31c0439423f787f2b3b479609b0f4ebc75581fcde3c147309957e09fba015d75

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/08/2026, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Size 4.3MB
Sample260801-ac7csstcnf
SHA256 31c0439423f787f2b3b479609b0f4ebc75581fcde3c147309957e09fba015d75
MD5 306f96e57690f61ed7639c02c28dcce6
SHA1 8cdb239ecd3d4d55004758b35f0b6c5a8fb146f9
SHA512 48a3f43515d58f6f75f681375903eea6e0c88d6e193b0057bab2d5377577b691e0d37424a112c20c854413403dd0db554198de9c29090a9465ca0cde94d8cbd9
SSDEEP 49152:w0hoCmC6hA+/PivcpfQvdaKYXf3CUeyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJUB:fKr9/PvOAjcXvvOOc5
TLSH
T177266B1E735841E8E5A6E5BD49868506E271F801C73257EF22A4875E2FFB7E31E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
916	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.exe	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe.exe	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX2627.tmp	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE.exe	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe.exe	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\RCX6507.tmp	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\RCX47.tmp	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCX35C3.tmp	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Windows Mail\wab.exe.exe	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCXF31.tmp	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe.exe	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE.exe	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCX4238.tmp	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe.exe	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe.ico	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe.ico	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\RCX6157.tmp	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe.ico	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Windows NT\Accessories\wordpad.exe.exe	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe.ico	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe.exe	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe.ico	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE.ico	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX2D4E.tmp	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.ico	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\RCX3447.tmp	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCX40FB.tmp	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCX5AD1.tmp	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXFD61.tmp	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.exe	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe.ico	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe.ico	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX4CC.tmp	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.exe	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.ico	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX688A.tmp	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe.ico	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe.exe	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe.ico	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX5F8.tmp	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe.exe	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCX14C2.tmp	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\RCX61E5.tmp	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe.exe	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\RCX80BB.tmp	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.exe	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe.exe	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe.exe	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE.ico	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe.ico	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe.exe	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe.ico	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXFE9D.tmp	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3956	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
3956	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 916	3956	2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Users\Admin\AppData\Local\Temp\2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe.exe
  2⤵
  - Executes dropped EXE
  PID:916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

arh.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
Size 904KB
SHA256 272a60e50bfa27468d154c1f8de34549845b604c8a2dc4b87a10056adec1f434
MD5 513f15e79279a5c470f588895428f862
SHA1 1bd4571a95ca33d8938b68e3565f89ee52d801e2
SHA512 c02fa434f988b07445190b3f5def288e96b276f3ae6604832a82357041d3542146144e5c36717c852a2a59cf0db5d26041ffa81791433d3dd965a70234b728d7
SSDEEP 24576:KI0Qlhjx7AzQWvLbyd0Ju6vrBwW0zvj2n72:KI0Qlhjx7AzQ6bydiu6TBwWCjS72
TLSH
T18C159DCD6B42C925FCB4593E6B0FF1A36B1EE85D641B8DC73E2C951E1B9018AE44E630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisabledGoogleUpdate.exe

Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
Size 6.5MB
SHA256 739b18003af7cbb6c1fe464430a625a7793cc185a1cb3cadb0096079e6fcde5c
MD5 eeb31eb4f6858063a793b6c0e6f5810b
SHA1 65b2ef7f62a6ea3a060080bc5655a5781b96fa21
SHA512 b3911cf8567624bfb38ab853441d8a5088c911f59f79daf574df7d71528af674d4cb79b88c8d812e0e765360e881736188b2509eae0abd7a095a84e9ab84ca64
SSDEEP 196608:Ok2Mog1P9fIlOuz6IgF+I3m2MXP6HG8Qzb:OkhognqO86IgF+qbM/6HG8QH
TLSH
T1AA668D23B4D04035E5F333356D2D673959327BA69F3245CB86A46C942FB42E3253A3AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ieinstal.exe.ico

