090c93fa7c2e8d2baca801b4e01f6dd2b7780d8eb58005b99b891d6010c4d0bf

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 13:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
Size 854KB
Sample260812-qdrazaxfqa
SHA256 090c93fa7c2e8d2baca801b4e01f6dd2b7780d8eb58005b99b891d6010c4d0bf
MD5 519fb59112d6fdf7fafdbb69c7d6f0e5
SHA1 caf286b9970f276755a6d672c754148084df2475
SHA512 b5ecf63e9d2f91c825ea2bb11c9c8e4055f036eeb4e3a2b960ab108ed9d560caed4d54e729eb0cb19077e722da0a67d19e554a11b34741c359b5f126831b4318
SSDEEP 12288:uW2FVwW/FugBDphj5rFuwMZ2c+Nw5idp+Wy5u6qDNT:WwW/vHswMauA+q6UT
TLSH
T1B015AD0A65E188F7C0DDCAF0B9A312F64D692A55C8711A8B329BAB3D3F5054518F1BF3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1852	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\RCXE156.tmp	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\RCXF1C9.tmp	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.ico	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\RCXF758.tmp	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCXFD23.tmp	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCXB944.tmp	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\MpCmdRun.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Windows Media Player\wmprph.exe.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe.ico	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe.ico	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe.ico	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCXA083.tmp	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.ico	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE.ico	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCXD2F3.tmp	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\RCXE3BE.tmp	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\7-Zip\7zFM.exe.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\RCXBFC0.tmp	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe.ico	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\RCXF10C.tmp	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Windows Media Player\wmprph.exe.ico	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\RCXD44F.tmp	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCXFE7F.tmp	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCXDF2F.tmp	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.ico	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe.ico	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCXC634.tmp	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe.ico	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCXC254.tmp	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCXD0EA.tmp	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX9765.tmp	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5496	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
5496	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5496 wrote to memory of 1852	5496	2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5496
- C:\Users\Admin\AppData\Local\Temp\2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe.exe
  2⤵
  - Executes dropped EXE
  PID:1852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe
Size 1.9MB
SHA256 024389712caffb28a6348ddf1ed0c73a2afc4291b4418b48f2d970416206abfe
MD5 e536dc8aa784940d5187f3f6d41b03e2
SHA1 5f3d9da4da1f50218c627a4b7dae247a517df6f2
SHA512 0251b11142058b45560a3bb9e7e4d03c8ac49b0a505aa8aed13f633cc7b99fe0ac164eae7711971dde4a51ffd7e7d8d7e392964c429af764e2af904b3cb2f109
SSDEEP 24576:b1/4IAZo7RGNJXkiz5/Pem0+dl6ZVP5ozP5IVJXyxR:5wIAK7R2Xl/X0+d4/xozyVJO
TLSH
T17295AE06B28480F5D02DC57C894A49B6D936FC195B31B9EF0E90B7692E36AD53F3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe
Size 4.7MB
SHA256 cc100223c3e1158548c70a9a5141de61850be1352da2a284c1b98169faab46c0
MD5 ce9a4b9daa628a2c4b72eb456c3000f2
SHA1 0e92c83648c2a1755e9e704cfc605c1510ba0a0f
