f1f8faa3429b94c84051eb3022592bffe1642ce8ddc3e13356ac2405e2aa6228

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 1.3MB
Sample260730-cd5lpsbl4x
SHA256 f1f8faa3429b94c84051eb3022592bffe1642ce8ddc3e13356ac2405e2aa6228
MD5 31c925444a55c7e4667ac43a1dfce472
SHA1 d8f028fe68dae25d30928c70bffc95e35c6a13b1
SHA512 817d2bcfb48178857482b3e7d4331c9e999f09032005c7ee9c987c01da69e809454c7d2e142c2720215022b9c735103ef8bf717ac3e81077219e760e8a8bff58
SSDEEP 24576:xuEuuHFk8jP/eIhirMSKrsheM63Td9CHKy7GZO:D1eI4AtshaTd9CHKyao
TLSH
T10E55AE63F3E440AAECB78934EB254551A7767C0949718B9F43E429CD2EBB68048F6F31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1276	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe.ico	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe.ico	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Windows Mail\wab.exe.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCXB859.tmp	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\RCXD8A3.tmp	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe.ico	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCXBFB3.tmp	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE.ico	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE.ico	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCXAF60.tmp	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\RCX9FD3.tmp	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.ico	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe.ico	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe.ico	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe.ico	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe.ico	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe.ico	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCXAE24.tmp	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCXC17F.tmp	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.ico	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Media Player\wmpnetwk.exe.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe.ico	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXA368.tmp	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe.ico	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\RCX1AC2.tmp	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCXBD0A.tmp	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe.ico	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCXD401.tmp	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe.ico	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
436	javaws.exe
436	javaws.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
944	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
944	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 1276	944	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	84
PID 1276 wrote to memory of 436	1276	2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:944
- C:\Users\Admin\AppData\Local\Temp\2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Program Files\Java\jre-1.8\bin\javaws.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

arh.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
Size 920KB
SHA256 d4e73c9fea7d18e1ec294adb7189dac40555462fa1262fd9247e19ca09bab0e8
MD5 82935ad11fae6d276816a62fdc3eade4
SHA1 03c531dd99a780882e0f9d478d71070b380d0664
SHA512 d5d6b3cfdc2377ac0e0b2b1ea00041ba55231500fcdf0a1d0be8fa3cd9f8be3d6c29e4f0ed52afd5dc43782629895bb7a78f522593cc5e384772369e8577d48f
SSDEEP 12288:hjtpZcCiYu75B50KU0dtJMGpCrz+/6OF/rw5igYiuEesKYmIjE72:hxgC1IFu6tPCrzaOjbm72
TLSH
T17C15BE897940862AE45F03F04D16DAEEDF2CBE0E99B5010F761926CF25B737887712B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisabledGoogleUpdate.exe

Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
Size 6.5MB
SHA256 cc6262f50394cbc0f9a360ed17b11ec729705a32efb446f556057ba22a451cfa
MD5 f19dce6a8606d74fbb65e4570571b16a
SHA1 94dd67e09c8617f0c003b0c9edaea0e0e40bee57
SHA512 c5501a62c04b53e97d55ccca8acdbbacbbcdac4b1a5fbfb5e551dea4ab310d88b5639d34cac448dc1c0fbe03984e777c44499a790392ba661658f55304e25db3
SSDEEP 196608:SqGhrXog1P9fIlOuz6IgF+I3m2MXP6HG8Qzb:DGhrXognqO86IgF+qbM/6HG8QH
TLSH
T1AF669D23B4E08071E5F732756D2C673959327BA29F3185CB86A0AC942FB47D3253936B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ieinstal.exe.ico

Path C:\Program Files (x86)\Internet Explorer\ieinstal.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

msedge.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 2.3MB
SHA256 9a557ae7c0f4dfc5523033e7911de2834cfc3ce0376fefd5f6f0192fec011f0f
MD5 d18415c164ee6748516e6d7baa26841a
SHA1 9d81b0786bd4ee24477b9698a9855382af4b77c1
SHA512 1d680178effa8b7bd60ee2f2bf1917cccfe7d9632fe0954709d3082e979a9af167837304e3c05a4d2201cade92f58c53d482dce022fa312d938f683c3904c175
SSDEEP 49152:Mv5yZa5cM6sqRwTa4QOitU/03nmdXa5o5QPQ+:Mv5yZa5x6DRbU/03mdX+PQ+
TLSH
T139B59D13FAED80A2D05DC27CFAB64B32D6617C715F205DDB0690BA252E77AD05A393E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 2.1MB
SHA256 984b4bb2e9dc86001d3386e7c9b71476cb3e9e9ca8ed7d10a956cd1e9c605637
MD5 a39027e8ca70d4b9dc652720d3b0bc81
SHA1 0e43efe0613f89d35b80e7dd701285a66e082397
SHA512 03f814166d50eded59002eb503207a79f5f0c1a97136f7208252920bcb5160030964106817edc104122f76cbefc7f8fea4435f8d6d8ddd1ac610b0a075a405e7
SSDEEP 49152:mVEi14MO4+aQJuXL/d316X7Pru0WjiMgCv1jn1ChuADSi:mVEi1LOPaQJuXL/J1AWjN1jo
TLSH
T1ADA58D03B69B49A4C0ADF93486164276DDB17C819F3656DF069C760A2E33AE4BF3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 1.3MB
SHA256 4d1618d4f158be49178afcb1b8e1e18c1314f1cbc1ec61b49b21b3e5575974b1
MD5 d4b7406bbc6b738eb5948858f33e1db2
SHA1 8ae057bac466d799b8592e69505c546f9c20edf2
SHA512 32569f06c30a3c7bf4891dec3a47c24a96f6a4671fae65200a98616c4cebb7045b480b19f784d97eef1bd9fec90400ddbec48f192b8c032d6971a973594b7033
SSDEEP 12288:uezjzjJs+1gOGNUw6W0iILw5i7GDGol1S86nHrUA9HVlK8SQBJ9t4f15rL:rjJs1KwbNI83pW86n9kAJ9tA3L
TLSH
T10E55AE05B2D28E95C16E80F449637978A6617C534B367DAF43A0622E2E376DC0F3DBB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe
Size 2.2MB
SHA256 eefd6d9adf8b588157b6963e3b6eb988718eb1d7a53540cc60fa6c992c8ad390
MD5 76c0ebff0edd090d7a279c5d5201e0cd
SHA1 800fab5dc3f9351f32879d832481fd6dc4fc2f78
SHA512 d67961df21ef4d63a6d0f83690903ce6719f416977556e5f6792f4d6af7e5804986d567b28bd1ea8aa6692e879757827c00c381b7be247e63fb8126c182bb7fc
SSDEEP 49152:AKa/pq6SfehjvHHKTdfxINPEt99G2Bo7EukU1a:AN/EyjvnORmE
TLSH
T18CB57C13BA9844E9D019D178C7428565EB727C504B38AADF0B90BA493F77BF45B3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.6MB
SHA256 318da3ad4798b5bcb567f19349e0de4e5b1dbab7d6b96b21e10e9c3dccb0f386
MD5 d26bfd5ed96dca5ee785bca1d0b1267e
SHA1 4108d978c75ad3950faa6d599bd710b4dec02391
SHA512 ab8fccc5e7528372b9c3bf2cf9e6298b3351ab44edf610a410614dd6b799a8a6eff6443d5bfa3e0b8782c67369f85a9c979a1009c80e14a736882c6341337491
SSDEEP 49152:CwXyzQhpWR4ILF5VbetHTNmSM4upZGu6qG13O7Q7gLYduZrSdHBAVfb:CaYYthNIzR6YjwA1b
TLSH
T1F4D5AE17F6A640A5E0ADCA74CA268B25D6717C1F4F2165DF06A47E953E73AE00F3C3A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
Size 2.2MB
SHA256 b8371a08bb8a41c806cc9cbec53da9b3cd848b9211da6253fdf3cac6fe870bd9
MD5 25382ea7a4b1af815786ecfe2a47dea3
SHA1 a116f89fbc7fbf3df403751fa08199072919cf3e
SHA512 e748e4dc94775b971a5b62e2168d41f712944b41ba2b1b723e86e306298fef19b6ad5c5ff5e8cb24a7898cb050ad8e64da59372ecfa72d0e2f23199df165f023
SSDEEP 49152:zYxzXLdvIYDY2fF8FhmS86IUJWQn+6h27d6:0hLlDbOjjsts
TLSH
T12CB5AE07B6D940EAD01AC275CB568635E9B67C230725AADF07C0B34A1E37EE81B3D764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeUpdateOnDemand.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe
Size 934KB
SHA256 8cd608d0a0beee014b1bf2a909356e40663a6d929bdf164c84b7f7d0a6daee10
MD5 1ef66b3f7d6ba3f4ece198f11ddddeec
SHA1 3fe5fa8816a33cfe2e1cac08169faba63011a1d5
SHA512 5a8dde7f471283ef9c3ecb3cd8db88b7a5034e6babd1009397f0c73a834dfb7095e69499519a9687a36d5bea19de0eaf53c29224b26522fb771baec194fb5eb8
SSDEEP 24576:LnDTAGiJWhS4giQixp9hOswE05dbBPzBAU:LAGicSo/pWsJGBBPVAU
TLSH
T19915ADDEB1C09146F228C8FEC9D552AE75BAFE900F11CE4F66AC6A5C6C30949CF65630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe
Size 1.9MB
SHA256 8eef46b9fd391d8ab3b98cd4d226ece408aeb142d6e6cd7f54504443dc2f96df
MD5 e0fcff6eb0ab3ec195f4acef33bdf3b8
SHA1 3548811faaa8feb246dd60b34cbdf3032454711b
SHA512 e3d0bbf13794168bf6a16fc5a427f72ae4b7e050dcfbfd1f03beed6b242e2e3b76c7258c8d423bfd730ac94e4e0c747f8bedf68b143638b43b024c1c18c871fe
SSDEEP 24576:7SzKteh/bAvXq9HjuiDO41f4YmWHHo7fvqcXFudDJdWQCkvjZQqg+lIVprS7:gIeFQa9DuGhSYzno7fvTqJdbPrCx9pG7
TLSH
T16395AE47BAC440DBC02DCA70C65A4771DB727C720B2466DF03A8B6591E7B9E86F39329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 2.2MB
SHA256 babe8265a38abce2e471b36467c53ffeb566756fb683ce64b1cb7e3e544aed2f
MD5 a926485d3679238fc4a377cb0e85aca5
SHA1 8c04d8451fd4fb8b9a446ca5bbdd8c44b4bdc954
SHA512 44a5ada6bc24573960090bdf61fbf1fd4f324568793e61ef60bacf12d95e9a6cd724664903b09b5e77403f5006ff50af1afd94514a2e9f23687bf4c6807cb8f2
SSDEEP 49152:RyzyjSybDvwZ2XuTjPb33g9gZLfCdW9HTlXrk9dBB:ljDI4Ds9Ol
TLSH
T1E9B59D8BB6C451E8D079D174CB4B8E71D9A17C820B6865DF0760B30A6E77BC86B3E361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 4.2MB
SHA256 a4bf9618595f7aba05f6c4506d01c75cacc4b637cfcdab36883e4ac694b1b110
MD5 dfbb708547615b0c2906c0434aeb938b
SHA1 294e67f78bbeea6a4ec238b8130a66b4b03743a8
SHA512 47a48e7557305f3ae8be07d1c6b3a842c51bdc43d5dfd072541ada5fc9e4895e66630d23dc63256631f6ff38cce1ada74afbe90a0f6556ade1ce0ec0bbfe2c78
SSDEEP 49152:drTngwmUC+BEGNuZgk07G0auOj85q7aGScYbb6YErz7z4AkOuaRoBISCaQZCLlrN:hgwvHTo/Yhy8OnZy
TLSH
T168166B03A29910D4D059C074DFA68236EBA1BC8847F162EF3791B6D92A77ED47B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 2.2MB
SHA256 0dfefcb1d28b56ab99618bb031c3aa53ed2cf7f1dad9913e68af8ce228026880
MD5 2f0194e6d1ea2c6ee23fb82b47812dc6
SHA1 fc8d5074436ccf4c6007907a2300e5b1ffd2b7bd
SHA512 b6c2d042931815af3532c037fb41fac4fec848094bc8326c437a3b92c38aa26141eebe2678632b7add181f80d17d8f397b0222f405f9197f6d92a10430837297
SSDEEP 49152:fySESIGduhnY2fF8FhmS86IUJWQn+6h27d6:lOGAVbOjjsts
TLSH
T190B59D07F79A40D4D01DC074D75689369AA2BC4E4B2AE5DF07A0B6092E37AEC5F3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

