55c3458ddc4e8fe83d14f19b4d7a3984b5ee0497bad19c450edd910f04faef70

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 10:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 4.4MB
Sample260823-mlc7jaaa45
SHA256 55c3458ddc4e8fe83d14f19b4d7a3984b5ee0497bad19c450edd910f04faef70
MD5 2f0528c366854e721213d1e8bf784b8a
SHA1 c74d9a492e8d9fd6ebedc41f32d80c329048d1ca
SHA512 5a37dd7ee3a64bc9e5f433257105b5f01015a8072e6765759f7d38ea12ddf282d323d169f49cf82f0be29150112be89dbb3c660e9420c6413e91830b94ef35d0
SSDEEP 49152:RCuzCOe+6sa23IetlomzqbeWsLf83Won5L3s9x1OxGBcq2exk74gcAFu4OuDmGRq:2vsYbm71OxRR9Sl1xB
TLSH
T177267C03A2F549D8F0BAD6789B259731E9737C858F34A1DF06A056191E36FE48F38722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4820	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
6020	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe.ico	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCXC44E.tmp	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Media Player\wmlaunch.exe.ico	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCX24A.tmp	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\RCX10FB.tmp	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\RCX8DFB.tmp	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe.ico	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe.ico	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\RCXF770.tmp	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe.ico	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\RCX1C9C.tmp	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\RCX1D1A.tmp	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCXAB92.tmp	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe.ico	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCXBE61.tmp	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCXC351.tmp	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.ico	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.ico	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCXE2F8.tmp	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Windows Media Player\wmplayer.exe.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe.ico	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE.ico	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX9B03.tmp	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\RCX48D2.tmp	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe.ico	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCXBA11.tmp	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX9C0F.tmp	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe.ico	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe.ico	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\RCXE17D.tmp	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe.ico	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE.exe	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe.ico	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\RCX8D4E.tmp	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCXBB9C.tmp	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_546687797\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\zh_HK\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\nl\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\128.png	msedge.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\ur\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_221586602\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4160_2011959498\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1094350312\_locales\gl\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2828	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134319547844538709"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{79045D6E-D61B-4B77-BF07-E1C2A3CE4956}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4160	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1840	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
1840	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 4820	1840	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe	89
PID 4820 wrote to memory of 6020	4820	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe	90
PID 4820 wrote to memory of 4160	4820	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe	91
PID 4160 wrote to memory of 3384	4160	msedge.exe	92
PID 4160 wrote to memory of 2828	4160	msedge.exe	93
PID 4160 wrote to memory of 1956	4160	msedge.exe	94
PID 4160 wrote to memory of 2028	4160	msedge.exe	95
PID 4160 wrote to memory of 1956	4160	msedge.exe	94
PID 4160 wrote to memory of 1956	4160	msedge.exe	94
PID 4160 wrote to memory of 2028	4160	msedge.exe	95
PID 4160 wrote to memory of 796	4160	msedge.exe	96
PID 4160 wrote to memory of 4112	4160	msedge.exe	97
PID 4160 wrote to memory of 796	4160	msedge.exe	96
PID 4160 wrote to memory of 796	4160	msedge.exe	96
PID 4160 wrote to memory of 4112	4160	msedge.exe	97
PID 4160 wrote to memory of 4112	4160	msedge.exe	97
PID 4160 wrote to memory of 3700	4160	msedge.exe	99
PID 4160 wrote to memory of 4776	4160	msedge.exe	100
PID 4160 wrote to memory of 1200	4160	msedge.exe	101
PID 4160 wrote to memory of 4480	4160	msedge.exe	102
PID 4160 wrote to memory of 3452	4160	msedge.exe	103
PID 4160 wrote to memory of 4480	4160	msedge.exe	102
PID 4160 wrote to memory of 4480	4160	msedge.exe	102
PID 4160 wrote to memory of 3452	4160	msedge.exe	103
PID 4160 wrote to memory of 3452	4160	msedge.exe	103
PID 4160 wrote to memory of 5288	4160	msedge.exe	104
PID 4160 wrote to memory of 5288	4160	msedge.exe	104
PID 4160 wrote to memory of 4344	4160	msedge.exe	106
PID 4160 wrote to memory of 2632	4160	msedge.exe	107
PID 4160 wrote to memory of 4344	4160	msedge.exe	106
PID 4160 wrote to memory of 2632	4160	msedge.exe	107
PID 4160 wrote to memory of 1504	4160	msedge.exe	109
PID 4160 wrote to memory of 1792	4160	msedge.exe	112
PID 4160 wrote to memory of 1792	4160	msedge.exe	112
PID 4160 wrote to memory of 4724	4160	msedge.exe	113
PID 4724 wrote to memory of 1832	4724	setup.exe	114
PID 4724 wrote to memory of 4588	4724	setup.exe	115
PID 4588 wrote to memory of 1552	4588	setup.exe	116
PID 4160 wrote to memory of 1880	4160	msedge.exe	118
PID 4160 wrote to memory of 1880	4160	msedge.exe	118
PID 4160 wrote to memory of 4544	4160	msedge.exe	120
PID 4160 wrote to memory of 4544	4160	msedge.exe	120
PID 4160 wrote to memory of 2312	4160	msedge.exe	121
PID 4160 wrote to memory of 2312	4160	msedge.exe	121
PID 4160 wrote to memory of 4064	4160	msedge.exe	123
PID 4160 wrote to memory of 4064	4160	msedge.exe	123
PID 4160 wrote to memory of 2456	4160	msedge.exe	127
PID 4160 wrote to memory of 2456	4160	msedge.exe	127
PID 4160 wrote to memory of 1220	4160	msedge.exe	128
PID 4160 wrote to memory of 1220	4160	msedge.exe	128
PID 4160 wrote to memory of 4916	4160	msedge.exe	129
PID 4160 wrote to memory of 4332	4160	msedge.exe	130
PID 4160 wrote to memory of 4332	4160	msedge.exe	130

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4820
- - C:\Users\Admin\AppData\Local\Temp\2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 --annotation=exe=C:\Users\Admin\AppData\Local\Temp\2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ff61ec7eb10,0x7ff61ec7eb20,0x7ff61ec7eb30
    3⤵
    - Executes dropped EXE
    PID:6020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --force-first-run
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffbe17bc188,0x7ffbe17bc194,0x7ffbe17bc1a0
      4⤵
      PID:3384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1672,i,8884149303287431116,9485254329705052303,524288 --field-trial-handle=2468,i,767838173527356600,12937442416481369649,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:11
      4⤵
      System Time Discovery
      PID:2828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,16736800695562686380,12636824303878947288,262144 --field-trial-handle=2468,i,767838173527356600,12937442416481369649,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:2
      4⤵
      PID:1956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2204,i,7570510433396680154,14569060661025864548,524288 --field-trial-handle=2468,i,767838173527356600,12937442416481369649,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:13
      4⤵
      PID:2028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,10786844323699891956,16797682270757157289,2097152 --field-trial-handle=2468,i,767838173527356600,12937442416481369649,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,16128078502236088881,15373370440963746150,2097152 --field-trial-handle=2468,i,767838173527356600,12937442416481369649,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,9900469172305496598,16466356836129472712,524288 --field-trial-handle=2468,i,767838173527356600,12937442416481369649,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14
      4⤵
      PID:3700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,18338995440962531967,12375778110209465376,524288 --field-trial-handle=2468,i,767838173527356600,12937442416481369649,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14
      4⤵
      PID:4776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,725803227432191477,5420922470456160852,524288 --field-trial-handle=2468,i,767838173527356600,12937442416481369649,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:14
      4⤵
      PID:1200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4304,i,10091557626794142513,9004586205840478968,2097152 --field-trial-handle=2468,i,767838173527356600,12937442416481369649,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:9
      4⤵
      PID:4480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4296,i,1285867709386443738,11814269880937643664,2097152 --field-trial-handle=2468,i,767838173527356600,12937442416481369649,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
      4⤵
      PID:3452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3444,i,3248371909570833529,13696397557225490684,524288 --field-trial-handle=2468,i,767838173527356600,12937442416481369649,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
      4⤵
      PID:5288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,16541210031107699354,13748489301550961152,524288 --field-trial-handle=2468,i,767838173527356600,12937442416481369649,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
      4⤵
      PID:4344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,7767105013878955546,7149876822425097779,524288 --field-trial-handle=2468,i,767838173527356600,12937442416481369649,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:14
      4⤵
      PID:2632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,8383037201023534093,9726226786695588409,524288 --field-trial-handle=2468,i,767838173527356600,12937442416481369649,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
      4⤵
      PID:1996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,8383037201023534093,9726226786695588409,524288 --field-trial-handle=2468,i,767838173527356600,12937442416481369649,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
      4⤵
      PID:1504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,15404150913314174836,16348109499720379387,524288 --field-trial-handle=2468,i,767838173527356600,12937442416481369649,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
      4⤵
      PID:1792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x244,0x248,0x24c,0x21c,0x250,0x7ff7bfae04c8,0x7ff7bfae04d4,0x7ff7bfae04e0
        5⤵
        Drops file in Windows directory
        
        PID:1832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:4588
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x21c,0x24c,0x7ff7bfae04c8,0x7ff7bfae04d4,0x7ff7bfae04e0
        6⤵
        Drops file in Windows directory
        
        PID:1552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,6160747960970863096,4996931263268181713,524288 --field-trial-handle=2468,i,767838173527356600,12937442416481369649,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
      4⤵
      PID:1880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,16007468279155569420,18067217618895520067,524288 --field-trial-handle=2468,i,767838173527356600,12937442416481369649,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
      4⤵
      PID:4544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,7607863156733185622,6249818032112981283,524288 --field-trial-handle=2468,i,767838173527356600,12937442416481369649,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14
      4⤵
      PID:2312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,8861347632199421259,14384623922569577685,524288 --field-trial-handle=2468,i,767838173527356600,12937442416481369649,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
      4⤵
      PID:4064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,16880372702809975880,12092988681839907540,524288 --field-trial-handle=2468,i,767838173527356600,12937442416481369649,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
      4⤵
      PID:2456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=800,i,17719380111166668431,12433485011652660243,524288 --field-trial-handle=2468,i,767838173527356600,12937442416481369649,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:14
      4⤵
      PID:1220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6656,i,498865891248471982,9347868309180369520,262144 --field-trial-handle=2468,i,767838173527356600,12937442416481369649,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,10487677002195349534,3192032802712811836,524288 --field-trial-handle=2468,i,767838173527356600,12937442416481369649,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:14
      4⤵
      PID:4332

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AdobeARM.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Size 1.9MB
SHA256 7dcfa57ff2d52d6e901b9d595317ed10579994e57a74a60d5790ddccf9ea5310
MD5 3efa4a24f64a7fca5760b99a75dffde8
SHA1 3fc8a6304a9d245ed5a052ebf1e98c741e19de35
SHA512 425e3ad9848543a8b45651ee25b2f09248fa0ed9f76c1978386d3d908165349cfc4d8fdb2be73af160d0104d857d40b60aaf2e07108542b2de0c611228fe9b26
SSDEEP 49152:prR8gMtGp447+E1cSgouvAeFfenxyQZXS7uQ0NIq:jI43iS1uxaxdS7u9
TLSH
T1DD956C8237F84129F5F37B30FAB987609A77BC61AD39C50F1298124E09B5E549A72337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe
Size 1.9MB
SHA256 680f4f337f43d1a7573b85c5602669a1093cddee1e5978eee4afb3a9dc0026e4
MD5 6b57fcc3a0d753d738a32c7919ade01a
SHA1 5c6f811ea448ab1d4aea8f31e392fd4629435b4e
SHA512 107d204f9e6173ba790fda1a8d96c3c2825c8809cd3c67e5a645bb70b11b015836dc1b8c1c09800882dc014601bce39b9352a4ec562ac000a3c805835091e65f
SSDEEP 24576:w3QIrEA+Zvbn+lWk0eTy5xDz7EqnPATW41PcL3LU:w1EvNbn+lp0L5xDzoMY91P27U
TLSH
T16C959D02B9864CF9E09A84B08A127171D6727C520F2577DF1694B75D3FB7AD82F3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookie_exporter.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe
Size 882KB
SHA256 1b6e20c94e7893b280f9425217e9180713d2a0309ab8b7baa63c556b8c5d7971
MD5 52712c25e14c09e6e359aa63cddf454b
SHA1 3af9d1b9f86a7b5728d16115c5b672bbdee509c0
SHA512 a42a58a7d1d8cddc0099d7e4abf92fdceac9e92e6b3f201065da9007b47459f17b1ed85b4c617a2ce2718d5a4270bcc81762395ddc980e0b144c42e2c53c4891
SSDEEP 12288:nTf08FYArrm4tw5zxFS5w5ispsnRpAr4svndNIaUnE:Tf0hArrFKzTdzuTjE
TLSH
T1FD15ADA97BA5FCE4DC2916F16C4C8AB0C76E5C615D12F46B03D33A1E2D65BE00DB0672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe
Size 2.2MB
SHA256 404f5ac757e9485d10d747e6bb5219b63308b29e67521fc26507eb4a73c035cb
MD5 e04553f7020b22ff254ffe78b4a3dcd0
SHA1 a982c72d7f5bf4d4341a419ae7d995d7773472dc
SHA512 bd352bbb2c98c00f67f50638c007c1071803bb6794271abba6abe89ec2b28aa6bf551b2a4b4ba43e31abefb18767b3809224d271ffc61098328c34825f013ddd
SSDEEP 49152:iTY2bKQ/VGtn4fehjvHHKTdfxINPEt99G2Bo7EukU1a:9QtGIyjvnORmE
TLSH
T123B5AE43B2C444EAD05AC074C6168736DBB37C8A1B64A6EF0752B6495E37BE49B3F720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe
Size 1.3MB
SHA256 5544b9e6c3d1699e842fe73129929726e57f905aca97f711b0d2e82ef85dcf96
MD5 027d817174884c4d3c685e1448a03100
SHA1 f636f081a1d87f08423663a7afa8f43f4f6279dc
SHA512 9b4b5010d3baf175db855771af63bdf0f8152afc82593b2efe48e9bb008d96641a431b8f7bf688c4e549d6226a6426dae19e60ac89bf4445f5a8780ce9f84990
SSDEEP 24576:UPCDQBUXldmDF3KV5RAL545reoI/ewe/k9mR4qYbTM:6CDQBmlUDpc5RAL54Ve9YomWD
TLSH
T17E55AE0576F489B7D03D44386A9283A5E97B78C19F21568F03D0717E1F726B98E3AB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe
Size 1.9MB
SHA256 f99f7eda91672dea9d344fcc33d0f197944ef86edcc952f6afd01125f1b92003
MD5 8e4417936cd205fde7be0826d459494c
SHA1 6421899f5300adec12c081c127ca99b9d83cba3a
SHA512 eb07367f8eeaf810ef5ae8b3806c49d79947f64d418d2054e7f2550cc3cb182fc3c41234f4e50fb3e40652b2911fd9952ad929d53bd37c24d0be10cebd9f425d
SSDEEP 24576:kLXyCRvBBfaxbLz9YDjz5/Pem0+dl6ZVP5ozP5IVJXyxR:kLiCRvBgJz8Z/X0+d4/xozyVJO
TLSH
T17895AE07B98684ECC06E82728AD6552DDAE37C951B205ADF41D4B31A3E36DE41FFE321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe
Size 4.5MB
SHA256 d9e43578ef0ece874e1c729b2c3c5ce9a98114c06130cc5d65ce98a09e372156
MD5 3c2649624ba4c6191002ab2308ad29a1
SHA1 7e2e3628f635f11c87a911fe9829b41f6089002b
SHA512 b910ad56b0e2e0c440c15b4c3c477e4d73f85620aa13bb43d854c120acb65a612390ab39d56c3d1e242360e5d209b60e119a35e2ded5278dcb40f46a03708dd8
SSDEEP 49152:0B/L6gu3VyrBme/hqvxbmhLbKqm006NPpIupEoEVu+e6NqcXToRzvUqIzYHBigdy:0Bi3mMsYvRmCCENUhIUBbM
TLSH
T150266B03B29900E8D05DD978C7578222EAB2BC854B25B6DF0750BB552E77EE4AF3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe
Size 4.7MB
SHA256 d02d4d6fbf30018e88c969a8070b927c1e580ebf6028ce341376fb5f562f7035
MD5 87ab5d8af65ae3f26cba54649ff515a3
SHA1 8f3c5fbf976d5a6e576ef3e197e071db767a342f
SHA512 4542b389e897515b8066a3f64f4ea9ca9176aa7652178c6f079535d1fb67b2db64e354867bfb393f427ca1ac1a50f45275e79cd948842bf21da24e28c32853bc
SSDEEP 49152:yWshzYloYLGCacgJudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpevA:yW6zDA3ac6ijnUdYd+RaAj
TLSH
T1FE367B03F29980D4D049C574CE468272EB617C8947F161EF3290B7EA2A73AD47B3DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

4588_13431954783764744_4588.pma

Path C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\4588_13431954783764744_4588.pma
Size 1KB
SHA256 e37261d17ea74f0f7806e4080cc8874fc6b90c3befe53219c4a482a64326fe50
MD5 aaff10335fcdf392f1d871dd1f1f3c1e
SHA1 d3bcff39b76c75861d55ee7e06d66d546455ff88
SHA512 159839a9989a4a752a0dae331fb38f079d06e012552aa0b9e31509f6847cc7aa96ba7192cc0662fb27890b9778e5e153b7beb388b5d6191dc2a1b514f097bf1c
TLSH
T1BB319B44B7B89A43C8539632C4E703553BBAF6E637424BB62145A70F1E062C84ACA080
MD5 SHA1 SHA512 TLSH

Submit Download

4724_13431954783824213_4724.pma

Path C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\4724_13431954783824213_4724.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

MpCmdRun.exe.ico

Path C:\Program Files (x86)\Windows Defender\MpCmdRun.exe.ico
Size 3KB
SHA256 02221d573edefa486ba8fe5aee3c8a10c8c7e3188914c0f22df06bb1338db790
MD5 1272e6501512e471bddb879dea4b5800
SHA1 1c8b9489166959e6106095c0974a1825ac1179c6
SHA512 7ef9f685457532d84ba2ed316ec52a44acec151b92e563f6943f593d272745bad0f7c549867a723d2b3532cbcb76ea2b99a965b3b2412d5e7644570740bb4194
TLSH
T1CF6140A1F209FC58C45CD1744DC6C2CC18543D958C0A7273FADCBF8F69724E52E21181
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

appvcleaner.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.ico
Size 3KB
SHA256 463b6e99198762de39ea3c9156504527673355f452c17063d0fcc34caa3cfded
MD5 01f2c0d2e4df4e0ed544a4e4600d1457
SHA1 2bdf43857fcfeefcd37ee7a82d733ca4e4f1d871
SHA512 8238557d4075faf0d780ce775a6bc0121cf2da9b826cc49095fec9b35096809e5187f3027682db88d7358e21025c5d24d2ef784e9c2b0a8aa7021589ce68a8aa
TLSH
T13061D3A9E5052C3BFD5CDA7935B6DB60C2077ECA021680778809F58328F768B16ED974
MD5 SHA1 SHA512 TLSH

Submit Download

iexplore.exe.ico

Path C:\Program Files\Internet Explorer\iexplore.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

joticon.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe
Size 1.4MB
SHA256 4aef2d6828d23ac8cbb84c907194a486d36252204b1bf18848706e1599a86cd1
MD5 7880be25cbc577bac263cd7fe4ee1e64
SHA1 8c5f9fef77031576c696f85895c7e2a26b017c90
SHA512 373573f2e74173ac7f41d003b20e32cfe7891548fbfbbfd3ee2fb4b074b8089a5a93d8c32343a0099ebcf1864ae25f649f3d613110ed200214f18e74a575573f
SSDEEP 24576:GGZ0RWKxfbAJx3ejwnG+e3GkVmadUbF3RcNic:Yxfbwx3++eWadcq
TLSH
T11F6591E331C7EB6BC84D5C7438F885A39CE06CF50466A126F35DBE6AA4B3C1A57C1126
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

RCX8207.tmp

Path C:\Program Files\RCX8207.tmp
Size 764KB
SHA256 47e2a0031df6ebc9b9e07797699e651a6f60b094fcf96ef2bec117c721812a46
MD5 cb72b434387cdb20aef6f31f694d8ee1
SHA1 5bef7d6b70bbc3b268970e895ea46eb8c7819d72
SHA512 7093926fa2c368f52a8f4cb8cc9104083b5e026d0faf2647cfeae25fab431891b8ab66e12a89e545e8656dd08c5d33edcdf2ac04e8b86ff42a7feae838dc9433
SSDEEP 12288:bAqRXWjWE449zL2cQ40me00tBdR0OeWH65rqVgMft6mw5iu:/ZAl9r0l0wCOeWH61q242
TLSH
T1C5F4AE0F2351DD61F07EEBB6785147E436622CA3D43029AEAE71EE4F392F11E6414A39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

OfflineScannerShell.exe.ico

Path C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe.ico
Size 3KB
SHA256 9e3f1f8e5166514df44b02a1e0bf7474708dafba161e263cff087af62ba89ae5
MD5 d8ef82bb84e2efe95de666f46d0c7ac6
SHA1 fcdd2f6ceacde21e1e38a687041138aa5bb0ef68
SHA512 61f7439ba615c3250701aeecb96ab8319f2d84ffa7e61076f6dbfce20ee3409d212e8d9deb274b145b7f0eeed2388681b929ba897bc85b4d3841f7003bc40afd
TLSH
T1C461FEC2D34610E8DA8268F34DB58DC487650CD540E4ED920EE6BCE39A745FDA93188F
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 1.2MB
SHA256 fde1461cbb049aafadd75b02fddab9b8b77047354641518bc8eb5a718e6825fe
MD5 403f4918902f2f2e271f879b48ee4526
SHA1 db957432b17eba4946bf4db29f685cad26c4acff
SHA512 97e63f303fbbeede38c0f634af2b11b6ad80a21e8b8b647f5aebe1c94db9b19dfcd2488657bd6f08f3a2cd007b278d12727e17175f5c404d0c722d90ed3d79d7
SSDEEP 24576:cLoLtZ4IOvZqMfzkz8+0efOn9WOBOkUhMXcBwc04nA:Y0MvZqMfzkz8+ac0Uasqc
TLSH
T15645BF2AA7D38022C06C0573A917AFB17D7AE50C2B21911F92E8FE5D297C185D5B73F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x64.exe

Path C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
Size 1.2MB
SHA256 2712227960519617180fcb22404eb761265fc6f2a487bb0ecbb83b2550dee93b
MD5 70333fc1cafbdb33610dd93c6c005924
SHA1 2b0bc3d9b5c8d46e313135fbf3d8b2231c3723c3
SHA512 7e15e88d43ad634556e4d8ec5b98d920beed474c21d437f167c54d2ae5a9d85468b5be52ef74448d33cc12efa4a6df17d37fdbbf0c49318f4f4607210189a503
SSDEEP 12288:2JXP/K4dVzu22g+k0Zd2FjZbj8pZruQdFwtiTSX7vb+b9w5iMQAiqIOkU8AMXE9Y:NMziglXxj8pZrufLspBOkUhMXcBwcy0G
TLSH
T13745BF21A9D4F132C3B4573EDE14C1B0AD2BE9957A01512BE2E47E6E29B60C586FF133
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 e727cc56c381fd765c672ec7917c22eca8ce8c9e994331e978303ccc3d181a41
MD5 53392d7ee1507e1a7c558439a03f0832
SHA1 8df8ba6b6bf29a2c575d3589e47bbab768bb7ebf
SHA512 4e62c4480057efa90ffe1c38197c872b3ea0b8501eeccad15b533032417ffd32fc18aa806afb48b9dbaa5c03a23f27335070cf1946685a139de69922910f04a9
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e77d2cde01b3580cba21a07f4d25d107e0b3720d866fa8d4b039a3798b5fce2
MD5 8c2bac8482b5e26539fe99dc447bbd62
SHA1 06c0835cd0f3065b619a38c6e0fbe749e9d59de2
SHA512 6c6f3f6b2047dd4b8a1c37bda8c23522af172ad58695c9103ce9ece86b5ac64b5e0093ae832cdc8c34ff33ed24cb0b9c108a43144db91fb5ea5aaa6cc2ab4ab9
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a401d2b9f05d3d98701d67f886043ed0f944a01e16deabd4e11799a9de8a814d
MD5 5598e5a316d93ddd04cf46abba02de8d
SHA1 664467fafdfb289b52e11fa306ec0cad82099bc0
SHA512 c3bbcf3afc546cd49414b8493863857ec93a47c48355f433a75f41de3c3ba6641410d95f15a91f871ba3b3bdda56f0e816284aa9e47dc9940f7732c9ba852f0b
TLSH
T11AD0129456814100C1011C73B67A49400502CA00DC00A12011D033016C85114605D09D
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 e827e269687e4dae7578becc86acfe37c8a182f87992eb0f76cd1fb16a364dfb
MD5 cac608e01a3adb6ef1412936a17e3e81
SHA1 b83002381922995cb57c5e29d4effc3c454ab051
SHA512 44c82c2307883c08cf02e75e7e9aae0df79df32f8979b81cbb6791e6b3f1c3db9ed4cd86b7d596bf3235bce6ca31cfbafa79e7bb9f2d68076796c70b3b256164
SSDEEP 96:blDaUnZIvvosKeHbVS5em2XIk8Wve9PP6Y:NnnZIvAio5Bw/vrY
TLSH
T14C918C4CB7FFA989DF1506749C50CE3D3EB88A4C854A77030BABF978288B3B804510B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 567bd0f4d85bdc4bbfea2738c49b7dfe8aa233a2418d9a4f997e5409f91017ec
MD5 f12ab296e3c52183de976dbde19a8cae
SHA1 9403a6a884667d90b6e607e3f5c68de9060b883c
SHA512 c1ab4a83110ed1ad49414aa71b836bdd41ca4f8a21b665a9792c54acb0bedadc19695d49eba9fbec78155171d4ec8324e82beb18bb90ac6492e6e9d207b9bace
TLSH
T14C8199F3C3B9856DC90196F0AE146F1BCE1D0455436C3C5A89E4AF1BA3F2461E151B8F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ad0c634e41325be96a76bfeced48e9ef1f015fe55d2c3c42f03ca567adbff7fb
MD5 79cc058b8202795a11dfc1d6d4942c03
SHA1 313bbe4972489211c0880076b959bfc89f8f4d70
SHA512 f7a5a58bcc6172075bd4166b5e4bb0c32c35c4231df44bf5b1878e4414fb48d00e815b7125597139b2e3ac47ef0d5fefbd95032fd5d2cd93b50b84cd9a3f4ba2
SSDEEP 192:sxR9HRcxc/fTsXxprQ5obkloA8pJV/g6+WNPye/YngUBhzGkIgVcJ:sxRpIc/fTsXxmsr/5X/fuFe
TLSH
T1A552B6166928687B5CC7E259FA15BB53E6F86032A0D45E88A6FCAA5C04F76CD1207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2a2824ac11235843801aecd5c3d3054429988b11af6a86f5555c7c7ac9f9ca0c
MD5 2fa1b2205db51249dd761fb1d1d9618c
SHA1 f534cd79a658e3e608feba4fecbc27bca1dbe823
SHA512 f8a48e8d1c21d1aaecfeb7ac47e99468f16d10e27913e69a767a9ae12137ee7f93dbe52998b5ea1b86507cff6d1cd71ffb735bc292767e708321e8811a79f80c
SSDEEP 192:sxR8HRcxc/fTsntxZlVXKbkloA8pJV/g6+WNPye/YnghKzxzGkIgDpgcEJ:sxRSIc/fTsntflVXsr/5X/fhQFW
TLSH
T10852C716A924597B5CC7E21ABA15BF52E7FC6032A0D45E88F6FCAA1C04F76DD1207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b5fcfc94821649bce5d119061f56f110551e03b214b4791534fd703abc1a836f
MD5 169b67aca21b758d826ff074705da576
SHA1 d090b91ed3ab8acc4d7327d9a2af1c302ceb81ee
SHA512 afb600093d6d9b13b5335e7a5666457f2a91f6991e740951d1f5b1171213a73634330f6ab8b21354ed6ad8a0c1b294ecc34760c1b42be6baabfe112de1dc52ed
SSDEEP 192:sxR8HRcxc/fTsnxxZlVXKbkloA8pJV/g6+WNPye/YngUXxzGkIgDbcJ:sxRSIc/fTsnxflVXsr/5X/fcFI
TLSH
T15452D716A924597B4CC7D219BA16BF53E7FC6032A0D45E88B6FCAA5C04F76DD1207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 3156aba4c586f3768cbd662eea44c2a743808bcdf0bef92de22305dc695ceaf7
MD5 9dad057e8ff9e9b612ae76874c139667
SHA1 c8a293e46081012fd59fb6b6f89dfc410ac27394
SHA512 8b34c7bbe59d0644b01435967c500a163bc5eb9a7988ae4607db857a78e9a3de18f1e031bbfecf593aea3a6c18a71f7880c84dd1ba3af99b80f0f7f2eb091fbf
SSDEEP 768:wb8dpg7pLuL7r6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVVu46tCrohRY5p:wb8dpsE7r6Wgouf6Mu1jaeV6tZAD
TLSH
T199C2EA7B740DCB7F4F800ADDA819BE9F6DA802CB5AD8CD4047FE951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7162f9e7-1be9-4724-94d5-21622cf48dd4\index-dir\the-real-index
Size 72B
SHA256 b3bfeca60d10436e8f959959b6b7e8346c0362d90c36768887f5bcdf5f250c3f
MD5 208ac031fb5af2e6fc488a985054829f
SHA1 217a3fa25400372e84b71c405628bd4a90f3010b
SHA512 252815d52559ff1099692c0dbf2a0301f24d3f11404fedadb3ce2c5ca222e92e462b40f89dc513f25f0fa6c1ab4ff9d41a6e48961463f5061b59b5a10dbb9a9b
TLSH
T1EFA0021602C0110AD406E6F179A651713356E9620305130742916444CE505568FA210C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e16d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7162f9e7-1be9-4724-94d5-21622cf48dd4\index-dir\the-real-index~RFe59e16d.TMP
Size 72B
SHA256 fe943ed2cde6a1472f7619727e8afc42193fda5b030f6a55f111a9d3f38cc423
MD5 94aa609491056abb2ebf1514a400f71f
SHA1 cf6b2011e24f0767809543ad2ce70fa216b6060a
SHA512 07ba5ff706f8289f19d4fa706e03d89d28695d30224ca60de8392e1c99cc90e44a9e4317d97bc4137f39748936e85716982edd50648704e0b6573697815de68e
TLSH
T117A002230780010DD51352F119565A851216CD5C2101125E50A58149CC54480ADA301D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8ee8ad58-4f1c-459c-bc95-4ac98d1cfc38\index-dir\the-real-index
Size 3KB
SHA256 c6e0f37dc086aef4eafbc699f3408b61db05feb805dde75877aa01a748462d75
MD5 4bb9011b930aaa10d686178243787ba0
SHA1 26721f43e301357e654e6053c11150f5c2f734ca
SHA512 72782e44a2e2e56bcb2739ebe94c0f5fb378b07edc81111bf5915296446a75191b2b61325382129d9c8959d26e4f393f26f390b2d7ad3b176586292e8b5d4a6d
TLSH
T1F351B74F8D8A1D1DC5AD01B2A8FA148133B81CEE4B94C9873ADCA271A8D733E1D0865A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 c1d506794095a51a10b6c2b6e7437407c7624b54be171f1323fe1db480b552c2
MD5 a09b4c38e5fde615c51df76cbfed9838
SHA1 c7710fa2486baa5fc4dc87ae1307b17b1e03e2bd
SHA512 976b585dac154d95e942d67a40d40dbccaafb2f188879d57e85200fead280505bda7fa2b1289a18ef2aeca8254b4b7ce514e1cb0b3db1fbb0f4368406b8018c5
TLSH
T12AE020773EF72804FCEFD7DA1831645105107454844DBD4FB816E2D721B275434A5C61
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 203f99925e79d7325e8592ba27c4a3f1c8a31082df2e88ec8f35b44b9e844fed
MD5 a5eaa384bf3d16a7870d65eb6bfa08af
SHA1 3e62dc25eb10d93ce5316c17103a1081768284e8
SHA512 8cf91aee561313a112a87d9abc86f9a200e23ad2927433dd1d847e2fee5080818c97f3af621d7e4f492435ed290cdee302417a67115c0edbe804097cb8234618
TLSH
T1F2A00251DA539405C16016B1317D11883F24CFD989E62631E6BA804ACB54BA145C3504
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e0d1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59e0d1.TMP
Size 48B
SHA256 95f3a438fa591657eb32f3d38cc7a89a6250e92ee197309c84cbfb4d9df6eec5
MD5 abf145e47115cb493709f53d0279e6fb
SHA1 4a2aaa7697692aaef2eacf2e1173eb24b3feda12
SHA512 fe3def55f36ea1c3716d767fe80d51a2a30003ff19115edf36e40d4c8c76b86edef3a225c38fbcd75f9f57af90da80c8ab8f19f53b99849330c9cac082c944e0
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7dffa6c3937ccbf6a97c23f68be5a864eb47847ccb3fbdbbb1f69e17ca53f28c
MD5 536d1752578a66bb502da5f1786af4f7
SHA1 d428346878387a0875d07d57261cc09ddd75672d
SHA512 62b6c43c08402187e110feb9ae2b32fa82447b783bb0da4ab032c6370c6f23ecbe803a55d9f38efdc480059c4877ebbb7fe2bf6244f9487486c8c2081399827e
SSDEEP 96:KR4Jco6GKQWOTDgQQK4FgyQcAQjS49HdqjXNn7vWj4mgfvK4+gBvcldQzwnMbHta:C4Jco6GK3OT8QkFgyvAQjS49HdqjXNn4
TLSH
T150918620717B02517C7F6C4CA2AA981B96C170A2705DF63B7BA901E69F66E434CFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1f730c15-35da-4ea3-8dd7-883f53129ddf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1f730c15-35da-4ea3-8dd7-883f53129ddf.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 e021b9ff1903d292f1ec18578b55841ed18c2a93fe05b6d8d5dc5b1927a4d945
MD5 2bf45b4b39f8cf26623acd34b7b6fdc0
SHA1 34717280bade992590a3b77cfe69a0a5f46f2867
SHA512 f5c71c41689e5bc78739046bc811c5283b46cb668effb06b191f80124f81bd5db0513403db4fb34bd707eca63aa5f5898ef21333a2eef259ada3d08fe8a670e9
SSDEEP 768:5rv+4UNbds3FnDZIO0VvYXNzc4ReyIs2beVH1S5D:5bsbS3Htc44bsMEH1Y
TLSH
T17003BE32E8789937ACE66786B14771137EF8921B82881B90C9DD6F0C4A4B1DD131F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 a36b53993db092f412884a666adf50cdd38c7e8608510fec7ba44ec5e6587f57
MD5 4a011c84d1b81ad3dc767b4ab4f29623
SHA1 c6ce7ba32ca51d01405e56e2cb71a439246429a9
SHA512 80b9a9183544c66a24e2be904776f424dc0bd7464b494f613565c830efe12deb4ed5708d7f97d02dffdcd5daa7826ab546a6d9a88c6bb51e56865c019a3e967c
SSDEEP 768:JFVK39wgnLgZw5O0VvYnNzc4ReyIsPbguuVN:NK3jytc44bsTguQN
TLSH
T199037C36DC64C96BACE69786F7067502EEF48157C2DDA9D0DADD6E1C009B2DE030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 b1f9bb9aa749312252f1a38607904aa05ba09ae4670d84986fbfe9f1f2c659a6
MD5 8b4c0e8e3ec1c7433493e2678cbb0c1a
SHA1 a27ff8e0b3dcfd8ceb8c3ebc7778d0ec009d517f
SHA512 4f51155a9d08bd648dfeb288b220ebb56964a96eadf973f13feeac25c72d0bf39f3112030e9c3a1f5cd13129412469dce72dbbd988b5b638c206d6cc32a7f891
SSDEEP 768:wrv+4UNbdT3nLRDZIO0VvYONzc4ReyIsPbeVH1S5F:wbsbp3nitc44bsTEH1W
TLSH
T1F613BE32A8689D77ACF66786B10775137EF8911782880E94D9ED6F0C4A8B1DD031FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 2bb3fb79c532578549925bd5492c587f72c12a9c5af4821be8158cfa4ff8ae8b
MD5 b5bb95d2e5f21e6cc45291d51ea697b3
SHA1 3465ad2bc860784714deb2110107314265612b83
SHA512 91fa5c87c17e48424e4a116a437aab9a2d9b0e3bce417796f1e848ed257f73c24000cbeadc4d80a0dc703e8a927040c33a19981ddac9393921d89279dd33be27
SSDEEP 384:nuZcI038N+Fjbpp6+JDZNfNoXOVSUU1XaFaXFikETRzcoXfK86sfxEZxxsIj4lBa:M035LRDZIO0VvYzNzc4ReyIsPbguuVN
TLSH
T1ADF2AE31ED649C676CEAA386B6063112BEF48117C2CD6E9099EDAF1C054B6DE071BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 613d4395a1e9acfd845ffa80d5685f602ece4228e4991feee4997bc6975b767d
MD5 b1c4907f83e250d307a7ece520bb4851
SHA1 414bf1a5884dba38e8a5d12b8676de8460354c92
SHA512 e90472f97f1da9ce10e5101caf4c18aad92ef2def195c1f182d45bed5a3eb0b885b7a18125dd95f58522dd6586c020c3b6008037d3d1c521140097316f8545fe
SSDEEP 768:xrv+4UNbdT3z9RDZIO0VvYgNzc4ReyIsPbeVH1S5F:xbsbp3zqtc44bsTEH1W
TLSH
T16A13BE32A8789D77ACF66786B10775137EF8921782880A94D9ED6F0C4A4B1DD031FD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a851e511c493259a23af7b602d7db8cef03ea1dc92624305d91adcf750fc0da0
MD5 36928e578278e71fd1c1229d994c2e27
SHA1 0c03af78bd9a51eecbf263ce06d9f03400c36777
SHA512 ea0a5253790b0f96cbfd5bdf9c7e1619b6b42424f62ef323ec80f416eda9ebb7a555384e8e299122a5fc1d26340dec0e6bff2e85b824968e5e9a0f1eb40071ed
SSDEEP 768:6rv+4UNbds3gLDZIO0VJNzc4ReyIsX2eVH1S5D:6bsbS35tc44bsGEH1Y
TLSH
T12703BE32E8788977ACF66786B54B75137EF8912782C81B90C9DE6F0C4A4B1DD131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 ca7c6f7417bb03012977bc5d7a3c6c839f192e763490b33e162b60a28bf3e045
MD5 69d8c71e9e216f4a04632ac56a3e332f
SHA1 42bfe96ae16ef416c6f49e4fef26c9e18382dad9
SHA512 4de9fe86666984d442b2b7220db1ede3d2f108a3c1db7dad08f3cceee93a0f2f283b211a28bdd7884261f0c280eeb3cd1da455052324e5db87bee6f29a906d76
SSDEEP 384:noZcI038N+Fjbpp6+JDZNfNoXOVSUU1XaFaXFiYETRzcoXfK86sfxEZxxsIj4lBa:W035LRDZIO0VvYnNzc4ReyIsPbguuVN
TLSH
T11BF2AF31ED649C676CEAA386F6063112BEF48117C2CD6E9099EDAF1C054B6DE071BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ea1736b0-0950-4fa6-b1cf-55b9dd1882d3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ea1736b0-0950-4fa6-b1cf-55b9dd1882d3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 56KB
SHA256 6362b8365a9b7f4db95ff50b784d441d774ab51c806c07e2f67ee1ce09f949a7
MD5 bdd5ad9bb74d7131c6060b61985fd106
SHA1 67062e16d2d3f7cc0985c777370282e48c153912
SHA512 7f8a721dd015acac251ac835de7e2160be9705beb4511a0f236fb66fe99811cf5b88c0faf54a2b7df55196026c494a526b0eff15750d8092ebae5264d88564bf
SSDEEP 192:DeYhK9eoIdnCI5Y2bT7C1Tyzndj3GU1Qz1DQacLfb:ZltTeTcnyztiLj
TLSH
T1FA437416B844E606ED051D36AFEBD5EC72317E16CE8B071339C2BB3F4AB70C14A29199
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-22_2f0528c366854e721213d1e8bf784b8a_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
Size 3.6MB
SHA256 a1c8b8cb825bd6d0a13a2d57b5c9cd46768eb2521e858e540c8ae46c6b6543d8
MD5 433c50fce26baf4d76cde29fedb5cb7e
SHA1 d94162ca78cb3d476ea2d83c041d898da2f23664
SHA512 a8db21c557f81f4c67fdf68e84af968b239c1906c280fe5882de369f40fafcedbc7161359a8737a21983fbfb1260d72331186326626a8f42adc843c834bf2b24
SSDEEP 49152:n23IetlomzqbeWsLf83Won5L3s9x1OxGBcq2exk74gcAFu4OuDmGRmR/1HLiTs7:pbm71OxRR9Sl1x
TLSH
T12F064B03A2F541D8F0BAD6789B359B32D977BC855B38A1DF029056191E36FE09F38722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab33cbb-997e-4239-983c-49c2f8ae76eb.tmp

Path C:\Users\Admin\AppData\Local\Temp\cab33cbb-997e-4239-983c-49c2f8ae76eb.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4160_861224160\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RepairRestore.exe

Path C:\Users\Admin\AppData\Roaming\DisconnectSuspend\RepairRestore.exe
Size 2.2MB
SHA256 3fc2072d7425bfee7f79e0e2d70b719573a1a1e6634899ee17828c54426b534e
MD5 a342485309a1625377fd610a550d717d
SHA1 410c00659a514d3c363a0d33cc535a92c3d5234d
SHA512 f4f352a7e89ab7f688034fb7fe3e0c2e61b8e64b32140aa724f5829f20329c726061586174c0907e5ca5aac90f17e4b539b7cc3f38079a01408979393e8f14c3
SSDEEP 49152:1bzR9eQmycco8fId/aQrHv8qTUye/qh/Hr:1nRIQARZC+GyH/L
TLSH
T138B51206BD864833F43900717AAE97E4FEDD7B0DC94515AF2932A90D1A3562E38F2E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PushDeny.exe

Path C:\Users\Admin\AppData\Roaming\ExportJoin\PushDeny.exe
Size 1005KB
SHA256 432c26db0c2f1c410411035465305004b67b758087e88ef83887b308838bc433
MD5 a24f0506652fecffc0e797cbc38e4d7a
SHA1 1546a8a99107a67f227fd1017097ccb2928b2eab
SHA512 0d8e7c8bc77852d5e50e3f40f77ca1f4242367de85ffdcb0fc224142107ea3f14a695a20926a2eb99555b29994577a3cc5182a7322db9b1686811356f2b5291f
SSDEEP 12288:KG7gijLs8HZ+B8x9K4AzbkeB6Aup13lOZTMw5iMtHhif2s4Si3ONCrFM26v9:KijLvZN9K49AW11OZTJxhB8yuxV
TLSH
T15625CF49B99E1D2ADC3E84381C8ABAE484EBA909CD5C512F6544BF0C7520F892CF7D7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\Desktop\Microsoft Edge.lnk
Size 2KB
SHA256 429719b98ea69acefaa37d7a14638f84e3d28b21a3fbfaf55017843f3956d853
MD5 a6243abf6bf6a4f01c5299cc6bc917bb
SHA1 37a8ad4d133620ff2ec2ca3341e99eadd14ed730
SHA512 d3ae3ced2049006b986eb335705dd6215ffda245649c7151ccd02ba09aabe85944b812c8d1dd0e908e41d176001cc0697045b2c8ef694c173ba345f83073979f
TLSH
T1F641C2055FE50A29F3F69D725A737A31AB37B809DA144F1D008943490C63B05996DFA7
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_installer.log

Path C:\Windows\SystemTemp\msedge_installer.log
Size 123KB
SHA256 512600a72dfeb236b7a54c300e83f79424bd50fa7b0a6f9863994c5967381a1d
MD5 84dbe477be4a25e8207c3da5ba009358
SHA1 d701a83eff34dd75f7a8a7f1ebeeae69257816ad
SHA512 514f25cdb50112a084b20f6f25138335142dbf97d03fdb46d6baa435bd55098de5bfaaf57e743ea5eda188766fe89a6f925d4eb93617ca21a89264c8e7401a67
SSDEEP 3072:U0Tk/KqyXYliy0bQkBlLXMTM+v0ojO8I5:U0Tk/KqyXYliyiQkBlLXMTM+v0ojO8I5
TLSH
T1F5C365153F4600D77B85BEFB2543792659AB229BD4C41AFA3E94B400B1DB9F2019B0FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1840-921-0x0000000000400000-0x00000000004E1000-memory.dmp

Download

memory/1840-0-0x0000000000400000-0x00000000004E1000-memory.dmp

Download