4ff95cef360907b2b79793a231413b1e42ac79a6b29ac8ffb65d698d654fd1bd

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 4.4MB
Sample260922-tmrjwaaa87
SHA256 4ff95cef360907b2b79793a231413b1e42ac79a6b29ac8ffb65d698d654fd1bd
MD5 fa45c496617c4dfccd6584cc205ad363
SHA1 b4fb47db2335e9fc95421d08ad12f8e984ef2817
SHA512 5681d14063063542e2afaa9815829324ee5ce41a35c41e74e80f0f9f4d35934c8494efde4bae5c81a8153ccef76fb221a522e5c39d3540cc66774126f9437143
SSDEEP 49152:y69Waekdr23IetlomzqbeWsLf83Won5L3s9x1OxGBcq2exk74gcAFu4OuDmGRmRd:y69WQdVbm71OxRR9Sl1xB
TLSH
T1CD266B03A6F545D8F0BAD6388B268732D977BC855B34E1DF029056192E36FE18F39722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2860	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
4632	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\RCX32F0.tmp	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe.ico	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe.ico	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe.ico	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe.exe	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXA0B6.tmp	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\RCX2C8D.tmp	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\RCX479B.tmp	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\a92ddb41-827b-42ed-bd56-e52439fe5ab4.tmp	setup.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCX13F.tmp	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE.ico	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.exe	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\RCXFD7F.tmp	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe.exe	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe.ico	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\RCXCFAF.tmp	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCX144D.tmp	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe.exe	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\setup_wm.exe	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe.exe	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe.ico	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\RCXC5E.tmp	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe.exe	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.ico	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.ico	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe.ico	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe.exe	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\MpDefenderCoreService.exe	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe.ico	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe.exe	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe.exe	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\RCX3F8E.tmp	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\RCX4244.tmp	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.ico	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE.ico	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe.exe	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe.exe	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\RCX62E3.tmp	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX9D54.tmp	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe.exe	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE.ico	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe.ico	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX39D3.tmp	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe.ico	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe.ico	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe.ico	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCX4ABF.tmp	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe.exe	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_880163370\llm_user_input_extractor_config.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_1803732531\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_344063140\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_1803732531\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_631754967\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_880163370\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_880163370\office_endpoints_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_631754967\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_880163370\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5536	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345670636285040"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{2F294CC6-875B-4994-A670-9D98F090D710}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4696	msedge.exe
4696	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4616	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1700	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
1700	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2860	1700	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe	88
PID 2860 wrote to memory of 4632	2860	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe	89
PID 2860 wrote to memory of 4616	2860	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe	90
PID 4616 wrote to memory of 5364	4616	msedge.exe	91
PID 4616 wrote to memory of 5536	4616	msedge.exe	92
PID 4616 wrote to memory of 1792	4616	msedge.exe	93
PID 4616 wrote to memory of 1792	4616	msedge.exe	93
PID 4616 wrote to memory of 5644	4616	msedge.exe	94
PID 4616 wrote to memory of 5644	4616	msedge.exe	94
PID 4616 wrote to memory of 5644	4616	msedge.exe	94
PID 4616 wrote to memory of 2152	4616	msedge.exe	96
PID 4616 wrote to memory of 2152	4616	msedge.exe	96
PID 4616 wrote to memory of 2152	4616	msedge.exe	96
PID 4616 wrote to memory of 4860	4616	msedge.exe	97
PID 4616 wrote to memory of 4860	4616	msedge.exe	97
PID 4616 wrote to memory of 4860	4616	msedge.exe	97
PID 4616 wrote to memory of 2572	4616	msedge.exe	98
PID 4616 wrote to memory of 4428	4616	msedge.exe	99
PID 4616 wrote to memory of 3060	4616	msedge.exe	100
PID 4616 wrote to memory of 3700	4616	msedge.exe	102
PID 4616 wrote to memory of 2796	4616	msedge.exe	101
PID 4616 wrote to memory of 3700	4616	msedge.exe	102
PID 4616 wrote to memory of 3700	4616	msedge.exe	102
PID 4616 wrote to memory of 2796	4616	msedge.exe	101
PID 4616 wrote to memory of 2796	4616	msedge.exe	101
PID 4616 wrote to memory of 4324	4616	msedge.exe	104
PID 4616 wrote to memory of 4324	4616	msedge.exe	104
PID 4616 wrote to memory of 2708	4616	msedge.exe	105
PID 4616 wrote to memory of 2708	4616	msedge.exe	105
PID 4616 wrote to memory of 3760	4616	msedge.exe	106
PID 4616 wrote to memory of 3760	4616	msedge.exe	106
PID 4616 wrote to memory of 5964	4616	msedge.exe	108
PID 4616 wrote to memory of 5380	4616	msedge.exe	111
PID 4616 wrote to memory of 5380	4616	msedge.exe	111
PID 4616 wrote to memory of 1392	4616	msedge.exe	112
PID 1392 wrote to memory of 1112	1392	setup.exe	113
PID 1392 wrote to memory of 5384	1392	setup.exe	114
PID 5384 wrote to memory of 2540	5384	setup.exe	115
PID 4616 wrote to memory of 5360	4616	msedge.exe	117
PID 4616 wrote to memory of 5360	4616	msedge.exe	117
PID 4616 wrote to memory of 3284	4616	msedge.exe	121
PID 4616 wrote to memory of 3284	4616	msedge.exe	121
PID 4616 wrote to memory of 5876	4616	msedge.exe	125
PID 4616 wrote to memory of 5876	4616	msedge.exe	125
PID 4616 wrote to memory of 4592	4616	msedge.exe	126
PID 4616 wrote to memory of 4592	4616	msedge.exe	126
PID 4616 wrote to memory of 5592	4616	msedge.exe	127
PID 4616 wrote to memory of 5592	4616	msedge.exe	127
PID 4616 wrote to memory of 4696	4616	msedge.exe	128
PID 4616 wrote to memory of 4492	4616	msedge.exe	129
PID 4616 wrote to memory of 4492	4616	msedge.exe	129

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2860
- - C:\Users\Admin\AppData\Local\Temp\2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 --annotation=exe=C:\Users\Admin\AppData\Local\Temp\2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x25c,0x260,0x264,0x238,0x268,0x7ff6fffeeb10,0x7ff6fffeeb20,0x7ff6fffeeb30
    3⤵
    - Executes dropped EXE
    PID:4632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --force-first-run
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x2c8,0x7ff83324c188,0x7ff83324c194,0x7ff83324c1a0
      4⤵
      PID:5364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1752,i,105320833751795523,9204487579933527064,524288 --field-trial-handle=2488,i,6190505955863981982,5079755798036707542,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:11
      4⤵
      System Time Discovery
      PID:5536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,13303872711875289318,11279071954900446537,524288 --field-trial-handle=2488,i,6190505955863981982,5079755798036707542,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:13
      4⤵
      PID:1792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,12290344806424602835,13617255435113712451,262144 --field-trial-handle=2488,i,6190505955863981982,5079755798036707542,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:2
      4⤵
      PID:5644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3612,i,10666101973186263120,9156651227554453992,2097152 --field-trial-handle=2488,i,6190505955863981982,5079755798036707542,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:2152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3632,i,3393637505309153878,4919387007461902991,2097152 --field-trial-handle=2488,i,6190505955863981982,5079755798036707542,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:4860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,17275041202340424266,10630342861472175621,524288 --field-trial-handle=2488,i,6190505955863981982,5079755798036707542,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:14
      4⤵
      PID:2572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,10611096032058385991,14780449768162967571,524288 --field-trial-handle=2488,i,6190505955863981982,5079755798036707542,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
      4⤵
      PID:4428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,1580196954968627565,8158128181592555854,524288 --field-trial-handle=2488,i,6190505955863981982,5079755798036707542,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:14
      4⤵
      PID:3060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4316,i,1412048670006633163,187545101249344024,2097152 --field-trial-handle=2488,i,6190505955863981982,5079755798036707542,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
      4⤵
      PID:2796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4340,i,18074237597771493246,18353211595851660008,2097152 --field-trial-handle=2488,i,6190505955863981982,5079755798036707542,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:9
      4⤵
      PID:3700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,12766811090525088160,9081397556882685117,524288 --field-trial-handle=2488,i,6190505955863981982,5079755798036707542,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
      4⤵
      PID:4324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,9152399641137323549,11368362678220690879,524288 --field-trial-handle=2488,i,6190505955863981982,5079755798036707542,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
      4⤵
      PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,18340616497742099190,18195469184342628608,524288 --field-trial-handle=2488,i,6190505955863981982,5079755798036707542,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
      4⤵
      PID:3760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,6647886969594700775,17644016388089457738,524288 --field-trial-handle=2488,i,6190505955863981982,5079755798036707542,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
      4⤵
      PID:3512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,6647886969594700775,17644016388089457738,524288 --field-trial-handle=2488,i,6190505955863981982,5079755798036707542,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
      4⤵
      PID:5964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,17337768175615095127,657196097528701714,524288 --field-trial-handle=2488,i,6190505955863981982,5079755798036707542,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14
      4⤵
      PID:5380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:1392
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x1d8,0x218,0x23c,0x1bc,0x240,0x7ff757b404c8,0x7ff757b404d4,0x7ff757b404e0
        5⤵
        Drops file in Windows directory
        
        PID:1112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:5384
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff757b404c8,0x7ff757b404d4,0x7ff757b404e0
        6⤵
        Drops file in Windows directory
        
        PID:2540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,8344538831333234765,10497604563582087572,524288 --field-trial-handle=2488,i,6190505955863981982,5079755798036707542,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
      4⤵
      PID:5360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,1441056657828557486,11903072950782994123,524288 --field-trial-handle=2488,i,6190505955863981982,5079755798036707542,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
      4⤵
      PID:3284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6872,i,18385090194879567265,1592303757353154577,524288 --field-trial-handle=2488,i,6190505955863981982,5079755798036707542,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
      4⤵
      PID:5876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,8106566196572971615,16601685737398927651,524288 --field-trial-handle=2488,i,6190505955863981982,5079755798036707542,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
      4⤵
      PID:4592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6940,i,10075210447405628832,11894607300566229690,524288 --field-trial-handle=2488,i,6190505955863981982,5079755798036707542,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:5592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6556,i,16030760197660165289,14096265966080906112,262144 --field-trial-handle=2488,i,6190505955863981982,5079755798036707542,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3484,i,12579784635758882344,5074240975483749260,524288 --field-trial-handle=2488,i,6190505955863981982,5079755798036707542,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:14
      4⤵
      PID:4492

