndNj7tCbOjjsts
TLSH
T12CA59D47B28844E9C019C174CF45873AAEA17C864B39A6EB4A90B6151F7FED44B3EF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeUpdateOnDemand.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe
Size 842KB
SHA256 75b8a8e0cf9e412d394ec8db5b425fe66eb0a9db85f8a1b57aa7b45588460d37
MD5 96bc8ec736e87b72b800daadae6b2842
SHA1 e3f0b52fe8018491a763ef6f9ae2869b6a35f8f8
SHA512 e2fc2274ea0d24d8aee096d9abb81f3d91c47e9f97a623d3345b0d470afa5e53899f34564095cfea18e0ab919f83f74a308d2f52d5a94aaa211a3f8f4925a9db
SSDEEP 12288:gGAMxB4CTs5+kqX1HsU51Nlzutav39Pj2vbFfV1SCj6Bw5iLtTdbrNPzB+NU:zMCoRQutK2HlgbBPzBAU
TLSH
T1B805CF6C7B81443AE028287365EDEAB9E3BA7F1D598357171224BCCEED3E1522436274
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe
Size 1.8MB
SHA256 c88714ee077d0b0ed1d12d1e77b95ed152199668b35a2fbd37c11e736aead793
MD5 56f544994319ecd5cdccba0d464e120b
SHA1 5b292ae8fcd0721676196a0af3580ebb7a5a3109
SHA512 93f83b4492f0e6f2bbea0c163c4e029168a12f7ffdab30ce9a4ef944f7d79d3f264ffb35307dfa55444d35b3386ac3501a8eb25f21e6799986bfcd88f37f4df0
SSDEEP 24576:ZKkVZfWR6iIDixddaYmWHHo7fvqcXFudDJdWQCkvjZQqg+lIVprS7:hZfi6iI+laYzno7fvTqJdbPrCx9pG7
TLSH
T19685BF4AB6D441E8D419C4368A9A5372E6F2BC564B2069CF02D0F65F1F3BDE81F39B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 2.1MB
SHA256 a5ee66215abfe4c88224a176589941a6579b95753c09c7a1d9997806839e9836
MD5 6061413a7ff1e3ac74ff2a78f0dc8354
SHA1 11c4a75aa0408e225f59784b37f79b852eaa0090
SHA512 57c545f2c3f3e53b758680a26db83d897c1c02adb80ee8f75eabdae2641324bb99dd683264d52bd4c63fea43d17b23493bbb874b63426f4e6463d7ccee6aa885
SSDEEP 49152:iZxo8MksNiEYFx2X7DvwZ2XuTjPb33g9gZLfCdW9HTlXrk9dBB:ibqsF0I4Ds9Ol
TLSH
T171A59D03B29944E8E01DD1B4CADA8535FA727C52CB24A6DF0B54772A2E37AF45B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 4.1MB
SHA256 0d4cac2f36aee6f7b4ae524f66d5dd45a19adef6783c9de23ffe69c46f1b3a71
MD5 3985eb86dcf59e3062fd3094e6f2b214
SHA1 969408587eda90de3251ae288bea8628d6827c3e
SHA512 0a8c0e27dca0cb4031b3c4de1b1b9934c4dd2fc1429824936e1d94d6e9b4107ed572b6c648325b36d72ff988c2ad9ef180c01ce6927649217aaf82e4e56a4e7e
SSDEEP 49152:obpVhgbaDGsjr+uZgk07G0auOj85q7aGScYbb6YErz7z4AkOuaRoBISCaQZCLlrN:ovhjPr2o/Yhy8OnZy
TLSH
T170166A03F29980E5D059C074CE969A23EBA27C8847F562EF3690B7D52A77ED07B39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 2.1MB
SHA256 a111ce6c59b0c012a4264e3d2388f12e46d625b811d17fb8a713a736d112a613
MD5 08f804f3727de01da9d183108212a3d6
SHA1 3b4b72fac5a610c3ebd370aee190c57ef47eba14
SHA512 f4d961a2fb29f1b48045a31a5911efd8650b5c28b24115884a9b11a947dade3e2f50e18bbba55c49120bf7a9f475341377717ddc2d378e44cfbe660af21fba14
SSDEEP 24576:6uTG5mENN37FoNvMc4bRZGY26UEU3RyRPW+uSmS86IU8Gc7QGsVa4i6h27d3WlN:JXEn7aN7Y2fF8FhmS86IUJWQn+6h27d6
TLSH
T104A5AD07B39940E5D059E0B5CB56C52AE9B2BC010B75A6EF0B90B7192E77AD46F3E330
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

