d698cff02356be2ec646eaf71b1078a155f36c0a58a493e1973f7d43de55e2f1

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 1.2MB
Sample260908-ltd85aef47
SHA256 d698cff02356be2ec646eaf71b1078a155f36c0a58a493e1973f7d43de55e2f1
MD5 990945c18b801b52422b125aedcbb298
SHA1 fa94b9ba6e8d1225384f8306f131613c02124995
SHA512 e3d2d586a294b3a7e1863c30ff88c0c817368aab2694db411517ffa6a7ec2b51913bb7f6e8076198bddf76388599efcca6a3df87fbed2dc93ca8e0aa27778440
SSDEEP 12288:AK+3rwT5NTSnU3viR6yclPxCSw7q7evVe5zAsCorqBw5ici4e7WRdTfgwCHKy7Go:orwzS4viquq7CVe5rr3Td9CHKy7GZO
TLSH
T16545AC11E3DCB362E8365530D862485EFAB77E564B21D68F0ECCE51E2E22A414D39F36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4928	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\RCX96AD.tmp	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\RCX9885.tmp	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCX9E2B.tmp	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX1FBC.tmp	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\RCX5F6A.tmp	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe.ico	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\wordpad.exe	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe.ico	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCX80D5.tmp	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe.exe	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCX3BCC.tmp	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe.exe	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe.exe	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe.exe	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.ico	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\RCX59EA.tmp	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE.exe	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCX69B9.tmp	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCX6AE6.tmp	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\RCXADF5.tmp	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe.ico	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe.ico	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\7-Zip\7zG.exe.ico	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe.exe	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe.exe	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe.exe	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCX8922.tmp	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\RCX5CA1.tmp	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe.exe	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe.ico	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE.ico	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe.ico	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.exe	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe.ico	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe.ico	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE.exe	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.ico	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe.ico	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.ico	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe.exe	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe.ico	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe.exe	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE.exe	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\RCX5B36.tmp	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\VideoLAN\VLC\vlc.exe.ico	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe.ico	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\RCX5C33.tmp	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe.ico	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe.exe	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\RCX8F1A.tmp	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCXA348.tmp	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2828	javaws.exe
2828	javaws.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3048	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
3048	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 4928	3048	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	86
PID 4928 wrote to memory of 2828	4928	2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Users\Admin\AppData\Local\Temp\2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Program Files\Java\jre-1.8\bin\javaws.exe
    C:\Users\Admin\AppData\Local\Temp/2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

arh.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
Size 840KB
SHA256 6d825b8a35a0998e8c516c772cd949347b761b4585ecdbaed9cdab4eb107e8d1
MD5 5a53b7f47d84f5c81d533e52ddf48b9e
SHA1 be6b840ddb30e51c6db9ba6e7501d5a7781c0224
SHA512 bf8e54944f7646cf316666afd194bbfd817dd8eef85fe65bd133a43a10b96e6bae27749d80bfe43bd1f8eb357f3a7aea4d08f928adfc67a5cf3600c9bd72e8a3
SSDEEP 12288:ME3N1ukeKx85Rdv4Mu7ktDuyJP6cbw5iOgtkcPoyRDYmIjE72:MM0keKEdrDuJdsNgy/72
TLSH
T19A05AE457180F4F5CB9E8A703AC046B773AB681E6E227B5B65D097ED26DCA40C6301FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisabledGoogleUpdate.exe

Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
Size 6.4MB
SHA256 74b5aaacf4a642f1d7eaab389b4dd07198badc1c9ca099cfdb36997162aeb7f5
MD5 2724e8ceba390478e37d2dced272725d
SHA1 a0c3656f76293c998a265f83428e170f7c2d1492
SHA512 58010ebc19e06d9001ce5b5afdcced1552dd893ce72fc4f96b907f8e627d1d54a682575f424c6705a3a4c4d4fdbdd82b09a52ebaf712a4b7bcebf1d3b9b6f054
SSDEEP 196608:MC+og1P9fIlOuz6IgF+I3m2MXP6HG8Qzb:6ognqO86IgF+qbM/6HG8QH
TLSH
T194668D23B4D18035E5F732356C2D673959327BA29F3146CB86A06C942FB47D328793AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ieinstal.exe.ico

Path C:\Program Files (x86)\Internet Explorer\ieinstal.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

msedge.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 2.2MB
SHA256 8209e4e24b963023853cc5346b75288e1ddb4069478cc7e7121df93321b21f3a
MD5 21ba4f3068c899477775aa13a7396f87
SHA1 3e73e286f67c70d7cd08528d82a961754e6914b4
SHA512 bfb45b4e5f24bc36730de8dc9424242830d2030230b0696012f9e294abeb97efb9212a66fd5240d626cf47b3395466721f041b3c4c96f903d7dad2d04f51a685
SSDEEP 49152:t4ATsXeG+JD0DUWtole+QOitU/03nmdXa5o5QPQ+:t43UWCe6/03mdX+PQ+
TLSH
T1FCB5AD03F68581E5D05DC1B8CE6A477D9A317C317F1095DF02A4BA2A2DB2AF44F3A7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 2.0MB
SHA256 190bce544d6812a462c7eb8febbffd7f87e1b7b6b1033cb7c069c231cd54e964
MD5 8b5cc7ead4721eac6f39cdfe35cffcea
SHA1 f2184e3a21db9c9281d16208e95a28ebbbd403e1
SHA512 69d0c6ac5357ec6144a8f145b4d797d5a8b3021ce439a1c6980a985bed64be5dd715d42e3d28859ea5b409201e39cc206ccc47ddc2eba78e3d21d6f58499acb0
SSDEEP 24576:6b2jwSIdJxIQbx+X8/Lorgc3y0w9jfGX7yxgCJd1fbgqf1ChKRADe1qRAi:YSI4QbxHcru0WjiMgCv1jn1ChuADSi
TLSH
T160A59C03B69942D8D07DE4B48A56C279EAF27C510B2057DFCB58761A2E37BD85F38322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 1.2MB
SHA256 5d27e3fd8497f657bdd8743077d9050f305d52bc9ddc25ef24af07e60588d0ac
MD5 de805a07b6fa7e1d9e2b5b162915568f
SHA1 5b66862d8be71330a2272d1c55953657f27d53e6
SHA512 1a8c891d0f1b614cafee141c76826bc296451942cfc50732d7a09a7341f95b1a736112557ac52c508c8efe22b56d62b5d1928c8e59fc2111d469e6cc9b334584
SSDEEP 12288:B1MN49DnWSn/QziY2vnMzKNx8K/VYkUyQw5iTHS86nHrUA9HVlK8SQBJ9t4f15rL:vWSn/Gi7vTm0Qy86n9kAJ9tA3L
TLSH
T129559D46F690C7E8D06D853059B6884DED72F8530F7C6A8F2958923D2E767818E3AF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe
Size 2.2MB
SHA256 33756f64ac0746200f8ee89ffd3303e16a6e707f943def1175ebd01b09afc644
MD5 011327622a77dd3df64d3540b1635002
SHA1 11ff7ebeb15f9217f4ecdc987834a5bdea023de1
SHA512 1dae04eea904d88b0e38d688fbc6a66632bd4a182324cbd40dcbcbf75429a55691b56d88fd3b0a1292138e64c93a9f0a7bf9e58bc860c05ecb75955b0f4900f0
SSDEEP 49152:LSWVCmoFoEPCdsfehjvHHKTdfxINPEt99G2Bo7EukU1a:LLHkCkyjvnORmE
TLSH
T19DA58D07B2D841D8E0A9D174C6564537E9B17C190B34A7DF0BA3B6462E7BBD4AB3A330
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.5MB
SHA256 4c3edff2170dbd2fb1e54eef4d0a0218bb22173908189bbd93a557b16303e267
MD5 996af3fc66bd0d3523a4adac9accbb85
SHA1 1bab3f4aa6698b610b760b7813da058f21e742e9
SHA512 249bb48495761f6f9adcb9416f917603194cb843ed0613e2c0ebe2de0be41a49530e683b017517a4e2bf4172442a36757cb186526d6292e5a85511c8f54816c6
SSDEEP 49152:SQGZqD10NZGu6qG13O7Q7gLYduZrSdHBAVfb:SQCq+nR6YjwA1b
TLSH
T17AC59E03F69690A5E059C578CA728F39E6B17CA04F3055DF02A4BE192E77FD40B3A7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
Size 2.1MB
SHA256 bc25a09fa84794d8430476976b61096ff984082bfb6d5a654279b95c25fcf56b
MD5 3969c9fa2faf6220a3f8cbc96ce781f7
SHA1 086c4db66b507125bd0bd3b662189420682ca1c1
SHA512 4e22e31c7da2ae5aa1fad5d0003f7916af4b5080bbda613891b0ac98afae5742547c34b39612095598f4cc6cd4160882049966145a2611d240289727a48c01bd
SSDEEP 24576:119tRe+eUtannZwZGY26UEU3RyRPW+uSmS86IU8Gc7QGsVa4i6h27d3WlN:xdt0Y2fF8FhmS86IUJWQn+6h27d6
TLSH
T111A5BE07F38888E8D01ED174C65B473AEAB1BC418B6569DF1740B7196E7BEE40B3A724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeUpdateOnDemand.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe
Size 854KB
SHA256 05fac1c381b61364c2571649dcee01e40b5450cba2dba7db63be8c304063337c
MD5 d14156f40bcd43ef76e1316ca95c0f37
SHA1 4db2157147b89d409daf7086019066f856facde0
SHA512 babb1116ab5cf7e39b520b40247dfe257f955bea0d6e0dac3cd9b9a097188cf92969eeabc78c8bf978703e60d92d5b50c55ffe79812bf0ac58bea4ce683fc95b
SSDEEP 12288:bRrMIE/x/xNkFxnx+ELWN1g6NONk12h1HmYst2u8JGCoL/fmeus0a/ZBzw5iLnJ2:bR1naQINYI3v10aBSsJ2bBPzBAU
TLSH
T11E159D2EA5F78492C4AD08301EB687F4D6766E47C931B47BAAC8351B3EE15005EF21BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe
Size 1.8MB
SHA256 3b5dfc90b482e92eec8633a079d735ae8e95658c98505a58db90854cffa8174c
MD5 9c4c3a7ea9c8e6ce7ef2dcaeac68d4e9
SHA1 7b61218615171d10dfcd92f0a39bb68d398c3889
SHA512 07a54750bf8aba8d6f8d3414dfc88f33dee03a79e79a9ab1b680147973ca53348bc59ec64ecc55aa45da13bcf6ebe937d6301cc41bf8215273a7874ad8feb7ba
SSDEEP 24576:uqPMqzJ0QAss54wFNfrqw6qYmWHHo7fvqcXFudDJdWQCkvjZQqg+lIVprS7:uqkCJ0jFJIqYzno7fvTqJdbPrCx9pG7
TLSH
T17C85B007B7A940D5D01CC8B489964577E5BAFC520B24E6EF02A0B65E2E37EE85F3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 2.1MB
SHA256 5b7aedc3a63456f1035b678ed3642ce8a6dc79b0397a32043ba11df61c163f24
MD5 98af311cc0c1066fddd0e45a6896936d
SHA1 e5ff392adead98d482e77444c0bce6cb0b2293e3
SHA512 0a9fe1ababea25dfd50ebf869924cf0781208365c59d58b22b7fc5408e56b1f13a0a06b4a6b4a9fe86b0537d1f222295ef61bd1f1d1c185d302285fd31d924d8
SSDEEP 49152:htXxs9gci7S/DvwZ2XuTjPb33g9gZLfCdW9HTlXrk9dBB:Dy93i78I4Ds9Ol
TLSH
T136A5AE03B2C444DAD069D974C79745A9E5B1BC420B2475DF2B94B28A2E3BBE49F3DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 4.1MB
SHA256 1770493b1b69003e30272fb2da5e6e9476d4b0e266df6733b05fc6bfc591c513
MD5 26aea3765012f00ef6729025772cd150
SHA1 6b6f0b770449d4ddae50b862478b1bbe620872d1
SHA512 8f4664222cad6922fe41a24d8bd5eaa8bab93d1a50372812f0cb6908754ee3de88413cf6fceb6cb72576c49de0455995228582deaa1a9d0e856636f8ccf1fcdf
SSDEEP 49152:KTa9HjQuZgk07G0auOj85q7aGScYbb6YErz7z4AkOuaRoBISCaQZCLlrrZ:KT0co/Yhy8OnZy
TLSH
T165167B03B29900D9D049C478CF6A8633EB627C884BF161EF365076D52ABBED47B39764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 2.1MB
SHA256 27fba683008fd5108f9410f9d4d935b79d1d3aa048b5f36f285cca4514c0e424
MD5 684a6ca28877458df3ebd821f610d5cd
SHA1 2ecb721254433f3c53a3c798dc7bb88fbeb536f5
SHA512 17650ec22efbd686dcecf9836882d3098f5241228d9eaf010f5fa93cf7a1b60795ab42681cc6c407c368f29a902bcee8f1af8464f8cd5e995c4535705ba0919e
SSDEEP 49152:Ehja/qis1Kt5WtVjwww6wJ6Y2fF8FhmS86IUJWQn+6h27d6:YBiSI5W9www6wJ6bOjjsts
TLSH
T134A59D17F6E810D9C05DD270C65A99B9E9E37C050B28EBDF0794BA691E36ED40B3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

RCX1DE3.tmp

Path C:\Program Files\7-Zip\RCX1DE3.tmp
Size 752KB
SHA256 dd7f386d94271d48244fdf33340c61408369e33ff31349638fb3d0f214099ab9
MD5 997f1af443499bfd9f50fc6849fa1ba1
SHA1 f121f50d2a1441841d0b068390053e91c9e260a7
SHA512 7919aab5d9d2f4ea1dffaf45bfa38a99df8edd100dae2edcab294abc985f09ac0fb34fae84db13fe3070a2c18e64995033fe02296ee0e974a7274ffe7003f141
SSDEEP 12288:AK+3rwT5NTSnU3viR6yclPxCSw7q7evVe5zAsCorqBw5i:orwzS4viquq7CVe5r
TLSH
T155F49E2AE74CF317DC382030E1165CAEB6A75F568656A2CB8CCCF91EA658D051C1E93F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.ico
Size 3KB
SHA256 2a5c5c2bc95c18eded222f0a38752717c1a6ad20e31bcda6472bbba77ed22fe4
MD5 de1dbafd46ca8d953c93a1c89766a8c2
SHA1 41ec8c2a24317bba7a64f4b60341307033edcda0
SHA512 06a89f154036252f396a9f2ac515c5e03e8dd54eb7ba6c3bd0159f693d85846c4ba1b29c0fdc83f14d8c9128f18db3ee27c73111891dc66f81d4fd14361e6ce2
TLSH
T1D861565C04E3ACB1D6E548B83235B2C460D88A364424C867A89D7AD7CE7D8D473DEB0D
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

dbcicons.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe
Size 835KB
SHA256 f56195d1023b1f39c6fca66f3b47aa94ec2aa86e1103671485e1ef9ff8dab323
MD5 d96f900c894dcbebf56e41c21466755f
SHA1 7115c272ef191dded91320f5a32ee1f4a12fc72b
SHA512 5c54f0f89061d5d894453938236d25a4c7f4260fa5e2cef0c7350910df12d051499cc42ae0452297de82a8d9610547b5a5f70d03ceca968010dd6d1d7d90c6c5
SSDEEP 12288:Om9sQ8Zd5R+NHQCZTIsLZfweIZcvUU7Og421VSJf9qlKNw5ixe99KoF:38Z/KeemQtp1VGgz8E0oF
TLSH
T101059E12B3D5CC95F6EC04FCCC6F8AA0A076DDA1986D69BA5234BF3ADC311D429E1271
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 1.3MB
SHA256 275f7884b99b761f803de186aa46996b9b1fbe62db34b15ebb7bd5e1a9476879
MD5 e08ca8277d44ec898aa9b043cadb83cc
SHA1 d0bff02d64521fcf6b0b8f27d0e7a33b56ada74e
SHA512 96db4efaa1c0a785fd525c00eb7e2285538426ad47692c0f7c432d255caca8fca123d47b08f0d3bbae9fd1fa88f0b47ebd2680a8921065d90a6ad4d2dc4f4b5c
SSDEEP 24576:h9agxsOBy7PaWY8/09wFwKbAm39PZfePv3r7fm6t+jqp+3l+zCM0D:h9aAByJ097gZ2HbbZt+jqpQ0CMO
TLSH
T1CE55CF35B7626136E2A9013398ACC1356D3C96286721441BBBC4AF0D7EB9B615BF33F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
Size 1.4MB
SHA256 76a4996b0d6f3971a2a956e81ba62897be744fce7f5db15241587335a2198823
MD5 dd343747d4e7277a970c3721208b7ef5
SHA1 8130f773e12b1ce1ea6d320e53bc066c37fc0e93
SHA512 d3b2d36d634f2bffa3e49bd051a7a31221cdff3ccd1d0d82c77348d12c044b99f181a19367c1c8c7981dc0bea23ba2738a9255f714f2cdc0136316c06350e772
SSDEEP 24576:YJN1yDqU2mIMumgMysZgjS1hqgSC/izJfojymk4HM5yJ:MyDmmIMoRjvQotoy4F
TLSH
T1A865BF357561ACB7F1FA09726818D3317964AA316651891BA1DCEA1C3FB00921BFB33F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x64.exe

Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
Size 1.2MB
SHA256 fb5ff0d3d2785e9f290fbbbae9c5cb458a0448c7bb5165ca7b05d3f8f2f5a301
MD5 a81ad90af309d8d279124b8fe558df9e
SHA1 e8c9b04bbb383e1c3d389919e7f3a1f964d706e7
SHA512 432918c79ed6b448b525b27e6b7ce74ba29b7891ff3767cf9bbceed0e29ca68b3bcf3bc1513b7c328d80c47a421f2539dda1e0c401f04af2ba019da2c948e0ec
SSDEEP 24576:iawGr1qZjUCTIPkFDAbfGEtDYj+jKMYenGJiKEbXWtfOkUy:iawGr1SU7PkDAltFPnRWtGkf
TLSH
T11345AE367940A036D0370E72945492782B3A9F07BF3E504B89B4BF0E3D7966477BA369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveStandaloneUpdater.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
Size 3.1MB
SHA256 10ff9463c8d45f24ff3169452cc9015856a5060caf6690ac5579d36913feb7bd
MD5 ae9cfed20032f8c7cd8ff112e0a69dc5
SHA1 01557f054c9fef801d676f4cbc6913230017dd3d
SHA512 b3399a2d0ea8c490cf2a0b0ce48f7437d88e584f3baceb31f085e66f5b1f17e0da4f932cbe613b3afe6a2cc86fde4569f604f791c3d2ff1f1b971dae0cb52cef
SSDEEP 49152:cDpEXNpCQjrt8NVAjXR6t2jgZ8tzPFASjYhMleFLyJwXP9L8vzbtu14BCNbTc7Fz:t6nAjUt2jc8tzhYhMMFW8LMprG2
TLSH
T197E5DF217A81C032DDB316318ABD67B8517AFD719B2281CF63C4579D1A784C26E3BB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-07_990945c18b801b52422b125aedcbb298_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe.exe
Size 472KB
SHA256 2ee6d09d7b69987a0debf328e7eb09083a81f47889b5592ed2650408f9035d30
MD5 121eb9453e78b816c7f1d75318fda6e1
SHA1 40b0c328143d59db3fc1cbbd4f9c656b3bc5cc29
SHA512 2ff529b4e00f9af995baedd3d9047b75bf3c6360fc851479e20ad8e90581345293f1394cfb782c9b69e0e226ff62b6695ad168931bba83fb14b4f47f230d8246
SSDEEP 6144:ViYB2nEaKTRnXtTkCgwCzUg/HpjN4IBwu7QTLbpqmHdIvW:Vi4e7WRdTfgwCHKy7GLbbdIvW
TLSH
T10AA43A90F3E414E8F0B79A3589764511DAB67C5A1B71CE8F03A8661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3048-923-0x0000000000400000-0x00000000004DE000-memory.dmp

Download

memory/3048-0-0x0000000000400000-0x00000000004DE000-memory.dmp

Download