a2ae6d4ad0fc2d6c4b3b7aa53baa78a74ed8607502317e89328482e9bd95d32e

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 17:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 1.1MB
Sample260820-v8wamasdnb
SHA256 a2ae6d4ad0fc2d6c4b3b7aa53baa78a74ed8607502317e89328482e9bd95d32e
MD5 77fea9b37440ba9ac6b123fb67a25be0
SHA1 d640858d5800c53750cf455ae53696b7bfa5bae3
SHA512 ecc08b36e0438837e296adbfb80ac803aebc9f9ea4da12081872132ed2dc7c4eddc5a118bf38129cd599e8fd8971c487b23853a4761ae284e47cf123023414b2
SSDEEP 24576:a2Ic+AIa82lmjhWLzaAQABftZM9zFVSOX:hIdJjWzHZM9zf7
TLSH
T1B9359E3A6F608CF5C4260D384C6957517622FF6159A5890FE3B4292EAEF611C38F93F2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2260	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\ielowutil.exe.exe	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX3089.tmp	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe.ico	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX4FCA.tmp	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe.exe	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\RCX77F6.tmp	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.ico	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe.ico	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE.ico	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX4EED.tmp	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE.ico	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\RCX5B6D.tmp	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\RCX6350.tmp	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.ico	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE.exe	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Defender\MpCmdRun.exe.exe	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\RCX96BC.tmp	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\RCXAAA5.tmp	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.exe	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\RCX67FE.tmp	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe.ico	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe.exe	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\RCX9101.tmp	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX91A0.tmp	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe.exe	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe.exe	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe.exe	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe.ico	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\RCX79B1.tmp	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.ico	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX2AFB.tmp	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe.ico	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe.exe	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.exe	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.exe	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\RCX9DB1.tmp	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\7-Zip\7zG.exe.exe	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.exe	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe.exe	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Mail\wab.exe.ico	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe.exe	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\RCX9779.tmp	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\RCX19DE.tmp	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\RestartGet.exe	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCX4034.tmp	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCX6147.tmp	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Defender\mpextms.exe.ico	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe.exe	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX23A6.tmp	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.exe	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.exe	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX3195.tmp	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5668	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5668	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5668 wrote to memory of 2260	5668	2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5668
- C:\Users\Admin\AppData\Local\Temp\2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
  2⤵
  - Executes dropped EXE
  PID:2260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wow_helper.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
Size 907KB
SHA256 c0658272d130ca10adca06b15699f991edbeb8994e6ccccfa0cb14189427d6c2
MD5 2d579ad0db5ccba1237270ce7c8b3c37
SHA1 64461751b7979e5a3b8e996a6ae6512b52e56c30
SHA512 41ff73f0c023f059c4afa7047dd810be935ebf98ce4976007e58ed6bedf93bee975d2789ecd39e2644e3ce5461371ab4cbc4c0fe324e4f836411b4ed5eac0f66
SSDEEP 12288:OE7i8ScnZg3i+SJOUm9clLoWzfXkvZp0Cne19QWXN/w5iMqGtzQl8Hok:L7iMZKvS4UfzApPe19QWXah3mhk
TLSH
T147159B2BE941BDF5D0B5B072A8768ED50A37682E3512630F90E16ECF9D278080E597F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe
Size 1.2MB
SHA256 5c4a86c7dd51f99d6f4c798c6d6b82783a54b5dbed5e7486690df40d0eeb2c30
MD5 d4bd6237f19422df8bcfb819ff598990
SHA1 604979591bf47c62369c8375d54f82a6f8acbc48
SHA512 2de6fb46192c6f52072ba2220411df4b1ff2b24f7c7a446798189c047e780b3c5305d3cc3898643ef4c9f1ad4f6f96df82ae00f84fe856902dadd598824b8369
SSDEEP 24576:C4GCOvJnEdGLvh1N4aGOEkniPUa2j3Td9CHKy7GZO:C4vOBhL7WaGwiPt2DTd9CHKyao
TLSH
T155559CAAF3F840AEE4778535D4D1421286B2FC62F922F7CF5264AB0D1D3268059B5F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe
Size 1.9MB
SHA256 88bd8fb34a37aea917e88a3b6f5adeafaebefa81d7f4c71e67f3669354b5e330
MD5 78b90a354ab2869839f82057c3da040a
SHA1 7c98744f4c71ad846b963761bb6462436569352a
SHA512 db6a77aedb835cdc9ab26974cc759f0d66ed8859432d3e24ad36b2c8b425b0da9d26abc01aeed9bae56bd7d26882734788d31eb036ebf4b48ba3ef5910ae3725
SSDEEP 24576:P+Vkomt88KNU5yBs99PMkFXalWk0eTy5xDz7EqnPATW41PcL3LU:P+cgK7Klp0L5xDzoMY91P27U
TLSH
T1BF95AE03BEDE44EAD86DC5748B6B4561E9667C590F2162CFA240F2182E7BADC1F3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 1.3MB
SHA256 0b96a68c989b6109689ef8af3baa2d32dee3ec215e285ea870635389c61b13aa
MD5 031e7721896285f30deeca251156104b
SHA1 95e5b29e85dd27948fa330313c64489a0b317a73
SHA512 78c762dfd037b7ac653a58c005c91ab902360e6f841884d89a0eb91c2e22cfd460e22c1c1c036adcfade5c8c106f72ad33032646d8e0a72843591d3ef9a8d665
SSDEEP 24576:p/+cn38aTaEvC7v/P2klSCB3ljGDNo86n9kAJ9tA3L:pmcn3JaEvC7v/9Zg6T9t2
TLSH
T13F55AE0EB6C4DAB5DC3E8934B9078289D675784D0B96538B0240BD6E2EF72950FBF724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookie_exporter.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe
Size 914KB
SHA256 00dc05c65414d2053afc85576f95c1ef37917d791f0c10b2dd86ca20c330d800
MD5 54006f4a45f1604128835ff265e44e42
SHA1 9846740f6ffdb76acdb24c1912fa9afea6da9d38
SHA512 0914c61dd7303f182d5ccb7877444f46736ac1b337fb6e510237c39d786a5ed58ce101bb20f619397681d2c94346659a1ebe5c740e6e2f7b33766cef94a226b7
SSDEEP 12288:meembWIWvkDr9uYaLD2zsBYFD+EHA2EralCaMaSVzw5iS+iezZZNnRpAr4svndNN:qHkVut0+SCrnaM1Vk9+iezhTjE
TLSH
T188159E1AE7D0CDB2DCAC9E3078404EE4DB259C1AAF562F37EE744ADD3D292A41C14272
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.6MB
SHA256 dd15395630a06a7b94968cc1dd3a8b25a3391b9b131905920796fca47f83836d
MD5 04263d000cbd5a3488c981f8ed1d55dc
SHA1 b7e40b9271827137f4ad530f02348f98d2af8d8a
SHA512 bbb01988143978f768652317d839daa489781b15456fea425e1f8ddc7555992eaf311905ed21a6830ee98a26755d76eddadd1294d949576deaa3bf0f59715244
SSDEEP 49152:tXwLvo5ZGu6qG13O7Q7gLYduZrSdHBAVfb:tX+qR6YjwA1b
TLSH
T17FC5AE43F28580F5E059C1B8CB7E8B35E6617C564F246ADF1A80BA593E77AD00B3D3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe
Size 4.2MB
SHA256 423b3116902ea7ca2d623c0c756c2f98e5e21c3cf42385b123abc567e72b110f
MD5 71b7f358d84fd06b553b817eae9141ff
SHA1 805d3d72a59295290d9035e901572a2658c77be9
SHA512 0020d57d2af8799ef379ea1efe24211a30d34a568cff5e50d9ba57967e94d5a37c8ee49d218a5b286ef34f284f5aa6e96dec1977518bd97e34d8352544165a33
SSDEEP 49152:dlDBFeXuZgk07G0auOj85q7aGScYbb6YErz7z4AkOuaRoBISCaQZCLlrrZ:dlNFGo/Yhy8OnZy
TLSH
T176167B03B29940D4D069D478CF8A9536EBA2BC8847F161EF3250B6D52A77EE43B7D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe
Size 2.4MB
SHA256 d3c01e947faf4d7ea171af418411de13094e0e66c959a1360394f9cc4c9a4499
MD5 f897c26c83af5a6ecf091385a27ecb94
SHA1 3ef5c9fa5d6025c6917b39b46484be5047fbdc73
SHA512 2ecb797110f19ea353d389f255e75aea1a99c55466cafa5300ba44e1adbebf402fa255e25be1af746bf3c29671724ca41189c91f1ada4154bea65eaee5b5922a
SSDEEP 49152:WVBNa6z24hoNiZVB6PeuT5lxeHX04mfHI:WVBNlvhsi9ubH
TLSH
T132B5AD07B2A941E5C06DC2B48A56D532EBB1BC460F31B6DF0642B6991E73EE41F3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 1015KB
SHA256 5b7309700bd8af707a07a0abe1e28ef632816ecfa3445f3780a57664b33ab71e
MD5 e97b7fd073dca59dc0a086cbb8ff0a11
SHA1 f2e3d4272bce75363650f27555f750c7f740c6b5
SHA512 4c6275beb9654f853f866a6865da7c45fb08786b8ddb5d1f212fe7ce1b32e325d1ff1005ec36955b8c36969b732866d3af3ad152b7764fd592a50b9696a7d799
SSDEEP 24576:/QQMnuYk+LJBhOLOG8SizadDU09OIYZGmFyHUj:/QVJBhOsSim2K9EP
TLSH
T1B125AE3E3DA54832D064C4B8CEE59B556AB2F82368124C671F52B35E1D231EEEC5AF34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe
Size 2.4MB
SHA256 49d99b8d10cb8d1aa05c0afe7f5f603b31a3828c2d14d608bf39edc8c6b85eb9
MD5 7697ccb2fd8404c5366302613aa9ef58
SHA1 672f67bffe2a561b6365c923464cb002cf30df39
SHA512 d8c76e5bcd6522eb9510ffc9e122b470bf4462e85d4d4589fc5b6ce5525d223e9dc0cd1780df0209cb4d39b05d267ec0e45ea3b1b3ece4004235b973d40b9270
SSDEEP 49152:Omzj6MUdmWWu1zKeI5Nj2bcuBluP3GiynKDU:OmKMUdmWB4Nj3uoi
TLSH
T119C59E03F6A944F8D069D1748B468232EA617C450B21AACF47D5B35A3E77ED82FBE710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe
Size 1.9MB
SHA256 9f413dc83e55aa400ee6549a3772bf827e2dc6e6ada742b7bf232d12d660a290
MD5 de23a89afff30c5f6832d583a56623de
SHA1 f5c9a20c21f67a06da7117a76c5ef244352a4b95
SHA512 12a7ecfdf5c5eb001fe78b36160c72e1c155e54bd87cd528f2393566e3bd8c466368a8d6d7c1ef3f7963ef5aa9dde26dc01cf2941ce01ea61dd862d97ffddbe1
SSDEEP 49152:rpGznn5/IolPXyWzLjTUDi7PhOtdx4yYmOZsrzQ:rpGznVI+XyY3TNstdx43
TLSH
T19C95AE0BE69544F6D01F80B6CA4641A2E9B27C011F2866DF02ADB71D2E77FD85B3B721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe
Size 2.3MB
SHA256 1897a755da94d9a1f0949e2be39cd12bd17024db339f6458f4a2fcf2dd7eaa2f
MD5 8cbbd0f1c03b0ff5e1731d5e1eb66b19
SHA1 d3781bd060e657dd3d72d0968e3a4cef9fe08256
SHA512 90d6a547746c66366760c2a7ff41684e564b9513e6e97afc46cba7926dae836fa3a71e2702807d8d25a42492fb26ab1b95357cc3811b1421b27469741f9f4d31
SSDEEP 49152:PbnP3dSXes9x1P1QnQxqz5/Kfi2t0YpRHr:PrNses9n1BY/KAsHr
TLSH
T12FB5AE0BF68A80A5C01DC9398F674BA89E717C215F2996DF0294BF192DB79E01F397D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_pwa_launcher.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

MpCmdRun.exe.ico

Path C:\Program Files (x86)\Windows Defender\MpCmdRun.exe.ico
Size 3KB
SHA256 02221d573edefa486ba8fe5aee3c8a10c8c7e3188914c0f22df06bb1338db790
MD5 1272e6501512e471bddb879dea4b5800
SHA1 1c8b9489166959e6106095c0974a1825ac1179c6
SHA512 7ef9f685457532d84ba2ed316ec52a44acec151b92e563f6943f593d272745bad0f7c549867a723d2b3532cbcb76ea2b99a965b3b2412d5e7644570740bb4194
TLSH
T1CF6140A1F209FC58C45CD1744DC6C2CC18543D958C0A7273FADCBF8F69724E52E21181
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

iexplore.exe.ico

Path C:\Program Files\Internet Explorer\iexplore.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

dbcicons.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe
Size 879KB
SHA256 b26aa77f23cb63ca854b23cdbb5c52ad9df891fe198b88e2f8ad5f5723b0e108
MD5 00deca652c757186d6a096a52f000cf0
SHA1 2a35f482405061b468c35d44ed132a6b97068ddd
SHA512 95565f73cc06d613c2a0d7ad955cb9f2bca3687465435616cb0f42c9a7c196aa66b2d3ef3bd4a4d9a4bfe03723266338ee441b220c018c17395a524895976fc9
SSDEEP 12288:DWYKyRU050/SgHd8Qx/XfeU5tZuqYABmG5Wnl0fchw5ikBALCKF:DWpyRU050/1HdLtXfeUDZuqRUMl8F
TLSH
T1F2159C7DB4948B6CC9D21030CC4243B39435ADB32AD96FBEA568772C9B751A0F9EC178
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

RestartGet.exe.exe

Path C:\Program Files\RestartGet.exe.exe
Size 796KB
SHA256 8fc7e1882a479d608ce718295b7932d17b6689301f63af62eaa398f4aa43c2fc
MD5 a06d959e55342231da07cd38e3c88ab8
SHA1 e9d1cc93d1de83cf95e80f480bc71ccd8f19e643
SHA512 4bc09609fb66d7cff950d8a55cab8d2d2abc9976931328ec7da7973fa0af598f0b9a71fe097b23b459c76168836e8611f53b0ffc9de7117f796f0b482ebb41ee
SSDEEP 12288:aIpIcO3AIafcD8DlXWjh272YJKqLzaAcUw5iZZ11/Bl5:a2Ic+AIa82lmjhWLzaAQABf
TLSH
T106057C3E6F61CCF6C0290D341C6967A13A02EF61989A490FE778586DBEE441D39F52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnblockRedo.exe.ico

Path C:\Program Files\UnblockRedo.exe.ico
Size 3KB
SHA256 463b6e99198762de39ea3c9156504527673355f452c17063d0fcc34caa3cfded
MD5 01f2c0d2e4df4e0ed544a4e4600d1457
SHA1 2bdf43857fcfeefcd37ee7a82d733ca4e4f1d871
SHA512 8238557d4075faf0d780ce775a6bc0121cf2da9b826cc49095fec9b35096809e5187f3027682db88d7358e21025c5d24d2ef784e9c2b0a8aa7021589ce68a8aa
TLSH
T13061D3A9E5052C3BFD5CDA7935B6DB60C2077ECA021680778809F58328F768B16ED974
MD5 SHA1 SHA512 TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

OfflineScannerShell.exe.ico

Path C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe.ico
Size 3KB
SHA256 9e3f1f8e5166514df44b02a1e0bf7474708dafba161e263cff087af62ba89ae5
MD5 d8ef82bb84e2efe95de666f46d0c7ac6
SHA1 fcdd2f6ceacde21e1e38a687041138aa5bb0ef68
SHA512 61f7439ba615c3250701aeecb96ab8319f2d84ffa7e61076f6dbfce20ee3409d212e8d9deb274b145b7f0eeed2388681b929ba897bc85b4d3841f7003bc40afd
TLSH
T1C461FEC2D34610E8DA8268F34DB58DC487650CD540E4ED920EE6BCE39A745FDA93188F
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
Size 1.2MB
SHA256 e9a2aa8de4953ea1be0c934f00c8be094b4dcd5d770bd8ea5d3d24284961083d
MD5 6d37c26452fdea0e08eb7c3d0fb6351f
SHA1 3d227ef17bfd1410b4ce3ebc6151f83d3cfda4ad
SHA512 66cb39bc092e5acf4ec75684ab784cb22d071bfc70d76e383271e46f92e83d0cc7c6900418de24aec1845ee4a8516f8abf305763d6072a25f0fc99e52aca7119
SSDEEP 24576:WcUJs5mxcja4gLaVPDTLMD2wgKA2NXQrMYenGJiKEbXWtpOLl8:WcU3LLaV5H4C4PnRWt4G
TLSH
T16E45AE39B514C333C3662432A816BDF6FE79A8341A3B049F9240A60D3DB654A75BB37D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x86.exe

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
Size 1.4MB
SHA256 da8ae5952b9f74ac70b5f70d4fca4a9600fd290a5c931fa7d43d0a1d93792fef
MD5 6b42a65c6411f11c4f6d574a6e623473
SHA1 dda8148f94e9d4d52ac0d74a75049cbcbcf39261
SHA512 4932fa1d1fbfe68cf7e19fd2063a711cbe18772e1eb336f1749a2d2e51c54c1c4488138c314bcf111dd81cd518e99cf9ec509e4472a36a7916d61522cbbbe36d
SSDEEP 24576:FInparsXXtHBFRhfRUCMysZgjS1hqgSC/izGfU2JGlbhlAZ4/:FInkrsXdhFR5RUCRjvQo0nGH1
TLSH
T1C365BE31A180B276D3B7C53374A492716939DA281F2774EFD2D4ABCD7AB70402F76226
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
Size 1.1MB
SHA256 c4d03d63fde4168aa9f1fd1860f92701187a23738c3febe2272cec1e7319824a
MD5 1d6fb49ee0dd140bc379d29271fec049
SHA1 7ed67a3475e86c5f6080c77a026f7fb9214c450d
SHA512 9f6c723a368cec91b4ee08042aee06a85de58397a697ffd9bb7249152bed7f56b09b22c089bf11e6fdb3221c9f044f16b0d0d07a8dd153982680dac01859ef78
SSDEEP 12288:/cSu2Vfkn6cM+B8IzAfW7lt+9jOU6bX+Qnew5i5Y0UxMhiZwb5zzFEoS2cPvy:/VfkFM+B8IcobbXrnLsY/ZM9zFVSO
TLSH
T12835AECF72518CB1C816C938751349BAC836BF534E55F10B27656E0A8E7FEA408A67B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-20_77fea9b37440ba9ac6b123fb67a25be0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
Size 292KB
SHA256 c1e752335cd5df1839c3c9fd4071d223c135ea831b2dce0ce356c1d73c0c8b39
MD5 9c921609168b577ac115ebf0a61fcee7
SHA1 7f717a62d19d3c3e1622df1898c3904bdaafc470
SHA512 44023edcb72fa58eb2ff2a92e61eb34f3d80b37f44bee702b5f277fce94a57f10a1ae96d47c253ec4c6b8c991b01e234596cc363d164fe06f759f97e79f7dc37
SSDEEP 3072:5LBM1lpzb9ydKHsz1//3H+ktNNWo7vNnParlMhubG0XqkwnJEszNvarvcLPYDJ6E:pWPZw225bN5zFEjGkqkAJHyEzYV/Pvy
TLSH
T15C549E95B3901CF8EC67813EC9558906D6B27C5A0B70C65F13A436275F333A11D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2260-55-0x000001C44F640000-0x000001C44F8B0000-memory.dmp

Download

memory/2260-47-0x000001C44DBF0000-0x000001C44DBF1000-memory.dmp

Download

memory/2260-10-0x000001C44F640000-0x000001C44F8B0000-memory.dmp

Download

memory/5668-0-0x0000000000400000-0x00000000004E9000-memory.dmp

Download

memory/5668-583-0x0000000000400000-0x00000000004E9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads