Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    01/09/2026, 22:58

General

  • Target
    2026-08-31_fa88a43641e6a39f767241930eb70981_cobalt-strike_hijackloader_icedid.exe
  • Size 574KB
  • Sample260901-2xt2rayepc
  • SHA256 37b73993057acf150241713548e3252ca591ab85560e3813420b0693d1b2cae4
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Family: Azov

    A wiper seeking only damage, first seen in 2022.

  • Renames multiple (10545) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-31_fa88a43641e6a39f767241930eb70981_cobalt-strike_hijackloader_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-31_fa88a43641e6a39f767241930eb70981_cobalt-strike_hijackloader_icedid.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Program Files directory
    PID:4520
  • C:\ProgramData\rdpclient.exe
    C:\ProgramData\rdpclient.exe
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Enumerates connected drives
    • Drops file in Program Files directory
    PID:4348

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        64BitMAPIBroker.exe

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
        • Size 296KB
        • SHA256 896376d766c1ee39a1001ed60c1924d74041a285844eb5fef558093bcb32db1d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95875\java.exe
        • Size 333KB
        • SHA256 f8ad819d75001e16784cc59e47af9954aa11b754ed1636cab491d93c7ab19e88
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95875\javaw.exe
        • Size 333KB
        • SHA256 0e06b1b26f84683bee2667230d676971a360bd24f85e27cb46d51d9fb9a09175
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95875\javaws.exe
        • Size 540KB
        • SHA256 1ad5158ff9ffe6a0b4fc347de835ed959223af844588a2dce821374314236840
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ie_to_edge_stub.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe
        • Size 596KB
        • SHA256 08dde2f9071704d8082af711d06cf5c50ed519910b9dbf30964e470d43f37927
        • MD5 SHA1 SHA512 SSDEEP TLSH

        setup.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe
        • Size 6.7MB
        • SHA256 223afe5260dba2a93ef78c19c996f5c26e5733a401f73ca5db831654b4a7f0e0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe
        • Size 1.9MB
        • SHA256 fbd2b55349ac31f49529d7dd9376fcfd93767409a5a28fbe40f085b5bf8edf56
        • MD5 SHA1 SHA512 SSDEEP TLSH

        identity_helper.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe
        • Size 1.2MB
        • SHA256 40ed3609c1bbae85a23ab9305d96c85126a0b22158bc7c50b82d5b0463cc7753
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msedge.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe
        • Size 3.9MB
        • SHA256 4876cc2c7b4f82d75bed9843860aaba418e8863dfcbce4bf5127aba8ac72dd1e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msedge_proxy.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe
        • Size 1.2MB
        • SHA256 ca598ee315c3ab88e9d997e51028e6ffbb79c50c9227a992a9bea162dfc26bb2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msedge_pwa_launcher.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
        • Size 1.6MB
        • SHA256 e78ad85923d867fc09f81d0db8524f75dd32caef71598120493a4650d7d07730
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msedgewebview2.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe
        • Size 3.4MB
        • SHA256 c225ec311be59d1b33e0fb888bfdfedddd6f7d35e3ca105064c0b86da206e624
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
        • Size 1.4MB
        • SHA256 2467841c31fe5fe4514543afa6c6b443a5e13a27ce7f585f43b36f10e321723c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pwahelper.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe
        • Size 1.2MB
        • SHA256 f82f2234aa252b075ee8172b806cf1d831857b8b811c7557189526fb69eaea5b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MicrosoftEdgeUpdateComRegisterShell64.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe
        • Size 248KB
        • SHA256 348d056ffc25309d62027b15a9667035d7f585a9ce94eb94117ff2e949bba2c7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MicrosoftEdgeUpdateComRegisterShell64.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe
        • Size 265KB
        • SHA256 066b97a8b05a11c5f88fba3625ac1a959183ec288228602d3117eda2d0bc42b1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ie_to_edge_stub.exe