SHA512 7c7ae1a772a424161497fc8c3ae969cd8c19585eaa859b5675f80abdcba7b995a6eba19a7b3f19f831d451520f4dd2f3df9a478d0b4273a1271a9e2d12bc8f91
SSDEEP 49152:hKEdTKVLrgLudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/Baj:hKEdwgJijnUdYd+RaAj
TLSH
T1CC366B03F29980D4E049C075CE569232AB657C8847F161EF3691B7EA3A73AD47B3DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.5MB
SHA256 6b42c67c2144ef8a62723a4d1c76c4ebcb47565cd00842e249a147578189f912
MD5 0bc4e316c5c047539d18730caa6ed35e
SHA1 0cc6935b5c6323ee625450aa8b534219a945225c
SHA512 090f8db6d3aaee890b082a5182e30eca4028d1ae4c83340c4f7644501a978332bfa883c3bb046a36a970e2da1ec2c6d2ec56515abb022242af0aad3de69d5613
SSDEEP 49152:cca6bBlhVuc4ZGu6qG13O7Q7gLYduZrSdHBAVfb:06bPGR6YjwA1b
TLSH
T102C59D43F68682E5E05EC1788A3687259A62FC954F2066DF03417A752E77AD80F3F7E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
Size 2.1MB
SHA256 d63360afbcfbf5eef87163e442aad741f21baba4448f6f3fe6a68d7e033f601c
MD5 e1e371872199010df55f9fc63de77717
SHA1 1a3be1afde3a661fce046117b45a33ca1212b0cd
SHA512 d4ad8ef8e7247cf73e70fb3d71daf6398e709c57ada8ef5d9bc528a0a19185ede2f09db8d335e05fab96249b3e7f7d8e689ba2318188cf6f55f2832cf155ef48
SSDEEP 49152:69yqWHom4UGFHiY2fF8FhmS86IUJWQn+6h27d6:69yqWHom4UGFHibOjjsts
TLSH
T15EA59D13B38E48E9E05ED0B9CA52852DEA62BC86072556DF0750B61B2F37ED41F7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 976KB
SHA256 73fbedf91a883a369422505395c281f2c159f717e99614d2f4302ae57770ce61
MD5 22cd35088d6c90d0b4c759985399ede3
SHA1 e30691962101d2b38d9364603b7b4cd8c99238c2
SHA512 a8ecb1bd41dbea83ce56431a5c763e97c499d33a3d4c35f3f66585c069a8a2e18845e9caac37b6d481943fe121e70c7d77e4e1498a0a3ff4be42fcebc3dd8900
SSDEEP 12288:JbeaYkyHxf8rUp2VJcdWInB7WRoajOw5iBE31CbDjM35i6ows0:JbeaYkyirUmEHna3ogeDA35i6c0
TLSH
T14825AEAD33FC8861D03E50304BC9D62DBE217CE54D26CA6B469367CEED1E95348A2B74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe
Size 1.2MB
SHA256 4cba8b084abf30c9ae8449a9b638ea851839c72fc65dbf52a5b1c5de72b4c7d5
MD5 a68c83cdc705f7735bf97f0ba554bd68
SHA1 1377c523a6490158918aa06e9e6fe3e9a876da8b
SHA512 1280109b276f802ed019fcebc1693270391da833603f5dde2fce1d73db28b4efab9c692aab53409f8eddcbed1a62ce0b88ca16316500c5493c42ee546e02928d
SSDEEP 24576:crlWx82fCQoFsqYd3ewFDJ6hXdk9mR4qYbTM:cBW62ftcsqYd3e2uWmWD
TLSH
T12D55BE44B3A104F9DAE74039EA464342EA77B9463F45B5BF0398935D2E339D84EB6F20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
Size 4.2MB
SHA256 b3f7e794e35792d00079c5738c240de9e1d1e214e1084b548709125284b9f004
MD5 36d6f674568a644ff10cae67af3f3a21
SHA1 9f3eeacea9ce9da430f228d1980cfa2baf395db7
SHA512 c540bdbce644679969e8a4234493540bab8b050eb95b34975dd3615ca8efb2b151284bebd29e0bcef59bc9f18724484e9cdbdf858d5d7edb35bd6a3e281cb2f0
SSDEEP 98304:xExaUmTUfHAHgpeCVD4H62kp4I+8XsuAnJpslJi9bN/ki+EcF0pDeN2y/:xExaUmTUfHAApeiD4H62kp4I+8XsuAnu
TLSH
T1D3166A03A29644D9D049C974CF469232EB62BC890BF162EF365076E52F77AD03B3DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe
Size 1.9MB
SHA256 31282654c6500e0af9273260838b75d71272e6400e545afad94f451cc457f7dd
MD5 f0d3f04ed33a4728ec5460f581184508
SHA1 d68df66e53ed752acc80d4d011fcea988830e55f
SHA512 84d289890247e57e5c3eb6c52e5d0bb9f5137d6996822a3a4f6798ba902e7be11883d64e8fcfad9ddd904f972a60819d9dd5e49b094cce27ff5eabff8fdeeb20
SSDEEP 24576:UFqgCGPFBO63loNlWk0eTy5xDz7EqnPATW41PcL3LU:EYG9BO60lp0L5xDzoMY91P27U
TLSH
T1EB95BE97B29580D5C03981B0CB624176EB667C560B64A6CF1652FE0C2E37AD86F3F72C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe
Size 2.2MB
SHA256 fab4823d1ca338340d8aef3b71c5a11e33d869bca599ced9c6595f51e83f5aa8
MD5 6447890fc77fcc2761199ffde0b4cdcf
SHA1 8314dc08f8d5472ae0f4c3d7a6baa5fabb7646c3
SHA512 a20ee3687ca5c81c438941249ad3c2275051cc88be572d863736220b23b0e37a80131f8f070c85cbec0cdab70d2a161f380bad2ec9a0dd102c5533cf924c7690
SSDEEP 49152:t7YzKK7/rs59lRm/fehjvHHKTdfxINPEt99G2Bo7EukU1a:t7mKo/byjvnORmE
TLSH
T1CEA5AD43B2D803E5C059D374CB659532EAA2BC410B2666FF4B50B70A2E77BD45B3BB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

