165f9a4be27f8dbf2388da99438494e46a290073bca6ca4ede6f87e00c96bc26

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 4.4MB
Sample260908-ssramagd36
SHA256 165f9a4be27f8dbf2388da99438494e46a290073bca6ca4ede6f87e00c96bc26
MD5 7d0dee3ec24732ec6a7e2140c2ec6a94
SHA1 c6832e2a7a18e75184e6aa7e8920e289bb93dd23
SHA512 be8a97c111c7c4e23b56e0b7751b265aa37acc29ef94c7c627ede8607a8ae59a7c135348ac7ef5008f6bca777785959c69765ebcc0a051d95dc125ae5e47aefe
SSDEEP 49152:ecRwr23IetlomzqbeWsLf83Won5L3s9x1OxGBcq2exk74gcAFu4OuDmGRmR/1HLL:eMkbm71OxRR9Sl1xB
TLSH
T11F266C03A2E541D8F0BED6399B368731DA76BC895F35A1DF025066191E36FE09F38722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2032	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
2652	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.ico	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\RCX1FB4.tmp	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.exe	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe.ico	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe.exe	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Internet Explorer\ExtExport.exe.ico	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe.ico	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe.ico	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe.exe	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCXAA8D.tmp	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\RCXF136.tmp	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Windows Media Player\wmprph.exe.ico	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe.exe	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe.ico	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.ico	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.ico	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCXA443.tmp	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe.ico	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Mail\wabmig.exe.exe	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX9E3.tmp	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\RCXA42.tmp	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\e068bb4d-7ae8-4759-b6a1-6e465748ccf3.tmp	setup.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe.exe	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX88C3.tmp	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\RCXE72E.tmp	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX888.tmp	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\RCX12D3.tmp	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.ico	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe.ico	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe.ico	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe.ico	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.exe	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe.exe	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe.ico	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX8A5D.tmp	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe.exe	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe.ico	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE.exe	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCXDBBF.tmp	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Defender\MpDlpService.exe.ico	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe.exe	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Media Player\wmplayer.exe.ico	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe.exe	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.exe	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE.exe	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe.ico	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe.ico	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe.exe	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_942951843\protocols.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_942951843\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1871443942\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1884777869\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1884777869\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1884777869\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1871443942\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1871443942\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1884777869\deny_etld1_domains.list	msedge.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1871443942\LICENSE	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2864	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134333546308031330"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{53166A11-536F-4962-94D6-A655C32F9792}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2396	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5136	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
5136	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 5136 wrote to memory of 2032	5136	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe	91
PID 2032 wrote to memory of 2652	2032	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe	92
PID 2032 wrote to memory of 2396	2032	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe	93
PID 2396 wrote to memory of 4692	2396	msedge.exe	94
PID 2396 wrote to memory of 616	2396	msedge.exe	95
PID 2396 wrote to memory of 2864	2396	msedge.exe	96
PID 2396 wrote to memory of 616	2396	msedge.exe	95
PID 2396 wrote to memory of 616	2396	msedge.exe	95
PID 2396 wrote to memory of 6464	2396	msedge.exe	97
PID 2396 wrote to memory of 6464	2396	msedge.exe	97
PID 2396 wrote to memory of 3928	2396	msedge.exe	99
PID 2396 wrote to memory of 1704	2396	msedge.exe	98
PID 2396 wrote to memory of 3928	2396	msedge.exe	99
PID 2396 wrote to memory of 3928	2396	msedge.exe	99
PID 2396 wrote to memory of 1704	2396	msedge.exe	98
PID 2396 wrote to memory of 1704	2396	msedge.exe	98
PID 2396 wrote to memory of 1188	2396	msedge.exe	101
PID 2396 wrote to memory of 4644	2396	msedge.exe	102
PID 2396 wrote to memory of 3740	2396	msedge.exe	103
PID 2396 wrote to memory of 6328	2396	msedge.exe	104
PID 2396 wrote to memory of 6328	2396	msedge.exe	104
PID 2396 wrote to memory of 4532	2396	msedge.exe	105
PID 2396 wrote to memory of 4532	2396	msedge.exe	105
PID 2396 wrote to memory of 6476	2396	msedge.exe	107
PID 2396 wrote to memory of 5592	2396	msedge.exe	110
PID 5592 wrote to memory of 4484	5592	setup.exe	111
PID 5592 wrote to memory of 4540	5592	setup.exe	112
PID 4540 wrote to memory of 1652	4540	setup.exe	113
PID 2396 wrote to memory of 6460	2396	msedge.exe	117
PID 2396 wrote to memory of 6460	2396	msedge.exe	117
PID 2396 wrote to memory of 5912	2396	msedge.exe	120
PID 2396 wrote to memory of 5912	2396	msedge.exe	120
PID 2396 wrote to memory of 6228	2396	msedge.exe	121
PID 2396 wrote to memory of 6228	2396	msedge.exe	121
PID 2396 wrote to memory of 4568	2396	msedge.exe	122
PID 2396 wrote to memory of 4568	2396	msedge.exe	122
PID 2396 wrote to memory of 4836	2396	msedge.exe	123
PID 2396 wrote to memory of 6744	2396	msedge.exe	124
PID 2396 wrote to memory of 6744	2396	msedge.exe	124

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5136
- C:\Users\Admin\AppData\Local\Temp\2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2032
- - C:\Users\Admin\AppData\Local\Temp\2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 --annotation=exe=C:\Users\Admin\AppData\Local\Temp\2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ff7d0b9eb10,0x7ff7d0b9eb20,0x7ff7d0b9eb30
    3⤵
    - Executes dropped EXE
    PID:2652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --force-first-run
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ff97954c188,0x7ff97954c194,0x7ff97954c1a0
      4⤵
      PID:4692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,9129580964847812136,14620244142869034426,262144 --field-trial-handle=2620,i,12565994734728886179,17434181324413162521,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:2
      4⤵
      PID:616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,4271285346525417413,14508756012620962814,524288 --field-trial-handle=2620,i,12565994734728886179,17434181324413162521,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:11
      4⤵
      System Time Discovery
      PID:2864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2148,i,15088137091004804083,12877669494241318143,524288 --field-trial-handle=2620,i,12565994734728886179,17434181324413162521,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:13
      4⤵
      PID:6464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,12751171827146957472,16983216939612136827,2097152 --field-trial-handle=2620,i,12565994734728886179,17434181324413162521,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:1704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3672,i,6169893309112026330,7526060143141879568,2097152 --field-trial-handle=2620,i,12565994734728886179,17434181324413162521,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:3928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,1309047148317152703,12264965731467466527,524288 --field-trial-handle=2620,i,12565994734728886179,17434181324413162521,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:14
      4⤵
      PID:1188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,6574230828312790319,7745997887008861563,524288 --field-trial-handle=2620,i,12565994734728886179,17434181324413162521,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:14
      4⤵
      PID:4644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,6904156962204847668,8282620013927216375,524288 --field-trial-handle=2620,i,12565994734728886179,17434181324413162521,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:14
      4⤵
      PID:3740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,6415190107708351609,7941000703282154762,524288 --field-trial-handle=2620,i,12565994734728886179,17434181324413162521,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
      4⤵
      PID:6328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,66260173360236819,15622107221185854765,524288 --field-trial-handle=2620,i,12565994734728886179,17434181324413162521,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
      4⤵
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,11169997624493702091,14493941622074207118,524288 --field-trial-handle=2620,i,12565994734728886179,17434181324413162521,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:2164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,11169997624493702091,14493941622074207118,524288 --field-trial-handle=2620,i,12565994734728886179,17434181324413162521,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:6476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:5592
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x21c,0x24c,0x7ff65b2104c8,0x7ff65b2104d4,0x7ff65b2104e0
        5⤵
        Drops file in Windows directory
        
        PID:4484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:4540
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x21c,0x238,0x23c,0xb4,0x240,0x7ff65b2104c8,0x7ff65b2104d4,0x7ff65b2104e0
        6⤵
        Drops file in Windows directory
        
        PID:1652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,3554996553672717214,13378795042581128071,524288 --field-trial-handle=2620,i,12565994734728886179,17434181324413162521,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
      4⤵
      PID:6460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,4457548326830811211,15341038180917097052,524288 --field-trial-handle=2620,i,12565994734728886179,17434181324413162521,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
      4⤵
      PID:5912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,6545797917808234179,6421409932565645894,524288 --field-trial-handle=2620,i,12565994734728886179,17434181324413162521,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
      4⤵
      PID:6228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,4363937910658640842,1790468931350473197,524288 --field-trial-handle=2620,i,12565994734728886179,17434181324413162521,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
      4⤵
      PID:4568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5360,i,5660147463022144149,9002617540672017990,262144 --field-trial-handle=2620,i,12565994734728886179,17434181324413162521,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,6302819515858051152,9791029852004543318,524288 --field-trial-handle=2620,i,12565994734728886179,17434181324413162521,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
      4⤵
      PID:6744

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:7144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe
Size 1.9MB
SHA256 6d2c398f18978db0ec34b376497e0436cca5e2e8b1f338a9c92bb092ab9f0926
MD5 a45c7725cf6aa7146097a412e8128a42
SHA1 5d3498c0f8fadcf90fba8bd7a39b12cbbfc1d3c7
SHA512 6c14003fef886e6b13abc2f99604ffa658c6aca590734ea852c3cf2cad2f43e4d264985589b4880919237454431ba8a27427b4b0d17be1012d1b545bf7bdae64
SSDEEP 49152:QMkont6wulCBow/RjE6SlSQJ/X0+d4/xozyVJO:QMkonAwrBow/dCXXd4/v
TLSH
T19E95C02BB9A943E4E03A857086468271DAB17C517F2476DF0290B2193E77ED47F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe
Size 4.7MB
SHA256 486de0b0a6388b629410680c676e2b617608226092ba1fca5e55d986c3ca6d0f
MD5 21f1ddada6a9fff3d9bc8929586eaa3a
SHA1 bcc820a45d76dd2785ab0946de90b03195c03643
SHA512 8b30200615dfa0be41801a7dce1e93024bffa5f50f860d4fd382fdd0bf80ce7adc831e28504614f439095ca99e13a7a62d4ac991e605e111ea82446da2efc042
SSDEEP 49152:QTd+J3Ll9x8NwgnbQWOkludQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWP:m+J3Lfx8NHnbQWOkHijnUdYd+RaAj
TLSH
T1A8366B03BA8A40D8D059C474CE5A8132DB727C884BF161EF3694B7EA3A77AD47B79710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.6MB
SHA256 9e26a17f17c8045e7e28d5b1ab3b9cf157619dfdc64cb4010cbc03305c56aec3
MD5 2f8a96809f35b42817077714cb4c125b
SHA1 b79c7f52f769e67d55dfc73eb917fb9784c56d7e
SHA512 5fcd224a4bda9917da237b09dd22d14a6d13f9e5129c2f99242d16f7a9df8b137e02d1a842c758ff401f5c2cbd3717c3f0e1f1f0272ca540c81320d3589f4ef3
SSDEEP 49152:i5U+5LVqZGu6qG13O7Q7gLYduZrSdHBAVfb:i5R5MR6YjwA1b
TLSH
T130C5AD07FA8D40B3D049C2B4CA7647359A62BC594F2865DF1280FA6E2E77AD41B3D7E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
Size 2.1MB
SHA256 ccbb7996516cfedd8f641681c9d0a9797667a1df8ad34cffbd07bbe992a67fa4
MD5 33f77900d3e5f1d1d2afecf007a186cc
SHA1 9534d3b9d542e17efde48a3dcb88908e319647d6
SHA512 f2d977d41118a9345b9e8c4c1e566df648f75ec6d2106554f8c10e189a920d6d82f9c80bf64f445c4c771ee088bc2e44cb6cfda27120ebaff65a0ac75bdfbd38
SSDEEP 24576:Vdr+1CGO4JlOgqQSZGY26UEU3RyRPW+uSmS86IU8Gc7QGsVa4i6h27d3WlN:DaEVpgPJY2fF8FhmS86IUJWQn+6h27d6
TLSH
T107A5AE03B69940ECD01ED0B6C6568537EAF1BC454B24E6DF1750B62A2E77ADC2B3B720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 886KB
SHA256 da628c7eb6f9940e4c067cce5c07cd0e01e20688453e052cf5d1074d45ffe44d
MD5 0002dc7e9c0bb151c84128f1046b15d2
SHA1 3717b508f69e4d560c3a8d9c30f5bafdb7509122
SHA512 ae0646d82bf322750e2ad8b5a33bf49fda6574432e098668e2af8a176260c83efc24c952e65162b9e83143b5862e5ef91246f85a623f2c99c2c471e3cae4b03e
SSDEEP 12288:ZIv13Wihkif5Fv6GG8X0sg/AAP+a9eIQqNBekrw5it+bdAMsgG74rzB+oi:Ov1W9if556Qq7TeN6kkcm+eMLGsrzBli
TLSH
T1BB159D5EBD82C75EC964293008A723FB9E7F98451F03871B1310B29E683369475AFE76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeUpdateSetup.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe
Size 2.3MB
SHA256 fffb6fd217c3618b4206d20d9f1c42a84629b0d4711f6d9e5aa5bfa0e61f0ac1
MD5 820154e9f962ec704efc7e84c1612b97
SHA1 f1d0cc3e23cf61e54fb2a33544cf74c195c6cb2c
SHA512 123f7eee43a297491429bdccd24cfc2878ba2577cff584f72c4780fb6a240d957b5a7c6f136954cc3442fbd533977142705f60fe02683a492c6f1a8740d35b8d
SSDEEP 49152:saR5SGg8TUnbpneyiEa3B/yvJJHBXNTn325kSiV3QpOmTiGIcNMzwjbVPTI/:3R5Ngx8yihyvJdn3JSiVgEK2cK4bVbI/
TLSH
T15DB502F7BCC8C562C1EF0A708ED943B01D2639608D26CACB2A15E95D9EF53814B2DB75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe
Size 1.3MB
SHA256 2531aa9717e784d89076194947acfb522f0a396ce55beb39b87dbd418ee64b70
MD5 b00270cda0b43293cdb21aa880dece52
SHA1 8ae4f4c16728d883eaff952207ed5c31a240defb
SHA512 9e372d3b0b6786524f50277516a76347a83793f4df173f72de09f8b65fe8cdb852ed32d582f3344f597cc5d7ab631ad987e5e1d053c6292b410c021f232c2d7d
SSDEEP 12288:Or6fky5n4+wjGZ6V8yAFlobhVqVp6mTKXduw5iBn50k9mnRT0JIxQ4ObTM:24kDj5AFytVqVp3OXFjk9mR4qYbTM
TLSH
T12055C008BE6496B7D07984334B478225DEBE7C5A1F60AD8F02D5E73D1E766904E3A338
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
Size 4.2MB
SHA256 e39ab206729caf944b37fb389198f67d0b1a18ec56921611d75063a3713b8a40
MD5 947006970f935c22c9cd9f04195ec3ce
SHA1 548200fd1fbf6a2cb8e25ae68e1f0711ca2eeb7a
SHA512 25f2fe450089a7fcd0d6257473f20321e4e34359c9dabfde1b8efdd253e1170734bf210f94920ccb4d7fc5860024c7a99f66572f66a125cd6a029bef82f7597a
SSDEEP 49152:s69fMUtTrUJ1kFS2aBW08mKqRXGPd39PyPvnkSN+EcrxA3vGCDlBYMO74U2y+PhC:HikobN/ki+EcF0pDeN2y/
TLSH
T16F165907A19A04D8D059C034CF469232EB627C894BF266EF365076D52EB7AD43F3DBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe
Size 1.9MB
SHA256 775bed59bd7b1adef98b1a9df30e0fb58e632dad6bb5556d2a66b927786268eb
MD5 208e5fe5543317b14c6a067a5c186721
SHA1 a4cb1f06619049fa606b040830fbaf57bdf60b88
SHA512 6da95f8c27bba96fa8929733fc91d12298cbdccc6189f960bd92333cf26aa09851821704aef8809e763cf7be4a16ed63f530a8ca7846900392f059eaa0761b8b
SSDEEP 49152:myiaZApUF2mtkkhU3lp0L5xDzoMY91P27U:nF2UFpkVpQrzoJA7U
TLSH
T148959D07B7B980E8D069C0B0CEA24164D761BC450B2556DF06A0B79E2FBBED43B397B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe
Size 2.2MB
SHA256 637877472b496145e74949ac5863d6a0b87a9710ebd638eabdd37b93eb04d711
MD5 af99f86702c39c8d97c5b3f3302b64c4
SHA1 f2968febced3c625575557416c4d2b5e7838685b
SHA512 044c383f31fa16281b74f05f142aebc5fa99ed01a1bf49ef58abc61242ab2b19d2afcd73c826aee830dd46407b6506093a954ba3a4065e5289c002cacaf9ec97
SSDEEP 49152:0p7u5Z74BVQj8lfehjvHHKTdfxINPEt99G2Bo7EukU1a:0pXI8JyjvnORmE
TLSH
T1F4B5AE0BB39840F8D49DC9B4C6958976E9B27C414B15B2DF0B50B2896E33AD45FBE3E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

4540_13433354631213765_4540.pma

Path C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\4540_13433354631213765_4540.pma
Size 1KB
SHA256 e37261d17ea74f0f7806e4080cc8874fc6b90c3befe53219c4a482a64326fe50
MD5 aaff10335fcdf392f1d871dd1f1f3c1e
SHA1 d3bcff39b76c75861d55ee7e06d66d546455ff88
SHA512 159839a9989a4a752a0dae331fb38f079d06e012552aa0b9e31509f6847cc7aa96ba7192cc0662fb27890b9778e5e153b7beb388b5d6191dc2a1b514f097bf1c
TLSH
T1BB319B44B7B89A43C8539632C4E703553BBAF6E637424BB62145A70F1E062C84ACA080
MD5 SHA1 SHA512 TLSH

Submit Download

5592_13433354631281701_5592.pma

Path C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\5592_13433354631281701_5592.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

MpCmdRun.exe.ico

Path C:\Program Files (x86)\Windows Defender\MpCmdRun.exe.ico
Size 3KB
SHA256 02221d573edefa486ba8fe5aee3c8a10c8c7e3188914c0f22df06bb1338db790
MD5 1272e6501512e471bddb879dea4b5800
SHA1 1c8b9489166959e6106095c0974a1825ac1179c6
SHA512 7ef9f685457532d84ba2ed316ec52a44acec151b92e563f6943f593d272745bad0f7c549867a723d2b3532cbcb76ea2b99a965b3b2412d5e7644570740bb4194
TLSH
T1CF6140A1F209FC58C45CD1744DC6C2CC18543D958C0A7273FADCBF8F69724E52E21181
MD5 SHA1 SHA512 TLSH

Submit Download

RCX76AD.tmp

Path C:\Program Files\7-Zip\RCX76AD.tmp
Size 784KB
SHA256 017f5ac832d23e54079bdd55c767e50cb5095e0329ef4c04bf2a0453e8ef4c0c
MD5 df8d962c8759afc56fb6dcb43f626c2d
SHA1 a6eb18796d6c523c8aa2aa5e4297cf12895933d6
SHA512 c5bdd5b75b76483a04dc289fe17be41d4c1d1c77e6619b93863f7ffdd451a1e68d53c8bfc2d5eb773bd150c0242cf3cff87679a9f20f6b99be0a988d86ab8959
SSDEEP 12288:tJZ9XMLIpRJlGCPBAhIfPnby/dBdd1w5iWnQQSs:tX9SI/f5+KwR2fms
TLSH
T16C059DCDB58B892AD09D8033F877C5B893F9984DBC134397EC65793E2E291112CA66F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.ico
Size 3KB
SHA256 463b6e99198762de39ea3c9156504527673355f452c17063d0fcc34caa3cfded
MD5 01f2c0d2e4df4e0ed544a4e4600d1457
SHA1 2bdf43857fcfeefcd37ee7a82d733ca4e4f1d871
SHA512 8238557d4075faf0d780ce775a6bc0121cf2da9b826cc49095fec9b35096809e5187f3027682db88d7358e21025c5d24d2ef784e9c2b0a8aa7021589ce68a8aa
TLSH
T13061D3A9E5052C3BFD5CDA7935B6DB60C2077ECA021680778809F58328F768B16ED974
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

iexplore.exe.ico

Path C:\Program Files\Internet Explorer\iexplore.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

lyncicon.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe
Size 1.6MB
SHA256 7a2130b70a81e9e62bdb98d4335aa00e6f2e0d131eedb6a177e6c34e051290bd
MD5 0b825c67a6d243f096b649f5ad913c4a
SHA1 d7a4db1907f43bc733359f559ac87843e34fe16b
SHA512 287820716413bcaa308e1349dbb2dd80d65ca5818aa2503b7ae8c1579675fec1a86b11191243b3c83cae272afa6f9890778ad1ef13bd2ff8d096a24946bfacef
SSDEEP 12288:PHqkBswSyUh5LPvoUkIhBOlILbM5KUVoEKG5ZLw5iVv5dJvL+:PKkagY3XkIhMQbM59VoK5W+BvD+
TLSH
T148751740786C9E42DC3E0FB59048F5B1FE196C8FBC0FB2066D14B66E25BBAD164365A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
Size 1.0MB
SHA256 a57ff0af8d4621a156d087953063a621a3d3406974484302fa62990ca6804e7d
MD5 df772bf1baa02fbe383320c5abba5081
SHA1 2027e3c62e3a3fd1e314a3ad6715c72ab0a435b8
SHA512 805777b5fc361fdd1e04e824afc5fd45a21593f3e6f84f8986b938813a120d6d540d9cfe2e3ffa28b3eb9bac12367a90f1b1e5da17920658bc1d763ca48a511d
SSDEEP 12288:NM8RiVRIhBkqhECT/vMlTDyqvS0+oelWQA1Hw5ieOSFkq1XLsswWkxy2lRq2czAe:m8RiVmB8DPVWWQTZHXYfDtczAe
TLSH
T181359D29B55F8EF6E81F413495DEC19A9BEAFC127F11C90B0EA0566DCF23284097D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

OfflineScannerShell.exe.ico

Path C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe.ico
Size 3KB
SHA256 9e3f1f8e5166514df44b02a1e0bf7474708dafba161e263cff087af62ba89ae5
MD5 d8ef82bb84e2efe95de666f46d0c7ac6
SHA1 fcdd2f6ceacde21e1e38a687041138aa5bb0ef68
SHA512 61f7439ba615c3250701aeecb96ab8319f2d84ffa7e61076f6dbfce20ee3409d212e8d9deb274b145b7f0eeed2388681b929ba897bc85b4d3841f7003bc40afd
TLSH
T1C461FEC2D34610E8DA8268F34DB58DC487650CD540E4ED920EE6BCE39A745FDA93188F
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
Size 1.2MB
SHA256 f909d870d93fcd257e818e2f881ec4cd2f1719a9062721a746455a09732cf88f
MD5 4cae043cdf114b81179fddd138e7de41
SHA1 c5eaf94fbd72265fe5c4c531a7e3f35ec15c5650
SHA512 cd3205be6a6b2864505097260f485871f6e6bd7d009ef8f19f39b99391d46846998a8842f68c91574261e1833e52291c0d7714f15026b6bb2171221ab8a58a57
SSDEEP 24576:2ebSpMwqnlVdfQX3PhNJYv8ZMYenGJiKEbXWtpOLl8:28SpaCXwPnRWt4G
TLSH
T18945BF36BE479027C135027AB925C6B07E35A435AD22041B1F64EF6F397E2426EB7363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-6.0.27-win-x64.exe

Path C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe
Size 1.4MB
SHA256 497c5b5f26c132ec57bfb0bc3b36b009de6a52996839d3b34737cec4c77820a9
MD5 20691acdcb08aaaf282ac2bf267ca8b3
SHA1 0933112a86a4fc0c5357aed1d32d20d4c9191021
SHA512 a1ad716a3f69619599a5f91d67060843119640abeadfedd991560c25788f00d734d133321290452ee4786ee683dcaf55bb0c225f2d896adac3ae5a64338cfe29
SSDEEP 24576:Ge08pxtmsGPJ/71NziES00rz94EUNPSwr5mWpI2jFM5sFzfTpil15Z+M6qTX:/0+XmjPJ/71MESlG15BjBbTpi75Zr62
TLSH
T12A65CF32B85A413BD3B009B2A91D82316EF9A61B77607516CBD7BD0C7A3C4815B7733A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 20bc6cf3b38ed5b48301e51f89fcd3fa1b0f2df55f78db267a774f243e986b21
MD5 3037ae354f35e47588697a47a051c7e1
SHA1 150dae17cd38d3bd37cafee816463e7accdd260c
SHA512 d2390df81ee053af2f6684925ba7823b77011747f7c9889f9cf7a1ca09ddd2066f0176fdfcabea82c6b5e3df42de0ea030532763800874e0877cc6a2ae4b7f73
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bee3eae93621aae8f9fb0ad0d9b346c6cc6f37719e4b54966dc71c7e21196b01
MD5 fef02470a3eb53efc089b5ccff1b5cbc
SHA1 a0dcf6d3bb8dc0d02e90507e5d322141182df887
SHA512 41ed12334c383f57bf390b76cc9523b18725b4ebf435a4ee3d35f2277ccaef4a84cac5cf539d705178b65d44704131fc40ee173727f1166b6432054d2d856221
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1197d54dfde2bfe1f7389d68293ab43c9c24992ef025f49c52f38bdbb94924b
MD5 887180d3ac48562378ba219c012d8290
SHA1 994526f2094d4fd80c2044ef51fa7ac08246a8ce
SHA512 2644ff464f2f11636c09b7cd2577336f24e0f525b459ebd0933d287532c2de38b67ee7079b5090b0c652cbcf7fcd2309f6e03a017cde9bfcec3ba24a13510375
TLSH
T1E0D0243777140041FC4057314051CD441D17CC03C07741000C31400CDC73573104D544
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2f924f1fd3b0ebab3f8d234615a5af28aecb960afc7209221ebd30c82107355d
MD5 c8aadf8b7f3c8453bd0522e633e8a52a
SHA1 1af1c9ad27ca71c5b6e79558e2401dcc013f0724
SHA512 52a53098a41747e15c1fbe4154bf738e785d298d73e4a6f1f3e334c83548379bb1d3de1be87a75b3d64998ae1975e6f0513bc762e2cf97f2fc0fa34eea0e07f6
TLSH
T150E0E555C820B82769FC5B1860940647E740131B3B40884F3A3D912D4FB06374B86C5C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 8981e08ba73c4e92d99768220204cd9972e0267745428aad55189771070d6092
MD5 38674529d015ff6d1771b9c02f2a1768
SHA1 146627071145f6f3b72103e3f96f8b178ed310a4
SHA512 69547c6da9478fe59e6b7bd76fd025641aac6d769578cae4f6fda2af3b4929affedd40057e40c8b914f5cb9eb32f203b50585b9b6dd6d9934800bea4ed8057a4
SSDEEP 48:aUwqivEjRiwC3p56aVL+fuaFU6sf6fWbosyCbWJXNGEVIbh8bBxFuh5:vwqWcze5RSVFU6OXtbWJdRY4y5
TLSH
T1D2A195C28399A285FF256073FA93E8486AF570EB8A0B9B821444DE361613FE215E1163
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e0b6a189a0ba59db24ffd143a1718d339f390d1700070e347e819abfea6e62d7
MD5 e14c27b6133a1897dc638d830419a844
SHA1 3dc2e1b5c2397c579fe813677f6429b0563d6262
SHA512 2bde13b79fa4d7b95af3f2f3f5788a41028534c136651cb3360ebf5011931954c5715a41acd99ecef48de21505bd6d1512fdbbaa7aa12bec367c27b07143f6f1
TLSH
T1967199904351E789EB25757369D3F84CB7F644BB8B07ABC01845DE721B16F8028E2233
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e5a3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59e5a3.TMP
Size 2KB
SHA256 1866a74242dd2fd50a783e1dcc8f40f4ef937d8738a76a7c2ef8824113085ccf
MD5 18da16273fe573753c8e431aa241a201
SHA1 f64f5a56bd3cb66e5fae3480fc556a8329661706
SHA512 a1b63a5eba3e93690df3548d5173261394ae0b5efb9532096d37a8c82757d70144c144dcf242e350c5b53a0c9d680e7b8d07c6005ba85e45ab7db99cbabd04e4
TLSH
T11851C5A04322E7DADB61B5B36AE0F04CB6F584EC8F07EFD448451E700A26F8428D2233
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 2c127f67e3354e75205d97c1cbd702a6adf61acd5669eb5889826313b20e5b43
MD5 4379cf9bc83d917246647c94cff54588
SHA1 def2f732d169fb2227f877af3479b2dd0c2817b0
SHA512 e13490a0035d5ee37bcc4c89380afcb89a1ff5661cf01c91902448005c328933f761755ff4dc876f987a8a1f67803b4bb9cdb64c43e6636c870fcb815b228f70
SSDEEP 96:D/O1Itn2aVZaij6yzBGO5RZvTcwoGtHCfx/O:DW1Gn2aVZaij6y175TvTcdGtSx/O
TLSH
T10E91BDF783B5856DDA1195F0EA146F1FCF180552436C3D9A89E4AE17A3F2871E042B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 f2d0da9b53b2daf031f394c2b02ac587dabdb052b9b03bc27a9dcb14c34bc09e
MD5 d98f48e4e36bcd90850fb36ab0ad5a18
SHA1 fe9ee10d85d871f5a2b0d8c3228b04936d0bf078
SHA512 013b455ea93178961440d93dfd067e915a272682ac3e9441dd39eb7e538d6846bed44d91e1acdb81cc2c3c693dd8cdf1979d594c48e53e53d773cfb57b7e483a
SSDEEP 384:sxR4qqg+/f6sM2N/RIbSbT/5g/WsQsGQgyBc:sEVg+/fC0W6/5CWsQsGQc
TLSH
T1F982E81AAA349D3BDCDBD219F9557B93D2F9112391909E44A6FC8E0C04E6AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 419b7199d4ad0842ce45097ff56cf848c2d65a3a24bdcd2b254c7e74c122b145
MD5 35ce5edc0f56586f610944a52806fe61
SHA1 bce0f93325b63ed322c51c78162a08dd699cec87
SHA512 0650e20c714ce4987409c618a581ce853cd0984490d44487d8664f57233cee40cedcd518c95e57ab055dc4387976987f7e9867dd132c348141085e1ad13a82a3
SSDEEP 384:sxR4qn+/f6sM2N/RIbSbT/5g/WsrsGQgyBc:sEu+/fC0W6/5CWsrsGQc
TLSH
T1FC82E91AAA345D3BDCDBD219F9557B93D2F8212391905E44A6FC8E0C04E6BED2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 5d6222f82244bfea25b7557fd8f860345a468f6a7cfbf77c5c65e8dc0fb13ce9
MD5 8d8cd4f03255d6e71b83489eb9e6e436
SHA1 1e394e344201222c95b6bef717aea39c42a65173
SHA512 6ef5679d171483c304f50a6cf6a50fd120fdf078bb8d589f97fe640bfc020733b2ebb1c2567156713ead15a25fd4a416fe4fac23f988dde8bec9e9770ee7f059
SSDEEP 384:sxR1qn+/f6soDN/RIbOtT/5g/WsAsGQgji:s5u+/fqJWk/5CWsAsGQj
TLSH
T11C72E816AA348D3BDCDBD219F9557F93D6F81163A1905E44A6FC8A0C04E7AEC2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 242d17814d7fa542e0fd6404f3d622357d121a9263415dbe81c100202ba1def7
MD5 626b6e1de647b04600ecc0692078469c
SHA1 2d76e1696bb421bb65efe23b07415830506a0544
SHA512 eebcd0d29a1b6028b64722fbdd3853fcd06504074ecc05b03954db73f08aa0dcee44bedcc5875cc76261e217320c1007d92c961ef192cd9940c3ca55307f1ff1
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpobbDwzroa44:Ob4YZnE7yTWg1NfwBu1ja6obHwAl4
TLSH
T170E2EB3B280CCB7E4F804ADDEC29BD8A6DA801CF5AD8C95447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4d44b95f-8952-43f1-b2f7-4a0671c2caca\index-dir\the-real-index
Size 72B
SHA256 974fdcbe49081fd8d6d55b7c2a64708577c50fc229085327b05f72d973f743a9
MD5 56f1664a8ace41ab2367733170b4b88b
SHA1 da11acb1b971c7577b3679e9c5cb167ce1385383
SHA512 2c7562f5baacc757d1778f7c388355a4118418f1cf0da81dbd3aefd06a5e6e60b698a403429c448a1e34d880f32119714bc542570f68f964baaa0ed8fb436c28
TLSH
T13CA0021562C15022C18213B2E59711C22311DD21121927874299D294CD535464D4169F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d1bbffe1-aa68-495b-82a7-07fa91903c57\index-dir\the-real-index
Size 3KB
SHA256 b28a23c89cbd73cebe25d2c48f7e7c041449d6b34de880a8617bbc8bce0e9bbb
MD5 65255cbe24448e662ce71832bb4657a3
SHA1 7e32eada53620ba78de20d3e8ea043c66423b93f
SHA512 c588721f7093adb6738c5d632ccd6eab89454f14465bd8aaa618dcefd8e4c320b27e868b592c0a3f03e8b776675a94bafb27a9a5323590454919d20b8cdcfe0a
TLSH
T1AD51E90E4C030F1AEEA8567218B904593739B4DC22582C1775FE8234F8D3728AD4C6AC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 a55fc5eaaaa74b4b3f63c85d57ecb1250535648e480d7596bf8c2355d0238432
MD5 537fc9751406b62627e7c4d55080d683
SHA1 f104fe098aee159a88f0972ed8c8b87b0a5c2aab
SHA512 3b91504b8da1b964380e08a8736167565cf4be9474f6208c2598ff3b59c534487874b0191dd45c2243b3992cdb60c3c9afa7dcdc32ba31848bec7380fe997684
TLSH
T15FE068B72CB32808EDAEE7CA287485A000047454C615AC5F2059E2976CF23183106D61
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 3f9c165af01f206a13feb77223030dbafca02f14910985217484645d51ae2c81
MD5 77ee141f2396e90f9a43f22089a83034
SHA1 c5e97e2d2d87e391dcb1e140ad0fc0589f3ffc31
SHA512 c05ed516857b52d9219f8739317fdd5d6a1fa3eb486a1b12598064684d7f0eb5418d3fb1c1e1be50b0e6776b2d0ba30af4e41dc861657a763320fe1ed7fd6a0f
TLSH
T149E068772DB3280CECAEE7C6287485A000047464C616EC5F2069E29728F23183106D65
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 72B
SHA256 4196f71ad7e843ac1895a2216c8a546020fea84648af94a3c843aa80cc5aa79e
MD5 b79b3f4dbd7558089c2ba85c202ef2b0
SHA1 daa27477a8faa8cbca290148be75e17d2a4fada4
SHA512 04470227b61cab00fba1fdb3fdab9eee6a9afe0529268d4d66942d3402953870f0925360229aece89d61140fbd2e509b83c1519547530944e7650b080bacd900
TLSH
T173A002259A4BA003E60327F591EA564073605EDB4219231AF6D8E1D8CD9115551C2345
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 356aba0b292bc13ff532e87873380d5e2a33bda1bae9ff3885c604a5425025db
MD5 521c8e36dbe5beabde74818b89526eca
SHA1 748aba83f39f171ca0f0198cff6889ed2750a25f
SHA512 76c2bc330cf0e79a8cb84ba63d311546c23ec4a1958526b513cac1ba31f00eeca7f4291955b7969808e768ce04103ac6a1c7b041b934d461a0cfd2cfad5a2ad5
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ93Zy:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDR5
TLSH
T12FB25C11713F4290387EB90C81B8981F86C2B4637519E53F7BA806A65F67E139DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 c1792e193fd294a08389be502e882d24c4843ce7d04d0bfd50aae6574143f6d6
MD5 04749349611e4de9b08f1d35e0ae78cc
SHA1 9070521ec8a5272456527af2bd4b2227e72e6803
SHA512 83907168f9dfa4c157fcba46c25578691505e6d23b554c2f6177881ad095789e75c452e931f97f6239faac19bb576d8a3cf3208d7c2918de47f77bf01b7c662b
SSDEEP 384:nuoiF1tNn/s3n9Su8NLm8TUNTUlIRoPvuTME/EqfbzGinM2wzPZzAnLMmh8LEEIG:uzF1j+9nQmwg6uxlGqWELMB
TLSH
T1D1B23A36E9A4CAB7ECEA4FD9A70A7607DEE0526384CC5AD8D9C85D4D00CB2DD4707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ed7188270dbd3a82e43259d1a32c3c197338e395df9fff6af8cf51e1dd1f14e5
MD5 3d995f9de3414605fb6f6b48d43e0c41
SHA1 5a6d117fbf0cabcaba8b30fa8528e8fb9ed05f22
SHA512 8ec2aec78eec734aaf7134b1bbde26d6d442db370e228461c10ad266f9f53027c0e29212c691e28d07abff09fac7f09fb85260a123cc1ef2f3a37350d819f350
SSDEEP 384:nMiF1tNn/s3n9Sn8NgX8TUNTUlIRiPvuTuhREqfbzGinM2wzPZbLJOObjI9G6w7k:3F1j+9SXXwgUuCXGq6J29MjQ
TLSH
T195C24B36DC55CAB7EDE64FA9B30A7A56EEE0126384D85AD8EAC85E4C00C71DD4303C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 5e4f1f5a8c9bb3426041c063c7ae9ad3338ee10de81030fbb8045b8627f457ab
MD5 46fee0260c6e1364f764ea3c52159e4f
SHA1 157e7381aa748169ed6e7a919a264fa2a9d054ba
SHA512 c59bb87203aaf8e0477f3cf736d2b4887e906ce47ba5b5e7efe348802c2fa22566cb1c0f66d685e35a533dfa8023aabdbe9c1d38185f33d569e6579ba521157f
SSDEEP 384:nIoiF9ZcIk8NLm8TUNTUlIREPvuTME/EqfbzGinM2wzPZzFLouvzxV+MhdpLt8LA:IzFlkQmwg6uxlGqWFLP184pLB1
TLSH
T134C24B32ECA4CEB7ECEA4BD5A64A7603DEF0515385DC9AD4D5C85E0D008B2EE1707C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 aecc3196bc85029519a3ca805cf74aeceead58e42e228cbf913ae65cc7e4771e
MD5 c94db8db76432f4617b4e82668a2a5e2
SHA1 b9a17eedce6f6b4d879aa46fa63f6864fca1072b
SHA512 9b33ab88fbd6430af2951ef111a7c197e12f4377aed2db67cd86e6b36a164061202777bac13e970d88467819021e05585b11d5cf91afa9924464131b88e95264
SSDEEP 384:nLiF1tNn/s3n9Sn8Ngm8TUNTUlIRiPvuT3O/EqfbzGinM2wzPZzAkLOObjI9G6wI:mF1j+9SXmwgUuSlGqWZL29MjQ
TLSH
T1CDD25A36EC54CAB7ECE64FE9B24A7A06DEE0526384DC5AC4E5C86D4C00CB5ED4307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 bce851dd2f587b8ef20294a7bafff61f9e59fff8d1e5ae82fe9c156945e4d87a
MD5 c607c43520ba5f1e5fa2e6ae47ed5d69
SHA1 c4c9a1ef0e6e182a7dcf01a0007232f35cb6eddf
SHA512 ba2bf6fe9a8e77d06b7ed9afcca2b35e20a91033f18de1f1fc885f626685fcf1465d45f1b5205b9bd500c8cb0d7c4c0ef32f846465570f7ad92d7c11c0772e42
SSDEEP 384:nI/iF9ZcIL8NLm8TUNTUlIREPvuTME/EqfbzGinM2wzPZzFLouvzxV+MhdpLt8LA:IKFlLQmwg6uxlGqWFLP184pLB1
TLSH
T102C24B32ECA4DAB7ECEE4BD5A60A7603DEF0516385DC9AD4D5C85E0D008B1EE1707C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4ed75183ab4c01a8cf95dca5341883cb0fa416577b712d8c80fe3de93da20fed
MD5 f4d5498bf38f1c252553e7f0290f5db9
SHA1 3ec4ed8b7aff772639a3b5188c7944a66d989c09
SHA512 d327602216864e4d34f285559c47acd70585eea2fff5320b5ecd6676b4465e291a6b4b46b699c8ee3d93cf1444991b1df7efb789baf83dc27b2f91ff7372b2ed
SSDEEP 384:nuoiF9ZcIk8NLm8TUNTUlIREPvuTME/EqfbzGinM2wzPZzFLouvzxV+MhdpLt8LA:uzFlkQmwg6uxlGqWFLP184pLB1
TLSH
T1B8C24B32ECA4CEB7ECEA4BD5A64A7603DEF0515385DC9AD4D5C85E0D008B2EE1707C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 5b13b6fcdf04fb96e793406611cf7bea4f0b25a21e6210ff6fcfb1601d456cec
MD5 12233c6bdb79fb5af7e57b25da973536
SHA1 34747b1c27534b8b74cbfee6a2a11d96508d27a4
SHA512 dbd9a12f0c15dfb739a20974af92acf153e278d3895c5b3771f558fd6665e280e51d7fd4931709d73557d9ed82792f579b34710e934cb9cfe292599545ab1b56
TLSH
T153512DE04C381AC1D4BD0E7FB45B78FC85E8C726F490343D6858EA985A7A65D309483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 fc8158bcac0e1a43c912e8899e7f1c5e1d622db63f0096f7ece6833f081442b6
MD5 35a224c2ab78a8e4de46ffe2bbfff98c
SHA1 5bf2c935d683009baad6b104386ca6a2df08bfcd
SHA512 a0cef6559aa65787fb88ba8f2a20f8d8f87fa2a86afadf9c255bd6df6083efb477762c29e4417fd191353f39724da6b875183e140872a4617e941adfbaeb280e
TLSH
T1A8512DE04C3C1AD1D4FD0E7EB44B78FC85EC9726F89434386858EA985A7A61D309483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 227be09e96c4832820afaacf9d6ad4e465a70ffb9ad647e7506b01eaabc2ba29
MD5 6b31e16abed878ec8f83c2d26611117b
SHA1 708191624e1213c3f87e073e478169f0b74f0514
SHA512 beea38815a8328c54cdd63c2e77537c64fdf3a5fa3ef4fce943c978f9b4ffac236a333b5ece11ffc02821ac21421ffec15a7eff5e2b5771e1ac768c33789b00d
TLSH
T159514FE04C3C1AD5D5FD0E7EB05739FC85EC9726B89034386858EA985A3A61D309083F
MD5 SHA1 SHA512 TLSH

Submit Download

FileSyncConfig.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe
Size 1.0MB
SHA256 22b21ffd961a1cb244f02140dacee798556d123e926aeff724de3be6c7cf47d1
MD5 bb0560228e5f3b1f1280ca350cce02b4
SHA1 d06a52cdc53885eb0d7eb57949698a085aed95a3
SHA512 8984cb9bd4181a8845a6f8e92dc7070dc87bc16cc9178eb630d1259daf2d5a225a35f3247ec99e6d40b3695b740f2b99ccb95a548faab156b7fd4d56e754e73c
SSDEEP 12288:XHm/NUcs9MDYpVKLrkg3Dvy20c160VgJhw5i5n41xIOsGVxwNR89u+Y2yBYzwH3:XHm/NUcs9DXYk066fgoPFV+PAk2hMH3
TLSH
T10D35AE2576A89032C1F5CC310B6A89E8BA389C21FB5150C7E66CE63FF5BB2D61935731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 28KB
SHA256 ab3528dc2ea52213a51892c8c8f5f9f4bfe6653e7e8c231290f0f9bff24f0388
MD5 d1b759ad38d9004f62fdd47bab8ddedd
SHA1 fda589f4591dd4c9cf072c4f90619c56f78d82c9
SHA512 81f988b4a51043dc327b2383f314ffb47302dd2fc7492f9a2ac8f7259293834b308cd2b3315ded1a0e3ca4a9e6b2147e3d669a254a7e835a3877d0ea2689bec7
SSDEEP 192:8sJ6EdZkK9t69OkLGgeZAECFmfTvPVwGVUo8:8LQ1ZrCFCSGVUR
TLSH
T15BD2B856B848EA02DD0A2D369FEBD4ED72313E22CD9B031379C2B73E49B70C14D58089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_7d0dee3ec24732ec6a7e2140c2ec6a94_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
Size 3.6MB
SHA256 e77bdb636f03a8564f18b5e470bbade5bd16be269f4282788120ac6c826579bf
MD5 97e7029df7620da890bb9387e19d94b6
SHA1 5710a6a1ece129ff0340d4857dc13f17d3d7bfa5
SHA512 e8ffb90847e4525ed5e319bba475fde9d7b035813566915d3b88068b0f7f48feb86852bca679115e7a8de76b3e64fa53ce54ba3daf42f392f55f45f3a096adff
SSDEEP 49152:n23IetlomzqbeWsLf83Won5L3s9x1OxGBcq2exk74gcAFu4OuDmGRmR/1HLiTs7:pbm71OxRR9Sl1x
TLSH
T16E064B03A2F541D8F0BAD6789B359B32D977BC855B38A1DF029056191E36FE09F38722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\Desktop\Microsoft Edge.lnk
Size 2KB
SHA256 7e18db9ee6b7007874db22536e189a51acc6dfbc7ef3e9723e612f35e2d471d5
MD5 e166238b4df1bc752e390620d16766ce
SHA1 cb27008d20258d97ba919d3893335bb11c53a5ea
SHA512 ca68a6ce0bb5ad6546ec29a66169901d25ae9c05483049f7613764b2f2a3ff3a2465c371f9200e16bdfda112843ff0d9e6388444724e2c3d049412e6e430425f
TLSH
T1CA41C2119FE50A2AF3F7AD7259B36631EA7BFC08D5244A1E008A064D0C73A05856DFA7
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_installer.log

Path C:\Windows\SystemTemp\msedge_installer.log
Size 122KB
SHA256 eb5eecd8d5fbbe6599a95031a0827970334a0f9c21a52ca7520b08cb5513baab
MD5 866475eef7e53a84801276aa777816ef
SHA1 a86c5fcbdb582d97b80117f0358a180b84c096f7
SHA512 ea3d8c8a5ed576638429da442ba2ff5e1ff6c5d014962d1c3fe0e91e59a9c4a82c43ae12b6ac9dd5764dd220116ddd0be688d80bc697a93f57092eeb174f7468
SSDEEP 3072:DO26AtZdSnMBd0D0g3jO8LHbTuMQ9UZ8r:DO26AtZdSnMBdk0g3jO8LHbTuMQ9UZ8r
TLSH
T17AC314216F0641A72F452EEA66433626A6AE3787D2C457F73ADDB441F0C6E63005F0FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5136-851-0x0000000000400000-0x00000000004E6000-memory.dmp

Download

memory/5136-0-0x0000000000400000-0x00000000004E6000-memory.dmp

Download