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
        • Size 610KB
        • SHA256 6cd96b8e11458dff779c336c457a4f8dc5f045fdc3f7f5c7d1ee3210c5577762
        • MD5 SHA1 SHA512 SSDEEP TLSH

        setup.exe

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        • Size 7.2MB
        • SHA256 5449bb4109b935231b665a58e6c581b3ef36031e5c975216b2520f37d1a875af
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe
        • Size 3.9MB
        • SHA256 5a18b75ebc5ee6594d23ea9de894bcc6a2e208838bdec1f01f593e81d25a0878
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.3MB
        • SHA256 45b5504e5fb085d091ae873496d6347294fe32d6c2696797688f4c601496fc64
        • MD5 SHA1 SHA512 SSDEEP TLSH

        identity_helper.exe

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        • Size 1.6MB
        • SHA256 87ce090bb2884e44d68dec42b6555433d394eb4455b6723e991c79462e8b4981
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msedge_pwa_launcher.exe

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe
        • Size 2.0MB
        • SHA256 d7b5b39573ff70ca2d1904e7e9bdbf4e97158e69cef95d28147bad6b245af556
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msedgewebview2.exe

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
        • Size 3.5MB
        • SHA256 76c109c03385a7378b2db8e4c3801a569b90732958297d97637c458abb5d1729
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe
        • Size 1.7MB
        • SHA256 1db72f1ca7787a3ec04f43f50eb82602cc0fe0f8c9518036b5021a0498553d6a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msedge.exe

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        • Size 4.1MB
        • SHA256 840608dce64d0dac7725f9e8699cb07e510459e70fdae0a764d87f98f440c7a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msedge_proxy.exe

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
        • Size 1.6MB
        • SHA256 44eb0314699c23a0a4b45d320d7deba897218a7745711f505095f4cbb431b42e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pwahelper.exe

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
        • Size 1.5MB
        • SHA256 9844196bccd3b9514fe6a94e91879556fc46c6695dfb0d16b31ad612eeeb40e1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        maintenanceservice.exe

        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 329KB
        • SHA256 ba9094055720a15ce62108ff04c232e190d834696f4d7167cfac5d4d123cbd48
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7-zip.chm.azov

        • Path C:\Program Files\7-Zip\7-zip.chm.azov
        • Size 117KB
        • SHA256 f2b3a1b300cb3302fcf88e78aff543ac1238bf520bde9edf12e74d77e2acea69
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7z.exe

        • Path C:\Program Files\7-Zip\7z.exe
        • Size 672KB
        • SHA256 91b280f6c73ad2b529370f509f83842ae1394745019a2a63e738d63b3a21e1fa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7z.sfx.azov

        • Path C:\Program Files\7-Zip\7z.sfx.azov
        • Size 210KB
        • SHA256 02e9e27201d26679afd893a6571a1bdc36a8c44656e119c0c19bb99707c23e27
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zCon.sfx.azov

        • Path C:\Program Files\7-Zip\7zCon.sfx.azov
        • Size 189KB
        • SHA256 875ec070c3710ab4e4ae98a3fcccc3adf69d37adc7f8ac98d0170011fd15cd7f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zFM.exe

        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 1.1MB
        • SHA256 f3c2f9156f82a934c95051797b9604cf9ba78420086b5203e415ec8b107b4673
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zG.exe

        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 840KB
        • SHA256 af63621f63133a06a6d729719fa64c544e3cf84ad62d9da9731251fee9af660e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        History.txt.azov

        • Path C:\Program Files\7-Zip\History.txt.azov
        • Size 7KB
        • SHA256 504547bc1d216af2677dabfa23c6048314d0034adc1a4be5f81121422511bec2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RESTORE_FILES.txt

        • Path C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt
        • Size 2KB
        • SHA256 c97412fbf88da8f91099a52888dea4c3f222cd95af3e681e3271cbca8b6b7bb5
        • MD5 SHA1 SHA512 TLSH

        af.txt.azov

        • Path C:\Program Files\7-Zip\Lang\af.txt.azov
        • Size 4KB
        • SHA256 31c3e07cdb388c18b3872d7151a6660cb553570678564c464d13dbd33b8457f2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        an.txt.azov

        • Path C:\Program Files\7-Zip\Lang\an.txt.azov
        • Size 7KB
        • SHA256 a68d8b91d521207b5ba4ecb498c3a09b5766cef945e450c27699b2e4839c943a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ar.txt.azov

        • Path C:\Program Files\7-Zip\Lang\ar.txt.azov
        • Size 12KB
        • SHA256 dc9af474ffca95371b7d20b4a78f20e669cf9b1de9e70de1c04808d96ef82d2e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ast.txt.azov

        • Path C:\Program Files\7-Zip\Lang\ast.txt.azov
        • Size 4KB
        • SHA256 4af50571b87bdf19e3714b069c6062d4d6eb507c93fea7086f6e837a1c134544
        • MD5 SHA1 SHA512 SSDEEP TLSH

        az.txt.azov

        • Path C:\Program Files\7-Zip\Lang\az.txt.azov
        • Size 10KB
        • SHA256 03467745f41925a4ffd1a9bb803613cc9869c6b1dca11f0bc1ae645d91cb1876
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ba.txt.azov

        • Path C:\Program Files\7-Zip\Lang\ba.txt.azov
        • Size 11KB
        • SHA256 1978bf694faaa174c7efa2d5160767140681be4b839b4f45f9397c43911c5b74
        • MD5 SHA1 SHA512 SSDEEP TLSH

        be.txt.azov

        • Path C:\Program Files\7-Zip\Lang\be.txt.azov
        • Size 11KB
        • SHA256 c565ed60f95867477ef9aded24d3eeb35d94d6980c3a173aa7c793d87c7de2ec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bg.txt.azov

        • Path C:\Program Files\7-Zip\Lang\bg.txt.azov
        • Size 17KB
        • SHA256 c0c7fa72922df09909f8b1314c61c0ebe26e3e172547a2cd36c8beaf0a0fc1d2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bn.txt.azov

        • Path C:\Program Files\7-Zip\Lang\bn.txt.azov
        • Size 14KB
        • SHA256 eb9985cac1520b03c7716bc2c85dcf3beaa4d87887fb435952eedfc3aab1f3b2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        br.txt.azov

        • Path C:\Program Files\7-Zip\Lang\br.txt.azov
        • Size 4KB
        • SHA256 5083e97e137cc8a1c94ed887d2a5d358cbe96ad9c22ee3ace97b2696ae942a29
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ca.txt.azov

        • Path C:\Program Files\7-Zip\Lang\ca.txt.azov
        • Size 8KB
        • SHA256 6752d9853ce40b6f2f9993675f18db1f4981414ea226f22eac4dde9dab73498d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        co.txt.azov

        • Path C:\Program Files\7-Zip\Lang\co.txt.azov
        • Size 11KB
        • SHA256 c7a88b3a71110f3566753da0700cee172fa41e0fcd1031d5acdccb46aca363fb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cs.txt.azov

        • Path C:\Program Files\7-Zip\Lang\cs.txt.azov
        • Size 9KB
        • SHA256 8dea8d176e2ac875be84a2fa46d6d9168cc286dbf06574b68c7178bf567bb50c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cy.txt.azov

        • Path C:\Program Files\7-Zip\Lang\cy.txt.azov
        • Size 4KB
        • SHA256 0dec7b1ffb9eae49afb8c588624bf45ca036d9bb4e625c4266276f8401b665c5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        da.txt.azov

        • Path C:\Program Files\7-Zip\Lang\da.txt.azov
        • Size 7KB
        • SHA256 d14749014a9d406bcfe9551feab38851ad8719741029fd3380ff2a9fcfccb5a6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        de.txt.azov

        • Path C:\Program Files\7-Zip\Lang\de.txt.azov
        • Size 9KB
        • SHA256 9e6102fc7bd067387895dcc726a050dffecd44438a0a40b10e0eb9a04c619692
        • MD5 SHA1 SHA512 SSDEEP TLSH

        el.txt.azov

        • Path C:\Program Files\7-Zip\Lang\el.txt.azov
        • Size 17KB
        • SHA256 f5bf13c3cfc397f4f0e6e78ad7502240e7d438d7498ad383ceac4419dbd8192a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en.ttt.azov

        • Path C:\Program Files\7-Zip\Lang\en.ttt.azov
        • Size 7KB
        • SHA256 60333f88f517b95f42427f15ea18e9df0d71c9541c482000016079c0efa354db
        • MD5 SHA1 SHA512 SSDEEP TLSH

        eo.txt.azov

        • Path C:\Program Files\7-Zip\Lang\eo.txt.azov
        • Size 4KB
        • SHA256 1e4541d6777701745dbd19a4ecbf168d1f65fded95f5f4311f907748d705d145
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es.txt.azov

        • Path C:\Program Files\7-Zip\Lang\es.txt.azov
        • Size 10KB
        • SHA256 6105bb411ecbc5f051dfe3659f5e68bcae094278b0bb3da3c3f850a9725bd7e1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        et.txt.azov

        • Path C:\Program Files\7-Zip\Lang\et.txt.azov
        • Size 7KB
        • SHA256 502f6fed58a57f1fdf3b1451df624bc91566f72643ded5f10831f831294dc7ca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        eu.txt.azov

        • Path C:\Program Files\7-Zip\Lang\eu.txt.azov
        • Size 8KB
        • SHA256 0911e4c88e5257bf8da6d2dbea6f518e0114d1e61adb8280f5e7b85fc1c0e007
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ext.txt.azov

        • Path C:\Program Files\7-Zip\Lang\ext.txt.azov
        • Size 7KB
        • SHA256 a7aa9177abc72446897dcca9334628afd4f9dd9e1c4e63611347218f7e4441f3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fa.txt.azov

        • Path C:\Program Files\7-Zip\Lang\fa.txt.azov
        • Size 12KB
        • SHA256 538477051a199264380854f0dfe3d890da01a8a24f4d26e504b36bfb5b239bcc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fi.txt.azov

        • Path C:\Program Files\7-Zip\Lang\fi.txt.azov
        • Size 8KB
        • SHA256 7dc613c2b30e591e820c78f05fda16ca849fc74b7f521cc57ca092607246b3e0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fr.txt.azov

        • Path C:\Program Files\7-Zip\Lang\fr.txt.azov
        • Size 11KB
        • SHA256 c52725fbdb270d9406426dadfa3327d943e4ef224d6e7e13639c61dc3225f6c4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fur.txt.azov

        • Path C:\Program Files\7-Zip\Lang\fur.txt.azov
        • Size 7KB
        • SHA256 1a6faf196d8da39f80f4983a71e55269931d4c50c6bf022be1796edaef1514b2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fy.txt.azov

        • Path C:\Program Files\7-Zip\Lang\fy.txt.azov
        • Size 5KB
        • SHA256 3633020570167fec8c79c77b0302f6a99780ba812787ee0b477b21acd452aa91
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ga.txt.azov

        • Path C:\Program Files\7-Zip\Lang\ga.txt.azov
        • Size 7KB
        • SHA256 4199df4c19d82e41c6d12d8faf06eebb8f651925ebf537b7ead0c1dfd296486d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gl.txt.azov

        • Path C:\Program Files\7-Zip\Lang\gl.txt.azov
        • Size 8KB
        • SHA256 586ffbd210ff5cae837c1eeefdd97466861d981e5f2c42104b26c159e65118a3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gu.txt.azov

        • Path C:\Program Files\7-Zip\Lang\gu.txt.azov
        • Size 17KB
        • SHA256 bfedfc6d4fccb058aca2bc0737e36ac15f5c66cf63666c8ea9ba3ed352c51a0e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        he.txt.azov

        • Path C:\Program Files\7-Zip\Lang\he.txt.azov
        • Size 11KB
        • SHA256 5fa44e85a4ee6f122ec087871ac3ab64b95628a9eb688097b97acae1e3f11afd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hi.txt.azov

        • Path C:\Program Files\7-Zip\Lang\hi.txt.azov
        • Size 17KB
        • SHA256 b955a1b5ef40d274427a8c6aaac62ec533a203381697cdb0467514e78973c9f9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hr.txt.azov

        • Path C:\Program Files\7-Zip\Lang\hr.txt.azov
        • Size 8KB
        • SHA256 8bb5cf0cceda3f0e489f4f5e2f0e38368841f1cee212bb91eba20f17edb43029
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hu.txt.azov

        • Path C:\Program Files\7-Zip\Lang\hu.txt.azov
        • Size 10KB
        • SHA256 93fa4b0abdec71cb32b98c9dbc02bc742467e19f34b465174ed67f88cbbe636d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hy.txt.azov

        • Path C:\Program Files\7-Zip\Lang\hy.txt.azov
        • Size 13KB
        • SHA256 18b433cb4c48a59cbfca5485f6c900d2fd7c061d540556a10ba89080ea6c2ca0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        id.txt.azov

        • Path C:\Program Files\7-Zip\Lang\id.txt.azov
        • Size 8KB
        • SHA256 baa1138c29825955370f603cfbf6f6e862ea506cd1eec224b85852096d2f2591
        • MD5 SHA1 SHA512 SSDEEP TLSH

        io.txt.azov

        • Path C:\Program Files\7-Zip\Lang\io.txt.azov
        • Size 4KB
        • SHA256 32744641cc53036df499d6b6cbba60b88ad805d93e42466121b18f622757004a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is.txt.azov

        • Path C:\Program Files\7-Zip\Lang\is.txt.azov
        • Size 8KB
        • SHA256 08e7c8409bbf62c05eb131772dafcd91ebf3b2aec30e6e62bb557d2fb1653158
        • MD5 SHA1 SHA512 SSDEEP TLSH

        it.txt.azov

        • Path C:\Program Files\7-Zip\Lang\it.txt.azov
        • Size 9KB
        • SHA256 3c80f5e4f42d9544bcb127bd3441e12032fb8c9c17666ae326a064b929f25eac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ja.txt.azov

        • Path C:\Program Files\7-Zip\Lang\ja.txt.azov
        • Size 12KB
        • SHA256 de88928377b9aeb94063c12207c42bb5100476bdf1db864ebb8d0a562c1947cb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ka.txt.azov

        • Path C:\Program Files\7-Zip\Lang\ka.txt.azov
        • Size 17KB
        • SHA256 6b3dbe93f098544e7a674e1b9be7996713e69f498d49d8d61104204ca851aee4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kaa.txt.azov

        • Path C:\Program Files\7-Zip\Lang\kaa.txt.azov
        • Size 7KB
        • SHA256 1db53d515c8c58c2ac6663bc0920221b47557d2b443653151f41c06773dc8eef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kab.txt.azov

        • Path C:\Program Files\7-Zip\Lang\kab.txt.azov
        • Size 8KB
        • SHA256 88007e767380a0cd0716fd52023b29e61cdd636666a8d0d2b473f3ce3ec06c83
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kk.txt.azov

        • Path C:\Program Files\7-Zip\Lang\kk.txt.azov
        • Size 10KB
        • SHA256 f3b5542c58542441371c6e90fc9bf3ad57c19e5fca9419ca12768d73c95222dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ko.txt.azov

        • Path C:\Program Files\7-Zip\Lang\ko.txt.azov
        • Size 10KB
        • SHA256 7f412050e23fe6df85b377d9d4fca27d61c3a5aed4d3b1e9f188aa5054194015
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ku-ckb.txt.azov

        • Path C:\Program Files\7-Zip\Lang\ku-ckb.txt.azov
        • Size 11KB
        • SHA256 bea72785cbe4d59d6fb40a7961feefd0b1fdc13aa2a015ba7ea1a2511f6fc294
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ku.txt.azov

        • Path C:\Program Files\7-Zip\Lang\ku.txt.azov
        • Size 5KB
        • SHA256 55f99452b766daf3837bc0d66c2d53886609f9192501dd0ebc337cb8af80848e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ky.txt.azov

        • Path C:\Program Files\7-Zip\Lang\ky.txt.azov
        • Size 12KB
        • SHA256 91ddd0b50d9e3f6029a7c70789afe9cf9c5a0a636da15f938774b9a6b5283200
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lij.txt.azov

        • Path C:\Program Files\7-Zip\Lang\lij.txt.azov
        • Size 7KB
        • SHA256 7a7df230bfd4213bfd4c9bd88eab4add0d57f3739eb134ac4b3b6471b6a8e057
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lt.txt.azov

        • Path C:\Program Files\7-Zip\Lang\lt.txt.azov
        • Size 8KB
        • SHA256 3a18cd5574b4511411dd13ca950588e89ff98acc2644bf5fc9258d92f2a14bae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        descript.ion.azov

        • Path C:\Program Files\7-Zip\descript.ion.azov
        • Size 666B
        • SHA256 f233d3bef8c0dfebc0004bd219653c926e5cbb48c1fe669b9cdd4cdcb135484f
        • MD5 SHA1 SHA512 TLSH

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 350KB
        • SHA256 2a0c2b439335aa487e7e6e5dbbe50eb9bcce9454dddc89c549c660bddaad261c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntegratedOffice.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 4.3MB
        • SHA256 297eb4020466d33e65e373d2ccbe90c29f2540baf4e86d7df9a1869278a80a58
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 2.3MB
        • SHA256 4e6f55e32e193e78ff23ded2c3d30b06ce32b58ab3a003e934aa20935d29c9e3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrmstp.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 6.2MB
        • SHA256 9f3cd28ad9a17abef673edf9fe2ffeb9cf4f4d162dd1982d2b10b784681a7778
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 1.9MB
        • SHA256 06afc8ead7ce99c0ad6e08374b92234912018de9a19427a895caf7785c27149e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 3.6MB
        • SHA256 a8458f447f9bd1091b8cd605246c331190d350bb769ca47a1db360b3f2943a5a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 2.4MB
        • SHA256 668df53c9e4dbc570d97cb695280c44b1d203ff20feb4984d824414195884846
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 1.8MB
        • SHA256 1273d81cb4a22cbc94c3f5813e439322a0acb4acc3ae9f947e68c682766d22c2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 2.0MB
        • SHA256 88a6a1eab2b2cfce163a56ad4c4dbdc7313e5f28a967e1ceb65dad6c548aa8d5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 3.2MB
        • SHA256 ee7e0fe0f4490b2c6135a91577eeafe33e7ec689f47069951ed1eb3d1065a01f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 1.6MB
        • SHA256 736f5241b12a6bc5f48ef76f9e3d4b07f41fe302048436a9e2af37c044374524
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 333KB
        • SHA256 e76cc09ed76db86f6b8c32bfd99e9a4fb6f11a6698e4be71225a93513dd1b652
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 333KB
        • SHA256 f413f7e1f4ff7b184dd20ee62a6749205e7e52f82f3f8a936a13207ea78de9fc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 540KB
        • SHA256 dfe5ec3695a55c687e54d570be8331a37f80f6b5db263eeedfc091c323e2971c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 333KB
        • SHA256 f415524febb47c89cf926c95c440212797b3242e56d763d36a74ed40f440e5f5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javacpl.exe

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 142KB
        • SHA256 98e1ea117c767f847df13b042b156f11b5a48cf511c8ef82b3ba3017477f6c2c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 333KB
        • SHA256 a50f4b8e26d9f832735b49421d2fc2cbdbfac7df9aa066dd2a04b5ae552be12e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 540KB
        • SHA256 b4a2211bf45d78cd870306b031e27bd3ea3168ea4ec8340cfcc7c38b465e2578
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jp2launcher.exe

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 195KB
        • SHA256 a02d596e2bb44a6ff52979947622120b0c4fecaf5cdc02603a389ddfcff94d3b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ssvagent.exe

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
        • Size 138KB
        • SHA256 8d71a082be3e4ec85c27aabd797efb15a2f1be5930a5ca855a4729009ec7e8f8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jre-1.8\bin\java.exe
        • Size 333KB
        • SHA256 bd0869d31af64a9d67460f004ddf31890fd607c4103a45727b507992ab5bafcf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javacpl.exe

        • Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
        • Size 142KB
        • SHA256 81412046afc8b3ba623b482e8b9727c970824763a0192561cce499a862fe0e16
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
        • Size 333KB
        • SHA256 4ceac11a877adf3b79e807da8f9be812b48df6962637c93b21285e10f69b5c84
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
        • Size 540KB
        • SHA256 99c6a89231cc56910b1820731904a7b15629cf31c0b53c93c7400bfb24d78a15
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jp2launcher.exe

        • Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
        • Size 195KB
        • SHA256 03e6f90c2d2fca2453bef5e6395245e23e02cd2aa9b8c1e544ad456a2d81a4da
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ssvagent.exe

        • Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
        • Size 138KB
        • SHA256 81fd56cd85b1a8e3e01d265aa2ad2d1075ee537c6e2cdd0d4f80f639ce5665ba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntegratedOffice.exe

        • Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
        • Size 4.3MB
        • SHA256 1ceb985090b0b0063f01959fed15349e7337cc2667c75f75d5349ffc6b712f31
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OfficeClickToRun.exe

        • Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
        • Size 4.3MB
        • SHA256 1cb0364e8fefab1c89af6dacf11e8fa54ab9afa4e518d80686379f798e5cd1f4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppVDllSurrogate64.exe

        • Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe
        • Size 275KB
        • SHA256 f10a44d47c8503fe4fb6a161425da592caa5f7775c08153faa9b19a095e4ef0f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppVLP.exe

        • Path C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
        • Size 588KB
        • SHA256 7f6507d27082cae9116054ab18fa73a7e586e67ae73d3a1713f4b5efcd18fd8e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Integrator.exe

        • Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
        • Size 6.8MB
        • SHA256 c5c324e3ecbb71cc8b26903c6343a737ee8063d836be492068812eb789f16113
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Microsoft.Mashup.Container.Loader.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe
        • Size 100KB
        • SHA256 b62764a0dc101c8d537df13d9d9143f9d50088b3d2c6d1bda0eaf733e58152dc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IEContentService.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe
        • Size 449KB
        • SHA256 aeb5a61e6cf7bfc10233f811881f7043f1914c5738d377740d25b0c30483c569
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PerfBoost.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe
        • Size 877KB
        • SHA256 c043dce6c8f54f1a42ffb1c7cecacf62df275f9a3cb578172abac07773403529
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SDXHelper.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe
        • Size 189KB
        • SHA256 287c1e49b63c8d72cd348052d368da693b498a8973d89a80268811a8cd43128c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msoadfsb.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe
        • Size 2.0MB
        • SHA256 04832269fc615e415bbdf064e24efbec53a7d5aa965fdbf3b9d367863edf477b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msoasb.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\msoasb.exe
        • Size 341KB
        • SHA256 2a97a996f70bf3834378862406ae12dab177c83e993bfbf82cb272c11311c4a1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msoia.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\msoia.exe
        • Size 6.0MB
        • SHA256 7232ac82fafcf9fdc6078afbce06287069e5cf3713f585e1b95231d63c97f588
        • MD5 SHA1 SHA512 SSDEEP TLSH

        officeappguardwin32.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe
        • Size 596KB
        • SHA256 2cac5372b584733ecd769fc515d5d61308fbabf6a72a745c5db888a6c579abf7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        protocolhandler.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe
        • Size 6.4MB
        • SHA256 7f132b845df3f211fdd952f073b92adb775bffb45f367369cfd639bde32c388a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OLicenseHeartbeat.exe

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe
        • Size 2.0MB
        • SHA256 145ff334f58da81504a9ab0a07d3302e29c0c0fb1512f7d3ad0171fd2ca8ff91
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SQLDumper.exe

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe
        • Size 222KB
        • SHA256 3e6d8dcfd274d34b2b8a51349ac90d905c14e43df72b85cc9b98124b120774f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ohub32.exe

        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe
        • Size 2.0MB
        • SHA256 2ccc9bb45e0e8059aa983dc3ab8ff934e226e469e1befe6acc553e6095d1c715
        • MD5 SHA1 SHA512 SSDEEP TLSH

        crashreporter.exe

        • Path C:\Program Files\Mozilla Firefox\crashreporter.exe
        • Size 3.5MB
        • SHA256 ca59dc836ed1247804ce5efbc0a10064841f5eecd7171ac5a7c0da898bc129e2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        firefox.exe

        • Path C:\Program Files\Mozilla Firefox\firefox.exe
        • Size 777KB
        • SHA256 005e9971e1f73fc9a34c99aa2def38a3bc6fc7e878a436e8fd6a06cc2ff4b24c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        maintenanceservice.exe

        • Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
        • Size 329KB
        • SHA256 de8c348221b3c0565c507ba4123a0f61ff93a5f9005f2f47bd6c3f0bab4a3cb5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nmhproxy.exe

        • Path C:\Program Files\Mozilla Firefox\nmhproxy.exe
        • Size 654KB
        • SHA256 c703c953ff3fd9d9f291fef8fb6c082e71205753b005a47833aa6c2e68b00386
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pingsender.exe

        • Path C:\Program Files\Mozilla Firefox\pingsender.exe
        • Size 126KB
        • SHA256 a372b844a518af225c2d95613a81de6f6adf834d26054a079ab54126c166d217
        • MD5 SHA1 SHA512 SSDEEP TLSH

        plugin-container.exe

        • Path C:\Program Files\Mozilla Firefox\plugin-container.exe
        • Size 202KB
        • SHA256 b51fa7a312c9852b4665a7bb4e6cd8bcf52c05d57364094921beb4b3d66e45b9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        updater.exe

        • Path C:\Program Files\Mozilla Firefox\updater.exe
        • Size 523KB
        • SHA256 b0e9772000cf68dd6cf337e071ed3c97cd49d3fb993a1d86772fbc798e875ecf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rdpclient.exe

        • Path C:\ProgramData\rdpclient.exe
        • Size 113KB
        • SHA256 a215081d67ec659658d2bd7f0086d7add19acb8e44a726ab23920cc2f5dad129
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bb42f8745bf687cb_0

        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bb42f8745bf687cb_0
        • Size 666B
        • SHA256 68d5685170f9d3f8cd32b36f8c7a4bef7b801e98c3f54d16ae691b5979e5bef8
        • MD5 SHA1 SHA512 TLSH

        db3f07979695673c_0

        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\db3f07979695673c_0
        • Size 666B
        • SHA256 1d16e4b53514c224b17b359888e43ea5c567dc62e4d1338a26640cc12454c84d
        • MD5 SHA1 SHA512 TLSH

        memory/4348-379-0x00007FF7B7BC0000-0x00007FF7B7BD7000-memory.dmp

        memory/4348-384-0x00000263305C0000-0x00000263305C5000-memory.dmp

        memory/4348-382-0x00000263305C0000-0x00000263305C5000-memory.dmp

        memory/4348-385-0x00000263305D0000-0x00000263305D4000-memory.dmp

        memory/4348-381-0x00000263305A0000-0x00000263305A7000-memory.dmp

        memory/4520-11-0x000001BFDD720000-0x000001BFDD724000-memory.dmp

        memory/4520-2-0x00007FF7F7160000-0x00007FF7F71D7000-memory.dmp

        memory/4520-5-0x000001BFDD710000-0x000001BFDD715000-memory.dmp

        memory/4520-12-0x000001BFDD710000-0x000001BFDD715000-memory.dmp

        memory/4520-4-0x000001BFDD6F0000-0x000001BFDD6F7000-memory.dmp

        memory/4520-0-0x000001BFDD720000-0x000001BFDD724000-memory.dmp

        memory/4520-3-0x000001BFDD710000-0x000001BFDD715000-memory.dmp