RCX99CA.tmp

Path C:\Program Files\7-Zip\RCX99CA.tmp
Size 832KB
SHA256 2b52fd9b36c5f89d011ee405266e8d22723f8dfb3e6115c79739c5e093e5b0ff
MD5 21867f0bb9be623524d051f8f69c46a6
SHA1 f413a5e1d044bf61ac144b327150b87ba333e705
SHA512 e86e093e5380446154d78658034691c810193844ef66841a5812ab05aab4eba21dc6f0d95de1fdbd4ff7ccb70ffb4c57c5df0b5c6ceef77726eca6d457738374
SSDEEP 12288:xuEuuJhKM9k8YQrP/eIh+Dwk1mOMFjM/SrtiFUZAprw5iqprFe:xuEuuHFk8jP/eIhirMSKrsheC
TLSH
T1F305AD27F762C55BCDEB1C34BB2985A177AA890988B9072BA7E66DCD24FF44004F3474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.ico
Size 3KB
SHA256 2a5c5c2bc95c18eded222f0a38752717c1a6ad20e31bcda6472bbba77ed22fe4
MD5 de1dbafd46ca8d953c93a1c89766a8c2
SHA1 41ec8c2a24317bba7a64f4b60341307033edcda0
SHA512 06a89f154036252f396a9f2ac515c5e03e8dd54eb7ba6c3bd0159f693d85846c4ba1b29c0fdc83f14d8c9128f18db3ee27c73111891dc66f81d4fd14361e6ce2
TLSH
T1D861565C04E3ACB1D6E548B83235B2C460D88A364424C867A89D7AD7CE7D8D473DEB0D
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

dbcicons.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe
Size 915KB
SHA256 189a8a616e3605f6dcc89617932e65818964beed21b0066bf095cab4bdf3f65b
MD5 a92b4a6c0710beb38925aa98e0a71dec
SHA1 966a8825ce4c5510e02fb4d47159eea46fe55714
SHA512 eb89d829bc730e4ad8beb532d2e92adb08592f4afc0cd923fec73e092405f3d1f384e8db196394725c3402c6713b1df3a025443af4ab169df554df1974797168
SSDEEP 12288:KPiGLlsZv1VkSj0DbUKCu2F5rHDwwwOPjOa9V8BEw5if4vmlqaF:KvwkSjhKC15D0OPj59VyhQ4vmlqaF
TLSH
T11B159D46F49BDED2C89969318CBE8A50C5026E818F1144EB17FF7B2D6CFC9D4EA12634
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 1.4MB
SHA256 60d71629a39215a43e6027292f2f3de81fb6e9c40c05a9bcbf2556d7da170721
MD5 1420e8d153b9c6126e9b84f4a8205e57
SHA1 4f80e42a67ed9c3c21642f283decdc50c65a4f17
SHA512 dece1b1d7ba7ece0f1d6b2cf94367c9edada4dc58fa2f8ce5890f2c6642eb5a45df573af8680a029dc47a0f01f067f4643092e1327c097dca3aa636061c996c5
SSDEEP 24576:BRdEDJljlQcmrVbQnpb8jmqJ1m39PZfePv3r7fm6t+jqp+3l+zCM0D:BRdEDJljlcVknpKVbgZ2HbbZt+jqpQ0w
TLSH
T16D65BEB970E13125E1750DF28D99A2706D39AA101F14899AF7D0F90F3EB46CA17F723A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
Size 1.4MB
SHA256 0d5f7ea137c647eb66fca61e3b89947a88b995d1763882ec002fdfff7c516974
MD5 fc953c7e31f7e0376fbda4f79042d584
SHA1 4bdfe3c0a132b3d6a1909e56d6eb4805ff9a2cb5
SHA512 a67b234b56dbba881590ed1a3d8c0e3e2d92bc18dbdb03e67612aabb75b41c8f323018f4b2241ffc11db3c9c6a725a36dd70b81c4fa5704646858f4e00adea1e
SSDEEP 24576:WCwb/CsxEXXV90fQzzyrmcanpprvMKMysZgjS1hqgSC/izJfojymk4HM5yJ:WC3sxEXXV90IzZrvMKRjvQotoy4F
TLSH
T19E65BE227C604272ECB50033BA7CD234ACA5A51D170C48DBB6D4E96D39FCCED66B7662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x64.exe

Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
Size 1.3MB
SHA256 2f28f1fb573ec75b93ad930bccb22c35dd414c5e958e4aba693b6fe9efe00f2a
MD5 d05ad187c075b2107bca72ed97ac56d5
SHA1 69b04bbe7130949df76db3cc8a4f521f446d9d77
SHA512 32258bbf6fec7e5b01a8ac8b1cb4a6380318a16724f48f815e9b897a91fb1991d9158bd7cb7aa812d04440dc70fd062895bd237b22f4957f4da0861cc36b40a2
SSDEEP 24576:z8vwog1yBssr8aYUDV0bAAk9q9kLdZkknOkfkkakkiEUOpmvKP+8kSkTSy0NkLFu:z8vQK90sPnRWtGkf
TLSH
T1C555BFF776808C73CC6140B36515A070F9BF6BD54AA3449B92585AFE39B84422AF32F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveStandaloneUpdater.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
Size 3.2MB
SHA256 d935aa32e70833ceee6674b6f4bf87a7bbb671d871dfcd716f638364645cffcf
MD5 8e4dee5118af7b1593925049d2a1471e
SHA1 ae01dcc371b906636506d5f6637eafb75b691c91
SHA512 06518dbccb03b69fc5a911fd4f3158373c33a43652e86900c0f69e91e0c2f52cbac88a441a92cd86a6d72854d2c46422aa129c11c5d3b115dbfa7b01b15f747e
SSDEEP 49152:HXJURmAK0ahwwwwgR+t8NVAjXR6t2jgZ8tzPFASjYhMleFLyJwXP9L8vzbtu14BN:HXJ6nAjUt2jc8tzhYhMMFW8LMprG2
TLSH
T125E5CF23FAC1C032D17711714AAE6779797DB931272382EB63C4674D1A704E27A3AB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 56KB
SHA256 afb51ba415980c2eb8432baf2f4312551915f633bbb86b36ccbfdd12b9fc678d
MD5 fdc0b1c167929ea8a50ff45e9436e9f0
SHA1 4429ee561843305c8ce90447bb9f2ffcada6b484
SHA512 18629482890c4d55d7a3b2fe7b12bc3f9d6adf3465e3b8fbcb5365c68a71aef41f49393e98670f6ab67a7e4981c46fb663a2fd4bb919157075b9661694468029
SSDEEP 192:QC/hLoT1mmlaNQ8S2wGM5UzLigSD+b/JR2jxvsC9QWJhZF35G+kg:PBmlaRoGMUig8IMjyWQGhZF35hF
TLSH
T11243A296B448D606DD0A5D36AFEBE6EC7331BD16CE5B021339C2BB3F99B70C00A58185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 56KB
SHA256 9e7afaa2e9f05d1f6348cf113c74ef40ac85592ff11765655bde7f4c946460c3
MD5 613aa3b8cb4b4821e12a5240ece572c8
SHA1 90e887714dce5e5a0f77dfb71af1abb132b27239
SHA512 61a98f40065d2cd8bbee78f11810d710175704d843e1a19ed791822e2aa997e07363bab5d8850b3af86c90d10f36cac639626b8fe4741831e6b9ec5da05a233d
SSDEEP 192:WCnxvhUoT1Qrl6C6+8SrwGrYUzlugSDyb/J52jxvst9QVJ7ZF3oGOvd+:Jvhurl6ZBBG8uug88kjyLQ37ZF3opl+
TLSH
T17343F692B844DA45DD0A5D369FEBD6EC7331BD26CE5B820335C1BB3F9AB70C10A58285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-29_31c925444a55c7e4667ac43a1dfce472_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
Size 472KB
SHA256 5a0fdd1d3e0433e17c6665c25d906057e1a3bc20cff249b5a858682d4d632b92
MD5 6c12f91f516a8a37eaffb3d5bbd35628
SHA1 90a8b5e559b171ba05d524e104442aaa7dea3626
SHA512 f2ceba74aaa3690fdabb09650c2ac4c4b3e87fe63220554bd5e249efc5da906274247af1590b7f425ad9a2c46fc1492ba47ec82361bcdf8f3ffc5fbe32026103
SSDEEP 6144:ViYB2nEaKTRnXtTkCgwCzUg/HpjN4IBwu7QTLbpqmHdIvW:Vi4e7WRdTfgwCHKy7GLbbdIvW
TLSH
T17BA43A90F3E414E8F0B79A3589764511DAB67C5A1B71CE8F03A8661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/944-842-0x0000000000400000-0x00000000004F2000-memory.dmp

Download

memory/944-0-0x0000000000400000-0x00000000004F2000-memory.dmp

Download