RCXA999.tmp

Path C:\Program Files\7-Zip\RCXA999.tmp
Size 740KB
SHA256 dbb5dd3ed98e4c29acce52d7b2ee08cf837c892e4db9d4c14f2b64d876408924
MD5 fe287969117533c64c5ae2c3a570adf8
SHA1 103eb159e9e6130498ad96a5d7b6c61d2147ceb8
SHA512 f38fd6260b55c48f7958977370aa44cedafbbda19dfe83775b080b5a6b56504cd2dd5d5e08ad84daf8bbd9b17537b31ed5c72f6f09b18fbd34fa3fd1ab428b07
SSDEEP 12288:Lgd7esV0SWOQcuD7bIwPc4CufizgAWtorUxIn0vDVw5ifF:LgFJWaWdcHhRU60vKKF
TLSH
T18BF49C8F2584CBB6F11E25374A5E4BF96F919A104F8A4F63A1A4772E0BB0E1078353F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.ico
Size 3KB
SHA256 2a5c5c2bc95c18eded222f0a38752717c1a6ad20e31bcda6472bbba77ed22fe4
MD5 de1dbafd46ca8d953c93a1c89766a8c2
SHA1 41ec8c2a24317bba7a64f4b60341307033edcda0
SHA512 06a89f154036252f396a9f2ac515c5e03e8dd54eb7ba6c3bd0159f693d85846c4ba1b29c0fdc83f14d8c9128f18db3ee27c73111891dc66f81d4fd14361e6ce2
TLSH
T1D861565C04E3ACB1D6E548B83235B2C460D88A364424C867A89D7AD7CE7D8D473DEB0D
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

dbcicons.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe
Size 823KB
SHA256 fae65def2743dcf85c39058e2abbd57f042d3b5adc6b485a4fec08bd9c471b01
MD5 26cdf25cf6bf76ac3930c2bcdbb605db
SHA1 01134a87e4cf98946cd82a73db7ae7e36ef499fa
SHA512 3c47c91e7c14d8c729f10ba0b04f8a3c0e3fe965af2ba62b5c548c59a919b3a20713796667f08978e054bf0f30679f749c3d46ed3c436c73e6cfedf407ffd7e8
SSDEEP 12288:+l+N3Lua/9Gv0juvyo55olcdfbJhoB1xAHw5irqWtEF:+l+p//n6vy9cdfnKKqfF
TLSH
T1D2059D8CA1EAC5A3E59D04339CDEBBB11A564FE088431A6723E47B9F587C6191D2D33C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 1.3MB
SHA256 362e5582d014026ecd3d324302e94aed83a97b2425083f55a733a5281b3abc4c
MD5 7cd7a8cea21cb0773e145c1353a0a79f
SHA1 05a686fb5424b5b79416a127213b04e325bf3bf4
SHA512 e38551f7ab6993534685f8006c51a331b9036b530198d9e9ca0b181baf22c50c1aa157fcf6e310dadc2fcfbc98ab92395e46abd8bad9ed3ec035dc509bb1594e
SSDEEP 24576:OOtI8KSAFQgpGZX/uF5XDe8NsfhyHm39PZfePv3r7fm6t+jqp+3l+zCM0D:OOJ/gmfkgZ2HbbZt+jqpQ0CMO
TLSH
T14E55BF61A0CEC431E6B402737D6C8E392D68A21D1BA85D9AF3F4E90E2D7419717B7336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
Size 1.3MB
SHA256 8ce1306a94a630e9697d7a6c84f021e26530e2592d8eee899dd88c686584f852
MD5 907843f2216c1c7590349037948ca91a
SHA1 4a2f2f91813032650ed825d12e09a8a05c8e5377
SHA512 ae0ea0ca156247e27d3c95128e2b5db93998b0c3f31d5931912e8f2d48b49ad9fc220ed7979aca435c781de8e8f49147417f4e0a725234d73e6d4952124caabf
SSDEEP 24576:dI8FmTobbeNVLRO8it2aAMysZgjS1hqgSC/izJfojymk4HM5yJ:dIXTo/Gu8K2NRjvQotoy4F
TLSH
T1D365BF2164714827C1F10672AC2492747D7AEE7C6B244A6F92ECED1D6EFC0826BF7271
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x64.exe

Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
Size 1.2MB
SHA256 40dd29320ac1d90b61150df376a36d9349879ce0eb96f7b75308dfa9b0d4034d
MD5 6153baaf77cb1e1799b80c207978b795
SHA1 c768c08e9560bffa90af30d3468a668680fec906
SHA512 8c5c780c7fe4c824f462c27e5b49a686b8b999b5804fd8491c3748a1983ed99d15ee75a5fe74688f7dc0b90c745d63e41b0f79965fa0751f6afffc79931a7a40
SSDEEP 24576:5iSuJ4/qWJakcj0gm9j1MYenGJiKEbXWtfOkUy:4FJ46ky0gXPnRWtGkf
TLSH
T10445D0257681BC31C17504FA780E91F0BF3A9829EF09884B074E571E39790966BE6B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveStandaloneUpdater.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
Size 3.1MB
SHA256 c1a5a9d10b1ed927ca58e446f9cc5189ca7ba15a29e173ef7e8b9ddcdf35af9b
MD5 d68de77afc7faa92b1a5068b92a4a088
SHA1 6b96ecf0be4cf0a3d46269f87063411aee640a25
SHA512 96a4245959f10a62b2151e5ffd7c32dbd039cdf3fe1715c8c5b92332aead24ded80cde92e678e2c2dbeb53403de6369e64cf3444e36804eb71da0befb1ba8f85
SSDEEP 49152:7SlOIxWat8NVAjXR6t2jgZ8tzPFASjYhMleFLyJwXP9L8vzbtu14BCNbTc7FBHG2:t5nAjUt2jc8tzhYhMMFW8LMprG2
TLSH
T1FCE5C021BF85D032D2B302318EADAB79D67DB9715B2180CB63C4575D1A709C27E3AB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
Size 3.9MB
SHA256 99e789530f36aad05f002ff2ae822d162ae75028608ae1172e0b6c41fc41c57d
MD5 22fa9b8e3c8977d493ebff12c6d9ef67
SHA1 e25445ccff851a409a7350fa801ed38f6bc5f8ce
SHA512 37b84f31dcc7877ae0ac66a71b9b3f9c60115ed0852483bdb97e6757a0d3d71dae195772355d6cba03b17f2f3b8159434024e98b37df4d65b36577732f25070c
SSDEEP 49152:D18MAFpnnJH9BUfKn+95lRVfAa0Vg76Lo2E2T8avTXT8avTl2y/B:qMA3vBUGHoC
TLSH
T150164903B19948D9D299C134CE06C131AB21BC8D4BF6A5FF36A0761A3E77AD07B39B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-27_bfaeda566725fe118bfcb58829798335_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
Size 3.2MB
SHA256 8086309f6d09958a5235af461b71d21014ce778d316e5aa625c9f176e7543b47
MD5 b80a8229dc8d29fb1bc154bbf76fbfd7
SHA1 ea551bcf559845fce9da3da33e026e5b18618971
SHA512 ecdafa6f191b07cf77874da68e9235b9a7cb71f10e0ead2f27e971055b690f61242c58f6359f08e7230790231f807e8a82d70d3cde27a28fb52708c69f61a049
SSDEEP 49152:D18MAFpnnJH9BUfKn+95lRVfAa0Vg76Lo2E2T8avTl2y/B:qMA3vBUGHo+
TLSH
T157F54803B19544D9D19AC134CE06C132EB22BC8D4BF5A5EF3690B62A2E77AD07B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1700-0-0x0000000000400000-0x00000000004DB000-memory.dmp

Download

memory/1700-1121-0x0000000000400000-0x00000000004DB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads