8e1ceebb6dee0bf264598ab41db15f2d1246f2d978ddcd07beddd505506e18db

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 1.0MB
Sample260905-dbjf5avgrd
SHA256 8e1ceebb6dee0bf264598ab41db15f2d1246f2d978ddcd07beddd505506e18db
MD5 97506817bf2151beb1ef6732ab93add9
SHA1 ba42e30239b8ca6822ee7bbd5a8457f61966d7c4
SHA512 827f96c2a1ebf3cfe94e559bee8d6f4b2f5c67877e94292c87767302645fd8d799b21a21371d6ba79b613c7bbfcb87a706c6a5637966cedce2d69b6c539cbf74
SSDEEP 12288:6hl78NMaQdwBL/2/3VEzwtKRfz1uVKcS9gQyzw5iwAiZwb5zzFEoS2cPvyX:nNaG/E3CzzuUVZM9zFVSOX
TLSH
T17D359D5DBDF09CE5CC6F4038D07A76D952B27C264900861F12DCB66F19B3D84EBAC6A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4460	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\RCX7A47.tmp	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX2581.tmp	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Windows Mail\wabmig.exe.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\7-Zip\7zG.exe.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCX3BF3.tmp	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\RCX78DB.tmp	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\RCX1013.tmp	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe.ico	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe.ico	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe.ico	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCX3237.tmp	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Internet Explorer\iexplore.exe.ico	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe.ico	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Defender\MsMpEng.exe.ico	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Internet Explorer\iexplore.exe.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe.ico	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\RCXA58D.tmp	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCX34CC.tmp	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\RCX6532.tmp	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX2DD5.tmp	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX51FC.tmp	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe.ico	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Media Player\wmpnscfg.exe.ico	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCX83E7.tmp	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe.ico	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCX39BC.tmp	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe.ico	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe.ico	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX2396.tmp	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCX3CFF.tmp	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4920	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4920	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 4460	4920	2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
  2⤵
  - Executes dropped EXE
  PID:4460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe
Size 1.9MB
SHA256 0edc56a592334ded125821b051a365e6211e5b64c9dec308dfe8da731bac1182
MD5 1766b27723a1b4514e1db4469af86960
SHA1 b39a968de6b02b4f1ae01131ae04d05c43358d9c
SHA512 ec48775bbbd9525556ba5867afd7a981aed409d2ef4a0e9ba63a7b841d894e161960c96c88143f4f36eba58063ebd901fecdc4b5867e305774989c160592d9a9
SSDEEP 49152:/BjgpZLPWgF1+eraauD/X0+d4/xozyVJO:5j+LPWSsK+DXd4/v
TLSH
T16595AE0AB29885E6F029C1784A464175E9627C653F2069CFC685B71F2F77EDC2B3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe
Size 4.7MB
SHA256 335a8d0d726decae8de908f4fd6eb9602663507594616b82293f218893f4c468
MD5 303e661960cc33fcf0d9d8f2a2fd55bd
SHA1 d90631eb8caacae374e900732eb088a8c36435af
SHA512 55ea7150965b2ef18d3316681b60b217ecb6bd25086932415d9ff18c89f068f832534ff777827330d11ea5065fea2c5a44f7146df596d5ec9530d54bcf573cad
SSDEEP 49152:mxwnqEpBwvKOudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/BG:HqEpBsxijnUdYd+RaAj
TLSH
T10B366A03B28980D4D099C174CE56D233ABA17C8847F165EF3680B6EA3A77AE47B3D715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.5MB
SHA256 aee77950cf59db4e052b7647225640915bb1a50101fe65dc847bc38d6b04fbc1
MD5 3f60fe12ef34838cdb6d664e5323821b
SHA1 bf5bb989021df8c277d979ac60b7a2df9b76212a
SHA512 9a46ea0fe526a25ea743f5a010785d57794d2aa83757c68d655738e7efe0d2ff03dc83d835d09aef123bdf12858b2d98c17f01dbfe9051a9c482f828c23ae986
SSDEEP 49152:pr7b+313ZGu6qG13O7Q7gLYduZrSdHBAVfb:Nb+31JR6YjwA1b
TLSH
T18CC59D03FAC580E5E01DDA79CA668739D672BC554F2055EF0280BA293E7BBD05B3D7A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
Size 2.1MB
SHA256 ae351b94c8f73e21d046aa150166ceca216e7ec4249b55c2a664f062d23c5d27
MD5 79a67ea3c617e4dfad50dabf39663d61
SHA1 3d4ff6b1a7dba9299832dabf047e9a987a94bd1d
SHA512 2817182edb7f720b3bcccc376ec19d40920a604042725d3dc95ae525485be0a90463726b2a8ced107af15d51d1555fb9b028ccb904f2c9984037fcbd3f072820
SSDEEP 49152:Ks2qxMVfRcuu/Y2fF8FhmS86IUJWQn+6h27d6:CHmbOjjsts
TLSH
T1C3A5BF13B289C2E9D029C078CA5A4139DA717D410B68E6EF2760B7853E37DD46B3E772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 976KB
SHA256 2a74bdbace6488efd73ca8b71b97005e8680d21edc4ad0a86eae75722d9822bc
MD5 a5e46bc86e645b91ac19a37dff134618
SHA1 5faf7fd571fa8ab285b97b19e878b0f32848d3d8
SHA512 290a28ed3f57a6c3a752bb39a315529f9d7c9cd47cded12241da8428ce951b62b4b23513d356f3d8e643d07669484bd0e4763c03eaa6573e3a80f47e3e31666f
SSDEEP 12288:KKrW/PYhNCRZEY8kYjPxGLskw5i0jM35i6ows0:w+NCRZT810LUTA35i6c0
TLSH
T16C25C00C3586E476EC6986344AE38D56BB62F8A0B7004D1B46735D1F2DB27C07E7A9F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe
Size 1.2MB
SHA256 94c932adab5089eee62d095377b520b3314a336ff6eab84f83e3cd4ffa168bad
MD5 627203036d2f0ffe32726ebf1b7b1c0d
SHA1 e68049d9be70d799e38bf94970df86873a8b68d0
SHA512 73736ee05dc7ef9c18cf39f6977480b77971bfed1109a30804a0ef9dca06a282180f3b381ac9a6ff1fcdb53dcc4c548880e72c1d2672ac0d3104733410d30443
SSDEEP 24576:6uUNXN2k2vV9YTt5JHaO18qH9pVpU+HJk9mR4qYbTM:XUr2k2UxbHaO2qfymWD
TLSH
T1E255BE0576C0C6E6D0E54D34C8C38683C631BCE58E29568F0791926C3E7A699FE7A72F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
Size 4.2MB
SHA256 d5b36235486f8c62d4e6d27f37c87ca93785b41d6f722e9e4175222c94908cc8
MD5 e259b9cf409cf82ec0a29724fb0438f6
SHA1 f6272d0107239c5d1c08586736ede2c3860f4d54
SHA512 ec972b9b8941d29a833de9a13b85d35212dcda49d3fd666b173afcde77604596fa43d1ffa158408d0a82ca0ad9aaebce683817864f41d38caf8c9265761d871d
SSDEEP 49152:ROTdVo/pASFeOS2aBW08mKqRXGPd39PyPvnkSN+EcrxA3vGCDlBYMO74U2y+PhC:RO7A8NbN/ki+EcF0pDeN2y/
TLSH
T1C4165A07A1A548D8D049C034CF469232EB62BC9D1BF662EF368476D92A77ED43B3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe
Size 1.9MB
SHA256 fd6014df568c5725272e67a37ce55345bdefeb145867ce38276888cbee90eaf8
MD5 84499619582271500f0ad307eea1b739
SHA1 bd58c4380e3715e2950cdbb5059c6efc1c7d6f9a
SHA512 8f249a3ba727a006f2ec7d5a68bce6eff0ba7263dbe9a6224e9000e485299c521fb3148ffec66c004e7cab8cb489f285eb2f9d801d1b8cc5a105a1ad1fe44aea
SSDEEP 24576:EVOwslgejBup2N6MrhnAc6AbpzJvAy9DlWk0eTy5xDz7EqnPATW41PcL3LU:V/AMycfdzuy9Dlp0L5xDzoMY91P27U
TLSH
T15695AE03B25544E9D369C0B48A9B5361EE7E7C410F24B6FF4250BE192FB7AD81B3A724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe
Size 2.2MB
SHA256 9ee502b07b03e4b7aa4f3a673d5ca04aa8040b3d56b227ca63281d4df986d854
MD5 a899c7806c5d180f14e9d33ef6c6534b
SHA1 ee08a638fab452631fc131bebeed600b96059581
SHA512 5b82ea21f487cea4898352cd847426dd1880e4ee5cde5957574ff0b6035123debfa5ad02e8ce365a8aaba17fb234fd83f25acec2eeaa5917149dc261d420c2e2
SSDEEP 49152:3dZasyOq+AlHk6YfhcfehjvHHKTdfxINPEt99G2Bo7EukU1a:hWlvwoyjvnORmE
TLSH
T192A59E03F78830E4D06DC3B0C6468676D9A3BC524B2596EF07D0B6192E77BD49B3A7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

MpCmdRun.exe.ico

Path C:\Program Files (x86)\Windows Defender\MpCmdRun.exe.ico
Size 3KB
SHA256 02221d573edefa486ba8fe5aee3c8a10c8c7e3188914c0f22df06bb1338db790
MD5 1272e6501512e471bddb879dea4b5800
SHA1 1c8b9489166959e6106095c0974a1825ac1179c6
SHA512 7ef9f685457532d84ba2ed316ec52a44acec151b92e563f6943f593d272745bad0f7c549867a723d2b3532cbcb76ea2b99a965b3b2412d5e7644570740bb4194
TLSH
T1CF6140A1F209FC58C45CD1744DC6C2CC18543D958C0A7273FADCBF8F69724E52E21181
MD5 SHA1 SHA512 TLSH

Submit Download

RCX1013.tmp

Path C:\Program Files\7-Zip\RCX1013.tmp
Size 756KB
SHA256 bd1860df675dae529f1fa2cef49f82a38ee565f8d58bd09aeb9b6595e02905bd
MD5 f7353490168abdc4e46653b87c39b0bc
SHA1 d9527b6dede20b135d432e2d85673d387011ce58
SHA512 b3bc255d0205d33ba03ae7419817d8387c1899fdfa4049467632be4b97f13da16adc2aa63235ef80272de39f3d0049631cd350c4a433f8ece4631166abf05d6f
SSDEEP 12288:6hl78NMaQdwBL/2/3VEzwtKRfz1uVKcS9gQyzw5iw:nNaG/E3CzzuU
TLSH
T156F47C5DBDF59C95CC9F4078E07B76E922B25C228805451B22CCF9AF14E6C88FB9C5B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.ico
Size 3KB
SHA256 463b6e99198762de39ea3c9156504527673355f452c17063d0fcc34caa3cfded
MD5 01f2c0d2e4df4e0ed544a4e4600d1457
SHA1 2bdf43857fcfeefcd37ee7a82d733ca4e4f1d871
SHA512 8238557d4075faf0d780ce775a6bc0121cf2da9b826cc49095fec9b35096809e5187f3027682db88d7358e21025c5d24d2ef784e9c2b0a8aa7021589ce68a8aa
TLSH
T13061D3A9E5052C3BFD5CDA7935B6DB60C2077ECA021680778809F58328F768B16ED974
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

iexplore.exe.ico

Path C:\Program Files\Internet Explorer\iexplore.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

lyncicon.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe
Size 1.6MB
SHA256 bf3e458a9927f7f81c8686289a939424a49507b6c4b15e06d35000ff447ca606
MD5 5d090af4817b49b541c6bbe99502f733
SHA1 fe0bdae93ff2f7900713ec72ba8dd033136bd401
SHA512 192a8869c3e2167be2f1c1a57c05673950284460572e3345ad04b599e8abd44874c351bd07686f5430feb693e8a60f2b3e8ee5b11c58dbd0e999ec1abb205daa
SSDEEP 24576:l4Uz/JHLD+yn8RuTldIqZWaUWy2cXcqr+:6YrD+y80Tld3S4
TLSH
T13E753816BB8E9815DCAEBE3580596570F8136D9FBC1E70076E107A3B2AB38C2245C5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
Size 1.0MB
SHA256 cac2384ed462f3b08357ed3ae3a538add3a9bd1fe22ed4bdd2abeca79de0ee8b
MD5 15c30419069e28bd590e1c9a4a004c9f
SHA1 3dc8193bb3586dcb2daf50947d4874f670069c1f
SHA512 289c88f7764e395da8882a17745a1d6e7facdebbe7f494dad350de080f8775a5b911f895813b6696747607d3dca80b2c9272c11066eadacb48818e93d53a39ca
SSDEEP 24576:6FA6w0e/mcW7mq//Dah7wMkrXYfDtczAe:6pw0NC5tcv
TLSH
T11B258CCB37E34DAAF925CD3894815560EE63BC924570ABDB07648A0E3F2B1E53879770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

OfflineScannerShell.exe.ico

Path C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe.ico
Size 3KB
SHA256 9e3f1f8e5166514df44b02a1e0bf7474708dafba161e263cff087af62ba89ae5
MD5 d8ef82bb84e2efe95de666f46d0c7ac6
SHA1 fcdd2f6ceacde21e1e38a687041138aa5bb0ef68
SHA512 61f7439ba615c3250701aeecb96ab8319f2d84ffa7e61076f6dbfce20ee3409d212e8d9deb274b145b7f0eeed2388681b929ba897bc85b4d3841f7003bc40afd
TLSH
T1C461FEC2D34610E8DA8268F34DB58DC487650CD540E4ED920EE6BCE39A745FDA93188F
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

VC_redist.x86.exe

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
Size 1.4MB
SHA256 23a6ac73752b7360d0cb0ffdc745f1bc1f730d2872d6f4909e50fcfba03007e4
MD5 4d37dcf26b6564c5d288b4b96eb3baba
SHA1 b4ea0e9a9471b1a9f711e0f12fc69cb9482c5fb5
SHA512 27e2534cbb28cc5cb89de4ffef447b5ec422119a15306d4ac72350a634fc544daaad0632256ac8bc9216f864124db60d54bd4ea1bb47519cca68c9d962b783f9
SSDEEP 24576:Vx6DwKEXAcG7tcbQboB7B6LwDAMysZgjS1hqgSC/izGfU2JGlbhlAZ4/:ZwcGOMY7ARjvQo0nGH1
TLSH
T1A665BE31A46740A5D1FFC572657B83352E3ABD28AB27446E43E0F91C2DE54872EF2722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-7.0.16-win-x64.exe

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\windowsdesktop-runtime-7.0.16-win-x64.exe
Size 1.3MB
SHA256 38216608180d74013cc914f160a803f1c8035dd8f4c2198498392801cf3df19e
MD5 4deb5cee6efef887aa15d5d217e6adef
SHA1 c30dbe2eb9987275010038b1469db4f1e06ef2e9
SHA512 fcdeebdcf5bac91751afd9c3c9400ca070e455cce7dd60d95dfb0366f9aa2f0b5df0167894eae31aa36cc7dcb63f94123073e8fddf7058b41a23f29d1cf56d4a
SSDEEP 24576:Gmku4SNXY2+zghiF/pZ5QtyDUU+5mWpI2jFM5sFzfTpi71R8dZd:/VtXYUiNhv+5BjBbTpi5R8d7
TLSH
T13655BE26211DD032FBB175B2B828B27C59E8A90C1215F667E2D87DCCF93584197FB271
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe
Size 27.3MB
SHA256 7b55a954549dc272ccbe924230ec460ae25fa6e9af4d8f55bdffa18f8c5233aa
MD5 d3d7e025db528d48e970fbdf96f39ced
SHA1 c72ae245e169e870bda33de5a7bd215f56400f12
SHA512 f86d1dbe3cbb89d0c9185e601f55120832918c42b92873c3b20bf0c04ed3eb4f252813434ef561415241685ad5d19af5730d169412d8e776a8f26dec32658c63
SSDEEP 393216:Y/w5ZbDO6RGmb8hFZtxwbTNXp3YCkxJoPMAvqkWgoj6RVFK+q3HvUUw0vXL:kWO1c877xqpyovvVWJ6VFK+q3cSvXL
TLSH
T1565722927FE89031F9F346317A78567D457B7C225B3181DF2292F21C1A709E1AA36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-04_97506817bf2151beb1ef6732ab93add9_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
Size 292KB
SHA256 8491ab5b8abf621a90fb6d283dabb7164ad0f529e259a91c7f29d1e98283173a
MD5 44cbfb440894709b250be1a170baa3d6
SHA1 88383e2d4deccee4f32aa7b89affa7d8d73f2a69
SHA512 353acda5e8c8bb413cdfa2101e2f94adea7dc519c9e87ae234cb5ff6a162cd364a103fc6750eb55847a4da5905a53126335b537f96624478301f46b11beb497a
SSDEEP 6144:pWPZw225bN5zFEjGkqkAJHyEzYV/PvyE:piZwb5zzFEoS2cPvy
TLSH
T1DF549E95B3901CF8EC67813EC8658906D6B27C5A0B70C65F13A436275F333A11D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4460-66-0x000001D0BE9C0000-0x000001D0BEC30000-memory.dmp

Download

memory/4460-65-0x000001D0BD050000-0x000001D0BD051000-memory.dmp

Download

memory/4460-17-0x000001D0BE9C0000-0x000001D0BEC30000-memory.dmp

Download

memory/4920-0-0x0000000000400000-0x00000000004DF000-memory.dmp

Download

memory/4920-797-0x0000000000400000-0x00000000004DF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads