Overview

overview

10

Static

static

3

2026-08-24...ar.exe

windows10-2004-x64

10

2026-08-24...ar.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    130s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/08/2026, 01:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-24_c3c4ac8432b18cc24e01577d75229d99_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
  • Size 6.4MB
  • Sample260825-ca61cswbre
  • SHA256 503a6120880006cf45e62cd2e6a49498298aa9dcfc618683ca990922fa84c806
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryneshtapersistencespywarestealer

Malware Config

Signatures

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 10 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-24_c3c4ac8432b18cc24e01577d75229d99_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-24_c3c4ac8432b18cc24e01577d75229d99_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:5320
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-24_c3c4ac8432b18cc24e01577d75229d99_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-24_c3c4ac8432b18cc24e01577d75229d99_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe"
      2⤵
      • Downloads MZ/PE file
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3272
      • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-24_c3c4ac8432b18cc24e01577d75229d99_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
        C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-24_c3c4ac8432b18cc24e01577d75229d99_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=110.0.5130.66 --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x1a0b8123c68,0x1a0b8123c74,0x1a0b8123c80
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3040
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\2026-08-24_c3c4ac8432b18cc24e01577d75229d99_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\2026-08-24_c3c4ac8432b18cc24e01577d75229d99_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe" --version
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3000
      • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-24_c3c4ac8432b18cc24e01577d75229d99_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
        "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-24_c3c4ac8432b18cc24e01577d75229d99_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=1 --general-interests=1 --general-location=1 --personalized-content=1 --personalized-ads=1 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=3272 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20260825025334" --session-guid=816392c8-0f45-4ac5-9243-11dca93a72f2 --server-tracking-blob="YzUwYjYxNzE3MTVlZWExMDhkZWYyYmQ4ZjdmMmY0ODI0ZjAyODg2MTQ4MjY5MTViZmYxZGVlODlmZjA4ZGY0ZDp7InByb2R1Y3QiOnsibmFtZSI6Ik9wZXJhIn0sInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjExIiwicGFja2FnZSI6IkVYRSJ9fX0= " --desktopshortcut=1 --wait-for-package --initial-proc-handle=C009000000000000
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Enumerates connected drives
        • Suspicious use of WriteProcessMemory
        PID:1864
        • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-24_c3c4ac8432b18cc24e01577d75229d99_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
          C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-24_c3c4ac8432b18cc24e01577d75229d99_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=110.0.5130.66 --initial-client-data=0x29c,0x2a0,0x2a4,0x278,0x2a8,0x7ffe977f3c68,0x7ffe977f3c74,0x7ffe977f3c80
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4624
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://download.opera.com/download/get/?partner=www&opsys=Windows&utm_source=netinstaller&arch=x64
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:5800
        • C:\Windows\svchost.com
          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe" --single-argument https://download.opera.com/download/get/?partner=www&opsys=Windows&utm_source=netinstaller&arch=x64
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:4172
          • C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe
            C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe --single-argument https://download.opera.com/download/get/?partner=www&opsys=Windows&utm_source=netinstaller&arch=x64
            5⤵
            • Executes dropped EXE
            PID:2788
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202608250253341\assistant\Assistant_130.0.5847.41_Setup.exe_sfx.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202608250253341\assistant\Assistant_130.0.5847.41_Setup.exe_sfx.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3208
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202608250253341\assistant\assistant_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202608250253341\assistant\assistant_installer.exe" --version
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:804
        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202608250253341\assistant\assistant_installer.exe
          "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202608250253341\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.41 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x484040,0x48404c,0x484058
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1856

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ACROBR~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
        • Size 328KB
        • SHA256 a5f47d59b8d08fc85ee411ec2e1015fedda08fd4a6cae2bf7b3bb1a7db2ccb5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ACROTE~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
        • Size 86KB
        • SHA256 a46d1ffbe9114015050b2a778859c26248f8bab22d5d1a302b59373bc20c6b45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ADOBEC~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
        • Size 5.7MB
        • SHA256 1ebe469c94c2c2a5acbc3927cef19dbe2f583ba3651a55623633891c4c05cc22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ADelRCP.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
        • Size 175KB
        • SHA256 1ad4c736829dbcb0fcc620fd897fe0941b9c01e14ccba5d18085b3ca0416ab66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RdrCEF.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
        • Size 9.4MB
        • SHA256 3e815d583236b9cecd912fcc949a301d1e51b609cbb53a2285d08feea305edcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AcroRd32.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
        • Size 2.4MB
        • SHA256 bd7696911d75a9a35dfd125b24cb95003f1e9598592df47fa23a2568986a4a9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WCCHRO~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
        • Size 183KB
        • SHA256 8ca27077312716f79f39309156c905719a908e8ded4bf88c2ba6fa821e574673
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Eula.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
        • Size 131KB
        • SHA256 49091e1e41980b39d8de055fe6c6a1dc69398f17817960d64743e7efb740efc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FULLTR~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
        • Size 254KB
        • SHA256 129a2bfe25ceabb871b65b645ef98f6799d7d273fc5ddfd33c1cb78f5b76fa3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LOGTRA~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
        • Size 386KB
        • SHA256 cae320401aa01a3cef836c191c2edbd7a96bfcce9efad1a21880626a64cc4dec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        READER~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
        • Size 92KB
        • SHA256 7a8ee09f8a75b3e812f99a0b611c6720626c62c6985306a408694389a996c8e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WOW_HE~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE
        • Size 147KB
        • SHA256 686bec325444e43232fb20e96365bb1f1eb7c47a4e4ce246fc900d3a9784d436
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        arh.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
        • Size 125KB
        • SHA256 9a7391267ab83b45a47d9fcf1e0f76002ed6640ed6a574ba51373410b94812f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        32BITM~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
        • Size 142KB
        • SHA256 a89d3e2109a8e35e263da363d3551258ea320a99bfb84a4b13ad563008eda8d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        64BITM~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
        • Size 278KB
        • SHA256 b8c5b99365f5ac318973b151fe3fe2a4ad12546371df69e1b7d749f7a4ce356f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ADOBEA~1.EXE
        • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
        • Size 454KB
        • SHA256 f94ddaf929fb16d952b79c02e78439a10dd2faa78f7f66b7d52de2675e513103
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AdobeARM.exe
        • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
        • Size 1.2MB
        • SHA256 57329b38314923c17e9dd9e153e894708389dd597fcb1438d5291c7627238653
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jaureg.exe
        • Path C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe
        • Size 555KB
        • SHA256 38b06ee250af6554e6740a1bb7acfb77b99ccdb8081880e01c386afa98668766
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOIN~1.EXE
        • Path C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE
        • Size 121KB
        • SHA256 53e47df12f0ce2005f4a2a773d194c9431b325b64c205dfa4cfba45c973b65f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe
        • Size 325KB
        • SHA256 80de06ea5d221e21f765a96750f821aaaf8eee23bfd9d8cde265a8da11041c66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe
        • Size 325KB
        • SHA256 d2f956514bc885fed054dec3ad4c0e89e59a6a38390fa8432abd15eb201468b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe
        • Size 505KB
        • SHA256 97508a81b805937e1ca57711a51d2e8d715a2748e2f9d27d39dfecc28f3fb9e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DISABL~1.EXE
        • Path C:\PROGRA~2\Google\Update\DISABL~1.EXE
        • Size 5.7MB
        • SHA256 21719f3b636ac9d9a8b5ae3f1b15faf10a5110d2d75e0e4ca8e681160642e6ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ie_to_edge_stub.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\BHO\ie_to_edge_stub.exe
        • Size 553KB
        • SHA256 ec0a475d423140079ccf795ac5c8671a1b4211d317f781afb85c17fa3f600225
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\INSTAL~1\setup.exe
        • Size 6.8MB
        • SHA256 ab7e749dace77246f7f2c2af0a138dc9104ef3c3833a293ab12853999b1ab65f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cookie_exporter.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\cookie_exporter.exe
        • Size 157KB
        • SHA256 ea8e043a8af5e2dfb2091844f70f5e1c7aae710a0645ea108a1db015b55e8df6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\elevation_service.exe
        • Size 1.7MB
        • SHA256 a2523cc831659b237bcc32ca42b64fff36095f62b163c166f4b7e59100984a93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        identity_helper.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\identity_helper.exe
        • Size 1.2MB
        • SHA256 2f094ffd3985ee30b9ca280dcfff8f5c7e61db139fc3d2371e78be738450a666
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge.exe
        • Size 3.9MB
        • SHA256 9989311b0021ad7409263874b3db39f03d30ca9bfe5cac4a7f807b8557387ccf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgewebview2.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedgewebview2.exe
        • Size 3.5MB
        • SHA256 9d0f4a497db7604d3c9d3a2182d458f6091f6f567e957b72d4b0336d6a7c87e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ie_to_edge_stub.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\BHO\ie_to_edge_stub.exe
        • Size 562KB
        • SHA256 5ca66d0a92c97e353cbf7fc47246f2292fb9ec2966a4abf7a03ea4a8c8b406c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\INSTAL~1\setup.exe
        • Size 7.1MB
        • SHA256 bcea62bcf7ac1a58399565cb993ff0d74e60b117760c809a6f82d1c4f50e2d41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cookie_exporter.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\cookie_exporter.exe
        • Size 155KB
        • SHA256 7fc13ee7e85761659331398585b2d5bf08ecaa65077e162f748b2b97dd0b9152
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevated_tracing_service.exe
        • Size 3.8MB
        • SHA256 ffbd64f72a712f25934fae982a24bcf3f2be0ade3e54c4f606f0783722bb7d2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevation_service.exe
        • Size 2.2MB
        • SHA256 71fa2d5fb7c3da809fc0e66b5c8e989bad16b443d24487cf4508cde7e2d8397d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        identity_helper.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\identity_helper.exe
        • Size 1.4MB
        • SHA256 2feba86fd7ed5264c069f66397b7f08d8f245233c0c7a8be563e6f9846f0723f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge_pwa_launcher.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_pwa_launcher.exe
        • Size 1.8MB
        • SHA256 dd17f95d51fc498b681629bf544553d67dbec4840265af2adcbec04d9ae70bdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgewebview2.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedgewebview2.exe
        • Size 3.4MB
        • SHA256 8d98bbaa8691268632b5276bbb6a77437d28d0701c5ff083a306deebc3447a82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_click_helper.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\notification_click_helper.exe
        • Size 1.6MB
        • SHA256 dfca94b2e75cd8f292a3ee853ca77083dfdd196e7dbc2f52f80f59e77716d87b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSEDGE~1.EXE
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE
        • Size 1.5MB
        • SHA256 d6a52fc33703813fe2e2a549aa212fa07900d6677aece66832ae294b1f04f51a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PWAHEL~1.EXE
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE
        • Size 1.4MB
        • SHA256 6d3f80c24e7f9f0b5d8ecaa6f54c4f047578b8deef5f5dd71748074c3bd68ea0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        • Size 4.0MB
        • SHA256 a0bf37dcf76b6bcb0e1b4a13cb525ea70d88a2a8eac4f9b1c75f79c04b7e3b09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        additional_file0.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202608250253341\additional_file0.tmp
        • Size 2.8MB
        • SHA256 71a4cc628fd1716fd994689c4808d2ebbc00e8bd2ecb7600b9921baa8916c752
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-08-24_c3c4ac8432b18cc24e01577d75229d99_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
        • Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-24_c3c4ac8432b18cc24e01577d75229d99_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
        • Size 6.3MB
        • SHA256 a8531c852a93a130f8b4f0cd90183d0a1873f90064dd6977ba06135463a0bb74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge.exe
        • Path C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe
        • Size 3.9MB
        • SHA256 6d8e5d6a4d1c147b90b5a394a5054840e19dfa3eae3ea706ffb367477cecb929
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Opera_installer_2608250153322163272.dll
        • Path C:\Users\Admin\AppData\Local\Temp\Opera_installer_2608250153322163272.dll
        • Size 5.7MB
        • SHA256 a962d954e013cc51c136d48146a7bec1c24d6bc742133583e2ebe69744a077ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        settings.dat
        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
        • Size 40B
        • SHA256 74e9d15f47f1c9712cce75ce2ac7ec28372bc7673eb216528279455db95327d9
        • MD5 SHA1 SHA512
        Submit Download

        svchost.com
        • Path C:\Windows\svchost.com
        • Size 40KB
        • SHA256 f347adbd42e7d1442449c58b024fa29d263736ebd21e28fa86b5880ed1407b67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4172-230-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/5320-158-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/5320-233-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/5320-281-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/5320-290-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/5320-292-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/5320-296-0x0000000000400000-0x000000000041B000-memory.dmp
        Download