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe
Size 1.9MB
SHA256 43ed5ab726e3617985a831829a530724fdd46dd88b623608970607a1b792002e
MD5 64842592d40f1fa6bf98092286d10bff
SHA1 688485c7556033317e5898ed4d63c9889538223c
SHA512 dc484a272ef94fc94bdd874741c1c6b758da4a8d59deb42da7e6dc6b034b4299e4c41c6cc1a637a9e9ea0acd08f26bd0f8b4a1802c66f1930f9c95165371c8fa
SSDEEP 24576:hLf8OFvt/RmMHeBaQkSNL0I71K/UEvzSz5/Pem0+dl6ZVP5ozP5IVJXyxR:7H8auNL0gEvzy/X0+d4/xozyVJO
TLSH
T1EB95BE06B5D940D9E06E8170864285B1DEEB7C415F62A9DF06D0B3182F77ADC6B3EF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe
Size 4.7MB
SHA256 8bdcdab2a145e9bd35c5991115de5603d0ae320c6815020ac04358467f43d9ba
MD5 0d84ae9ca9ee8387f93796d4e11ee266
SHA1 f5993070be846840c6495fe5287130527d9d3dee
SHA512 e6cd651c8b0f488e1e5ad86c44de4ebae6a455586c26e64ea3beeeb8d8c1e51cd342565052d82cdd674712661f47c394cfdea4cd3fffce3fe2eccb049d0900d7
SSDEEP 49152:IxjNfV5cbudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/Baj:8BV5c5ijnUdYd+RaAj
TLSH
T104366A03B28940D8D049D074CE468632EB667C8D4BF661EF3691B7EA2A77ED47B39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.6MB
SHA256 62e775fc636e623da2c174ff7850cdffef49eea9a038169bca7bcdfaa626cc79
MD5 432364ed2e53e1f1d9ed4d87e7ab1b69
SHA1 666e1a74a985b8f7a4db3e5e1fb91d76cd7a5cfc
SHA512 f1cab1914236f329db8b0862e19393f63fc9268f813cd098cc725c9ccbf161eab9aef5b8e3f1230f6db442866fb33b87cb8692bd79d52df83dc226204b3c57c3
SSDEEP 49152:uKXF845lGBsz/xe+0Z1ZGu6qG13O7Q7gLYduZrSdHBAVfb:uz6YYxSR6YjwA1b
TLSH
T1F2C59E03F6A591B5D0DCC1B8EA368B35D6A17C584F2166DF0248BA353E77AD04B3E7A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
Size 2.2MB
SHA256 048e23578f0ad443f2be89c1e09af34b0fcded85e184c9f39bb1ef0d68466001
MD5 6626e5f14111c4cc30c3372155208b40
SHA1 de96a9ece660fd22668a50352e1a490824c0b167
SHA512 4bb57216ffc1040f3b98b17229909357273d945cf44be951a75f9235f61c5e9b78a7605a2d07b4b1f54bae628c2db97de5f488561060c53c6202666e63ec8c2c
SSDEEP 49152:6viGrxdpMsKyY2fF8FhmS86IUJWQn+6h27d6:6BjnbOjjsts
TLSH
T186A5BE27B68D40E5C01AC0B4D7569935E9B2BC124B6866DF0B50B6593E37ECE9F3E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 898KB
SHA256 12f3d72483982bc0f716274bfa853deec534ed6318891d2406d52988b5b3d9a1
MD5 da9da20f04d4f429166c2e55c34ba911
SHA1 1abf69064267b6ee94e6a05d43d4ad5f95628e6a
SHA512 9e0796a1523a429a900ab47f401cf422c34519250a7e4fb303c69a471cd592a5999c7161d2d9288058bf12fd38ad442fc3479490e3ded20d820e2b270727c7c7
SSDEEP 24576:yVF0xmRPTv4C2yp1MDuq7wU9bZk3jNGsrzBli:yVFSmRT4C2yp1MDuqjNsrVli
TLSH
T14515AEA63D9CD021D9B87F340883A5E09F626E92EDD544232751F65C7E392F2662F338
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeUpdateSetup.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe
Size 2.4MB
SHA256 0b282196ff3e72779b2b8764bdcc220b69f6fab2f9b02dd6258346a0dccc9b0c
MD5 595b79f7a5f1dae9c01576bc645e651a
SHA1 c8d036a962f6808adb335aff644eaacd4e1d43e2
SHA512 25afecb66c9220fbe232f508fddabb96f6adec65dceb0283799f523495a9d751d35e71f928af94d4cc216001ef79eb005efb2f9eeb8462b685a3ccbe18fcb2e6
SSDEEP 49152:nggs0+/bgGeCiEa3B/yvJJHBXNTn325kSiV3QpOmTiGIcNMzwjbVPTI/:nBF+5ihyvJdn3JSiVgEK2cK4bVbI/
TLSH
T1D4B5010C3899B8B1CC612833589687B41A7BBD212D57CD7FE265EB4D2C70E636470BB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe
Size 1.3MB
SHA256 a774af0cb37e7d082396700fb53951a9f6c8315a219d1247f0d0b3ea36b06d64
MD5 a28f2682a9ad102795d72767b6f5da1b
SHA1 cee00e1f17eff889e4148a02bf905fd0b076b7e3
SHA512 526008ec7b1f1a869afc65267cc5bca3540569e24d6958314a8a8277a2006afde8f311a17ee12ba0c3ed37f804e85bad3b88b92644601a58e6e909d1208cb6cd
SSDEEP 24576:26NbGn9fYUZYXc5KdSbXX6f9zaFk9mR4qYbTM:2ein9ffZYMYdSbXXvOmWD
TLSH
T1C155AD4D7A9848EBC029C5388D5A4379F5327C0A5E7766CBC2A4B72D1F323DC5A36B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
Size 4.2MB
SHA256 d1036cc5eb086b9cf005b79ea453e5225077939ce6cc7e7b079b03fa6c61318a
MD5 05dc62f5fcd62bdc14101090fb8554ae
SHA1 ba1dc99faf361f1ecf90a72e34319e1d6b076531
SHA512 45162c9899b3d5b3e551693f98e04e4cd647bdf0785c8272fa8f97f2f8d269254a706eb6f687196106fa0222e4056e82e15b7cb1f8ff8c69be6ea75dc5d48d91
SSDEEP 49152:O9kZRdUijS2aBW08mKqRXGPd39PyPvnkSN+EcrxA3vGCDlBYMO74U2y+PhC:O+uiWbN/ki+EcF0pDeN2y/
TLSH
T137164903F19A00DAD059C174CF4A9A36EB627C8907F162EF365076D92E76AD03B3DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe
Size 1.9MB
SHA256 fef56eedbaeeb86ad6cd281eb1744437bfcd72905716604466ed7771e9a02b2e
MD5 e663de0c88ef505671caeebec1cae3ba
SHA1 39c104e95d12696f9579ea8a9a6c8565751c22f9
SHA512 d930c4b115e4a9f81575918172a1d32eefcb8e0f6ceb8faca0f27abdbbaca9be00b63887bbade02b54133564cc3c1d10e522e1d8ed639f1b80ab64df2fb28499
SSDEEP 24576:xNr3JCw+E859zAdp4S/f0IPTRlWk0eTy5xDz7EqnPATW41PcL3LU:xNr4b8pdcIPTRlp0L5xDzoMY91P27U
TLSH
T12C959D0BF5BC40E8D019C4788A724575E6BDBCD10B2866DF06A0B71B2E77AD45F3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe
Size 2.2MB
SHA256 b38f7fe1d6e92ae0c2c2622628a6b260ef3054b137cf33d37af62146ce19ed85
MD5 87471c3565dca1161fde58d07245d700
SHA1 04457b6dc8a4e825f4e4c1a9286118215e7fb371
SHA512 f0ca70b14370041ba4f767110446dddf27fe6f2fefaef85a1fe577d773df4768cc481df69a0b52bd5ea1df3f3f8df10c80a9565e44115ae8e2cd646795b6df09
SSDEEP 49152:6bUbGacifehjvHHKTdfxINPEt99G2Bo7EukU1a:6bsGac8yjvnORmE
TLSH
T150B5AE13BADA40D5F06DC570E716862ADBB27C464B256ADF0740B2052E7FBD0AF3A724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

1392_13434567063315221_1392.pma

Path C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\1392_13434567063315221_1392.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

5384_13434567063247159_5384.pma

Path C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\5384_13434567063247159_5384.pma
Size 1KB
SHA256 e37261d17ea74f0f7806e4080cc8874fc6b90c3befe53219c4a482a64326fe50
MD5 aaff10335fcdf392f1d871dd1f1f3c1e
SHA1 d3bcff39b76c75861d55ee7e06d66d546455ff88
SHA512 159839a9989a4a752a0dae331fb38f079d06e012552aa0b9e31509f6847cc7aa96ba7192cc0662fb27890b9778e5e153b7beb388b5d6191dc2a1b514f097bf1c
TLSH
T1BB319B44B7B89A43C8539632C4E703553BBAF6E637424BB62145A70F1E062C84ACA080
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

MpCmdRun.exe.ico

Path C:\Program Files (x86)\Windows Defender\MpCmdRun.exe.ico
Size 3KB
SHA256 02221d573edefa486ba8fe5aee3c8a10c8c7e3188914c0f22df06bb1338db790
MD5 1272e6501512e471bddb879dea4b5800
SHA1 1c8b9489166959e6106095c0974a1825ac1179c6
SHA512 7ef9f685457532d84ba2ed316ec52a44acec151b92e563f6943f593d272745bad0f7c549867a723d2b3532cbcb76ea2b99a965b3b2412d5e7644570740bb4194
TLSH
T1CF6140A1F209FC58C45CD1744DC6C2CC18543D958C0A7273FADCBF8F69724E52E21181
MD5 SHA1 SHA512 TLSH

Submit Download

RCX8E6B.tmp

Path C:\Program Files\7-Zip\RCX8E6B.tmp
Size 796KB
SHA256 2c5e828bf5cfd0898a60e81af71759c7aea1cbb49b7263bc76b414a470378ccf
MD5 da407b415fe167bcd3fa71f110606b47
SHA1 45a551834bd1ab2448442b167a3091bb4e840ed8
SHA512 4327856944a791252df5638fca5ff2093fbf83de3e9725d43284990fa37898b707c0ae7e2a80187bfdcad25173b253832171060e5d642a999918a517fff8bfa7
SSDEEP 12288:yCn9mfCMeVYkU7lE7dveBPBMpZLVoOkVoWYxhvw5iXUMTK:y69Wbe6kUhEsB+OOdUYU
TLSH
T16F059EC969D28C2AE11B2B309C6343F7429FADEA6360CD5F02D01A7E3E951A354775EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.ico
Size 3KB
SHA256 463b6e99198762de39ea3c9156504527673355f452c17063d0fcc34caa3cfded
MD5 01f2c0d2e4df4e0ed544a4e4600d1457
SHA1 2bdf43857fcfeefcd37ee7a82d733ca4e4f1d871
SHA512 8238557d4075faf0d780ce775a6bc0121cf2da9b826cc49095fec9b35096809e5187f3027682db88d7358e21025c5d24d2ef784e9c2b0a8aa7021589ce68a8aa
TLSH
T13061D3A9E5052C3BFD5CDA7935B6DB60C2077ECA021680778809F58328F768B16ED974
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

iexplore.exe.ico

Path C:\Program Files\Internet Explorer\iexplore.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

lyncicon.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe
Size 1.6MB
SHA256 37b2b39aa752b01b3f7168022975634eba71c0bd2cd219c4d143a2a8d8104e91
MD5 aae0a48f61fdf0c6d47f4d1fe85a33ee
SHA1 36c8bde567f3f4250fcb360d1dadc8190e446b00
SHA512 bf91da9fe8aa191d0ff5b243a0b40786ef6cde37e5d623666a783a4d56d53549b5fd589f92d5eade84124601f48b3f30129694622a5504e174c3c56b6b57fc47
SSDEEP 12288:mqK05+q7fjBoFEWgaMEb42aWKn6gchrA02Ngnk/w5iwZpJtM+:LK05+iuHkcFjgchrdBkg/0+
TLSH
T142752989790DA007DD9D1E32B0416A71F8113D8FBD1E70157E79BB2A5AFB5C0B8282B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
Size 1.0MB
SHA256 a07b57a4c612488d1a995397a5c0c8ff653481dc0f0a0d7f0bec6c4606e7c085
MD5 5716cdc54f28f0f43e096fbcaa8f0285
SHA1 b26e9f08523b42b7f95e2b4a579b34831fccce19
SHA512 ed172952113bf5ae3abbcc1d1a3f9494195ef10cb845bee0b03ebddd29d37bdc725225a4c2e8ab62d326df1ad01b8d9ff5d717b4e0009c08bc8f2465c5307e04
SSDEEP 12288:iHMEO1dNRdJmMVwC/9bqFK+iw5iqbbbbSp+f1XLsswWkxy2lRq2czAe:Y9O1tWFK+PbSgdXYfDtczAe
TLSH
T177358D286BD94A95D829113C88C18A71BFBE3C8DA7728677137C75095F33A88DD397B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

OfflineScannerShell.exe.ico

Path C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe.ico
Size 3KB
SHA256 9e3f1f8e5166514df44b02a1e0bf7474708dafba161e263cff087af62ba89ae5
MD5 d8ef82bb84e2efe95de666f46d0c7ac6
SHA1 fcdd2f6ceacde21e1e38a687041138aa5bb0ef68
SHA512 61f7439ba615c3250701aeecb96ab8319f2d84ffa7e61076f6dbfce20ee3409d212e8d9deb274b145b7f0eeed2388681b929ba897bc85b4d3841f7003bc40afd
TLSH
T1C461FEC2D34610E8DA8268F34DB58DC487650CD540E4ED920EE6BCE39A745FDA93188F
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
Size 1.2MB
SHA256 7d1ee9de8f222a909147db591649bf4f8e6b57c80ac5cabc02cb99c665846a9a
MD5 fd2daba1c0d0f5cf01fc8beb924c85f2
SHA1 eda1bb8d62e5fb1e452b06e9e248b29ca08a318e
SHA512 cff8e4097fa4ac42dd6850a0fc3c5938128ed935b9df2120ec222f8141667e3767e7efd9f75a5b6529aaade86ebbb1d11312fff627e7a407c7d67821ea7e2e93
SSDEEP 12288:Zhr4kH7XlyioWRwj7cf8/su5s1eUI5Y6w5iG1Zc0IursYCYQeSnyZJiqlEbXSb9B:IkJ1cj/sQs1zXMYenGJiKEbXWtpOLl8
TLSH
T1E145CF617624933AE9F10431AC25C2703E6EA0397D65581F976CA62F383C9BD26F2377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-6.0.27-win-x64.exe

Path C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe
Size 1.4MB
SHA256 e6f78158daaf555a90123894ff5ac2c7574cf8897c0634836835f83931cefcd4
MD5 a557e2f1fbf045b317c5a15012157782
SHA1 af57b2d1960835682f9449c940d857d71258a8f0
SHA512 3830572adc2385f8d4cb65a3b398b1854dc6fc9d90d6b29bdef3f7e3da4a69b3d604876ddfb58686322dbccc21387a4ea92e79178adfce05018e636c4633f11e
SSDEEP 24576:SyO0jnJSpS+ELtVjCpWSttvdQGrcd5mWpI2jFM5sFzfTpil15Z+M6qTX:Syzd9LOpfttDrcd5BjBbTpi75Zr62
TLSH
T12365CF307E94C039E6B81576983AE1F03C289B189791445FB2D8BF1C3E745A197BB2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 34f7ecb9980fd34ad0b9cb6bc51aed28fc5743635b3609c8729e437b9c9de778
MD5 975bafd458b864343444735788dc0374
SHA1 f56f98f98c670f9a9183acd9d0bc156057cfd7e3
SHA512 606b9da3a675de7defeeaecabbd49519e53e4fea81878dc272dda31f9926c4edd754ef4f246d5f87170ca65a6345dd1f77c82124400c6fd4bbd9c679b50f8aed
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e1125af5f049deb619ebffc84a42db2ef3a7014b6854f46b5d938a750819e169
MD5 74e1c2f8030907359ec500065893c570
SHA1 8891d4ba217a2a98a67ac5696227e7001e5e8ea6
SHA512 fb52b71d141f3f7a89c4a42aebf58f063421a93a5ad0f4ae35b4b238f80077f152d9ac6ddd2200dd424c9f8fd9f365718aa7f98e1b3f6e2d0f926f412b9d8199
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d68d2837cd4d3cbe361151b453a63800668dcf2cbe711623a85762fb7a3f8440
MD5 214ee6c3452392375e249dc93a02014d
SHA1 39b9ca666c35bb2ad7ce4351b3febb0b58f4e477
SHA512 102dc61ad8b6a518374b7edbfa48362272a68d2df99e03f7aa6cec0f398cd0f1c31ed573a9838017973451a805d761f2eeaf288d724141024699c4ab27ba4df5
TLSH
T1D4D0110ABA0B8202C02208F388E0830823AAAA228C0002C22828A8280A20AE000020A8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a1981ff2d407c493e3d8d9a5123b8ade39a9ed48e096ebe6db46f0d7abf5a5b8
MD5 a50535e6d9d17a3b36febcfccb14d168
SHA1 f24ee8d308b60bebba514d1c16d8c2a1db6c00c2
SHA512 671e82125c8f900a7b90ab8e485d19510d8349c11531992412febdde0608804bbbd7b5ec1cf67b698e2517e0177561688bcdfb3196b62fb89f475777c99f0ec2
TLSH
T158510B8795A17247F7FBD63549ED128B3AB05940AE873E4218A7E4B45A0BF54E30C13C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cb990447719eb8901a1c478c85b35334965592ce94cade1172faa56f737f94fc
MD5 0f6855864876ffe3d563a90f37bfdc5a
SHA1 199672862626e9c946614e08d457467a33a1e20c
SHA512 8d2dfeed7c0ec6bee1476a85c3ba5af8c3924db98be1c1947352f089e9e9c716c3d1aa7e2fa7696c478b75ac8829f93d3c82d790db4c9de604c2ad41bf62350b
TLSH
T16781CBE2A8D22343FFFAF93444976C49F262936C4E41EB6F3866D442D507AD391A881C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e843.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59e843.TMP
Size 2KB
SHA256 3c1efc084e458d8c5a32f4cfb9381a279414f5572fce88dd09d7018a7f5429bf
MD5 aee7f84ecca911fc253db71593318db1
SHA1 95a57c3bf477b9f8f34db9a818f0dd6ad7eafdc9
SHA512 9125e132a0e22a9026055838d140c57396d121869e415128a03d3893c54c21a68c43a8aba03fdc7670d8ab319ecc19924314f1083887f4df8cdf50b3e05c9667
TLSH
T15351FE8795617647F7FBC23549EC12CB39B059409E873E5218A7E4B45A0BF54E74C13C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 90d124ae386571e9d00c6823549738c546ea17e83f415945c60c07ad8546e241
MD5 f3045b81076c65447b14dab8f5a6aab8
SHA1 b30123c69e608f084c1c1a9558303841a6631f99
SHA512 5700f0f2e02b4c4c4d92996e830e0685847991cc04c4b55a0838bf5a4ba5d40f86131c9ad46e25f969b1740fa05222b02f00a0cb03ff6a228eec5dc8b94f90ba
SSDEEP 96:D4ObHUZnu0kVfaejhTJzeJNJiGO5/JGwBtHIJoJ/O:DjbHUZuvaejhNoXi75hGktGG/O
TLSH
T1B391BEF7C3F9822DD90195F0AA146F1BCE1D0556436C3D5A88E4AF5BA3F28B1E141A8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3562e6ecad503628b511807b212843ea97b01888054516a5281fd7450e40fdd9
MD5 6bc06273d2ba56fd2682e277c89f6787
SHA1 03afa9c5304fd46d2c01e95eeb9b9522b8152b0d
SHA512 ab502dee34a7f4991e4a1dd5416a25204447d5bb9ed31ad4d1d5b29e69f180b2ed8278b4592f1c96df7c89bd4878d3f09a2c946fbdca4d9cfe43261b84dfa3ed
SSDEEP 192:sxRRR7xs/fCsdNZzuII3oA8pJn/g6+WNPEa/YECvGrIgtJ:sxRRLs/fCsdjvp/5N/J3
TLSH
T11B32C815AD28A97B9CCBD25DFB657F53D6F95032A0901F48A6FC8A1C04EB6CD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c1e87dfae930e7221f47df374bc1f683db21037df73a68799a060ebae13aaa6a
MD5 179d585cf16fbc4128390c66013755cd
SHA1 efeecb1496fa7e0ce3d7ab2f699c735d54b2bd5f
SHA512 28ef619bcf7dc5f588a68dd297c8bfb55f2e3738f1c50a37b1cdc46c80fca489b5a544ea4a31298c6e41d5dcac5cbfdcaf6b7a22b314b0f8f57005efd71a4e63
SSDEEP 192:sxRFR7xs/fCsPNZzuIRlbMyoA8pJn/g6+WNPEa/YEyvGrIgDuJ:sxRFLs/fCsPjRKZp/5N/Zu
TLSH
T1FD52C719A928687BACCBD25DFA157F53E6FC5033A4941F48A6FC8A1C04EB6CD1213C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 dcd744665695e6399b2ed4e5d1731402c4b305ab9f7672aafa8aa9b22b2c7ea4
MD5 e45d029ed2f64ff2682e4a1579dc886c
SHA1 73069ffe56f04c95357ff9b6aa925d28a93eb36b
SHA512 2f5972adb4d714ae369a6cecc663be7c027ea23201e993577ea32b42b1b46b4b68987d4b724c9d0b75e236f4ddffd5bf5bf58ca64e24a86401ed0ac5146afba4
SSDEEP 192:sxR+R7xs/fCsmNZzuII3oA8pJn/g6+WNPEa/YECvGrIgDoJ:sxR+Ls/fCsmjvp/5N/JA
TLSH
T12842C915AD28A97B9CCBD25DFB657F53D6F95032A0901F48A6FC8A1C04EB6CD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 c4ac36d2d0cae9161f5c29ae5cb704fda00cee3705ea65994b18dccbaa713c96
MD5 f60390bade6f63bf1a2bbb8de9106288
SHA1 079d9ddb4419adb343f66f92c45795eb34cd643f
SHA512 337b2d49739c6739dde45ecc11ca2d5b49c2732d7e557511452757b9d5a1ef8978162be3a979a6cc1a24b7737bed9d5dff1753c34c87009f12eafc9b90bdddf1
SSDEEP 768:U/pCPx7pLuLbLmWg8KfrL8F1+UoAYDCx9Tuqh0VfUC9xbog/OVwguyhprroJ0:U/pCPnEbLmWg8KfrLu1jazgu8pYe
TLSH
T150D2D97B740CCB7F4F804ADDA8297A9B6DA802CB9698CD4047FE941D02C77EB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2c92e277-94c3-485a-a2df-e774118ac888\index-dir\the-real-index
Size 3KB
SHA256 e47b6c58ed4d3adf782a78e4d4ee008d5e4a2515dc5a77e325c42bf860e9481e
MD5 4ee0b65c4b0e8cb61ac726b2b979705f
SHA1 02ecfaf41c1ad6ed78e9c6a9e3a41d918ea1b3f7
SHA512 f12b04b7c2098b91b22a16285b3dddf6352cbd8a2a41f3715ffce1180a209aa7f503461163fba503561184e350676ce9a6de570b132f0cd1b2d912acf14d7569
TLSH
T1AF51E74F8D436B6ACCA8957224790845237416CC23640A2F66FE9238FD83E2629DC768
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2c92e277-94c3-485a-a2df-e774118ac888\index-dir\the-real-index
Size 120B
SHA256 2c71204019a3c32c143c54a7b66672e1ed6db998545ce61b30bc0e77be265547
MD5 3e23c8fa66e71523cd7d5e80ef26d0b2
SHA1 bc309de550b13490f592ff6beb4166b26434b44c
SHA512 812eaec40ec16134a300c21e5a64e18aff62f6e5df2ef5c0670f39a347868ec46a92d9eadfd0d0a28bf66e6d390e3baa1aff4cdea1186fa4be5bfd8b670c1f6c
TLSH
T11FB012A44DD53502FCB14530097A1031195008FD2420820308EDD444CC220C69110218
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ec79.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2c92e277-94c3-485a-a2df-e774118ac888\index-dir\the-real-index~RFe59ec79.TMP
Size 120B
SHA256 6e65a68e8dc2a00f1f9ae27858e2d070b9a1bd5a323616f43aa5d1b33684b15e
MD5 8f6b6264626264814b9a148e6f851c4b
SHA1 37a1b9d418519e0b4c9e0c1cb0f6f85a288fd46c
SHA512 8ce7ae7bfa07561d49d3d4c921141e34c93f86ab94850eadc4949c046b060b17ca3df66339502d886dea445ca357bf820214924fc4c6be1af7880c5b42ec1af9
TLSH
T147B01210CE542541FCA182700983013115014C295030521314F6E000CC030944540270
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b8444409-5ac3-474f-85d1-24a835db2610\index-dir\the-real-index
Size 72B
SHA256 78ea4f7edb4af1527e9070d7ac1bc070586dc5f20d41efbf22aa2c4ab7dbae4c
MD5 a6dc6387a6957b473bdc535b4abd7865
SHA1 dbb8098d73825a736a3023dd906e5a033a6dbee7
SHA512 dd34b0287b0c1a8e687398414399e99867125b1b2cae97ac074c3a5b8345e8c9f4eb8b0d35f791d9954ad01605a6fe020d34e019f2a3a1f6bfe8dcf00a8f6679
TLSH
T10EA0026842844102C4035AB4379743433310CF9E0342530B41A35085EC50D464D7134C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a41ae.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b8444409-5ac3-474f-85d1-24a835db2610\index-dir\the-real-index~RFe5a41ae.TMP
Size 72B
SHA256 aa5434ce3859f82a24ba92e15a70da203c4b84c7eb7a351e8c13ccf5642b1fd8
MD5 cb126448731c6c2f8c6080541c723b35
SHA1 ae1672b4dcc3a8a69303ac56d34a92b462fae54f
SHA512 175451f4a5c734a6090039604df0d9330f59236dcf2647f52612c8e1c56e30dd1570ec86e93158072885ce70835cc643940e4c406e0e9844654ce2c6b91cba2f
TLSH
T17DA0025027D10226D46251B3156206522341DC101100230F44ADC3C6ED544544D4120F
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 96394db3cb747b6814544eebb2b5897db449c34100d3bf564c72c95ae0fced8d
MD5 be251b27f41ef634b8d8e3dc427b4bf4
SHA1 ee77cc8bff04aa9f54994c25f5a209f0ea6d3221
SHA512 7fcb042ac71429a8f20cc0f6b8d642f92069f043434f734225b42c68817c844dc4a99558bcd39abb1ac522524d6e0b5b81e2d689eb2a6b67113463e4527c6dbf
TLSH
T100E026FB2DB71808FDEFE3F5243184750202B8A8C648FC8F442A679B10B2365344AC6A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 a05373d0e44702c6b2928ace2af8b729145c9281a2710feebd4878eae09962ac
MD5 bbb1ddb4bc24b28aa1664253e70d21e8
SHA1 576baed1b4dd6bbb30a44863bb095c108a9e5cd3
SHA512 8e8590b502c57b8ee327938c313a6a6c678dfbabd7bd393bfd0b3617c4126e0f6b53673f10e8ee6a6156787d97c8cf84f0deaf3a96af7e17bbf9cc060fa4dffb
TLSH
T1E9A002D189968149E4041A7A9866428472748EDC4705761581ECE194C991152C197014
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a41ae.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a41ae.TMP
Size 48B
SHA256 c855bf7721cf2fa0c1668520addcb0c103f010c405e14d75e368174d29fce911
MD5 45f396f79ea3558065eeeb5d3ce9b2f7
SHA1 40ef5d0501412f28f35955f4e2002c60f18a0412
SHA512 7156510674bf008001762a1a4c855f163c71630fba5388618047d737d24ab5616be9dc9ff2311724c3a1bfaa5c4c7f1c8543351568fc9b0b424bb3554c40e722
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a7bc9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a7bc9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 514f0f1daef25313f5838d582f77a36b8b8c2e173107a1e83f909dbeb7b72050
MD5 58ce5607c7a4ce06c035d11ab2f2dd3e
SHA1 fa87d1c4db816ee5a1b23460ac1c374ba299428c
SHA512 d0f48d80aabc1cdc56aedc61b9e4a8c30964a174803fe6ea9abe48f2e70807d5313d0ab212ff65861869aba9087f4788f8dc9205161b867fd7984b166cb35bb6
SSDEEP 768:QZ3Ufl2Wc7fZrK9Csp5XSwQs88uBkiT2drgTeu:QZ3ylYtrSCyILNBUrgTeu
TLSH
T1B0F2AF39E89098A3ACF693C2BB5737176EF09147D4C80B5485EEA60E02CB76D5707C6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a797848c7cf4a8654f18cefc224202cf7710f5c68ad46569e65b96ef254e0305
MD5 19003e77d6c120ae6fa51d64c75ef40a
SHA1 66932dc7a4bfd81072bd88b42d4f4fc95de38f17
SHA512 52e7f3f72878f618a7e5196dd9acfc066f4937914e8beda2b943ce43a8c4974c77a4672359bf03775cadb690875f9df4e00689b209a9470c9b4d7a1757f7e0cf
SSDEEP 768:g/UxvxjgC+g3LfAWc7fZrK9CTp5XSwQs88uBkiT2dY5:NZj3+g3DGtrSCdILNBUY5
TLSH
T1A803BF3DE894AC63ACF6A3857B4B2717AFF09153C4C40B544AEE660E02CB36D5707857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 3218d424c744a43a286f418203e59d96154062bacdf241f2051b63915efe65fc
MD5 6140d4e7aee2142289afd5f2f03172e5
SHA1 1d55959bd61c0e9fb16db1acff953d7489bd94af
SHA512 a842362e76c91f189403dcb7061879f498227473434be7a58d94353573b2f12f93b9a3866ce69fe6671bf777cef262572ee75bfa9ef0b1e34c8e164f9e01e541
SSDEEP 768:OFQ/3nwgMfl2OAerK9Csp5XSwQs88uBkiT2drgTeu:l/3ElHrSCyILNBUrgTeu
TLSH
T1EF037C3AD890D9A7BCF287C2AB4677079EF09193C4CC5AD4DAD96E0D01CB2AE1707C56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 2a370a7b5189e4139ae2e6e347226586591d04612645c3a180e587960900a1f3
MD5 98682ca2e7794a640cb26aabbf07d71a
SHA1 feec3ab0af09e17cfc7244d481d60d073c785a13
SHA512 b8ed4c4d2ca51c6e7ac615dcf7c4687423cf2bc31ad197c26163d571a9fdd42ac612df2c8b718db1435350c5c178bbb06fd3f1cf8a6faebb5dd9601ad7ffefe3
SSDEEP 768:R/UxvxjgC+W3TUxc7fZrK9Ap5XSwQs88uBkiTCX/P84g:kZj3+W3TVtrSeILNB6Hg
TLSH
T15003C039E8945863ACF7A385375A275BAFF05053C4C41BA849EE6A0E038B35DA707897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 a3e759f5a9829f1b981164b8854f5ae47691c68aa37a8cf26eb4f400aaf5eb62
MD5 bf06ec98954179e7dd9a323e0b59501b
SHA1 5753600be6343ccc0fa30b60160899c9e9950766
SHA512 299a7d755dd61544cdcb8451fac4069cbc5f6db10b3dac718f6a1bfe092017fd357edf93515c06e0f2450883df53f65b04a9f4d6106a91da1843fc69c32c3e7f
SSDEEP 768:oZ3Ufl2Wc7fZrK9Csp5XSwQs88uBkiT2drgTeu:oZ3ylYtrSCyILNBUrgTeu
TLSH
T18DF2AF39E89098A3ACF693C2BB5737176EF09147D4C80B5485EEA60E02CB76D5707C6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

25f62cfd-ec43-45a1-9345-e6165315d7cc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\25f62cfd-ec43-45a1-9345-e6165315d7cc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

FileSyncConfig.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe
Size 1.0MB
SHA256 fdeaaa041d620d80462241a6fa8bd0614c4bcd1467703af17afd37001abd1735
MD5 6f67e86680929d3dd5c77e437fbc1c96
SHA1 85f3d0119cb0d929a869ab8790c28420b3e70eb5
SHA512 3cc2351e7153baa982f3179645e4311db7f28f38b26f544f0e5ea7ab01e4499ecfee2d16715aed0315f2b0f472b32ac1f52b6c286baa3ad62a371b9065f2e8e2
SSDEEP 24576:MSLw7mtK04dN/ve6jJLIPDxZHV+PAk2hMH3:MsS2w/9Jg/Hi2WH3
TLSH
T12535BE2026D88A32F216077D989993BC21766E22BF02499BEF14758E1D7C5E149FF3F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-22_fa45c496617c4dfccd6584cc205ad363_akira_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
Size 3.6MB
SHA256 1267803e6a05b869c85ab9dde2027dbb8db5f5737e016dc8363cf0268e0f396c
MD5 62f2304cdab00f8f9a967312925c9268
SHA1 fca022f0314d7ba7afd46ed67641c8a37c77cc17
SHA512 c073cecf94bcf0101285d368ec87cf8482487d5ab85b4990578cd29d20476ab8187e64ed803053eca1dc04d74569432b0a525bf76a40578def78199d8b03ae19
SSDEEP 49152:n23IetlomzqbeWsLf83Won5L3s9x1OxGBcq2exk74gcAFu4OuDmGRmR/1HLiTs7:pbm71OxRR9Sl1x
TLSH
T174064B03A2F541D8F0BAD6789B359B32D977BC855B38A1DF029056191E36FE09F38722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4616_995642236\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\Desktop\Microsoft Edge.lnk
Size 2KB
SHA256 09bcaf24824078310e9dc50d173b97ddf61e640a421cf05a5b5cc24341e0fa97
MD5 bce84bbdf3ab8b498000ba5b3ddceb96
SHA1 24d8ab9651281e0aa4f057b40d2b6db854947bd1
SHA512 5b0fc7fe7c5b2b6c9078d285d64e265cd29d5ff51ebe4976f2aab6c52b36374b4d30d5cacac10ec5997876cc854a599a938fc3d4d872cddcd7d280ffa1a5fa99
TLSH
T18841C2105FE60B15F3F66D7399B37612BA7BB958D5284F1E408643080C32B09997DFA7
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_installer.log

Path C:\Windows\SystemTemp\msedge_installer.log
Size 123KB
SHA256 33cb910e976fe8e4bce26d1917a27f3f5db99f45b185a1da587ed2f7b5b61203
MD5 375f72d66eef2ef701c4647e3317957c
SHA1 20f3d16f834d3f68867605c855a71b3cf73c0aff
SHA512 6eb7c3e89f2aa8841b99bd3782b786be751f3cabc2e1e702f46fec267911e3fcd074a5068837b07deae21500347b4f48c36ec4a3e2a512d7ca29e0dbe0b82f5a
SSDEEP 3072:UukPWgoE7OFwEbsuKtpK7az/i63LkFBEP:UukPWgoE7OFwEQuKtpK7az/i63LkFBEP
TLSH
T18FC345113B0641F7AF0A7EDB254336247AAD1252F2C8A7F9FB647884F1D7A56410F0BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1700-745-0x0000000000400000-0x00000000004E9000-memory.dmp

Download

memory/1700-0-0x0000000000400000-0x00000000004E9000-memory.dmp

Download