81a643db7481647114180e3d61f712a05e98369b2f85b56d2c3bad20d59fa723

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 1.2MB
Sample260730-2mcdysgg65
SHA256 81a643db7481647114180e3d61f712a05e98369b2f85b56d2c3bad20d59fa723
MD5 1cbc5bc902bf186bf7b52a87994d2074
SHA1 883db2eb9e6b4d274e2a9b4f3da5863085155b13
SHA512 bb4f8335adda16b1aab7e1c80ab6ae74b2e7772976e676ed7acd923d0c42f80c511b2f3537c79d79260833a22375e43f9577747c8d1196985adacde6807b1ea4
SSDEEP 24576:61IJfb0RSc32H41kbQ43bRwk3Td9CHKy7GZO:qIxb0Rn3c4d43OuTd9CHKyao
TLSH
T11245BE94B2E895B3F0768578CC6DE2919BBEFC964B218E4F0224355D1F336905938BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3060	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXF728.tmp	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\keytool.exe.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX863B.tmp	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE.ico	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Mail\RCXCBF6.tmp	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe.ico	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX916C.tmp	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCXAF48.tmp	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.ico	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe.ico	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCXAA1A.tmp	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.ico	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe.ico	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe.ico	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Media Player\wmlaunch.exe.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCX9A50.tmp	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe.ico	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\RCXE6F6.tmp	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCXA0BF.tmp	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.ico	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCXB160.tmp	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX88D3.tmp	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.ico	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\RCXC943.tmp	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\RCXF3B6.tmp	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCX99C2.tmp	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\RCXB69F.tmp	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe.ico	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4524	javaws.exe
4524	javaws.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5112	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5112	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 3060	5112	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	86
PID 3060 wrote to memory of 4524	3060	2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Users\Admin\AppData\Local\Temp\2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Program Files\Java\jre-1.8\bin\javaws.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

arh.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
Size 852KB
SHA256 c660e6441f1f2402475bc6bce36879c0ef9b1b2290213ef3c59c22b51902d626
MD5 3d5636e885231a5c2c0b59e9154b9130
SHA1 9941b903aa5ada03c141ef3d91bd100c4f0bb912
SHA512 203c78d28d0c933825a1bcd19ce37835afcd195f5a9bc66a4e3ec23f15bacafc5fe4c01b569e69dfae9e044ef279d52fc2c5da43c40f31c7a03391cd7b2f4405
SSDEEP 12288:7qAyf2Q8HhCdLnGITRQdwp4rIf571w5igzYmIjE72:WfChw7GI+AoIfh2772
TLSH
T1CA058C3DF457EC31D1AE01BADA8695E42361AC6255E6C14F232C7B2E1EB423D683F271
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisabledGoogleUpdate.exe

Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
Size 6.4MB
SHA256 3d9105d4fdf34388e8b95dc16c41b8880e8e5cd47cbbc1b1dddc855a45dc42f0
MD5 94158f9f368585b331379f372456f321
SHA1 adc5aa1ba5eca4cbdf49af060f2f1ef3bdabe485
SHA512 c24f95740577ba35c33135b94e2717c77185b01a055582fe14b403e97e384eac5552a3b07bde8da794050dd9e38d359a73c04395f6c017027c3a6c56d0072bf6
SSDEEP 196608:yujNUYog1P9fIlOuz6IgF+I3m2MXP6HG8Qzb:x9ognqO86IgF+qbM/6HG8QH
TLSH
T1E9668D23B5E04035E5F73275AC2C673A59327FE29F3145CB86906C982FB46E2253936B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ieinstal.exe.ico

Path C:\Program Files (x86)\Internet Explorer\ieinstal.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

msedge.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 2.2MB
SHA256 9a79a11c3ec41f4bd8f2f68279cc49722d9de7b16472a21f8d7299f6dbbe093f
MD5 89f59a756f8016c2269668a55aa9556e
SHA1 cf5b57b4f67c092a0c584c77e789f73350955391
SHA512 a8eb9114e3ad2063fb20d7d6a96ef7396f7dc182a3dbd98fa7d3c7084e7bd28f37c8964ffe6f71567e9d02d3b75080b56c06240e933074da91439069aa9557f0
SSDEEP 24576:THZEHaPIHyrLCI4KMLxQOUJtUp90v1XFf3ng7d9+1UXJwhXCTi2Qlkkkkkkkl0Tv:THZiHgCyEQOitU/03nmdXa5o5QPQ+
TLSH
T1F2B5AD17F68581A5D47DE579CEFE0731BA717C624FA05ECB02907A292DB3AD00E387A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 2.0MB
SHA256 1849b4478516068218cbdec694bbbcdad5ab683295bdc4402157832452414147
MD5 1da6d5f3d0b66ee4a3838c7a9ef5721e
SHA1 e82b9be6621743f4f84ac9c2c94790c61958a7ca
SHA512 e288dec04e0cf14504aa4473b593f527ab17b76684c73635b54c97f5d09c9135ea7602ab860ffb3a4c19633011ca946ec6f5eb48b81e8269db23b1d36933b400
SSDEEP 49152:1xvNaWt1Ub40ctru0WjiMgCv1jn1ChuADSi:M8FWjN1jo
TLSH
T185A59D17F29A9295D01FC0748A1A4179EEB57C82CB2076DF029877891E37ED86F3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 1.3MB
SHA256 4ae94394d8f7e6114f435677de4be69eb226f5f4028918af9600a437bd5271ba
MD5 cf789caf851c380f1e873a32ae864b1f
SHA1 cf5b1fceccd152ed46a057739b42c3861175b26f
SHA512 ef7e0318b1e8c0d4c9e09d18f998c1b47ef507d69c37dfb768fa76c9bf90db8de63cf6748ea1b616fa94edc204f76d1c22b5c15be82e50a7c675202279cec285
SSDEEP 24576:epneaknIHizqRo1XvbwqpaaX/gk86n9kAJ9tA3L:epn1iWo5TPNtT9t2
TLSH
T19F55BF05728782E8C06984308D4E4591DA75BCD71F519D9B2A603E79AFB3DF8AD3AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe
Size 2.2MB
SHA256 cc3f04b829335f3858fdc9cd6703579bbb899c7e50ed892025df26118017c6a3
MD5 a08557f6809a92775e18f485d100da6d
SHA1 bad6893104ce309eaa6844ff5fdfe26b26718cc7
SHA512 7dac5bad6875e381696662f7e04a3423283f0062c5e653e6c859017f154584aafa2edfee148aa327e1848041a04f54921b2e37860103f2e314a0ad63c7e88477
SSDEEP 49152:xuDn+r2wB2iHBfehjvHHKTdfxINPEt99G2Bo7EukU1a:xUn+r2wvFyjvnORmE
TLSH
T1ADB5AD13B3D890D4D0A9C076CB86863DDA61BC464BA566DF06D0BA493EF7BF05B39321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.6MB
SHA256 22521bdc848baf8b524607c2089fb27fddb0ed402c8d99250850baa8f26d9255
MD5 b5ceb8bd2be2ab62adc595c9bad6764e
SHA1 3cb63c607ff1ab86cd0fbbe93bb030754c99d74d
SHA512 e79361a3c08f95576b17d08a5a2bcd6c86e84f00ea198f35e99f53145b016d5af46425ac5cfd0839a3446892677b82b3d350f5a889bf11a41af1e0d528dee715
SSDEEP 49152:7fGyEEQS2FbkcWvIZGu6qG13O7Q7gLYduZrSdHBAVfb:7fGyEEQjFYcWvgR6YjwA1b
TLSH
T1CDC5AE07F685C0E1D01CEAB8DA768725DAA17C584F2059DF03907E592E7BAD06B3D3B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
Size 2.1MB
SHA256 6ed0d3976d674fbaae445799a55bcf14370e875de7268784ba1801e7e26b1dd3
MD5 54069c2a435532b070030e3847138763
SHA1 61b7f73a48e93f72f97d7323f39ec280b667b7b1
SHA512 c0f2248db7ce71bfbcaaa2f038ae17597ce94ff9141482f657572335189d6e39210f5d92385db191d976d18943771b51b1bcf905a7586439159073ee938a4d25
SSDEEP 24576:W2I7YluUFVnsGVBI0YZGY26UEU3RyRPW+uSmS86IU8Gc7QGsVa4i6h27d3WlN:WB1UzsmY2fF8FhmS86IUJWQn+6h27d6
TLSH
T1BDA5BF07B689C0E9D069D478CB968A35D9767C420B25E6DF07A0BB591F77AF02F39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeUpdateOnDemand.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe
Size 866KB
SHA256 c9bd6b8d1a5680aa1bca2f99e28964f426e00aaebfc1dfc09548078d703ebe10
MD5 8018aa5de3984ed37de4121c5189e67c
SHA1 665d5e781e75a5a1df4536f362f837650d87e3e9
SHA512 c940db3d13bf228c25bfafb76ed92a089f475154f089cf6705cd7b67b8957961e33f1aef243635eb7e49e72c78c3296725dc451f400872abf4f45a7ac1a370c1
SSDEEP 24576:X1tHuuAcW4rt/HjPlOgjJQ7ZnmObBPzBAU:eOW4JfhftumgBPVAU
TLSH
T18F15AD86F6739D52C6F138305C6D6971BD22AC4A4B010F67E2AC352E2E3A5197C3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe
Size 1.8MB
SHA256 0a4b213abb3c006c9417c951972cb20f1315df2035a75abea19bdf1912dfeb18
MD5 66a296d63d09ba5f04e3a8c0508386b9
SHA1 5c3c8c568fc9140bc46ecc636ff3e5454310a749
SHA512 e6c5c6861c8d86366e45c42c7e770c32cd1aa1e0de451c61f2ca9c382a2e33d218f3338614e10aa96c43d9310f0202f2bfe04ec3b761303756828d9a1b3993ef
SSDEEP 24576:uSch63K2K7Us2KXxGqbGYmWHHo7fvqcXFudDJdWQCkvjZQqg+lIVprS7:VcY6d8KkYzno7fvTqJdbPrCx9pG7
TLSH
T10585BF8BB6A941E4D06E84748B9BC531D6727C524BA595EF02CCB2591E3BBEC5F38330
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 2.1MB
SHA256 002187a68a332661e03fdd299792ac90750ec017cee80054a0ef7f546de95a61
MD5 0b38c17509cb73f0454486ddf18380e9
SHA1 420cb9e5555c9a481fb73fd003bc5f7d94ef4b01
SHA512 323332e96a7cda30aea7f165fb922abec9cad8a72c947ab48ab3f69e65f3b24d357dfdb5e16e54a949a93431e48694734e37998339b53b656c68d5ad817bc4e1
SSDEEP 49152:sUrE1DvwZ2XuTjPb33g9gZLfCdW9HTlXrk9dBB:zgFI4Ds9Ol
TLSH
T194A5AE4FBA9680E8D099C4F9CB474536E6617C100B29B6EF0B507A491E3BBD87B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 4.1MB
SHA256 d5d9f8e9f2e2c573830684aeb0ecf82d1532712bf5153f55a52907cbb660ce14
MD5 a0389a7fa8f3e62c1f943d133d6de146
SHA1 bde0bb30aef74422d14a7c212d189e368567a78b
SHA512 5c7f53690c10b043dbcb307bfdb05690552bc01d3496c5e67b7ab9e26067fe14d7b43bea3ab433e1d4dccf5176698717eefe7e3140e673ba9bd41d2c6cfd1474
SSDEEP 49152:FxRsc5uZgk07G0auOj85q7aGScYbb6YErz7z4AkOuaRoBISCaQZCLlrrZ:Wcjo/Yhy8OnZy
TLSH
T1E2165903A29900D5D459D574CF4A8223EBB27C8D47F662EB3290B6D52E73ED47B39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 2.1MB
SHA256 39098827e996cfe3d8fe2d8742327d2a4bb5a9a1d96cbe81032ec28357aa5c27
MD5 1fd1cda2983e2d083a5d71f9628007ab
SHA1 d86b844932164aa829964ac153fc0c9a35969821
SHA512 e574b1b97717acad0abdf5af3cb58ab636b799191087e748a2bb54ad35661470542a6ce20ed8b76052bf5c91a48f14d165cf8c65f870260ad5cb03df98e8f89a
SSDEEP 49152:qo6pRBFSImmZlEY2fF8FhmS86IUJWQn+6h27d6:y6TbOjjsts
TLSH
T18AA59E07B39440D5D02DC0B4FA5B853EEAA27C554B34AADF0A907A492E77EE09F3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

RCX74ED.tmp

Path C:\Program Files\7-Zip\RCX74ED.tmp
Size 764KB
SHA256 0825dc917c2afb0c130b87e6413378e0e86290a38b83ccd0b7b663707af63fa5
MD5 8b8827b6ec30d4ac00a71b1294cb05d7
SHA1 d06aca7acb23a58a8f784024ff1f8bcb5f9adf86
SHA512 c0fb72f608016b01d61de7c12170b5cac08d01c001badf442201eb0703a6c99d25d017bb33ea749b0c39731eaefaca3f5197a117d07e8e66d222ec30b5fe7c4f
SSDEEP 12288:6kiIJfs6JyRGjeBbQr5ZC2HgXfr1kqekf43uw5i1Wa2:61IJfb0RSc32H41kbQ43bRa
TLSH
T1B7F4BFACB4A9EAB3F40804B8894DF3D16FEDDDD68A161E1F542861AD1F7B81122351F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.ico
Size 3KB
SHA256 2a5c5c2bc95c18eded222f0a38752717c1a6ad20e31bcda6472bbba77ed22fe4
MD5 de1dbafd46ca8d953c93a1c89766a8c2
SHA1 41ec8c2a24317bba7a64f4b60341307033edcda0
SHA512 06a89f154036252f396a9f2ac515c5e03e8dd54eb7ba6c3bd0159f693d85846c4ba1b29c0fdc83f14d8c9128f18db3ee27c73111891dc66f81d4fd14361e6ce2
TLSH
T1D861565C04E3ACB1D6E548B83235B2C460D88A364424C867A89D7AD7CE7D8D473DEB0D
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

dbcicons.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe
Size 847KB
SHA256 f94677fc1eefa186e4524e053450dca8fded09f6b7fdc1d02b3142ef32f62ca3
MD5 e982f0ee142216f824fa20149a6a8f0c
SHA1 e9c69555faf8657ee9750bc1cb1ec635eed50b8f
SHA512 a46885690ac89933607c9adb8f237ffdce687d9d7bba4beda854f9f07bd519d52887ca69363fa17fef35dfd0eb988147933e404e81d0d7e6491c949145bba360
SSDEEP 12288:l0QahebmhDjor0El48DSxuhUMAlSr2mvU7SQg4n/agNZnjrTPw5iWMcYF:KQa0GDjPu40SxuDAlSrLvU7SRurTwRYF
TLSH
T19B058C857083C3DAFA252BB04D4A69B02B457CD53C0EC73B99D87FE9AC75A196631C38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 1.3MB
SHA256 76788a4e0b57e93b64601930cead31662b6aecdfb48f8275a762dec5a7da16cd
MD5 1850e927c8889b8ff092e95b06798be7
SHA1 f874b921853b7f7fb3d03dea610b9e8d13b40af0
SHA512 6def9a4e29f283a7df9701d334c706f981d538741366ce39e82f0aa7fd5e90c70c92248c87c2ab3166f8377db19d756277a4125f0aee1ecce9df97b1e1625302
SSDEEP 24576:2aOM59UawAwbQWEcDfaMSjBam39PZfePv3r7fm6t+jqp+3l+zCM0D:2a9oawAAQboaMSYgZ2HbbZt+jqpQ0CMO
TLSH
T1D565BF71A0624077DDF005719DD8E6742E2EAA285B548AAFF3D0BD0C3A7C4937A7B271
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
Size 1.4MB
SHA256 f2504ab526f67b28ed6e3da0260fad986ca0581cb0e64841647580049e6e13db
MD5 bd3856fa5be1df12438d6f308f9af47d
SHA1 5fabf32c8699df0ef8925db13ab045158dc88ba0
SHA512 9b745412da21472889b803b2211485d777beb4cc379bf76ec526cef87a53be8ff18da877b6d9a5de7c6739566a4a66d3140ac6f3ce886a0223f658b355c48c23
SSDEEP 24576:RmxNz52HzeTq5HzcyqaysEcmRtW7MysZgjS1hqgSC/izJfojymk4HM5yJ:RmxNdwc6ZqaHRjvQotoy4F
TLSH
T1C665AEF26D688416C3B511339E68D2243E6DDC1C5B904B5BBFECEC1E3AB80467577A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x64.exe

Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
Size 1.2MB
SHA256 de62a5ff9a1d8f8270881f0ad85d34ec465eaa3ed2bbe0053509bbf50bb53fcd
MD5 a054b9cae478238e77cb22860f5e2e3a
SHA1 29f9658e83a9fc445f69d3933a133029c6f4954c
SHA512 a79db67871564d26946b24cc7c29e02861501694fce10b1bc6371ed129ff214385fbcaadec68162ebd3174d4b9b1b8180cd0d915edf4616be1f005067507b1b8
SSDEEP 24576:9FiYb5NxcDJ14fCD/X2ILUMYenGJiKEbXWtfOkUy:9FiYb5vaGILDPnRWtGkf
TLSH
T18745AE737590D532D8AA0233FD198C72ED3E58188B04457B57647E2F286D092BBAE3F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveStandaloneUpdater.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
Size 3.1MB
SHA256 c71fe364f95fb8b84753bd6e26875105c0fb9d2ebca0596c35b89ffc8020be59
MD5 7abe8d7afb34e8833bdd38a05f435ed8
SHA1 320afe371bf3f8411f1ae200aa8b9ae0f155dbd1
SHA512 eb6ac0a3e1a4165cd4921069634cdd014b65637ff62686e6a414ed2ad6ab65764bfec740fe476f304a6c4320070fe21d91d1aa328d26ba0ad0d353c333fce669
SSDEEP 98304:BUjX9421nAjUt2jc8tzhYhMMFW8LMprG2:2N42aptNAFWba2
TLSH
T1CBE5CF11B680C033D17311348A6DEB79667DBC71172299CBB3C8678D1B7A5C26A3AF63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 56KB
SHA256 95fbc1715d5994bbbee342f7f1d9afa3fe780230f7c1622baf940481ef15c9b5
MD5 ea13e31b75121ce5603edd223f7edd93
SHA1 8ddbf99c0ce9f4ae2d3c684202a6fd19befce325
SHA512 9e83013504be0fe34c3cce97ded00fab0769e4a430eb1c0989aac9aa12a53628a1a5f4373b01179646ab6b3887f3ad7498b40e38b3de2066ad8111039301d226
SSDEEP 192:oGayUsWijj2l9lClShPdBL0DzoIfs21lgCOuSFnb0M/q4ZY:oGaSu9QlIIfZ1+COfSQqb
TLSH
T19243B4A2B804DA04D9095C369FEBDAEC7231BD16DE6B425335C1BB3F86771C10E2A685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-30_1cbc5bc902bf186bf7b52a87994d2074_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
Size 472KB
SHA256 22c5c2d08205a58be15c9e6f4cdb2887978a7dc192b3a93d00d84dd596c6951f
MD5 2a73a9a6fcf3919ba582d5c7d13f63a3
SHA1 bf329de64ad88b3d7790c19faf460193c68bbe79
SHA512 95a44b5f06b88c6d5e2003f908d44d09f5c25318c920496318c5e49cfb49c41dae17cba0457ac629659a10c1ec33c4e5bc5f2786b159685da218222d675f1224
SSDEEP 6144:ViYB2nEaKTRnXtTkCgwCzUg/HpjN4IBwu7QTLbpqmHdIvW:Vi4e7WRdTfgwCHKy7GLbbdIvW
TLSH
T1ECA43A90F3E414E8F0B79A3589764511DAB67C5A1B71CE8F03A8661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5112-0-0x0000000000400000-0x00000000004E1000-memory.dmp

Download

memory/5112-777-0x0000000000400000-0x00000000004E1000-memory.dmp

Download