Path C:\Program Files (x86)\Internet Explorer\ieinstal.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

msedge.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 2.3MB
SHA256 44c808b18de3ba64c8b9355287db1d44bb1763183715d47dc77d54a7f3081807
MD5 e416cf0407cca7ea41d9946fedcc4f05
SHA1 c70cdec8c39eddd6a232ac8f1a821c62eaf50e04
SHA512 416731d59e1937cb2f21b36356ea079dfcc941e8408da7376502db6269f3323f8cd8df7f733ae271147b9619ed3f74dd51c475ff7b2495a34ac60ded855364af
SSDEEP 49152:TL57v1BfhEwaaTTTTr30QOitU/03nmdXa5o5QPQ+:TL57v1BfhEwacQ/03mdX+PQ+
TLSH
T104B59E07F69A80E9C069E1B8CB768B30D6713C565F2556DF0254BE193D73AE08B3A3E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 2.1MB
SHA256 98f58b08765f5a9934194231fca6c3ec7a730ba0d5e34ef9c8c093899dc43991
MD5 8b1d13c2c884e24f32fff2e5a0cacdc1
SHA1 e4850a2d48fded971aee92dfc3f9f3dc1ffe2aa3
SHA512 9cab0a218e783613bc6fcbe2cf7320d2587b6a02cfbd771a9488b32b8b2a1af0706c7260afbcd2bc1249f82a96106dc12f0afda956b8adaf3ffc29cd0f6b3ac1
SSDEEP 49152:ao2IoeMrGkNGaru0WjiMgCv1jn1ChuADSi:oeqGOGMWjN1jo
TLSH
T1B4A59E03B2B8DDD5D06DC4348652A636EA617C823B31A7EF069872199E73AD45F3E730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 1.3MB
SHA256 994f697551b4a929a3840beb42593e0874d955a54d7ae9b3ec32a5ad612b1eac
MD5 d5aa97b465b8618b786a4c017369c9ae
SHA1 99a694a716d927b074ab9c7ec165ee390bb4c371
SHA512 2a0d1e6caa063c4e3b9180e4ea93f6252bb2b06e155bb053d1a452757a3a7fa5f9eaa9fae86757ba9cc188a63ca28bb225228288d9490d8ed042f00604fa18fe
SSDEEP 24576:+3i0xrTKu5AOvXyDHzVXq86n9kAJ9tA3L:+Ch5h6T9t2
TLSH
T10355BF45728F8BD8F099F5F4891EA181A2E1F8867FE587DB0BD4421D2E234D19AF1B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe
Size 2.2MB
SHA256 56585436502df5662fc2a4ef753459947e42c8a359af5ac9246c9be8e4af831a
MD5 25b39c7c62908d829cd36dd6f5a6fff7
SHA1 2130379909c07e9a29eb8ffd6b4184fdafb798f6
SHA512 e0ca9d8276684e1a86826bbdbb3047500b24e0a3f56726e91947986cacf714eaff8d5ea716ba5c013ff832a72a6803c80b767f91061ef28ddcd3d21915aee36c
SSDEEP 49152:43V9SwN88FlIAkfehjvHHKTdfxINPEt99G2Bo7EukU1a:43V9fN8tVyjvnORmE
TLSH
T115B59E03B3F840D9D059C174DAA69532EEB17C410B35A6EF0650BA6A2E7BBD41F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.6MB
SHA256 bf667c6a7d5e0510449d0dd57d2777ac266c8fad2323c9fb72f1e59f59c3ad92
MD5 b2bb0bf2ad60ffd67abb1712799e68da
SHA1 01bc1c729b6ce154e43b0dd19aa5d817c430b0ca
SHA512 93095f8f87d5e28daa2af98419e9af588891f7b9e068d4e6e9ba92f78d37b168b96571a9ca4ad6af5140fe5055c5fa4c35e8bdaa79220ea7e046f281f9411194
SSDEEP 49152:HjiQmcIdJqfb2+92U5ZGu6qG13O7Q7gLYduZrSdHBAVfb:CmEsR6YjwA1b
TLSH
T1C3C59E03F5D680E5D06DC178CA668BF796617C1D8F2165EF02847A252E77FE04B3A3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
Size 2.2MB
SHA256 dc281f5315b7f6a2b2c6b67ed8ad97a2d11fb2d92dcf9000b5afdad735b105bd
MD5 0023908acaac44bb11c3fafd16af068a
SHA1 179344aa111b9c81945eea0826839f2086841709
SHA512 4ca91c564eb87e1c5ff98501c2d4adbd3dd020bd415e4da862a8cf249b082d901f399b324a94ea296ee152e1d8736612b6b3421011dec98009faa03d46cde431
SSDEEP 49152:FpkSWY4xyRNvKY2fF8FhmS86IUJWQn+6h27d6:KbOjjsts
TLSH
T1F8B59D03B28940E5E45EC4F8C79BC56DD9A17C860B31A5DF0B90B61A2E77AF45B3B720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeUpdateOnDemand.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe
Size 918KB
SHA256 93f01e2d062ab4161dad9666c1d906058d509ef002fa460a786d47c467b0263f
MD5 feba355b128835f8d3ec8efb15c8b495
SHA1 e3c264adca051cc9ac5fa0952dd3c439b651f0d0
SHA512 65aa64c3516ecbe1c33e5e41acb79a03fabf2a564130df9e132f9a621c9d8b0cfaa2610477cdfb237ac0dde6796ec90f12d7b0b128f9dce1341d0379300f293f
SSDEEP 12288:RDxl3llMYEn0Cg9wpqmnRa++rz2Wd8mXw5igKjDbrNPzB+NU:FlY0COmRaYQ8mYvKjDbBPzBAU
TLSH
T1E4159E197195C637FD264AB01176CDE03B7B79690AF046CB2EA36A8E0F309C254365FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe
Size 1.8MB
SHA256 aadfc5bb50958607e96745589adbc3deb4d811e7af3ee2ca7f2e03082a21ded0
MD5 bde060f7e9cb3ae25df39b0b30176ae9
SHA1 b962103b16e89a4d8a813f517a858704231be3cb
SHA512 ade6fccb8e4ca8422cc0dafbfae5f85f79a62f76dc22038729126777b8e67bf83bc9ba7e904d1f273de83b432f10565175e60bab2d09eb2e7d709a886183f7d3
SSDEEP 24576:f9xVDwlo6cf0xY2L929YI4YmWHHo7fvqcXFudDJdWQCkvjZQqg+lIVprS7:NYo6S07LtrYzno7fvTqJdbPrCx9pG7
TLSH
T1F695BF06B68C40D8F498C8388B168171DB727C4B1F3292DF1691B7296E7BAE45F39379
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 2.2MB
SHA256 8cbaa6beebe89ded309dbd0ae949b84bc3ce3bb5f77613f6ba28ad549bd65444
MD5 4bc21e4731da5f15422bdd9965086c68
SHA1 06980ab75da513f186c7e319866a203f3ab166a8
SHA512 d593b75f4db24a3740b645949ea5d84a0aaad45e1b3d0c4bdb83953adcb3028cfe813a9bf86d80cfb430fdd7019c47b68fe01bca15626cb42e07db3aa2aeb751
SSDEEP 49152:WZGsFRqDvwZ2XuTjPb33g9gZLfCdW9HTlXrk9dBB:WLEI4Ds9Ol
TLSH
T178B59C03F29940E9D439D574C696CA32EAB17C518B25E7EF0650B6093E3BBD41F3A326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 4.2MB
SHA256 97114cc67572d34a80f84cac4773d875f635d0ceb5ea01015a49006c8e1b755e
MD5 99a32b51c98eb1c4e9f9c43a14462258
SHA1 ad2e325932cfcbff8d9951a6315ae5eb98c4572d
SHA512 9c7f9e8d7b628837cbf01baf99781aab63627474309e5232b6c05e0c42f309e2841cb80b289e56e71b95b172cbc6776ddd25f86a1659dcf35f8bfddb45d5c4d8
SSDEEP 49152:O9OR0MZatKuZgk07G0auOj85q7aGScYbb6YErz7z4AkOuaRoBISCaQZCLlrrZ:L0TYo/Yhy8OnZy
TLSH
T15B166A03B29980D4D059C474DF968233EBA27C9947F5A1EF3A40B6DA2A73AD47B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 2.2MB
SHA256 b51ba6a0503b959592eac7242d7c1fa2f0c165e1c7c13af84183124f0dae7432
MD5 799ce705a08f5bfbc1e6b7f2a33559c8
SHA1 ace74ad332c2499639fe9e0828062ad2f72c2546
SHA512 8392c84f0338a10207dfdd309ad1f253785cd648ca471c6a0cbc725025a996d81aaa8f8ba7742443fcecb6942c7f0eef94ea3a24f71d3136bb1c49443cf9e2cc
SSDEEP 49152:dfBUeDNhFBClsquwcsMZHu2/PvfwEPn1Y2fF8FhmS86IUJWQn+6h27d6:Io1XIObOjjsts
TLSH
T159B5BF07F68900D9E069C174C6528539E9B2BC014B6563EF1F50BB1D2E3BDDC6BBA326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

7z.exe.exe

Path C:\Program Files\7-Zip\7z.exe.exe
Size 816KB
SHA256 241519aa1bf84b804ee8bba185c20e040c89abd27ea7854acfe00ff688f0cfa9
MD5 7666ea1c7d70e62a2936389d55ee65d1
SHA1 7ac9a79a02f1d073776386521fbf61996f2b55d8
SHA512 1d6f55bf6be3ede3eccdb3f4abb98010071cb7c699eab4d24422186bcc12ca3abbd47ad55cfa56c9ef1bd6c5b1ef694e999eee4b2bbaf0b05cfc69029580b107
SSDEEP 12288:jXMi6JA+0gF7VuPEMKW4CmDaL3oq6w5i/gggggggbUUUUUUUUIUn0hD9:Qp0hcZCmCoct0h
TLSH
T195059E097255A63DF9B67C3B00DA499898B5DB5A5B228F3B3570E83EB7A79013C33434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.ico
Size 3KB
SHA256 2a5c5c2bc95c18eded222f0a38752717c1a6ad20e31bcda6472bbba77ed22fe4
MD5 de1dbafd46ca8d953c93a1c89766a8c2
SHA1 41ec8c2a24317bba7a64f4b60341307033edcda0
SHA512 06a89f154036252f396a9f2ac515c5e03e8dd54eb7ba6c3bd0159f693d85846c4ba1b29c0fdc83f14d8c9128f18db3ee27c73111891dc66f81d4fd14361e6ce2
TLSH
T1D861565C04E3ACB1D6E548B83235B2C460D88A364424C867A89D7AD7CE7D8D473DEB0D
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

dbcicons.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe
Size 899KB
SHA256 954813f3c0ab47f6888e8f953b7df5ceaca19fb1d1fbfed03980d61fd0d84dd0
MD5 29d07518369bceab67db665ac9ff11f8
SHA1 73c093c4f6b266daf030ebdfceb3f728fd9cf3d9
SHA512 ffaa52cd66bb13688d4cdf4836fbc2835bfd87e61fb04f82a1087f3087892bd7fb97f4888a7a482059205dd2be36bbf81919dfaa90cca6fa435c222348ab0b9b
SSDEEP 12288:xDZhDQcyWWxrQTiLqC4fTkWCdOcJi9B3+uMmCw5iRVH/BfF:xDZh8zFrPEHCdOW4B39PsVHJfF
TLSH
T128159EA5E4E9880EDAC4CC32DC15C7ECB573AD624E4915BBDAF93F2A9B3D5046113270
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 1.4MB
SHA256 a4f78bad64dd555cb6a5e23ee0f70e1ba9ef54ddc91b7ffe4540817b64cf8ec3
MD5 76a6c483ecd063eeb84cee83d55c0184
SHA1 369b8fe9b2661e81ae65f0eb2fedc8f16ba3adef
SHA512 03e5fb31d691105f606efdc5487b8b00bf0595a7ae4ec6d7dc053533f1d5e3a4c69b6b31ead97b14f45e313d5e07d38e3308f879e2c84911bdb34c067aca7e04
SSDEEP 24576:gxNnKy7E4qhe17kohqaz5CYAsrvm39PZfePv3r7fm6t+jqp+3l+zCM0D:g3Z1Xhqaz5COrvgZ2HbbZt+jqpQ0CMO
TLSH
T12F65BE72A1D08079E7B02936B824C531ED3C67A57B18446FCAD4B91E3AF04C56AB73F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
Size 1.4MB
SHA256 8f98b1810a838d6350dc64408866f33d4ce2bddf0e7796d9b9baaa0cd6e9e7b6
MD5 77dde67112f01cf15ca7a32305045b67
SHA1 2d61538def4b0ecdc6417a610f4a2a6595b36162
SHA512 7a41194143e4f0ec3b7c4503fa04f4521ccdb5fa8d18c9a297fc6328e0b1254346612dd1990b60a3ca806d761e748adbdc4c8666a7d3225be0c664f52628d044
SSDEEP 24576:jfYulwoCNc3rGT1+dYl9GdU9/f58a16FDnbR/DfPQ1NMysZgjS1hqgSC/izJfojT:bVOf58Q61BPQ1NRjvQotoy4F
TLSH
T12965C031B160D8A6C0E81273A965B1F06D7495385AD2781FA3E67ADC3DF404EBE732B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x64.exe

Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
Size 1.2MB
SHA256 fd2a1c1c9adc075ab2eefa6e44fa5d479070a5a235416dbe98d228260f91094c
MD5 f9733d05a23db8d1ed5cbda5c3a55800
SHA1 7b2a400a0cc26ddbea05d6bf09000d5ea0e5947c
SHA512 8533e2390b768c933e2162de6ab789b5a4c027b39b0e49a15f6358d38982b59cd64aa7f53cfc232602cbbeccc380c20d18ad3163238c0784d7639e7fc19d47b5
SSDEEP 24576:dZPFl8wGlHmq0FjQHVFr9K9MYenGJiKEbXWtfOkUy:IlHMts30uPnRWtGkf
TLSH
T1C055C0397AA84412CCF176F18715C2B06935A9159BA1143F4340EFEE29696C7BBF23F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveStandaloneUpdater.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
Size 3.1MB
SHA256 6f342669262fa70c988d2ae40970f6806a26e302d2ba9d28e4226953626e2471
MD5 73561e836aaf492cb7fe8c1d56326b10
SHA1 221b0850e4ba111e3b8754b4a5a5d85b8469d0d1
SHA512 f77d3cfa6cba42639e5afcbea0a9e299d67f65d981eda04c7440459bb9c2896db80c976017d87042745a7397794ca6b49259ff63dc670fd59f0c10e12e4e0ab4
SSDEEP 49152:cYhs6gkt8NVAjXR6t2jgZ8tzPFASjYhMleFLyJwXP9L8vzbtu14BCNbTc7FBHGDC:06g3nAjUt2jc8tzhYhMMFW8LMprG2
TLSH
T16DE5BF61BB89C0B2D16701318ABDEAF85579B9321BA580FB73C4274D1A714C26F37A73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe.exe
Size 4.3MB
SHA256 3ba778cde953538935b2df7892750c8bf7dd1770d366c5ae3e7800f1b348ff52
MD5 a758aa7637068778340d976e9164ad79
SHA1 70a2963e7a4cd0f4a76cbea418e0638d4c32e56d
SHA512 ccf6c810b837d025ff8d872244daa50cf17334feda65186a81527d1da326e6b98e9fde52e2c075491f23054bb374daad59b04f9e4047a3daa8ac3ba89bb0646b
SSDEEP 49152:f+/PivcpfQvdK/PivcpfQvdaKYXf3CUeyjc4t2vLemGa2pcPVx7EhI2AM7/0XOM2:2/PvOw/PvOAjcXvvOOc5
TLSH
T1C2264C1E635C40E9D1AAD1BD8A46C506F371F8018731A6CF26A4875E2FBB7E25E7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-31_306f96e57690f61ed7639c02c28dcce6_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe.exe
Size 3.5MB
SHA256 9e7c1001836d307bab1a8185df766b0982f05d99a0c43f42ba7030dedf19ba52
MD5 f2af5b8c77b436679d891496ed1671bc
SHA1 2bfce1bd23e43915249d872d4f3adf97acf222c8
SHA512 bdd38141459950c63196fe05a1f87a4e2a9808b6667500ccd8e4cc1e896322aacd02285db7e594edae726e95b3684f365492c8404ce17f9834dd88d6ea9779a8
SSDEEP 49152:f+/PivcpfQvdaKYXf3CUeyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJU1QqpN755:2/PvOAjcXvvOOc5
TLSH
T12D06391E735885E9D5A6D1BD8A428506F271F801C73266CF26A4875E2FFB7E34E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/916-6-0x00007FF772560000-0x00007FF7728E8000-memory.dmp

Download

memory/3956-0-0x0000000000400000-0x00000000004EE000-memory.dmp

Download

memory/3956-959-0x0000000000400000-0x00000000004EE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads