55c3458ddc4e8fe83d14f19b4d7a3984b5ee0497bad19c450edd910f04faef70

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/08/2026, 10:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 4.4MB
Sample260823-mlc7jaaa45
SHA256 55c3458ddc4e8fe83d14f19b4d7a3984b5ee0497bad19c450edd910f04faef70
MD5 2f0528c366854e721213d1e8bf784b8a
SHA1 c74d9a492e8d9fd6ebedc41f32d80c329048d1ca
SHA512 5a37dd7ee3a64bc9e5f433257105b5f01015a8072e6765759f7d38ea12ddf282d323d169f49cf82f0be29150112be89dbb3c660e9420c6413e91830b94ef35d0
SSDEEP 49152:RCuzCOe+6sa23IetlomzqbeWsLf83Won5L3s9x1OxGBcq2exk74gcAFu4OuDmGRq:2vsYbm71OxRR9Sl1xB
TLSH
T177267C03A2F549D8F0BAD6789B259731E9737C858F34A1DF06A056191E36FE48F38722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2064	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
2864	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\pingsender.exe.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE.ico	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.ico	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCX6FFF.tmp	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe.ico	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe.ico	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\RCXE0AA.tmp	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_407976478\manifest.json	msedge.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe.ico	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXC9AA.tmp	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\RCX950C.tmp	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\RCX97D5.tmp	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX7C9A.tmp	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe.ico	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.ico	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX7E45.tmp	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe.ico	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe.ico	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe.ico	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXCAD5.tmp	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Windows Media Player\setup_wm.exe.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.ico	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe.ico	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCXDFFB.tmp	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Media Player\wmplayer.exe.ico	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe.ico	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX63C2.tmp	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCXDA48.tmp	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\RCXDF2E.tmp	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3416	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134319547833550365"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{35C4FFDC-057A-40F8-8A1D-9A211DEDF971}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5388	msedge.exe
5388	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2476	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
2476	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2064	2476	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe	86
PID 2064 wrote to memory of 2864	2064	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe	87
PID 2064 wrote to memory of 4672	2064	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe	88
PID 4672 wrote to memory of 4324	4672	msedge.exe	89
PID 4672 wrote to memory of 3416	4672	msedge.exe	90
PID 4672 wrote to memory of 3436	4672	msedge.exe	91
PID 4672 wrote to memory of 2888	4672	msedge.exe	92
PID 4672 wrote to memory of 3436	4672	msedge.exe	91
PID 4672 wrote to memory of 3436	4672	msedge.exe	91
PID 4672 wrote to memory of 2888	4672	msedge.exe	92
PID 4672 wrote to memory of 2324	4672	msedge.exe	93
PID 4672 wrote to memory of 2324	4672	msedge.exe	93
PID 4672 wrote to memory of 2324	4672	msedge.exe	93
PID 4672 wrote to memory of 772	4672	msedge.exe	94
PID 4672 wrote to memory of 772	4672	msedge.exe	94
PID 4672 wrote to memory of 772	4672	msedge.exe	94
PID 4672 wrote to memory of 3384	4672	msedge.exe	95
PID 4672 wrote to memory of 1072	4672	msedge.exe	96
PID 4672 wrote to memory of 1916	4672	msedge.exe	97
PID 4672 wrote to memory of 632	4672	msedge.exe	98
PID 4672 wrote to memory of 3276	4672	msedge.exe	99
PID 4672 wrote to memory of 632	4672	msedge.exe	98
PID 4672 wrote to memory of 632	4672	msedge.exe	98
PID 4672 wrote to memory of 3276	4672	msedge.exe	99
PID 4672 wrote to memory of 3276	4672	msedge.exe	99
PID 4672 wrote to memory of 4128	4672	msedge.exe	102
PID 4672 wrote to memory of 4128	4672	msedge.exe	102
PID 4672 wrote to memory of 1020	4672	msedge.exe	104
PID 4672 wrote to memory of 1020	4672	msedge.exe	104
PID 4672 wrote to memory of 4952	4672	msedge.exe	105
PID 4672 wrote to memory of 4952	4672	msedge.exe	105
PID 4672 wrote to memory of 3832	4672	msedge.exe	106
PID 4672 wrote to memory of 3832	4672	msedge.exe	106
PID 4672 wrote to memory of 1040	4672	msedge.exe	109
PID 4672 wrote to memory of 5008	4672	msedge.exe	110
PID 4672 wrote to memory of 5008	4672	msedge.exe	110
PID 4672 wrote to memory of 3512	4672	msedge.exe	111
PID 4672 wrote to memory of 3512	4672	msedge.exe	111
PID 4672 wrote to memory of 2904	4672	msedge.exe	112
PID 2904 wrote to memory of 4936	2904	setup.exe	113
PID 2904 wrote to memory of 4216	2904	setup.exe	114
PID 4216 wrote to memory of 3680	4216	setup.exe	115
PID 4672 wrote to memory of 3968	4672	msedge.exe	121
PID 4672 wrote to memory of 3968	4672	msedge.exe	121
PID 4672 wrote to memory of 4592	4672	msedge.exe	122
PID 4672 wrote to memory of 4592	4672	msedge.exe	122
PID 4672 wrote to memory of 5028	4672	msedge.exe	123
PID 4672 wrote to memory of 5028	4672	msedge.exe	123
PID 4672 wrote to memory of 5828	4672	msedge.exe	130
PID 4672 wrote to memory of 5828	4672	msedge.exe	130
PID 4672 wrote to memory of 3564	4672	msedge.exe	134
PID 4672 wrote to memory of 3564	4672	msedge.exe	134
PID 4672 wrote to memory of 3984	4672	msedge.exe	135
PID 4672 wrote to memory of 3984	4672	msedge.exe	135
PID 4672 wrote to memory of 5292	4672	msedge.exe	136
PID 4672 wrote to memory of 5292	4672	msedge.exe	136
PID 4672 wrote to memory of 5388	4672	msedge.exe	137
PID 4672 wrote to memory of 3276	4672	msedge.exe	138
PID 4672 wrote to memory of 3276	4672	msedge.exe	138

C:\Users\Admin\AppData\Local\Temp\2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Users\Admin\AppData\Local\Temp\2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 --annotation=exe=C:\Users\Admin\AppData\Local\Temp\2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7e0aaeb10,0x7ff7e0aaeb20,0x7ff7e0aaeb30
    3⤵
    - Executes dropped EXE
    PID:2864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --force-first-run
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffcaaaac188,0x7ffcaaaac194,0x7ffcaaaac1a0
      4⤵
      PID:4324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,2880967313198083239,10885186606713403725,524288 --field-trial-handle=2612,i,1416171474666363165,13475984325355800629,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:3
      4⤵
      System Time Discovery
      PID:3416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,782206197913030489,157120221120092861,262144 --field-trial-handle=2612,i,1416171474666363165,13475984325355800629,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:2
      4⤵
      PID:3436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,13574409113887638217,14519248883015553996,524288 --field-trial-handle=2612,i,1416171474666363165,13475984325355800629,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:8
      4⤵
      PID:2888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,3991913946898987637,10189349652665833692,2097152 --field-trial-handle=2612,i,1416171474666363165,13475984325355800629,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:1
      4⤵
      PID:2324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,1595367131199601508,17809239700100112126,2097152 --field-trial-handle=2612,i,1416171474666363165,13475984325355800629,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:1
      4⤵
      PID:772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4140,i,11381898620438981145,10805398240098310706,524288 --field-trial-handle=2612,i,1416171474666363165,13475984325355800629,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:8
      4⤵
      PID:3384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4148,i,15880564746761421641,18280651771451972862,524288 --field-trial-handle=2612,i,1416171474666363165,13475984325355800629,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:8
      4⤵
      PID:1072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4152,i,13909301795826413894,14491155660311875614,524288 --field-trial-handle=2612,i,1416171474666363165,13475984325355800629,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:8
      4⤵
      PID:1916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4164,i,17150630598151793072,537468461691707786,2097152 --field-trial-handle=2612,i,1416171474666363165,13475984325355800629,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:1
      4⤵
      PID:632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4180,i,5095073578048586533,9705066948164287783,2097152 --field-trial-handle=2612,i,1416171474666363165,13475984325355800629,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:2
      4⤵
      PID:3276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,11344789744195965247,4260098220780190389,524288 --field-trial-handle=2612,i,1416171474666363165,13475984325355800629,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
      4⤵
      PID:4128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,3549608844902978168,10781281428075799258,524288 --field-trial-handle=2612,i,1416171474666363165,13475984325355800629,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
      4⤵
      PID:1020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,13172006454575795637,9694511596934272207,524288 --field-trial-handle=2612,i,1416171474666363165,13475984325355800629,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:8
      4⤵
      PID:4952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,1673101441152177673,18328281752575302588,524288 --field-trial-handle=2612,i,1416171474666363165,13475984325355800629,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:8
      4⤵
      PID:3832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,77058802880428390,5239163943393453581,524288 --field-trial-handle=2612,i,1416171474666363165,13475984325355800629,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:8
      4⤵
      PID:2316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,77058802880428390,5239163943393453581,524288 --field-trial-handle=2612,i,1416171474666363165,13475984325355800629,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:8
      4⤵
      PID:1040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,6759253141007380072,7501476555844436177,524288 --field-trial-handle=2612,i,1416171474666363165,13475984325355800629,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
      4⤵
      PID:5008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,14831729888306887552,967859782251185680,524288 --field-trial-handle=2612,i,1416171474666363165,13475984325355800629,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
      4⤵
      PID:3512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2904
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x1ec,0x210,0x214,0x78,0x218,0x7ff6af0c04c8,0x7ff6af0c04d4,0x7ff6af0c04e0
        5⤵
        Drops file in Program Files directory
        
        PID:4936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4216
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x218,0x21c,0x220,0x1f4,0x224,0x7ff6af0c04c8,0x7ff6af0c04d4,0x7ff6af0c04e0
        6⤵
        
        PID:3680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,5003685162501435283,17836464221061829558,524288 --field-trial-handle=2612,i,1416171474666363165,13475984325355800629,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:8
      4⤵
      PID:3968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,9942497337994980799,6309168914140161950,524288 --field-trial-handle=2612,i,1416171474666363165,13475984325355800629,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
      4⤵
      PID:4592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,11268364892747023690,13955056554783466504,524288 --field-trial-handle=2612,i,1416171474666363165,13475984325355800629,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:8
      4⤵
      PID:5028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,7385677409918745216,10096091262773398081,524288 --field-trial-handle=2612,i,1416171474666363165,13475984325355800629,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:8
      4⤵
      PID:5828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,1335324256450070615,9021852071722617925,524288 --field-trial-handle=2612,i,1416171474666363165,13475984325355800629,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
      4⤵
      PID:3564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,14733585612105699296,3978033500009633662,524288 --field-trial-handle=2612,i,1416171474666363165,13475984325355800629,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
      4⤵
      PID:3984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,4883062677179614935,16067073004931241519,524288 --field-trial-handle=2612,i,1416171474666363165,13475984325355800629,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:8
      4⤵
      PID:5292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4696,i,8825717989043052167,3103185885386397475,262144 --field-trial-handle=2612,i,1416171474666363165,13475984325355800629,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,6224828890834636212,6387333713438436733,524288 --field-trial-handle=2612,i,1416171474666363165,13475984325355800629,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
      4⤵
      PID:3276

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

arh.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
Size 852KB
SHA256 40ae98fca5e238b21a74bd166309b097327bacb09121fde6b09e2803b08648a4
MD5 c10a0a272975d17933ca5e6523941366
SHA1 4c40033c0f7a7e7cc7896a67d600e52ffb0f5da2
SHA512 7c998d08e827826a9a43369acd771e16d10141afd5190e7406249063a9a84cf0a0db76c689f39e8832f4447db92f8d1e291d0f8ee01bfc97692e8ffc6b74267e
SSDEEP 12288:eyNh+z+yvXLEofxmIbONr1uF92Bw5iBAczYmIjE72:eU8qm9C5102C6AY72
TLSH
T1EF05BE2678C3F221F21C113880A5C7F0E97A39919A2F959729E1BD3C3951A43AF376F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisabledGoogleUpdate.exe

Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
Size 6.4MB
SHA256 46aab1f2c130b4fec13dc757335ec91cd54da55ab73d762c6ba70fbec7b65a39
MD5 487c6095136ca97684e05937e62a728a
SHA1 47d991bfe39a583bfa93c3b3d8a6e0aeff11c5f3
SHA512 2c392a02b84751dbdd2ee2ab282d12ef754876c64dbb40f000c443193b623fd22a9f0964dbb89da3d1e151e223a91b36d6346c35ef5e3e2fb8c9016db8319519
SSDEEP 196608:sAiog1P9fIlOuz6IgF+I3m2MXP6HG8Qzb:sAiognqO86IgF+qbM/6HG8QH
TLSH
T122669D23B5D14031E5F732356D2D6B3959327BA29F3145CB86A4AC842FB83D364393AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ieinstal.exe.ico

Path C:\Program Files (x86)\Internet Explorer\ieinstal.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

msedge.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 2.2MB
SHA256 53524e18c59dba4fa43edbeceed802275226858aef180ffdb3c8e1550864748d
MD5 3e65a63bf21c8c80cac240bb127ac1e7
SHA1 a65e3d932caa44f5bcb58ab5ac66119e8751674e
SHA512 a2fac05dbe4b24cb3920329cf11d8779beb25cd5e7e233563e2b0b73b84cdf40314901383a9c3466b52f1a1c8a216e5d45a6b1c92d649bd45b2c1a18f60d908f
SSDEEP 49152:yWshzYloYLGCacg7QOitU/03nmdXa5o5QPQ+:yW6zDA3acc/03mdX+PQ+
TLSH
T179B5BE03F68585B5D08CC778CE724BB0AA617C619F1155DF02B07A292EF2AC04E7DBE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 2.0MB
SHA256 e2e166e50676f33ca15fda71cf588940186255fd20fb8cc11a92b11bb9f5dce4
MD5 7e1e5376e598229f77d5f1100c14fcf9
SHA1 ed9adc1faffa86155d4731faef76779cef90d91f
SHA512 23f046e8d22d391e0d8d737abfa60b39f2954788b2cdae63a2b2cc3629bc6b9d21367b5b5b1f0007ca3756a771095be5d76ad86027ca8df0cac70f6117cd09ea
SSDEEP 24576:7Ko014n6OGjiYZsRQfz7GPkorgc3y0w9jfGX7yxgCJd1fbgqf1ChKRADe1qRAi:Z96Oqrsi+P9ru0WjiMgCv1jn1ChuADSi
TLSH
T190A58D0BB29581E7F05EC0748A5641F9EA61FC96CB2056EF0698B2092F77EE45F3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 1.3MB
SHA256 1e75ec9199c528a34f06949642f824b845c5b86fc7c26d61b3f4717da6637773
MD5 730665c00823fda68062521d3cf36e1b
SHA1 03ed9932c61716552795ff3c230038886decf9c8
SHA512 6a99db506b37eabdcea4d2de9196410f06f833da7fcd9aabe7cf14b627b571b1d6d39ca4e6c30531dad9eba5e8e380be29034f728d9ea19d43df92d8587b8dd7
SSDEEP 12288:QOO8hB+xQAlL6aqe9LjnRF22y/0yq38Oo2rOVzw5iaaXIS86nHrUA9HVlK8SQBJ+:J9Bk5N9LmRqR7rkkaXd86n9kAJ9tA3L
TLSH
T17255BF3CBD9B4BA7D02B8532A9564533E9F23C16579252CF0640672D2F322C77ABB724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe
Size 2.2MB
SHA256 fb4ce6679dfc42385c27313431862b42583957143ca672efada276ebd0c4a46d
MD5 00a9d88e76868fe83bf0ea29531ba23c
SHA1 70fc5b7626701eedee0311b9e727af7d6489fe30
SHA512 0f3257768b6f6a7baa2c51e28d9de18d1873ac9050f1f9d4dee7e8db9a4867651839356b45e53ca5a87c4198f0d2e17361087f85fbd10bd404477d1554337e8e
SSDEEP 49152:1bzR9eQmlfehjvHHKTdfxINPEt99G2Bo7EukU1a:1nRIQYyjvnORmE
TLSH
T176B5AE03BE8900E5E029C1B4E7568635FDA57D494B2466EF0760B60D1E37FE86B7AF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.6MB
SHA256 87808ca388006bd177e5f2e5fedbebf222b9fd277e1b502c623cbad5e9844a34
MD5 53d5ab7b2be3fd2f0fc39fd0f78b5109
SHA1 f92ffa0a77640c440304819bd7cf4b2c4b970e67
SHA512 4029ed82daaaffaeac88d45a1fa0008574c0592afcd30e69055ca739d4ab576268904b1338369162eff02aca20d237946e899f4b85034e9fcd4fceb36f3c93d9
SSDEEP 49152:KevZNykZGu6qG13O7Q7gLYduZrSdHBAVfb:HXR6YjwA1b
TLSH
T18BC59D03F68E44A5D46DC1788E269B65DAA27C148F2462DF0280BF153E72FD41F7E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeUpdateCore.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe
Size 1.0MB
SHA256 03da9b6aa872bcd3ffef5fc4690b6e761dadc45d1372c911d7753dc1b2ef1201
MD5 c12e4e6a60d463eef87aeca70dec12f7
SHA1 489645295792d92869e2c75cdae0836e9440f351
SHA512 6cee4d3d0707acd65b1015863a02fc8339bf85b0ac4bc942f8523709e0a42b23fc92f5f87310086234a63aa2cb7e323a4188f067d8187e298d65f2fff6326c13
SSDEEP 24576:UPCDQBUXldmDF3KV5RAL545reoI/ewelMGN/v4mWLqYPhOp:6CDQBmlUDpc5RAL54Ve9YlMu/v4eY5Op
TLSH
T1E625AE1638F48833D03D44792BE097B6A52FA8E1ED110DAB03D1316F1AB166A9D77E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe
Size 1.8MB
SHA256 72d560138faac51dde8a482b43d027b7f7a0bee4a941977502a180dacf39af3a
MD5 b38c62fa86bb51816138d6a5d5b1fd1e
SHA1 3d446221a50a66eb3208ea4f0fd3602df8fec95a
SHA512 3b6d0ab6c6cb95b09f9d7c98089f8350464d4b46a0ee91f0c1e901073cbbdfd014e1e99b15a1b6a6f2209e9c05c01e0ecea9bfe40f3f139da6cd2d1db5c3d216
SSDEEP 24576:Tf0hArrFKzTdz6YmWHHo7fvqcXFudDJdWQCkvjZQqg+lIVprS7:Tf0UqkYzno7fvTqJdbPrCx9pG7
TLSH
T17185BE1AB79894E4D82DD5F09E4A8531DAA67C420B21B5DF03C3B21E2E77FE45B39321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 2.1MB
SHA256 362cc568f180d665c978faff7ca262341df346d851ae614b0020bef96f0b8671
MD5 42eb0ddc44e77022693ab1b0573579d7
SHA1 23b9e4f1bfbebc5320b9f8b51c855cc65200e110
SHA512 b7749ea9c179c40913f516f446bf4f96c4fa0ae4fa27f13720518d4f766219e12368decfd9bf3fcf866f9ab6e509163e8650fd98a799369326ea0810dceacbb3
SSDEEP 49152:ryzOLxRinDvwZ2XuTjPb33g9gZLfCdW9HTlXrk9dBB:rLRiDI4Ds9Ol
TLSH
T15EA58D17B29AD1EAC069CD75C646C533E9AABC014BA556EF0750B3092E77BD02F3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 4.1MB
SHA256 010b36127e3c2fd0b0032ee68d948d500d6dd1dd377a5cf8b17cf659f40b8bd4
MD5 d8694902716c300ebc8b4bcf3f134950
SHA1 afdc37465167a4169c1d060dd24743e26817f4bd
SHA512 4a3a3aac749772b3a786e3b4869d66f2b82f6146b74c5dac7cadf5dbf3d240fd2ad81d556b95d512f88dd65513012d8a44aee82de6e7d356bfc2cfde64d70cde
SSDEEP 49152:ve1pNR+L9yVVqXQuZgk07G0auOj85q7aGScYbb6YErz7z4AkOuaRoBISCaQZCLlh:o499Qo/Yhy8OnZy
TLSH
T1E9166A17E29940D8D059C074CE5A9232EB627C8D47F562EF3290B7D92E37AE47B39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2904_13431954784097073_2904.pma

Path C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\2904_13431954784097073_2904.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

4216_13431954784037669_4216.pma

Path C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\4216_13431954784037669_4216.pma
Size 944B
SHA256 77b4f7a56226dac723e75967c9932bdbb93d57796bd00730b75d96408e00fd55
MD5 275c4b2adfbc66c86da785e53cc8dd97
SHA1 1f376d1be6e80c6ac9602be5b5383f93c429d9e7
SHA512 e50bd3a9e27bfac5177608e704e51051da32aedffc334900b89ad192204e8d7b3af474273ef292c82aae671f2ce18d94e3cf71e1d1395d78e1ec88c031c2558d
TLSH
T1CB11478577685A17D8038B31C4FA03563FB6F9E42B424B6B1545B60F0E132C88E8A080
MD5 SHA1 SHA512 TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 2.1MB
SHA256 3a9dd86dd2c2add52a16838c609e298c8edcc2af78bbd8ae2e823bbf1ee8bb0d
MD5 1f4de86d3cdbbfb0d060a6434bbde5a3
SHA1 3babdf8d5e23fed3017107275d26e59d952c448f
SHA512 e6a7933f11d825f184a22146836ee3f93783b9ac0ea41459463b76a0e9d3af826067b411e41c186d27712802c449b02d9326a02af70a2bf79b5b38689959648a
SSDEEP 49152:mLQxlKCK14MjfPHvJY2fF8FhmS86IUJWQn+6h27d6:VPEnPJbOjjsts
TLSH
T1E4A5BE03B28A92F8D058C474D7128675EAF2BC450B24A6EF0B42B74D1EB7ED45B7A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

RCX3DDF.tmp

Path C:\Program Files\7-Zip\RCX3DDF.tmp
Size 764KB
SHA256 73a649110a55db7337632128a4da1011932d19a636344a7e6406faac5e358549
MD5 96ba2141e56c625da3f11e79f3fe4e61
SHA1 c20346d8d043ef662c78de19f9365704ec274ca3
SHA512 23fc4c448062621624b129cbdafb3479ff19f5dffbab0e74e911eb8da7a004c62244e619067de02a1cdba183db01a2192f12b0a256881f32eee1ea0a362a71fe
SSDEEP 12288:bAqRXWjWE449zL2cQ40me00tBdR0OeWH65rqVgMft6mw5iu:/ZAl9r0l0wCOeWH61q242
TLSH
T14BF4AE0F2351DD51F07EEBB6785157E436622CA3C4302AAEAE71EE4F392F11E6414A39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.ico
Size 3KB
SHA256 2a5c5c2bc95c18eded222f0a38752717c1a6ad20e31bcda6472bbba77ed22fe4
MD5 de1dbafd46ca8d953c93a1c89766a8c2
SHA1 41ec8c2a24317bba7a64f4b60341307033edcda0
SHA512 06a89f154036252f396a9f2ac515c5e03e8dd54eb7ba6c3bd0159f693d85846c4ba1b29c0fdc83f14d8c9128f18db3ee27c73111891dc66f81d4fd14361e6ce2
TLSH
T1D861565C04E3ACB1D6E548B83235B2C460D88A364424C867A89D7AD7CE7D8D473DEB0D
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

dbcicons.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe
Size 847KB
SHA256 2cf1c20cea8cad6ec3d836a91c374c833f64d2646479d997f42a7c0fa21f4a9d
MD5 d9dd7d6b529ef4c73ce8f74099b294aa
SHA1 5138b144f48dff46af8a943128513723bc912fd9
SHA512 c7903a8800e60fc705929231abcb9e0541af0061545b0f5472e3da7c866a273a18a4dbddce694dfe4d0216beee421baa6de51d94c9afb741e2b024533aac2379
SSDEEP 24576:GGZ0RWKxfbAJx3ejwnG+e3GkVmadUbF3RcNi+F:Yxfbwx3++eWadcC
TLSH
T179058B746146C6F7C9960CB8BD5D46B1D2389DB2182CF66F2280FB1AFCF2C0950DA57A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1268878090\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4672_407976478\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4672_467724709\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4672_774065010\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_installer.log

Path C:\Program Files\msedge_installer.log
Size 122KB
SHA256 369ffdc87ee5a736023460f78805e1f19ce6628660b224f2d94500e13dfc1436
MD5 336b0c2a858e9f9822bef67d8ef60ac8
SHA1 a897d2fec4a6f505448b3e2c081121bcf830c5b2
SHA512 66d3df4a2c5dd7ca136b08b3441b0df9f8045796fe0ac14dce85d795b3e4c3bf4efa763e0560aba838cbc74b681e06c389ad1f3787410beb908ef6c890119972
SSDEEP 3072:EpWgfbv9d/oUTGVZkal6LSjsNBSsuafds:EpWgBGVL6LSINBSsuafds
TLSH
T13EC3563C3B0751776B49BDDB2A52752469FA2293F1C01AE9BE69D100F0C79A2506F0FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x86.exe

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
Size 1.4MB
SHA256 17784abb48e20b6b04c7c12bcdb9811132fc09f0fa765ec7915f7bab1ed12151
MD5 5b24b3d37397b11bc66f342463d18352
SHA1 23998b871f9db775e844cb88a6dccf90c16abdf9
SHA512 8865b8342dfea37b393f8906b722c4e503d037d36f6172b9d25dd167756ba9895aec5175fd5d738b80adf2f56dcc5175e7c9d75ae9a5f4f860f6038bbc65bbb2
SSDEEP 24576:frtV6qku4U0YlZxGbii0aYfoPoEwhY0ZComfMysZgjS1hqgSC/izGfU2JGlbhlAs:fjlku+YlZs/nBoEwhY0ZCXfRjvQo0nGV
TLSH
T16E65C03EE1604073D1B0DD3F599493BDED2A9528DB418D1A92C5FA0CBE6A41C3BF7226
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 1.3MB
SHA256 dcc259013d1d205f771919b67d1668532648faa790cef1f0cb45a2e77586e4bd
MD5 992b5ddfc9734a6c815c9b72f9ca3f91
SHA1 7a3adbd020140aed72813b843c3854b747002ca0
SHA512 9bd0dda8e6e5259fc44f000eeedc3fe2e92eff86633b54f32852e0b7af93670aa4ae4eeff592c1d551a224b8498f5e4f4bb9317513c506e0192f8770fe7eaae6
SSDEEP 24576:4BHbpjQkgeQq99DBUbOSSBgCSsm39PZfePv3r7fm6t+jqp+3l+zCM0D:4BFkkn99D9SzsgZ2HbbZt+jqpQ0CMO
TLSH
T1F065BF31716D5832E6A9083B695C82F36D69EB251F314CFA97C5EC3F2E2408216B36F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 1.2MB
SHA256 80c1c02171133e0f295be2ee6d820ca1e82541342f97933a6385a347e7631584
MD5 c0306035e6c8eb07e62ccd0ae7947449
SHA1 69931c5948a87975a86960a4cfd09f3d4a4c58fc
SHA512 7385e0bbadacc2cb463bcdf1147b5be79727901c6cceed445c91abf906b0941805f7613927b80adb12ada876bbdc9eb6db9e670b71718363345390ef14068d78
SSDEEP 24576:Yda/LwEusT3poalnguTl9aPEBOkUhMXcBwc04nA:PEEuepvljTjbUasqc
TLSH
T10445BF64B5E08476C8B40A71A650C3607F2A72702B0B8CE78DD46E5D2C7F5A666F3E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 e325a9cf514a34dec909cbaa7ff172754802364b525d53412f7bd25731517944
MD5 3eebcdd0a8632fd36870d32210240f0c
SHA1 b2c8a1e68a730dfa194bf3a52450c495ecf27977
SHA512 1ac18fdd9b1134193c14058e1bfb6f2347df7fb0c012093781cb5b8f2fb88e0b7fd1f82c25376ba5bb99694934cd23983c03b2ea16dd2237c186847cf24589f5
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e58eacaa93f711d5adeed0bddd4c0caa28eca1f74b1d789bcd86b78de36e5f32
MD5 303457e8d750b7b4c380323d1f1698c4
SHA1 f23dd0db6782a94c04de2f4df62d1a86e285a647
SHA512 f81b31a092aa12d16cfc48a4be278c87482e5295b1b0d08b7ad2bab771ed4a65c9b9038c65d429bfdef6a4d6922e906a87f7e13ba8d5c6dbc74f8ea3684b018d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0dee4552e24ddb56216029ef0aa8d8543f99f70af599e6f2a23acc073ad9f354
MD5 2e732b20187a4f1cf1aae6bbc91cef08
SHA1 141c480cb60ba805e4e5919958f043850929b4ce
SHA512 c3149cd662124ecd728c5d0611902b4ff454bea40ccb65c3aa2dad1024a1c6df8fea28a29562bb205f82ce3bcfafd6e7302b7aff142e3674bb5e3c4f698b6366
TLSH
T13AD022B0B2200FCFC00B00FCA0228F800333EA830A0323B028B220C3ECC028B208302A
MD5 SHA1 SHA512 TLSH

Submit Download

71095dad-9162-453b-970c-9eb53512b6d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\71095dad-9162-453b-970c-9eb53512b6d8.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 8c7a826847c055a2db5a972533dc8948924e3aaa095d370792275184009e0278
MD5 b221669704784e39d285628ae67ef626
SHA1 b8cb69b00ad66895b91ff01130da8ee8ce8815a0
SHA512 529e41be07efe898c9ef17834c56bcec220ea59bc04378e17c0bd05d458a6f41ebbda4120447de5cd42284d2c5f9664134f3e9c36431c4805794a621157a53bd
SSDEEP 96:wpqfU0t+2ga3paqA/k4orvuQR1delX8XgZpj:wpQHTga3pBMuzuQDde18Xgr
TLSH
T1C0C1A7B874D9ECF6DFD12671D4913D7A35B041D8F806BA0A03DBE474648A3B8056A49D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58c5fb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c5fb.TMP
Size 3KB
SHA256 1e81969be6b333e112e60a66a1b6fa562c6ae6eeab1e3fb2263a4f4e88a6f54c
MD5 89f72d1c140ee6d58cb8f7a581862a42
SHA1 2c890b901596adb496d1010c085c3c1a0f198a94
SHA512 c2ba9ce09ac80b84a8481a7f429b3306e8c3c5f823be8e7eb823c1b141d8bdb2b0b802c6aba7a80b5a6d217ee30128d83d17739ee2eeb6323a1d298b98bb1c8e
TLSH
T1D861C3BE0582EDF6E3D13A3190C03A8738F190E8F823FD5D01E748BA640AB114A6A4CD
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c25745682bba8bbc6585278a9fecb04dc532e69f07761dbafa4bc8221889e1aa
MD5 31ba7ab2b4815584066d4718ace3da39
SHA1 2893274b63dd8e9b04e67f412b4f95cbdf15f8c9
SHA512 06d3c3f5bd1862c4ab133a00b0d243e56aebf650c89a7de62f27962afc4234f198395a8192f3f427ff8fa8c194b54c5757e6921c211be5994c1625be9afc1dfe
TLSH
T1D381AAF3C3E9862DC91196F0AA146F1BCE1D0555436C3D8A89E4AF4BA3F24B1E151A8E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a9b7cabd1ebc5c278d40c88e97a64fde870da6faa95613c795312fefbcb0b14e
MD5 e2b86bc244ac09277ad0432930c6af1d
SHA1 9a9c12ec8d24b1a7320f4618bf55381dc2f95922
SHA512 bc18855f4e91e8d36eaf69983bf6640230c7cc1d56076cccf3f32dd26cb9e2b97dfd8f7d65d5c2c858faf383e71672829dde934c08ca99a0187d9c27d41861ff
SSDEEP 192:sxZnRiyM/jK1Ml8MEW/fIskYXqZUb6ldpmpHW6+WNB38/Y9IlQTxIg4J:sxZn8cW/fIskY6tJiHbm/6c
TLSH
T19362E7116A24597B8CDBD219F9457B53E6F84463D2940E88A9FCEA1C04F6BEC2317C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 420f2c11c86b87c92ee54a4c6ab22651fea4e6cbb533800faf2a263ffe4f48b1
MD5 2805ca8b6fe0815a7749c8050f961386
SHA1 c77f8e73cde04e225312c430a049ed6b1b725f77
SHA512 f271505b6c2e1a895bd964eb13d7e2e8e2386fbe216023b5dc424afbeaffba530c70f92c14fe097ad4209a482473b9312f7a384c1351693052904452776de187
SSDEEP 192:sxZnRiyM/jK1Ml8UQyEW/fIsfQfQaRDwZUb67dp4pHW6+WNB38/Y9IITTxIg5cJ:sxZn8qXW/fIs4f5REt3YHbm/Mi
TLSH
T1FC6208156A2459B78CDBE219F941BF43E6F8447391940D48A9FCEA1C04F6BED2217C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a076a6911457c0a7c99dd12a977f7714c0fe05a7cbe2a204e9196daee7bc8c56
MD5 377c9fa049b5dbd9fddd96801d77eee9
SHA1 35ec55ccb09d41127de2290946002ef11c6f0209
SHA512 58c6960fb8b5c29f8db932a9091962cf74baebf4d8a05f1b4c785755698e837d0c5fa335077791cc1d6dc725e13c82b22424398dcf34d03a07ebd723710f8a23
SSDEEP 768:+Hcv20wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVuFLlwmWN5roE6V4t:+Hcv20wWvu+Z+u1jahFLeRNyE6c
TLSH
T19EE20A3B280CCB7E4F841E9CED2A6F866ED801CB56988D5447FA884C03C77EB511B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3de769c1-1a74-4f2a-8383-bb3211a296d8\index-dir\the-real-index
Size 600B
SHA256 bca01b1a29a48fd87b20e8ecd6c909c49537e1155935faa5e45e5615eb3d847e
MD5 78a30ff8335cf66411d2d8b14434eb2e
SHA1 d7e259f0541d2a890d8d460329c67d82fb4a7f13
SHA512 899c70ee4bf0a701fb007b7b5581aaba4eddd17530454538b4a0fb9b26d97b1c96b00b3ddae864b4778be0a2a63e5a215c7ed5e903db23fc36f3e191045eb36d
TLSH
T16AF0AB265FE24D2FE95602773AF690FCB1700FDCA331C433A62D46A97E1635864861DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3de769c1-1a74-4f2a-8383-bb3211a296d8\index-dir\the-real-index
Size 3KB
SHA256 f63f74c90ee56905d3857593e3cd8a7ea3aaf0783a3bd142803b7f2cea208faa
MD5 e95fa0daa9202d64b880757a8ccb4dfe
SHA1 fd83e68fec144037740aed86a984d9cdb63916ef
SHA512 82263802a8b0d935d394641159e6c486a7b502acf00071f82aa4c3d04b67693fc80787a68012b23a322823fe7d321123a6e1dd57ae361b7306f3d94652a76f51
TLSH
T1DF51A54F9D4B2E55C9AD01F320FA1C82337428FE47944A47659CF571B88332A1C1EA5D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584e0b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3de769c1-1a74-4f2a-8383-bb3211a296d8\index-dir\the-real-index~RFe584e0b.TMP
Size 624B
SHA256 102ec402f114578253104e59811885f1eb3f9cd87acd3b44614b3cd23d68b2f9
MD5 e8331e3b18cf4649adf3a13a679e4733
SHA1 28bedd97bbfb01afc23be6f04804fba5e0efd7b9
SHA512 5c4338c0d2f8cb3584bb32d4da4a1550fbee263f2113bdadc7837550a2af94b25aca69535d1c40a53de299760df96d01f1239260e0be12ce9df6fbcb8c9290c4
TLSH
T1C8F0DC27CBD14D91E484067B2DB990B8F2200C005222E1A3502C552E5C266C80A120CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3f436495-df4a-42db-ba3c-15a8a2b50981\index-dir\the-real-index
Size 72B
SHA256 47e4aee0b8b78c1d6ee1d177f85f1e79ae83acc9e279e45d5d752e120fe5be7f
MD5 e3a108d96b8c8b366caf4398567e86d8
SHA1 7bd025c91d0f666ad264dd476b048292b9323a95
SHA512 ca33f42f7d318deccb1a2d32c17c29a4a2ff8908b66089520d673a13a3e79f0c504109202bd2ca4892cf43e7d04ea8f4ad2ee8f9becb6004cc84d42b7d2f2be0
TLSH
T12AA002DA06C00009D40292B425D605B13752ED120202634746D28168DD74665CF6201D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3f436495-df4a-42db-ba3c-15a8a2b50981\index-dir\the-real-index
Size 72B
SHA256 1a7f63c692f802f8b251585200675d72066367a7a652a03bdc90a094e4116e95
MD5 054979e27e05034bb9252222dd3933eb
SHA1 644afe5acca58d62b4167a26e9887f711383cc9b
SHA512 c3ceac2550e22038d8fee602edba075dd164888ef13534f89b51d65108dec103a9bd7c672e0030ec8cfc7b0e8b7960b7c56a5ccf0910abcb3ffba55e46250277
TLSH
T17DA00410CFC10555D55351FD775307411301CFF535041F4751F50144DC714404DC501C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 ffc013a1281ac0817b2c27f83738ca4f728bd078a00554b4c3bcdf2f29e95efe
MD5 a8591218b4d26ae13d26cfe54a798924
SHA1 64e93ebf518178593e93f02d358e350d55cf1e58
SHA512 44c73ba4bbebd5e1a7782ddd6d8e099b1e27811dcdbbfc37c705ca103b1899c2e2814b57f359e00a620a46f9e927f3833b1ec99f1e6474af3d05922ccf632920
TLSH
T164E068F22FF70950AC7F97DA187090A44842BE5C8D00FC4F102A65CB20717113129CA5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 429b592e87e038544fabd6ac00ffee535553768fa5b740b97ee9fcbcdc5eb457
MD5 590aba6168791b8d58dd31d4e1954df9
SHA1 5509cba55b4f3042d75f87eb0cbba11b56b20ddd
SHA512 2f71d76eab15d5495956f5f4377bb66db0b364e35c7b1657ee71e64d68fcd69a64d0f858215fabd5a2236d6a83e3a726bf3731c6d6f261fcc892a586314a4f51
TLSH
T126A002318A4EE502CC29467090ADD1417F608C9905B5532969DBD8ADCFF5BD151C5101
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a311.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a311.TMP
Size 48B
SHA256 29bdc1807568399bc48a1fe121a4f13ad751900b782ada37848c2b762d0fc644
MD5 d73232f03cd85eb4669b03cb5a134261
SHA1 e4038c9e2b3b35d6f33b0e809f5ebf8ab81b1919
SHA512 5d5efc7c2a70367b1652e6815bacc101ceb870614ff2e844d04179cc27fd743be66ac85ee5d4f9d4d320ecf8ca967816d93a684ccfc6e0986cabf21252e9005d
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 e0c3fef91834890f792e8489999e5ab7215246128883e5977ec3572dff06d5b3
MD5 632d8bbd3e9a8597f546a10c68cf269c
SHA1 1ca12ef8fecdf9e96133e3132040813018d1e5d3
SHA512 86ded3fed3d1cd77bb672a535e988a4262d7ded50042596c4d1fbb5bda56b0e9bb37a0d860697be85ef08f34e9ec718604b797274f2c5fc2286dc3ac99b830d5
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDCygKTyamXeKQQOkzYvTxJ52LJe95T2KBTX:mTfHt9kzYvTxJ5iJeTTjT5NObzm9b
TLSH
T1DCB1931130BA02573C3F294CA2A795261E4630627596E67F3FBD00E25E6BE525CFC8DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592d21.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592d21.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1da034734fafcd9750a3967f6861349da898c1c5b7defddf2de683d8c030e41b
MD5 9cbae6c3fade1ab8607bc936f0376fec
SHA1 890a512fdbbb6ba94658870a63e0b6ddbd987ccc
SHA512 0e27bbd44d7d36b19d1ba84f7f7c8e496828d0df6d0f1e2b87bc6a4e8975e022b89d802ffcf42033a61536e5eefa029c6e9c40ed09d08fc333aeaf9db583959e
SSDEEP 384:n2ZcIhsNDm9Kqzi9ACe+CXOmep3JrMv77vwuaoR:kh7vL1vO9p3hMv774ua6
TLSH
T1D5827D316D385CB65DE6E145F94A25179FBC9067D6CA2F80D4DCBF2C01EEAA8130AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 3207464b038190f7ce1d8c228c5efdb6a6ad05f5dcc161c155ac0ac5f3cc4f56
MD5 b972c5a962bc4205425ebf4d05b1cb81
SHA1 7f3471ccb4d9efda5f355823365d6b7b9698eb44
SHA512 107881d6450ac15c0b4e4bbb8e87dc2d2e97b33a9e19876e681f8dc114b88fc8cb5b5959af8c39d7eb7530dea34e8f6e2bca2fc3c3f828247c44529e548b9fa4
SSDEEP 384:nJiFiZcI0sNd8TUNTUlIl39KqzifICZDf4S+CXOmep3Jr4v77vwuaoR:gFQ0owgTvPvSvO9p3h4v774ua6
TLSH
T19DB22836DD64CA6BADE693C5F6467647DEF440A386CDAAC0D9C86E1C00DB6ED030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1a1a5a4293889f8faa306f01d7ce31ebdb7c3d9de22241bd172470efad026e83
MD5 6d9e5d7e291aac8f39ee3197cbbfabda
SHA1 40349aa128e5da507bd387cf0584819ec2462342
SHA512 2a5a9248f5e5cd61c2653c21a5db019f1acb51482a755d9a0755fac1077e5106f9c0bab58d8717530bdb0cb549f9500e928bb1b2aba86ea71dc4f7fbcd59b1d8
SSDEEP 192:iONu6v+YL7QmiUy8ueh+CG6Om9opwSJrHzCHvbqHLwU6:iONu6vzxieh+CXOmep3Jrgv7U6
TLSH
T1E1123B35B9385CBB5EE26595F48736139EA85127EA8A3F80D5DC3E1C02EF65C130A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 97062166809e6ade58e6444e3cb87bb1cc5b15035c813c8d735649c931917e0f
MD5 e13536fd270b68c8a71ec9dff619ff9b
SHA1 4655f7e2c379d1fd3ec32178a26c61fb7fa729e0
SHA512 117c588b092d0fc7010b677d8423673c37336b6d5f18ff3f8fefc91bddd7ae1abde7ebcadf26608ea0829a6fdf7d74cf5681b12eaed99f536609857c19dbb08d
SSDEEP 192:JONO6v+YLNQmiUyDuZh+CG6Om9oEusYlU6:JONO6vz/jZh+CXOme6kU6
TLSH
T11202EA35BD281CAB9FF26E45F98737175F98117BE9952F80D9D42F1C01D764C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 37dcd7153d0a55caa2f5f493dd2a15122f620947b37906a5ce4b8aece631e87d
MD5 8fef4b2af51381f7ffcac78db8171ce5
SHA1 a8e61203c89ebc74844acf8a5fba29861cdf32ae
SHA512 be8e9676503240640955121f4bb7b557b0a97642225c27209d3fae71e89b011a77844825bf0a24728d27602ce292d2ae1b1c0961651d5aab80c273c946db59f1
SSDEEP 384:nzZcIhsND39KqzifICe+CXOmep3Jr4v77vwuaoR:rh+vP1vO9p3h4v774ua6
TLSH
T162827C316D385CB659E6E185F54A25179FBC8067DACE2F80D4DCBF2D01EEAA8130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

10279f87-517b-4754-8124-f7bd8b109740.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\10279f87-517b-4754-8124-f7bd8b109740.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

OneDrive.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
Size 2.3MB
SHA256 7d30da4a74fcb53612c4b10b40fc01fc94c945463155149a4045cda619fb46e8
MD5 317e7b9be6921e3866b9ed49cc5b749e
SHA1 1360e5666fe448ed0e0015a5394c520798583c6b
SHA512 a889b94801b0c480575401f321590fa046b087f2eded3a5451fd1ef35ef7df2873bc0cbe5bd5a4effd5ae2aafc1936edec6c518836de668b63c7470b84a08854
SSDEEP 24576:gqx0mKxlBFm2E7aCo9nrGjPzTUouBBBorwDDs47WXnueVulvspdb7LMK:jG7GLzTURBBBo8Dp7WXnu6ulvKdfLMK
TLSH
T1FFB54AD37EA0F261C1954971391BA9FD9A537C358E2341C733D3F32E357A2A0692A13A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 41012bf366e1a9c433141b2578de310c30053fc7c6a41d3d2800c86d6a6ec5fe
MD5 dabcd16837c648babb9125a13c32729d
SHA1 ca2c7c2f0921e86023143df4d6d729ff32d493f4
SHA512 321c77a268dd39bb6ecba93e707dffc51b38322bc7bf286c0616e7c37fc014ede28ee72feeb702819301279ea3ab8732f81ecc5c72bda8d5b757d4469f69f479
TLSH
T1CE41F75CB6E91148B3B76E5A9BF6A86D487FBD372F0BD55D00110D4E0A36B40C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

12a9e87b-d033-4af1-b784-bb721bce3b37.tmp

Path C:\Users\Admin\AppData\Local\Temp\12a9e87b-d033-4af1-b784-bb721bce3b37.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
Size 3.6MB
SHA256 02b3c39acd7a0c6190e3d95bf54a3713639d05791f39e46b80f49ed570ce5342
MD5 a393ede1fdba517c92ed5064847475a7
SHA1 561d8e3895bd0e309cc5fc23ddf70e8b2f96bb45
SHA512 c24d1c7821df1467aedcc1f919362628665f9845bebd722af8f6fb494daead5c61937c55a809483ac034afa6fa4c83095017cf469f428be717e9ffc4eddfaacb
SSDEEP 49152:n23IetlomzqbeWsLf83Won5L3s9x1OxGBcq2exk74gcAFu4OuDmGRmR/1HLiTs7:pbm71OxRR9Sl1x
TLSH
T114064B03A2F541D8F0BAD6789B359B32D977BC855B38A1DF029056191E36FE09F38722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e9999b4e-07b9-4a49-963b-e57bf97b1cca.tmp

Path C:\Users\Admin\AppData\Local\Temp\e9999b4e-07b9-4a49-963b-e57bf97b1cca.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4672_1422241319\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d850cbcd-5eeb-4c48-8dff-c9f2c23194fe.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4672_1899145892\d850cbcd-5eeb-4c48-8dff-c9f2c23194fe.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\Desktop\Microsoft Edge.lnk
Size 2KB
SHA256 1776b12d63c4033de5310f8f6152b34dbfc9dd738c329e6ffb840cfbf6d787ac
MD5 a71f70b638765e6e40b1ac5eefc6a2a9
SHA1 b8feacbe6761f8cbf80059608d32ed8c0a5ba649
SHA512 b5f662681ef27b4c918b4370931f126d5e80863dfdfe635bda9e8cb30f937fa809ab1cf93397b8ad8e450b40182b2e1634a09f01b396d9fcbab42593f0524668
TLSH
T1CC41E5145BE50B29F3F6ED72E9B37B32AA37BC15D518471D408442081CA3B0AC56DFA7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2476-0-0x0000000000400000-0x00000000004E1000-memory.dmp

Download

memory/2476-1106-0x0000000000400000-0x00000000004E1000-memory.dmp

Download