MpCmdRun.exe.ico

Path C:\Program Files (x86)\Windows Defender\MpCmdRun.exe.ico
Size 3KB
SHA256 02221d573edefa486ba8fe5aee3c8a10c8c7e3188914c0f22df06bb1338db790
MD5 1272e6501512e471bddb879dea4b5800
SHA1 1c8b9489166959e6106095c0974a1825ac1179c6
SHA512 7ef9f685457532d84ba2ed316ec52a44acec151b92e563f6943f593d272745bad0f7c549867a723d2b3532cbcb76ea2b99a965b3b2412d5e7644570740bb4194
TLSH
T1CF6140A1F209FC58C45CD1744DC6C2CC18543D958C0A7273FADCBF8F69724E52E21181
MD5 SHA1 SHA512 TLSH

Submit Download

RCX8DDE.tmp

Path C:\Program Files\7-Zip\RCX8DDE.tmp
Size 756KB
SHA256 54c01f8b75a78349e34992c1e71848ca60bf4548ed17938964789fba6295766f
MD5 92cd6727940023624f35cabbda0f1ccb
SHA1 a81435355947e6c4ee0b3de0f58b5f9cd354e916
SHA512 ea78f149eab0c13e26c10889647179b683bf3ce01b6a3ad4ce2e1f36906bbfa62127b109306b843ae32f94ea7a8f17e542b9fd309f2b2ee509295753a300d86e
SSDEEP 12288:uW2FVwW/FugBDphj5rFuwMZ2c+Nw5ikp+W:WwW/vHswMau1+
TLSH
T145F49D0AA9E18CF7C0DDCAF0B9A312F74C591A59C8751987369BAB3D7B5040A14E1BF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.ico
Size 3KB
SHA256 463b6e99198762de39ea3c9156504527673355f452c17063d0fcc34caa3cfded
MD5 01f2c0d2e4df4e0ed544a4e4600d1457
SHA1 2bdf43857fcfeefcd37ee7a82d733ca4e4f1d871
SHA512 8238557d4075faf0d780ce775a6bc0121cf2da9b826cc49095fec9b35096809e5187f3027682db88d7358e21025c5d24d2ef784e9c2b0a8aa7021589ce68a8aa
TLSH
T13061D3A9E5052C3BFD5CDA7935B6DB60C2077ECA021680778809F58328F768B16ED974
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

iexplore.exe.ico

Path C:\Program Files\Internet Explorer\iexplore.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

lyncicon.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe
Size 1.6MB
SHA256 d54e95fe7ec6cea0b2e1008e19db8ad8a207f6f6373a300b13baa83e3b5fd9f4
MD5 c096a8ccc790a67b4c583ac5f90b6401
SHA1 0e7eb9b8b25c0db2ace4744a743b7584bf4f41a6
SHA512 30f7fb30d2fced6ad6b82edbb9410eeba9b9ad39509d8849b6cfbe72d55844dc40b947ff2568e8bb55279a67ddfeb66b659bd06fa133a5064c8f7b0a438e9b50
SSDEEP 12288:RAF+9bgMmK4Oyy7vR9ihwqfMOyTXeFcBnEJb8xL3vdbCq6iHVYOw5icXKdy1+:Q+WI4Hy7vR9iBfLGeWUsL9D/qXXA0+
TLSH
T1E6753945A89C4C26DC5F4E348A42A971FCA16CCFBC2E340E6D41B2BF55BB9C124696F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
Size 1.0MB
SHA256 e74d25912f9d7cc1e010d707da662f9f8bedf36e8f20543722c316370c7d3326
MD5 caab605c072183cfb9a6e87473265818
SHA1 380f259d46772c9c88b77472ac3c17fe1b0564d9
SHA512 05c3d7096194aa3cd3a4b8294565e9c110500f591672eea7d79ebcd2eb06c8f86e2410924c3652fae898696549514803c04b09b9da9c9f2e6ac76fd5c2804f16
SSDEEP 24576:qE7R/Y1NTEVE3iSsYuu68IDUoXYfDtczAe:1YkmSSnE8IQ/tcv
TLSH
T11C25BD0F7F8D878EEC2518378956A8B993373D254710484B23984FDA3E5B588E87673E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

OfflineScannerShell.exe.ico

Path C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe.ico
Size 3KB
SHA256 9e3f1f8e5166514df44b02a1e0bf7474708dafba161e263cff087af62ba89ae5
MD5 d8ef82bb84e2efe95de666f46d0c7ac6
SHA1 fcdd2f6ceacde21e1e38a687041138aa5bb0ef68
SHA512 61f7439ba615c3250701aeecb96ab8319f2d84ffa7e61076f6dbfce20ee3409d212e8d9deb274b145b7f0eeed2388681b929ba897bc85b4d3841f7003bc40afd
TLSH
T1C461FEC2D34610E8DA8268F34DB58DC487650CD540E4ED920EE6BCE39A745FDA93188F
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

VC_redist.x86.exe

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
Size 1.4MB
SHA256 6a2a8ff2190e421d7522101bf683e65f992862b8d9eae111ee975e5d3d88b498
MD5 d7462b107619989b149603946ae93f54
SHA1 6c9afbbf8fda81d137ab91e47c1f9402a7b865e2
SHA512 7fcbe070413d09fd78fa4d50092826789720edc7c5fa6322ad56cd369a122fb20c40aa80b000ca7237cf63783ca949ff11633cfd6563ff36dd9876d76b76d426
SSDEEP 24576:vURGmUN4Hsd7gUd+yBj+d/tMysZgjS1hqgSC/izGfU2JGlbhlAZ4/:vtN467gUxBjuFRjvQo0nGH1
TLSH
T14965BF31726BF062D5770772AAE5C230AD2DEA203B05455FE1D4F95C2AA88C26FF7225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-7.0.16-win-x64.exe

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\windowsdesktop-runtime-7.0.16-win-x64.exe
Size 1.3MB
SHA256 ffc68ae368e5943e4e19cf374b7ff25e34a1f47e4480f277b57bef8c5c5ef70f
MD5 ba7a2f8a36ec28d8fa6457ff28822f19
SHA1 06d7615a559f09dfde4ce99a8db7da04e18f1dba
SHA512 0ccb9cc4f6623c81c0661a8173e5e46af0a995a7dc3fc09a608d0803c22886660789a71fe3e199a2a7f5d71c1966927cc9f6c3ac45a3bbf3963360902d39e1c2
SSDEEP 24576:nLXDi0Tul+UrOnUIaFfLomt4PI5mWpI2jFM5sFzfTpi71R8dZd:LnToDrKZaFfL/Cw5BjBbTpi5R8d7
TLSH
T17055BF36A2F0C862E5E68132A934D1B43E2DE7147B38452BDFDCB82D3D64D741A77229
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe
Size 27.3MB
SHA256 1e2f750178a58beaa299150770c7cc85d4b440e708ed69541ee75170b77716fe
MD5 62c02a0f7b765b9e1e16e5778dea3c12
SHA1 1c8f8e48d3f7e913f64f618c4872c3b1fbf21c84
SHA512 1c76a0c92f244c2e6f95f23a280c7d2d3be74ff41f1172432f1ceada88b805e98dd527006bb9ef72d6ba89ddb65b25571291e3d6d53a85099d24128cbffffd73
SSDEEP 393216:ymPdPw5ZbDO6RGmb8hFZtxwbTNXp3YCkxJoPMAvqkWgoj6RVFK+q3HvUUw0vXL:ymPWO1c877xqpyovvVWJ6VFK+q3cSvXL
TLSH
T100572292BBE89071F4F30670BA78157E4577BC219F3181DF2292F61C1A709D19A7AB23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 56KB
SHA256 4f85bbf641e98eb55f9f2b30e9fb8becd52a4d52bcae30e8613e1ec39128b3dc
MD5 2997696829e5bff9472fdcf6b457d21d
SHA1 a1919a5cbf74e21146636e9925fc0882f4c06358
SHA512 ff4d48273433abef18ff0642b64b66b213195434c5307db898e1f335b64af98b86b70f5ad99e14467ba4e3b4d516fc68d23d23da0dd1fc55556508f3d74c89c9
SSDEEP 192:f2yTn2K9ysEQkpvUxXgZ+BjkUe4WmTQhFPl1aAqqreXKJSbeT/:+ukM+UBjCZwSyAqqvSO/
TLSH
T198437256B848E616ED091C36AFEBD4EC72313E16CE8B070779C1B77F89B70C18A59189
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_519fb59112d6fdf7fafdbb69c7d6f0e5_cobalt-strike_elex_icedid_vidar.exe.exe
Size 104KB
SHA256 e2efc2504aa28b794440b6d90ca2089d60b596d0eec53a0e55551edd5cb4f3ce
MD5 e2138063c5e9e4444ebddadcc10efdb0
SHA1 891fc59e77f71f4a8c5ef44dceb69e78ea48250a
SHA512 18442c543e78a0cbb4a327fbc575bfbbe3ba2b7e402188ccf29c91482aebfc29a7d40885d3cce188f53c59f4d0e44a3bc91ef5638dd8e921e3f7afce69e2e024
SSDEEP 1536:Rt90alFHfRr4vkK/sTZSGJcXaDNUjVa51UysWqEdU9dldSGyBkc2:D9R7fREvkgsTv6qDNUgzU7usKGuk
TLSH
T1FFA35C86B3A050E9F2734675C9A09A05EB36F87107618FEF0264839A1F677D19E3DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5496-0-0x0000000000400000-0x00000000004DF000-memory.dmp

Download

memory/5496-819-0x0000000000400000-0x00000000004DF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads