faffc38d4a7605900bb5a17908ef1b31e7ea0837395d7c552f98f54ffdf9f51f

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
Size 1.1MB
Sample260707-e5t1dsez2k
SHA256 faffc38d4a7605900bb5a17908ef1b31e7ea0837395d7c552f98f54ffdf9f51f
MD5 32838f10b0c8ac42290bbb8664a86db5
SHA1 faf6c8546b2afc2532636ec1433545b1ff0c590a
SHA512 7a261f842d39e1d359f8b6e3445315e95088009250aaa686af1460bc03a0a88582bc671bf7ae67a15561e10949c052da085aea0bad35ef66876809f8bd624772
SSDEEP 24576:KQerbFb1oyD940PzASBp5GvLQpyOOYKlDSq6jrc5xaNIBkjg+O3I/:KFdZoyD94IzASBp5GvcpJOlNSq6jrQaT
TLSH
T107358E0A63A4419EFEA7F076D617C61BD7B1784A0376962F01A46B726F337711A2E330
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\G:	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\I:	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\J:	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\K:	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\L:	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\S:	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\V:	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\E:	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\P:	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Q:	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\R:	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\W:	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Y:	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\N:	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\A:	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\M:	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\T:	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\U:	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\H:	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\O:	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\X:	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Z:	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Time.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\java.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 20 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4500	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4500	2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_32838f10b0c8ac42290bbb8664a86db5_agent-tesla_amadey_icedid_njrat_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

64BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
Size 296KB
SHA256 679dc9ff0f48ffafa162b77e77e7f33dbd255e06d2c8b7f7c8cb0fdec88033a0
MD5 8774c1af4b2a1ec94ed50d4e16bda285
SHA1 5c73aef2a26ca7450c9d215caf72f1612f475a1a
SHA512 a1a6cc2148ecb6f2ac9668961be876029ea935b8dca0f9524fb91bd666c87a91d1213f440503545183fec1fb3c200507ca88c7c4278504b1cbf1389ea7daef4e
SSDEEP 6144:hP+bOxxs9eTCD1PY7o/GxHsdcJtqQ1UN0LqoqX7B+6Wjp:9+qs9ThY+cyZ0LqoqX7Be
TLSH
T162548D0A37D94CF5E4A7C27989A28542E3B138851B74D7CF5760422EAF63AE06E3D731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\java.exe
Size 333KB
SHA256 e0e2bee8c44c1a553b099ee8164b7807173591d934cedc8591d038225264adbe
MD5 a41555383304c89ea306d354a7354c59
SHA1 1fd90b0891b28e91cfb62a4b1675667ae72d3ec5
SHA512 ce761f15482ba6951048fabee3ab753086d9705167156853e8eb89aeef1cc94008da08f803a19a055396eca4c20141c44b4780cd1ced821f9647e2356dfa5fcc
SSDEEP 6144:pIPVS+s9fbrZMMnj5JegJZrJhSYV/PvyFro8l:p0VS+s9fbrmMnDdocPvyFUW
TLSH
T12374BEA4B3900CF9EC67413ECD558915D6B27C590BB0C65F03A8376A5F333A11C6EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\javaw.exe
Size 333KB
SHA256 3617830726b70834b2096bbc4be25cb13f769305711948fade3d59e82c2b4844
MD5 33a9669b49cc9f2d6b9172867873890b
SHA1 41c58c1ae9a1598befa4bd2084cda99a12d641f6
SHA512 f6ababb69466816265be554f7921596c000970d60442513192f57f59a14cbd07ca6d957329dd1b2c2ccc099e0c0568b7ffd2f15de5d635ffe57878048c5b509e
SSDEEP 6144:BKuvms9RCe8LVmW3/5sl8yPxozPYutYPDvhtVzM:B1vms9RCe8L8G/6+ySzP4PDvhtVg
TLSH
T14F74BF95B3940CF8DD67823ECC56490AD6B27C560BA0CA5F13A432675F333915C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\javaws.exe
Size 540KB
SHA256 1b4f616c23450a3972a17120a584403d9ce94e8a5fa033189c6abddf7e4c354d
MD5 331307314c48a9e954089ce14559ac3d
SHA1 3238331ed26939719cb797a7e33827bd41574cf0
SHA512 8af35eb859ce8d43565f80a7192f70b12efb02d4125278cb54b6a09f331435acc9ff4232af5762a086ab96603cea6a102edfbf43e131ec01eea197a176cd6f14
SSDEEP 12288:f8MU4Vs9RdLQRYHNOnqmtWLbbdIvWwgPWG:fdoLQMOnqmtWZ4gPf
TLSH
T103C46C90F3E814E4F1B79A358D764512CAB67C9A1B61DE8F02A8255A1F337D18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe
Size 596KB
SHA256 4d71a01ecf6489d77f0f51ba7ba945c0b9f6603065f975794c1583571e6c958e
MD5 256f1bece6a4c68c7e11418785b14cbe
SHA1 c5713359dc308beb9ccf4915a6622afac42a2f22
SHA512 7fede7f231b795664a884d1d23b3713cd2991c3d174ab91d3991164efa23f4cc19a1760ec21f13c4fd369f115f7b595843813c20dae6ae9317215ad18e3177bc
SSDEEP 12288:5s9EzFgDdzMrqr6w1lrNSxGW7+WDilOegqGK:zzFgDQq91W7pDilEzK
TLSH
T14DD4BF41B3E846E9E06AC134CA538542EA7278960F60E7DF01E4927D2F37BE95F3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe
Size 6.7MB
SHA256 1914c1265d9478ad6f41df50c8d35aa85a5cdd4c62a1b477c82bddf59c3ca235
MD5 d38e579c6722df2bfdda80b0c702d5bb
SHA1 6cc6da83fa80210fd6db655343f42870cab13433
SHA512 1707b2643ba4771e3fcdfd86bdb38568253f36180bc6c6ac380b5fb7c063bd8b93655b9441222f015d3dc4ace36160e3acf028112ad4da81ce9c66feaba781f8
SSDEEP 98304:Xl8YfTaJ1+WEyB2L4HrZtMPIieK5M0uR7F5eC:V8YfTa8L/IiFUpIC
TLSH
T1F8666C47E3A600A8E46ED970CF3A5521DA253C8E57B493EF129476E81A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe
Size 1.9MB
SHA256 b46af17e3bb05e4d68f1caa3d445112fba5d2e6f43f0005101e13d4d020ab0bd
MD5 81babb2a854c709912b1c8795d84713b
SHA1 11847eba967f30a0d10cd57fe98ad23abe963b20
SHA512 d3da2c49bedd34664a738bbad30519dc169645d77189eb0484359a5fa1a15b96386f8d27d7e5b03fca5a673b93e15ff814c8a2f86bd22f330d9837411dd52694
SSDEEP 24576:sCR4RYP/aU6hXRG8jaMmP0d3L2NLb9Ld25PTOocJuJ/cIsY6Wfv9xCm:TRWYPyUb8jaMhbwpZeToMJseCm
TLSH
T153959C03F2D941E9D06ED578C7469536E972BC8A0B20B6DF0290B2952E77EE85F3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe
Size 1.2MB
SHA256 50351eab742f67e033480579d45f71a714a7f19c45bf5df691483fff592d2353
MD5 163b33be2f4f234bfdb6e930863966d3
SHA1 caccb8cd8f0ff7e8d0b1eff35b1524449f09d975
SHA512 94b877cb2cb0bc6a80086c998f38a713ae4afa3413be346365c23615307acb5d70115489db7e8ae53525c5d666444a2c8f114228c042b6e572d906ad2f87e58f
SSDEEP 24576:NKbzkN2tIvg/XlOwMYvhg3NaRy0EssIVprSfimBE0x:NK3Q2tIvmbMWC34sDGpGzW0x
TLSH
T16C45AE07B2D841E8D069D5B4CA568132EAB27C460B74A6DF06D0F25A1F7BEE86F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe
Size 3.9MB
SHA256 964f5713e471ee778cf46f8b1889d28811da39abf409fad1dbb2e852eedbbe62
MD5 1fc034751e68228c39190b527290029e
SHA1 3548a2f574ac27526c9f2d23b424e40b327024b4
SHA512 7c0cdbae197c9dcc6391afcc0683ac3f11000104d224ba243c0fdabf0137426f709ec70c95e92d4e96bcdff180c639d0e8af094f204aaafeda9d335861a24c56
SSDEEP 49152:4mZqbfZeCMKFgrwfSmeNCDR21t1Q0GD0AGguVEusJ6LNzOeL0GKVIeCjIp26If26:vmLSguVlcm7fwKAeX
TLSH
T168165903F29940D8D149C074CE5A8132EB627C8D47F562EF3694B6EA2A73AD47B3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe
Size 1.2MB
SHA256 582c8d3c829f222a00215812ad73ca5a66de104fa3e827de90eaa4e2aab1e34a
MD5 2d7c176b0bd93b41c3432a0d5314710d
SHA1 05836b108fa0b51e14a9c7e105d92895a03aa9e6
SHA512 a967e53cd09d1a609e3b271c48292ce31268486b4fe7a1b5753fb92dcf8886c90367a56c985268f5abf7d1c7b75ecf33af41ac5b7f0a453cb4fbbd5408606abf
SSDEEP 24576:HeMenl4oF8sXm6fpO4VLecV8Xk0pA08mWB7V9yAf:HeMmlDFZfw4RbGU0eNr
TLSH
T1DE45AD07B7D941E8D02ED5B4CB568536EAB27C420B24AADF0690B3691F37EE49F39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 1.6MB
SHA256 56456caecfa56162102d796946e4f856bffd28d5e15174a0f54f0d6b5abfc5d5
MD5 679661856dd4e99da8305bf85d28d217
SHA1 a4b3d5d9853eb618f0b3ec40947e607492b2a7aa
SHA512 788b168c2bf855fad9bb94259f35d439767472fe8871db8639fb0a3bd841f5d0e19dc342e93465194168a2edf02a8a458914d949d544bae612eec7f479f471e5
SSDEEP 24576:vn+jj2/W/QFs0CUX7C+KWP9D94w/xNDfuGufxUYlkkkkkkkl0T3gAQzjrQY3:mjjb/QS0PP59BNqjJ/PQzn33
TLSH
T1CE759C03F68A81E5D09DC278CA764B30EA717C655F20AADF0190BA253EB7AD44B3D7D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe
Size 3.4MB
SHA256 17665ed4a566f147dcb706c2d1371ffa64c705dfc2ed39c8d5c7a07df5636b1b
MD5 87038971921b8d0c22f80840dcb4a545
SHA1 05b63d9afd12b224793bc68b75794175abce7c4b
SHA512 5bc7fd36861d72ec27cda9cfbb8207c50d56f86bad3552a76cd9617b36b96376103b9cd4170946e39170e28fb63672f488049a591c56eecce903cb827eb0d5c3
SSDEEP 49152:fv+lSt1LEWUNdqYzj0fERWciyNEUqMzADOulO7Udq+KqOuBk7bVnU7wF62JtYUkK:KagwOul1EE4wsvl
TLSH
T16EF54903E29900D9D099C078CE4A9632EB627C8D47F562EF3290B6D52E77EE47B39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 1.4MB
SHA256 4743ffb152b65d1f11bb572823f78371de9619ab5d7d85f30e6957d2118cdc55
MD5 a32def9a667d6f36ed39d29d9d689659
SHA1 5deec94c9ee909a74bfb32b5060142f904682e9b
SHA512 6adc20d70e7fb7f31e3ef88279fd0795187ef9fb0a0b951eebaedb05621316d05b78024347c02a69567c34dbfc7d73f41e57ff419c36e1aefebceb9ebacf8c05
SSDEEP 24576:EvkMcqKEYfj3OX7AhlR/8zkwjX1jZKmde1qRArqcesdd8:akzEYjW6Rk4GX1jkmdSp6
TLSH
T1D965AD03B29D41E8E06DD5B8CB564536EAB17C860B34A6DF0698B2492E37FE85F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe
Size 1.2MB
SHA256 2417d1d3107b3f173b51135c31c7597d58691206fc133dc9694604dda8297700
MD5 f9861a4fd9299797327fdfaf31e076df
SHA1 4214fd52461d311781881418ace8303d67004e53
SHA512 56042468c5b3bfe67a1b0eb4013510a2a80fa2ef5f00c9549ca9c5f4489df3aef66b2cf32a13bdd2d2367d029a228c43b82d747e0ec381b3ffd16a656e648c66
SSDEEP 24576:C41TyNFxouwXDykQM9XV2kvSriEHOfIGvvXiy:C4BgFxogkl9XVDvSrB63iy
TLSH
T1F945AE07B79840D9D069D578CB568632EAB27C420B24A6DF06D0F25A2F77EE85F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 248KB
SHA256 79880d387b0e60894098784baf88782ae07dd837599a7532a5118a868ce98059
MD5 fca7fe5defd3734218d8969754ead270
SHA1 78a37d8b41350ff21def0084915efb4784577bdc
SHA512 ba902063570995e6b681a4cf9653ff34f8ea6b3893a210b80eefa320a8080ce94869e11f4c42277623eed4db6d0924ea2ee232a5557ad45e3b147760f3a2d321
SSDEEP 6144:Ps9Un6OTDN4Rb+cFmR/Cuoh0Cyl+Pxxs82:Ps9S6YmNmRoTyIPxxs/
TLSH
T192446D6526F810E7E076D1B4CED19903F231F8B617218D7F4290426ADF63A50ADE7E3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 265KB
SHA256 1b639620299d5ee769841e9c4fc73ff0e93d5d12829203e7e8748a6ba8edc5c9
MD5 9df6d887f2bf36f873ec41c9f3a3f740
SHA1 01073d4df3cf11fac1f6f4cce8cb7c7f6fa47596
SHA512 40cb05f047a01edb700374c6221aff0d7c5904fcf032c156cffadacd0cdca4da6e496c02a115f908b5db5e4c5b136c6e21571b741012da841745e154783a9bd4
SSDEEP 6144:Js9NlbI/raWpBX+Ao9YWoht+uoZWyaalNJR:Js9NlbVk+9Ho3Hyaabb
TLSH
T127444A2A25F914E6D176C1B48FD08943F270F8B6A3108EFF429143599E13A916DBBE3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 610KB
SHA256 980d6f56a4b2ac3c4b1e4ecb4ed60e2325761bbdb4e7e6ea13c134006ca0ed46
MD5 47c281a8026969991be1d90534485de2
SHA1 f89d92e58a09e5d6fbdd694d166f016dd703ef8b
SHA512 8e2b474b46ce1d75382b09cbc26a178df1eceb26c60546508e1d3a3bf219ac76aa9794b5e88733b94295f54797cdbe06f256441bc819c9c693075f71fd79aa76
SSDEEP 12288:cs9Y2xx8/Kn/4AHVlZMSnSm89bdR15rLuTA:42xWSAu989b336M
TLSH
T1E9D4AE41F3E847E9E06AC138CA52C546EA717C960F60F6DF02A4527A2F376E55F3A321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
Size 7.2MB
SHA256 c2af7ddec2290e197e358c470830ee75ecece759319256153b5526a291e8bc87
MD5 b5f6e7199f2f96816719c2ff95eb4797
SHA1 cc9fd6569bebeb4a805b8e04560036249b0f4188
SHA512 13c6be7c04dbc99856816d12b562ff657237f1d97d5fb6e8a66c52a2c26ba5644cd1f2eb24f80aaffc66e0138b43435cb831e9b10862febf17168074a742d197
SSDEEP 98304:S6CZetahq+WZZ+pUwCsJB2++fGUOxRj2vJzRN+T6frW:dCZeta9GGIG/xVqzRdDW
TLSH
T1D2766C07E3E600A8E46ED974CF2A9521DA353C8E47B492EF169476E41A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe
Size 3.9MB
SHA256 8a90aa4d7f943b9c9da2eef67e7c59f716402903291f10642ffa752c9f98f7da
MD5 d4f9d9de3a7b549b71d050162a552de0
SHA1 20b6a42ffacba4e254820c5ba8c0388b3f3fd8f6
SHA512 0188bf7cbb0a58d65d50e07d91f507479a9a83e063c455fdb1e7af4537ff42fcdd240b8c3b4d98b55a0435d9b902b32aebdfcc3f730ddd08296138590e8c967d
SSDEEP 49152:LafjEtvz+MsHw8xkgebmhLbKqm006NPpIupESVu+e6NqcXToRzvUqIzYHBigdQBx:+EtqDQIFAmCCvNUhIUBbfQ
TLSH
T1BC165903F29900E8E05DD578CB568522EAB2BC850B35B2DF0650B7562E7BEE4AF3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.3MB
SHA256 0d311958bc19fc11838a20a5fa42ae8776c47d50358d7cbad5f3317d26338b16
MD5 8315c62ad4d5fe795f40e41f70e99cc7
SHA1 e28e99f9db635d3f3f5fb7c54312e3be7bdc75dc
SHA512 b4d9f3fa9c5603f8eb694318d222a8942a051a3649ca028d117cb603ca78eb177ff2f80b702f781a063fb0167397694607250d60656790b37402ebf787da9881
SSDEEP 49152:qLuc3fBlUMDZWWwE6xstBhuXjfS4LWxnhej:G3JMfjBDj
TLSH
T127B57C03F2D900E8E06AD178D7469533E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 1.6MB
SHA256 7dcbc1e54ce24b900a697ab4a55916b2f614023585aead8b7038278203d1a92f
MD5 6731cc33d6491dc18e915078fdb40144
SHA1 a07a412b42ac6354c777ececabafa1ece623828e
SHA512 13970bc62cb5312cc06a60514aa532a41a2ffa2a2ad8731c9444e2ee3fa8b54a179d60072904ed83af6876d3cf7c887c7399e0aa4ae882c3ba482387d2f43b78
SSDEEP 49152:wl0Y/88zTjsiQiLUYzsShP6TlXrk9dB2BG:85vbV6Oq8
TLSH
T194759D03F39900E8D06DD1B8C7568936EAB27C450B34A6EF0A90B6552E7BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.0MB
SHA256 9b52952415f55ca427da90d99e5a16dcc46108151b5837c9e99e086d999f3292
MD5 f8d0e1b1f2e212ed1c946be7d575923b
SHA1 b2c1b2d18a8419a2f17f4a8371c93c031853873a
SHA512 4b1ac9ba678addd7fcf07e81add33f66bcafd8d5c242b74bc476e8f81460686d70e97c3653a2ab2c86425bf5d4190b99b05ec1659255f1b30fcbae2f1baa25a2
SSDEEP 24576:86YIza6i4LLDVCLFujokixs7n/v7Bs7CtW7KSdHBxmRkkkkkkklQXBysWAn6PDnK:8izasL0kokixs7/vVZrSdHBAVfnQ9k
TLSH
T126958D03F6DA80E5E09DC2B8CB768B35DA717C554F20A6DF0680BA652E77AD04B3D394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 3.5MB
SHA256 8dc78b3a9636f1531e7aa759b67804b28f17dfcffc0688946c5f0b70f699c161
MD5 6bee7d728f1898f31d5f0232d95b174d
SHA1 d590c2550b42e32e6c800fc210c00c0935e6e303
SHA512 ef6b301e118b832fbd3ce2de7b30db16f1ac1513ddb949c457e32e420fe919f018f867f279db57c6ab71e2719f4d9b2558b7fc6506482f6088d4912489b0a300
SSDEEP 49152:6uhBuFklx6JGRTSUFfmOhto7b6YErjz4AkOuaRoBISCaQZCLlrr77+:TR7/sxOnZo+
TLSH
T1C8064903A29900D8D059D078CF4A9223EBA27C8D47F566EF3690B6D52A77EE47B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe
Size 1.7MB
SHA256 c4732d25a8928a0248e813bb38caf6a907f07264c64564c2aaa969447f0fc63b
MD5 4717aaa1965f787741978fdb5fdda191
SHA1 69ba639b536c4d435f8cc96d5394da206e765dfb
SHA512 85583d4c614a1aba12d69ca7e00a10a7cd68d91492fd31efff87779f3f553ad83bdb1ff0555b855f213f7007688a2ef4fbf16d74070bf75394c7684f07564214
SSDEEP 24576:G24KDA6BgIObCejguThiRAIM9MoM67b98eQuJXlPnyF4mfHU9YawsN5Zd3hpk:zAoA/WAIM2oM63ieHX04mfHI5Zxw
TLSH
T18E858C03F2D901E8E06DD2B8C7469532EAB27C450B34A6DF0691B6562F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Size 4.1MB
SHA256 20d306880624b09d811241799787bc56647be3f3e68cbd483e8317d188ce03ae
MD5 968cf29858e626f380f5333cb1bc52a5
SHA1 4103960334fd09a5b80fada2d457021edbd65941
SHA512 f4b669f9a2c59a5fda0d76bfe99587cd61b00489fa6a4b9427bd671bcca595fc3fcc9678ea4fe260a9de4aa2850198fcf4b8227bc0df1abe2a94ebb44e988d29
SSDEEP 49152:DuhPp4qlsOrvWm3SZ0Qm8Ni+TjENzExldDwUIDtaZHWRdpev2y/BaOXQupqZ:i9wGzKd+RaAOC
TLSH
T180165903B29940D8D049D074CE5AD233AB617C8947F162EF3690B7EA2A73AD47B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
Size 1.6MB
SHA256 e65d43e37e62dfc428ab0cbd508d71c2b88696e25b96f0d48165a0ffa735e391
MD5 0684a83703caa15477dd1e091447c0cf
SHA1 786344b58c8cf0c3bf5b31413e38c424dffc8b24
SHA512 3a9966a1013cf702fcec519945b35cd8ff8b4a79efda97693db72c91e6e6200371b043e626073aff413c85c6a3597c2b08bbacab85bc010f43732d45db75bc4e
SSDEEP 24576:DaM4R36lNcir8S3ibou4qfEutXxjtkWVL1oaedpEukUoygGmq/SxarsIj:DKR38+i4nEqfEqXVt9VBo7EukU1rrsG
TLSH
T101759D03F3D801E8E06DD1B8C7568536E9B27C450B24AAEF0A90B6592E77FE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 1.5MB
SHA256 632765a33b3eec3adf6eb2aefec4daedd9754c0307ae070d4e30e826dec3a1d8
MD5 8c22e90f9e166da4655c5350b08da3f1
SHA1 6e2a9a6d67b1a8a7a1779ce58aba47299227cf36
SHA512 802b15ea3ea171386402761a4fd2b6106c10be80401ca8d09fabcdd7960f094aed68183fadfea412d13e28575cedb2cb777dbdebe2cf061fbd05b3881992089d
SSDEEP 24576:1raEfa6vmxkvdSzMDuu3P9sdCyADJGsVa4i6h27d3WlmWxcMDYvt:cEfa8WIwO3P9sdCZln+6h27dtQnYt
TLSH
T1D6759D03F39940E8E05DD1B4CB56853AEAB27C450B24A6EF0B90B6552F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 329KB
SHA256 ab9fd942e395f10edf0684317f5d6a4ce03760afec674cc172d0fb37fbfffd8b
MD5 bab1a51f07d8811f7b7501575083c107
SHA1 d944d4d4ca216b98695cff9f27ebb54d3552fe2e
SHA512 6f942db3ce29b35780a93f5453c69f6021665543aca1e940dd8a1bf71abc423f7f7988818ef4486f2710865247543399233f8252ef76a18ba16ba4705748351f
SSDEEP 6144:vds97doqW/IK5Av4z/x1WlM2lRYgM/iJPsfUrcA5Fic:ls97doqW/V5AG/Z2lRs2czAKc
TLSH
T16B74AE2967D008F9ED67823CC8B28501E773B8554B60E79B03E486761F237D85E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 672KB
SHA256 a4c4443ef25b169b067679a50037c69baf91b71ff5d30de7aba238fc2262480c
MD5 9c0f1ef050e867627094f7c7e55addd8
SHA1 e18c887cffcfeec5135c4ff2e1a399d7203533c2
SHA512 cae7f6dfac4f216fd570319da5052909ea0a5595574277fbe6c7d1787d42ff1aea42004189d451df4447605e3ee1fa8611ae37bd5c0889ddaccac0ec361a4fc6
SSDEEP 12288:8QIy7VZPKUkhhG7eZUyPLs9LrHs0rL/e7uVT2cF:IWZPBkhhLPyrM0rLLT2y
TLSH
T105E43A16F6748731D073C0B9C5D2A69AED7230865B308ACB4286D77C3E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.1MB
SHA256 6379d062be3f3e3f86a7fc4de6398b9cf9b18aba14b27f955ae6d6b1f203f5f5
MD5 d20a52382ab144d31e99631354794d31
SHA1 f7a417d3d742fc87e9d07e8e055dc2024a3143f8
SHA512 fe92f3d86771bec6efa4ebf6699662a5bf1ff7fb9d192cddfe1bf168fe60307790359b749e4d7e8a632a5a0f217405a7c46ee8fbec001f477ba1b1a5059d6a78
SSDEEP 24576:EoUSezSC6v8labOqgrvW36q8wyuY+6Slom:uSezSC6v85PvyHjyj+F
TLSH
T136351A25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 840KB
SHA256 010e8cab097fe400aeac9f85d143f1a2f3abe78f171db510c0d85d128843b0a2
MD5 79231806acc9aa0af162b03bdff1a37b
SHA1 e49f39a2e4589a45cc84a19e70c884f28124fbf2
SHA512 47d4a44d9ba2a9e34be8070392787791d3fc53b793330ea85014ac6e5e5ff85696f41546dc588526ede2106c03b88ecca394f024baac30c3fd78b6aef03afaa6
SSDEEP 12288:x7EZBBd3vvBdKaf4sh8mwsED4WBehs9sf0Im98ATh2oonYJ1zl:x7OBRvPK/NBeFATh2oonkb
TLSH
T14C055B66F5748331D073C0BAC4D2AA9AEE3230425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 350KB
SHA256 6326eeb7e3f25c1ad82e630ea3f84326f2bcc544304a394d030e0e9f4be12e60
MD5 a456bd5288b357c7499b35231b9c1095
SHA1 f78f8bf452f99aa0c763ff791d05e0d9bac75c58
SHA512 f47be62b7679eeecfd628abf60c5986a9bd107ebd848aa50ed6041a5660a0f8f85124ffe1544eecb7f367ca2f3ead30b57f790870e9d9f627a735656ce47077c
SSDEEP 6144:mOJs9ABJ/GKWWBNU6ITLBi0qttclOKgU91B1E+tB+M7X+/VGk4v:rs9ReBNUbTVO86USVGk2
TLSH
T1A974397BEE28FCE2C27A4DB85791C600A77278704B51A3CBD165C20EDE235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.3MB
SHA256 d02f60bb86989cc2fc362b862b41dd1cbb8fae5a66f16ec50d7ceca951403fc5
MD5 b8bfdf5b0b6a38c00d40e85a37d795b3
SHA1 3fe25d715f05d2d702a18bc23009905d04a6c9ae
SHA512 8b81f2c2e454f0faba7cabdbd97d824501200d6823d38817697884cf500da7c3cd7a7d551b69d9cf5c54bb2e2b0f328c7a5f69535b1f620b92273818b39fc77f
SSDEEP 49152:5la0HRZCykH+tafqt5WHa3CUlmLFdQ3G6HMDi13KeumkTwvfc4fPJXjyh+8NRV3U:5llkHKWe0L78NJTy35CwM
TLSH
T121265B656BF880F5E0B7E178897A86B2F7B678520D31EB4F0191C62F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.3MB
SHA256 dd194fb9546810d0deac3abe0743b28594d983cc00e0d13573e964b385dac51e
MD5 cb5fd5e06acee1a0711a9dd493bf1534
SHA1 77fd550d0902ce1293876df31129ef32ffec7003
SHA512 26e776fd4ff851680481d52fb6895096d8191cbd551ee69e93f170e1937ed965b9611775bc2abc3e16af708f2934eeccfaabf9a23521f2d5de9aa2780e78c12c
SSDEEP 49152:EaCv9Puxj2yL5zJfFiV+XenmE3/zYb2Djj:YFe8Vjnmc
TLSH
T182B56C0976B8C2E4D1F6C77886A2C647F37178154B35ABEF4265460E2D33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.2MB
SHA256 661e16d1253c47dad60558b4f51c44bf54350ac659dc9071b2338676517a6c44
MD5 3a7e14c1a1c314bf0348105019eb3a76
SHA1 69fe18372228baa5b58a039df0145f94f5e45ffc
SHA512 21f8422c7643fc64aecaf63d42d9ff6b9484e3f9b0b955e9dc3640a00ab26ea728ee9200561c55935694f7b06b091ce4aa6fb157af83e652baa4f30f44fc4b84
SSDEEP 49152:+j2kfVZl8cL1sp3DJf5SUYLoDpgLjSTYlQcGeiAaLSF259ruMHwpXMi4FqJLd23T:WByRQyi36YOcPGLvw2gAf+PN3u/F
TLSH
T184666B03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 6649e1f23a9ec67d766ed59e505c14f4c374224d205e7356d83c1ec2a547f9a5
MD5 7bb16f7ed135000f36abb45d2ba00731
SHA1 50969883dc0c22538b9d95773ab64117614104a9
SHA512 5d104eff66f0f9953cb1e139d2ed96e6124487ce1f998ce10b5a8fcfc6545eb3a71d19794c5093a3f995fedf6e4a21372c0df5eecf754dd025119906041cf4ee
SSDEEP 24576:8WvDHpk/QGr+qdDboeVVe0ya7DaHGTNHu7PNU3/5W/ohL02So2JlKTT3:TpAQY7XeBaeWu7PNU3/c1lKf
TLSH
T175952733B2F200A9C44DE1769F4A873196D27C758FE0D3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 3.6MB
SHA256 8fd59547eabb1581258490c1b965071bf043ae18150150b2535a93d9bd246cfb
MD5 66ae2cc3f29af1af11db18456b5ab781
SHA1 0d709ec9da52924bf0921899981842a8a056d836
SHA512 cd0b7f2eb183fb3f5f17e9123d9c2346ac2a94e52b5e4a1554fcbd6b66ff68c63623adcbf046262a630f834c8a3ac0f33152f1c472438b271d28945464ac3cdd
SSDEEP 49152:zw7Z/0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbGN3Oh6tznm2FQ/nho2qkrk99F:Dy5112gYy5azzVvB69nLKnhZ2L
TLSH
T11A067B13F29900E8D05DD179878A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.4MB
SHA256 d6a7a59b10517474313617dff80e3053019ae46a4ef8693d988fbf2e2c6eaed1
MD5 4de51130cd21f164fa3bdd98fd80c233
SHA1 c25b24df4ddb70ba31a714f86b99aad6ef5e1217
SHA512 a8f61f04364dcb029ee7e660e6e397260e645b9159cd34fd57496b4a508ff33cfd53c52e6fbf9aed61c2e29ca7f724d809174dba99c30d9f323ffe7cf26a12f8
SSDEEP 49152:vIIbRZ5xXBQOBr4tEG70bqx0z+n217aau1glTHQbZB:jxJJmtxd2dTHQbZB
TLSH
T199C58D13F1D901E8D06ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 1.8MB
SHA256 68b67faa4f60b6fd0ad9b78e39e4187a6da2f4d5ddc3c3b16e3154c1f22a513c
MD5 6d41266568d1c1cb4c8f914f1e36c617
SHA1 5805ff2c4d1fef91c57cdbada507fed2e87e033b
SHA512 316bc602616f99068316a43f8f623931ca80992d699775072ed314654272723933058f2c32f2a3036aed34f58faf3f19268f84636de625ae1ffb5b990da70744
SSDEEP 24576:d8vOX8Ehnph+ofgrzIjSuCMBVCAopUQ1zNOgLLwH7ReaQXx3uEXaJ7c:dsEhnpsoyAVCAAU44CwH7R4xeH7c
TLSH
T178859D13F2D900E8D05ED178875A9632EA62BC460B24B6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.0MB
SHA256 fb49bebd074b37b32a5c907abf5eb54bd2f607a90c8b2b216d080c5161d9b0d5
MD5 664e72f4127df5b03d68696bd373424a
SHA1 8e1dbc255173267cfe0fa1c4b29a9b25b82adcac
SHA512 e5b84f6ee1c314b7c332c85a1a6f1932537b53e607d992f107a7210421f744bafb6ea1b4917eaf90eae8885b617e1010a1d800bf74807cf61c1a01577465afe3
SSDEEP 24576:NeBvtrZ0pOa9Q3V9ZAP72Pa/BlTHWxJR04FxGgVG2Onks6xt4bSMHnqu+x9q633l:q1uOUQlcBlT2/RVtOnks6NMHq9PcM
TLSH
T119A59E03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.2MB
SHA256 3bf4abc4b81404f437308717e13f9f4342bebef72c3b14bb340380845799a340
MD5 c5302e1a0443e15e0eb1d460998289d1
SHA1 dee2f996597df4f27d7a7007c1ec9f93154ce02f
SHA512 f2533c9a024acffa1f6390d89af5c303e2de0c4543dd84e25fde2503d3e4ae1c8bcb97d6ac59918b6cda93a2eccb4f7a5ead7665bbf03bce0f493446fe93fb33
SSDEEP 49152:0evBKH69zx5jLAE3dGGj8bAEGcjesaNkYQd0XNJKcvaAcPTY6Y5A89C1:NNVvjnBDlZZQ1
TLSH
T160F59D13F2D940D9D059D078874A9232EA72BC494B3166DF0690BB562FBBFE06B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 ed77437d77f1b65cb30faf250f3da9d9e81a8ead13ee0947a8f6552b16b07dd4
MD5 6e6c4e1bda61a885576c9fd04ad8b9ef
SHA1 79f5dcb1402b67164ffdc9ee5bf5151fbe57d507
SHA512 66de0a2ae1cd6d1eccbf57cc3067f5aec0ebee643694d5702df8a6d1195b3459e392719016dd3fe0a2040d4d580a579e9c1c4a7630225d6072063243f3e8a00b
SSDEEP 24576:3BtvhUbJ+nUfE76nWtxyUg3FcYsi3iy9CTn0AP5+2QLQ1WXiZS:3Vw+UfE7oBFcZgiDn0AP5wc1Wy4
TLSH
T177759E13F2D941E8D05ED174C7468632EA72BC160B24A6EF0A50B6562F7BBE46F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 333KB
SHA256 5029f783087d924c92877b91dd6810b3bff00dc23a3b4e3ab30d32bc58aa06e4
MD5 e36d0a8425b7c71a0349b25765c2734b
SHA1 a5ea4775ea1d5c5120b8bb3666b8eec69a5e3fad
SHA512 5cb5f9347ccdf940aa37a295955b51905b296045055edfd39adc3d44c0d1094c7b48a6792cade0bb185b0f9e6a5ec60f1856357f59e0819767c3a2010308b933
SSDEEP 6144:ZuPIP/s9J5j77njyZ5HTTPDhp1YV/PvyzMOjrhZhkO:ZqIP/s9J5n7n4dzcPvyzHj2O
TLSH
T12D74BFA5B3901CF8ED67423EC9559906D6B2BC4A0B60C61F13F4362A5F333911D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 333KB
SHA256 afe9f7da391ec1aeb1b13bca73b1a3db727ad1de2d87d099378f83d8f7566cbc
MD5 6da32255848498b062935e8033850b37
SHA1 819f082a90feae82c957668be5dd26119e9510ae
SHA512 10acd8d528a1afc94b7f9b8de86fa9a19d84c218499e17b84bb513800b13667fa5a3b881778b0e19bfc2a6486a3d853e05f8526bb869012638528a9fcaa56072
SSDEEP 6144:i1Qzvs9jIujWgpzsmsR2PyZ2z+YutYPDvhgIv:i2zvs9jIujW0zs/0P/z+4PDvhgIv
TLSH
T1F274BFA4B35058F8EC67413ECD558906D6B27C5A0BB0C65F13A4366B5F333A11C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 540KB
SHA256 4d63a0d2f58ebfd8d24fd7321b091fe81ac517a48e08859e829149450f6bf378
MD5 46c212b8aa47a8d524948e101f6e5324
SHA1 ca72c21cb93d1de3e13a55b6cde2fa9da0cceac0
SHA512 154a5c7c3f588e8f2370848a5ed68440ede7835f5b974083e6b4f8ba1e56b393b1dca828029659408f087bba3fa4de6f4010330e2565faebc7547e55f1b13f4b
SSDEEP 12288:QKiZMms9ZoWhGW/hiZnESYRLbbdIv3BoaJlGZk:QxpWhGhZnESYRZgJlGZk
TLSH
T1B3C47C90F3E414E8F1B78A358D768511DA767C9A1B31CE8F02A8665A1F336D18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
Size 333KB
SHA256 096722b07857dd8b710d7a555bb25ea043c7cedf80c70c080fe436e44a2f05f6
MD5 907565fefa82a324f6c18ef0e183473f
SHA1 cc6f463155cfc93a3f8519e004bd40425a051163
SHA512 e6ec8f9a2634dceeeb127dc95471dfd123ee85da07f0d1b53b8061aec06a989d85e46a38a8332f98f2e662752b2ecb3caeba6bd13c7450694eed33109eb01aec
SSDEEP 6144:CBPr6Ns9o7OT7pjhFLF9C+pYCYV/Pvy11PNwgbz:C5r6Ns9o7A7paSncPvy1tz
TLSH
T11B74BEA5B3900CF4EC67853ECD694905C6B27C5A4B60C65F07B4322A9F733911D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
Size 142KB
SHA256 5d4c4ed39c6629f935afac8abaabb35affc70f4e1c9c345bbabe038e576d2f3f
MD5 be75016204cc3d54b29c6d36808507a9
SHA1 40d4cb5566d380ed9bc4c8fcc63adb5fb60440c9
SHA512 3addbf39db47b789ba0bca4b2d03b0ff169d552725141b6cc76ad45dc6a08115f68db786b35f6b9f0eb17267ee73d68c9938ef254f907a07bbb15ea4b6625a5b
SSDEEP 1536:1vXuhi3ugTXjMjl+5Fs8h8Zs8h8o4On+uvVK7qjh3rmKPNbj7uPxP9Is9qeUktOL:QU39EjlXEo43udtjZqMNbjuxqOqDT1
TLSH
T142E37CA0B3D82884F5379F7298B889215CBB7DA94DB1CD1E1395724D0A723E48479F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
Size 333KB
SHA256 9a211578eb98a7138b73779b4ee3eb4975b130d5aa2f5e9371bbdc66bb13c004
MD5 de947a7b36e8667d63f0b6d1dd5723bd
SHA1 311d3849a581e0d587bc35c33e979dbe1265c156
SHA512 3646257455637da77ebb3addfe88d0bb403a5e759a26effced6c25a810022a521921f78a779a820752a44b2d11b10cfbad9d9fac4faf8585fe18e82ee6057a8c
SSDEEP 6144:PnA8gs9QSnJ6ZhavMsmOe/YEzGYutYPDvhfKXBghszieb97ORzhgiE6PBhPEfLV:PA8gs9QSnJ6favhpetzG4PDvhO5HJ8tU
TLSH
T16374BFA4B3605CF9DD67423EC9598D12D6B2BC5A0B60CA9F03F932565F733900C2EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
Size 540KB
SHA256 e7f69c8bb53cb608e34e057f968ada36d1ddca8e192cbd7f904a5c56df13af10
MD5 b6a5d821966eee4387e863ba166bde30
SHA1 a668adb734f090c2d0fa61e06e9440297518e16f
SHA512 bf2d04085ce71a3cb00c3d66d1ce7aa6073c70889c812da4fd99502cf283ceff31afebf223f22298028544033fa368be982c11a4646e6f686c0b326d1a595efa
SSDEEP 12288:WBIocbs9DmepaYRi85E/WzLbbdIvo5HlPS3:W6zep285E/WzZt5Ha
TLSH
T1BBC47C90F3E414E8F0B79A358D764511CA767C9A1B61DE8F02A8265A1F337D18E39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
Size 195KB
SHA256 8ae83e05ccb0f4d0e27f89dbae5529505691999ca7270bdf539cfbec3fd8bdc3
MD5 681b8bedb5a71551367febc05855fa3b
SHA1 e1c676f8786873aca32eee90f3508c78d04ff538
SHA512 d66cb3d4c0f73e389a29026fcafb551c5e29e8e43825911dae7bd4b2dfee61175526a5bc6253f88418a5802dea63db7583d4d0a5269a6fa16eb94795a4c62624
SSDEEP 3072:tzUtxAt44Sdn/RU39vY5DEmd/MjgvhagI/f1OFOPqxkHlaSj:t34T/Rs9g5DEmdggIn1UGF1
TLSH
T1EB148C4033E81498E473DA3988A14545F6B67E521B62DFEF9385215B0E3A7D0AE3CF36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
Size 138KB
SHA256 0d26f98f833223da5797a8a453ac66194a2ebe8b476cb8c76ead279cea9cfd1c
MD5 c66badf4a8c21a965ce22e465b325d1d
SHA1 ff435121da7154a5b380883ac672c4814f7fbc0e
SHA512 e2c9973c72c6d7c6124bce60d78b5ba1973e7fde7d8b36d726223a6a27c6960bd1760524166935f3dc9222039bccde12547234639cad51287fc6afe355d5a825
SSDEEP 3072:JsQb8VU39T28vJEisdBziuxRB3+KhWlkjNxIsUj:iQYVs9a8qdBv3tLUj
TLSH
T122D36C02A3FC1894F1739F74A8B840119B3ABD521A21EF9E5384514E4E79ED1EE39F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jre-1.8\bin\java.exe
Size 333KB
SHA256 81eb3f1ad977533f517189029618d2631a6115a9ad59f778b67b93915ffc8e92
MD5 881cfbd6f97bdb060bcc2c7bf5c9f0ab
SHA1 dda07a28fde69c4e6a1ec695d688e0bedb37ccde
SHA512 42f023c39247df0a22ebf75db65ffe085b3ceb14ab041604e75fc9088c757a73008a1f70a3c4a9ee2b2d5f6790986fd4f7300c0e2070d30b3124061accd0cb85
SSDEEP 6144:DHPcrEs90g/FRhGjNsoNXe7oDAYV/PvyKpnhVD3StLfZZmoTK:DvcrEs90g9RgIMccPvy8r
TLSH
T1F474AEA5B3901CF9EC67423EC8658915C6B2BC550BA0C65F03B8366A5F733911C3EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
Size 142KB
SHA256 5a2a6d63100b2d5c54294e7d1cb9e3aa5e1366ea5419cc067d80847a9415fee7
MD5 a04f244ce800a7d60b659e0bdba682c6
SHA1 acc2d05de01048282a8092a6f5c2c77265b56d3f
SHA512 eca798f9e9834d9de07a07f58a868e8219b91e45cd197bf003cf18cd363ffd512fe08d2af96223b737097034409e1bc59918d6d9beac66ca4634c696323622c9
SSDEEP 3072:NU39EjlXEo43udtjZqMNbWwx2pcqHnzIfl4Rs4Ixnea:Ns9clw6vvWuinstpnT
TLSH
T126E38CA1B3E86885F673CE729CB99D3058777C9D9EB0DD0E2294310D0A767E04478F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
Size 333KB
SHA256 168229571a221ddfe63372bcede12297a3e967376a81585df1c836411de6a1c6
MD5 7fa68073af87562949f0773081703a2c
SHA1 e1fc739dcd57999d1e931046248cf96d3137633b
SHA512 2755c52359cdd57cc126d5999fd2b5e7b0d930ab2e6c7b2c06a2a55e219f98ef9496b72da6b7f461f07cb01b1bd3f10ece5e593eed14a569ba4692fb07ab2b6a
SSDEEP 6144:FMv/Rs9Ky5+FJr2cgsHxGkNNzbYutYPDvhP6M5tDy9a:FC/Rs9Ky5+FF2c9RG2zb4PDvhSML
TLSH
T10974BF65B3905CF8EC67823ECC158916D6B27C5A07A0C65F03B8366A5F373901D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
Size 540KB
SHA256 976f962a04a8aa09ddac77660683c9695b145d2e6acec6ce22b59518b263519d
MD5 bb0b09af6eca246420e8be6aa07141ed
SHA1 35eefe2f2acd81f820b6e8d5ed0688dfa668aa01
SHA512 8c6dc82c52d41c19f93268a0ee0126a9ace396ffe3b2a1c44e6aeccddba96e6b2e4608d07f93a067845160f8fa4346d8478d4fcc44cdd9c35244bb7173f24e9d
SSDEEP 12288:fUCDXqs9yVb9d87yWgDwYnLbbdIvWP9D3fYH:fP4b9zWgDwYnZNf+
TLSH
T10EC47C90F3E414E4F1B39A35CD764511DAB67C9A1B21CE8F02A8665A1F33AD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
Size 195KB
SHA256 e01229de50dd17dc0d1008cba43e9c732e07b03372e714a5333f11f8899fb305
MD5 5aee45cc28de8f78e72dd600d577fb9b
SHA1 d38f5cbfc8a450e3e93d7dfea63e26cd89fc4687
SHA512 08f4bb56c4865d4295df938d4fa1d20ddeba42be8bbb8eeeb470109f370f2486f55755d569ea3719fcab56839af0623f181ddd85287c20a8655d430a45fd51ff
SSDEEP 3072:sw7HxotccOXdWU39vY5DEmd/MjgvhagI/f1OFOCJGxG9bR3VXhErdtZwk:sbcVNWs9g5DEmdggIn1Unh9V3sVB
TLSH
T161147C0073E41098F5739A3989A08501E7B6BE561B61EFEF5394215A0F3A7E1AE3CF35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
Size 138KB
SHA256 3c97ead6fd76136060ea96dc3c4207648f287afb22a4e50dbfb90e1befcb1d9b
MD5 dc5094d91457143442de71f535e75e17
SHA1 d83340ad4ca9c7c702fc6292e5a5b2718a71d2f9
SHA512 2eb58bd7993c8bb91a41d232017d00ebd028f44479209f4e011bd0581c092679c75f5ec0d8d2c2dc774f647daff3974c075b1cd57cff11a4f96b37581d4ab0f3
SSDEEP 3072:PUQb8oU39T28vJEisdBzYMsxwlHeS1EVOd6esBzm:sQYos9a8qdBphz
TLSH
T125D37B5163F808A9F1739F76ACB444158B3AFE525921EF6E9240810E0E75BD1EE38F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
Size 4.3MB
SHA256 cb9c22a3e00bbc1b142ce5bc8f6d1be391e0a910be325a257251215295340507
MD5 c7bde634bd9d11cb052428f0fc65884e
SHA1 38fa9ae5b52804b8288610f939d2a0ff4448ce2e
SHA512 cd74f8e7a5f4112627f12a89c83d59c3b3a1c48ab16408ee91b867d24decd63fb6c847651f551070b64e61502ac75f277ace61d50a9854131396b4fc808a7548
SSDEEP 49152:H7Zv8y3hVhyWllRrYpBotGgc7L0dE05oofhnL3Reur3DudT+w6ZojGCqW8NRV3T0:H7fVJApQ8L61LoaCs5ClDR
TLSH
T140265B556BF880F5E0A7E178897ACAB2F7B678420D31EB5F0191C62F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeClickToRun.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
Size 4.3MB
SHA256 3d6f444821bcb196bef2ae3af4c320514bcd427f1d37401ad0cf8630af82efbc
MD5 4b3d1e26579a70213b87427a03512b99
SHA1 5c7a66de40ee0f8b80639422f32ab5558706402f
SHA512 2029e37299f59c93b42b15ec2e5753c7c126081e3713636b74ca7e9f02a907aa28f9c1615b67a392a91b9fc9f1e44005d32b5cc267689dd7a1e05524ea994561
SSDEEP 49152:kkmx16jDJnwhGHqGvDCa0aDNj6LVdTu/4yjxMr3seuAw9YrKueXHeSeDx8NRV3T/:kk7JVHCWWLY7JHnem5CceA
TLSH
T112265B656BF880F5E0A7E178897AC6B2F7B678420D31EB4F0191C62F2F336905D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVDllSurrogate64.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe
Size 275KB
SHA256 86d17ce95c9e4f684c168f61947b1e1a70c50043d712636838be57239c56709d
MD5 1a2ae9d55bddaf157492e10ac5807f88
SHA1 41e68ff3ef0a08b1430ab32e0fb6ac796902be45
SHA512 15a0c0d4faf7848d3bc95598f7af8b563c64b1afe10ab49ddda8bf7f2aa9accc08d108eb35ec611324415d4d699a5be20901908229069f5da2547e0732c03805
SSDEEP 6144:3ez97R1s9zWGNTNYdMzATVkQNUO7q5shb2Z3WgLe:OzxXs9aGNTCWsTGQ4yZ2ZGN
TLSH
T10754397BDD38F8D1C27E9CB867A0CB00AB3265714B42638BE175C26DCD136E15E69C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVLP.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
Size 588KB
SHA256 363018bd6f4962326e8aa474dec479549badb847a75b9e12c4f667a90c70f45d
MD5 e1ffbc99ff2b583918b739a4bed2ec5b
SHA1 f31a948b85046d43bbedadbfcb30de30d6fa9ac4
SHA512 ceef30ad34fadeadcd1ee730e866efbf302f94c2ababc5d787d3735fea108b21dd838ec04718e48b2eda53d2a7b3c246c34464fba25ea59bf497aec366444423
SSDEEP 12288:+jU24b9Js9RjluzvNU4TEYicvH7XH9vkV:H24RNq/cjXGV
TLSH
T1BDD47D76EE28D8E1C27B89789696C600E6727C110B61DBCBF16CD27D1E236D05E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Integrator.exe

Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
Size 6.8MB
SHA256 b79aa2d7534153bf3661e72a88870a52ffa695490400e8155c68a8d58105eed4
MD5 f9c35c2c94058dd86c36edaf0d093c1f
SHA1 08b8635b957f64a29e40a61b0a30b76765966dc6
SHA512 7ff13a10c307a9e7c06ee9a38de49cc4625bbe7a04c743c3c9e4fda35cfcc0743f132826f8806cea6704c3668a597ed61b962b08bf43db1b4124ef63cefacd4e
SSDEEP 98304:LHqWyF0VC4SHxOFB1GWThrrmqJjeb2RHt:LHzyqvSHxIUWT5SzmHt
TLSH
T1776629596AB481ECE0ABD1748D778772F67678428E33661B0271CA1F2F33E588D19732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Mashup.Container.Loader.exe

Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe
Size 100KB
SHA256 30e3c2dd207a3aad3b19218a277fe9ab31770e391cc7f5b3bce1b8a902a937ca
MD5 928334670f3d54c28391439ba323019d
SHA1 758afd9cb0c0fb608228ca36d199b5c162bc4b14
SHA512 e8d20e99da326ca4feb8dde17a0dda545aebdb700f8f2c4628bd622aeda3bcda86142719238eb61f80bdde1658897f4f2d90f500eb0bda7e934e6e3d2d8ccfbb
SSDEEP 1536:0KFfvXuhi3ugTXj0/eAMpldERVkofnQug1uNpiAkLpXeFtX2R7SCw:0kOU39eeAcILvg1ubLk5eFtX2R7dw
TLSH
T1EDA3AF05EBC805C8DA5112F3664DCAC963F2BE900F22E79F8295936F1F327C1ADB9516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IEContentService.exe

Path C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe
Size 449KB
SHA256 d2f2ddbaa6a02c1d22bed91b2ab43d348d7b154305be2ca90ecf7b85e22e77b4
MD5 fd514fcdba60e7cff9f0cd34e40efcfa
SHA1 93a6e6bf38e0bf3acb768b8bfd62de6f9b2a4ac0
SHA512 33f87957ef99c02d4a1633ec0f91430110ef6ca6a032ed67ac520edc536060d79bc6ce22ce2d919a8954d663d7eda441e74b519506622af163a2b263c2bc3606
SSDEEP 6144:6YX7JW7yxWmkugj2LkaVde+XC5Bes95soC5jfcbvnmwVFwelz/pEbNZ:NX73xWmJgie+y3es9URfM3NpWNZ
TLSH
T176A48D4AEBA054F5E657E238C57BC571F7B2B8890A20674B56A5C61F3F33A507E2C320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerfBoost.exe

Path C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe
Size 877KB
SHA256 1e47d64a08701d0593ccde8050701306162a7f5be714daecbfd2bf6da77c5bb6
MD5 444118e284c56c809826b5479687821b
SHA1 a2da62da218180d2bdd986eb4907bb500a07d7d8
SHA512 e12b644df44c7765788557cd3af482aaec0dbb985570f5bcfbcc791086ad67ed77874acaca548bbf23da4fbfa14f8cf357fbcfecb8f6ff8c3c244577b78b5836
SSDEEP 12288:1+zhCnN5yDX6Hws9K2Ad2GLaYILTW5vpEeZob4UnV5BMw9d1Y/:8zhCnN5yDX6a2QXQTIpEKdUnHBt9C
TLSH
T1CE153995ABF845E9F1B3A67499768575FAB2BC521D30D31F02A0C21F1F37A808D25B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDXHelper.exe

Path C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe
Size 189KB
SHA256 e9a660be95c02a5ad548c44125de69d92da38ad65ebe53f791bb9d5dc2c4917e
MD5 84a387b1987574bd83e24c1e3f8ac1e5
SHA1 058dd7d4a181183b57635ababae7022cead8e0ab
SHA512 cdc9515bbc6f211d243555b00e7a5af47e0235b4914fe385c718487226261809e2f97eac38e5bf82ffd46c44835e73df35c72acc49462b8f20be4c65e0fcb2ae
SSDEEP 3072:TiwSCdp/Nq/DEU395k1Q2+zT6lZdAh3SJxfFrgrwH61VO+usPN0Rvo8LaMW:TSqVNq/DEs959elZdGaFkrxP0Rvo8W1
TLSH
T18D148D127BD4E0EAE5529234D5A99671F7B7F6B21E20632F1367C20E0F23392BE14716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoadfsb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe
Size 2.0MB
SHA256 e1ee45edd27b20d7257b2b045643542827ee03106804b746a496fc2f38f13b63
MD5 8f82741f05c403094e327116a4a20722
SHA1 be0d1ba8b7a9a2ca4ec1a9daf055abad5dc578eb
SHA512 b8bb3f72fc8054f3d5336b71e75c3cdbf169a503f8a517e93e1c621a0f8cf83ac6446b34c25c6641ba8e1634cce6fbe6a51ea967b1e160aa13c650a42ef9c078
SSDEEP 24576:iV+P4UH3J0sxQ7mmtLD33RDdZC/NSkTFfjsTV3KuaR010dFT7bK7+6mlvKpEW:iw32sm75LD33RZk/943K701GFT7bhlA
TLSH
T1F4A52946ABE8C4E5E2ABE2789975C9B5F6F2B8510D31974F2156C70F1F336604E38322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoasb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoasb.exe
Size 341KB
SHA256 e16d628e13f3b1079634e08ee39fe97a3c53ae8fd9cddeb2e19306cb6fd08722
MD5 1e00407c78e64b0b54c7c05eb5915150
SHA1 944532c96bcf07a0d697ae5fa490ebea2250d6c6
SHA512 5b57d8514d33069e65400253d9d327f8679583799ab9cc01ac4dc2cef9f6a694c03e4c696e261f7eaf23b70904a16efef4b4048cb1cff4bd52faef2a8e1efbb1
SSDEEP 6144:baHNVs9ClNUzRPRZx8IxaspQPWBYO9bhvRx9EiOwZexhNHPfZawe1i:bars9CGRPRZSIxaspHYO9bhvTmw4dZa+
TLSH
T110744A577BA48CE2D917A1788986D2B5F7B2F8615F21C30F2962C31F2F37261AD28711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoia.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoia.exe
Size 6.0MB
SHA256 1af0b28e183fed348472d9618420a378ead2b2d89e2c93444cfc49a8e52a373f
MD5 262a7f865557373be6e29cc55ea2bb3e
SHA1 2edeba955f4f9963f9cc59abc713d471a8d60277
SHA512 fc899ea8475cd1e16903a2887e022710dd8d1ae64ecefced701cd6560c028feeefcf8e1520c51a353d4fb0df6ebb3d880a74a7dbc496164d2dce44bc774750d1
SSDEEP 49152:aJ+KzPIPdAf9cfrppOtdxQx01JY3VNmvHeE7gZsTrYEDAwt9QwK293+XQK+P5jGx:aRBHNh79aw5KZCLw21makh
TLSH
T1BA564A557BF882E4E1B7D134CA7286B6FAB2B8555D31A74F0561C31E1F33A909E28332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

officeappguardwin32.exe

Path C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe
Size 596KB
SHA256 5aa89e850058819bcb0384de84c6b5402856db83f817e6413ffc8478549e2c8d
MD5 76169fb02c2b64320a29628d6aca0bef
SHA1 d3f3a08ab341f0c1456acdbbc2732e0d0b124790
SHA512 194d5d0e7da8483680d7c6f4d5713d0b2d8713259ac7e7f01cf723e8bfa529818e1b34743aac0187a42bee50df06c4c436854dfd50f23d1fd34658d911558bc9
SSDEEP 12288:vxbtBzFjgy1vtSgpLks9wcIPr0lypFpxtp:vxbnzFnzL5cAlcdtp
TLSH
T176D44A41F7A881E2E566A1388A6685B0FA77BC170F70D70B7559F32E2F33640AD29731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocolhandler.exe

Path C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe
Size 6.4MB
SHA256 e0a3de7fcf36a33fd1c3a0700485d35c31ab7723c23a4dd64ee2d29cea0fce81
MD5 c2cbde245cbe0717188f3e18e5eb1061
SHA1 14330f49c158a4dd35ef9b8536067e8d6a745a4a
SHA512 f20300cc78442f7f63cbde2d8a9382c28b719ddb490a4db2b69ee57a092012576736f7e489bd632ab0975a4d17652a68b59d9146126572c4dfe3e268bd611edd
SSDEEP 49152:JJm8dqGQWcSLxBKBNo14jjOmRwAvrSfl43zFjzCfhFpOpcrZDlaXiFFkNunC4Vxs:f6ISFoOMCiFXwABzHjHU5p
TLSH
T1F2666B417BF880F4E1B7E2788A3A9675FAB278425E31AB4F0151CA1F6F776508D29331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OLicenseHeartbeat.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe
Size 2.0MB
SHA256 53fd34dd79ebaf74344da2722e8072dbb15bb3ca2b047a00e66b7500ed06f03d
MD5 0a1357cb28c0cbc7e68baf9ceeb8a94c
SHA1 a8e96ea2a72816cf7014e5e09ead4f11d811e1cb
SHA512 a5f65938db64ac9ba7642d1f164480fc39f258daa9b1102fda376a2835ebdbabf2a653e82d4d0d03748024009cfec779184418a3c1bc248859b0fbd8bd0afbfa
SSDEEP 49152:eK4yG34x3d2lJc9Q6LdA33ANYrU98xjqrAb:O4pM
TLSH
T1F9A527516BE881E5F5BBE7B89AB68979F9727C521C30E61F0146C60E1E33B408D39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLDumper.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe
Size 222KB
SHA256 d77bbc0ebfb268f1ac013f5156914a2ee1305f776df994324da8b0dcfca144fe
MD5 667db4abc59e59aef89044ca03fa909e
SHA1 65cd4f5b44781227df93e190d3c8ed7561a5d4df
SHA512 ee497fd0e38c12b2c8571caa76e77d4f26d0e7e50663b3c3b0eacd70c2b78bcb2371ace50d925d39f1458b1b23223960b62a62b2215c871f50f585946cde3862
SSDEEP 3072:XFjRmzpect8U39aaj4+qrSVzN2Bmt+hlIQbwXf6tFUtE5e:XFjRApBGs9aaj4dizf2wXf6tFUtj
TLSH
T122245A5067FA1058F5B3AA709EB68253AA77B8956B30D7DF0118825E2F33BD0CD34726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohub32.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe
Size 2.0MB
SHA256 67a067c13f15c728d4760aceeabb07c6204c0b6116d1b42979ae45c4a6e87dad
MD5 64f41b8e78053b55b79dde189496bb57
SHA1 004184610df556292f2ac23b987f08c4854ad87b
SHA512 0873cdd7b21f86ee1eb9d768c7c8a5462e4f8101ee16763e722e8d67df80ec17ce403ab19a9b17c82bf57767c6231dee359ad240072c4673ce04fc484c4b9fb5
SSDEEP 24576:Q88Sh2FjSYGgRHassBEAOjXJDM52A2NBH3NRLOPGxMFVwQPUvTNnEb4FgwPqe0Pl:Q88Sh2jAMmp4ULOH+MYu8m1/p9EB
TLSH
T1FDA55986BBA484B0D526A17189A6867CF7727882C9334F47318DDEDEBFE32604D59331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreporter.exe

Path C:\Program Files\Mozilla Firefox\crashreporter.exe
Size 3.5MB
SHA256 5e38d31e7a330388d6c7e5b0ad92bda6af39822bdc9531aed55cf95984508ae4
MD5 4e73cf6514df28fd21481d676485b9ef
SHA1 d8949d0a2731daad2ac846cd9268234c2d2bd4bd
SHA512 5dcabd2b93ef05a6d23f1712f3e8b5601c6a376ef9abf046f79c44eda2ba03758f48b6929695624dfb8a3bb3dc66dccb12828458a746b20a05c35e838621b9c3
SSDEEP 49152:+EzmQY2RzHCm5UNW7O28wsz3iDT4JmeDNB05FQz/7TmXLhm6kV9xb:+ESIHONt2Jg9f05FynaLhm6Ab
TLSH
T1FA061842EB611DDAC025C0B482266723B761FDBD073036F74A906735AD68EE01FF9B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox.exe

Path C:\Program Files\Mozilla Firefox\firefox.exe
Size 777KB
SHA256 e3b44307cc507ff74a0d594e07710aa88d71a18c1ba6b7ae26e42cb18a3556b0
MD5 45a8a9a9a6ef8eecd3e72345ac4184cf
SHA1 422f4f63f9901b9b06137d833ec9c7603e476d9d
SHA512 f94afc674c029ccfe54cbc5f11ed8cb68f2e8973b0b377d93a21ac8f8688ae112c18c0ad06fcca9a5d73341e8ce11423dd75e623a49ce7a83df53114869a601e
SSDEEP 24576:6HWGO7CEdvebAxN4SwpemIwpelzEbXaqpTMfNovFzoo7:GWGO7HdvebAxN4ZpeapelevqO
TLSH
T18005BF03F38516B8E48AD578DA42D233A5723C840B51A1DB1BF93F2A3D31AD16B7976C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
Size 329KB
SHA256 eca5ea4eb1b09e465587b34e809fe3cd4d2a7707aabca24f2a08325fc4e15c38
MD5 c63493e669cc026a78cb72a1ecbe11ac
SHA1 0dcb35d6316ba33782d1ea263463f36fee76e237
SHA512 00cad890515e058a6a16db945a3d7bc2f3a53d34543306557ab071edfdf8c8401d9b9e2967767f01ae9f3c383aeb60a6e78fd415df45aec661082bd5e0a635e9
SSDEEP 6144:DmXs9SG1coIS+538zj0Y1nK52lRBzU/iJPsfUrcAMac9G5Lai:KXs9SG1coIb5MH0P2lRq2czAMac9G5ei
TLSH
T1E074AE2577E408F9ED67827CC8A28516EA73B8510760E7DB03F4866A1F233D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nmhproxy.exe

Path C:\Program Files\Mozilla Firefox\nmhproxy.exe
Size 654KB
SHA256 9e230d66ecbfe4d45d7d43b478738e8fb82b48f60bb0b58e587b2a8ba594b7a5
MD5 783225254eb3920c787d7a66605744d3
SHA1 254e2c6835924f1b1cb16a8aab0937d8ebe08c4e
SHA512 4b3bac5ec806279c0d427feb28e7be33379c48528ed185dd56f3a61b9b3930fd560eae97982285dea6d7ad971d4aa119df22983d8fda90486d8b69a198227b04
SSDEEP 12288:QFpt9k8HoradqhiwFYy/Rs9EZc/waheNLj/YOiVNHFzJkrS:sptKaoKq07UHLj/Yl
TLSH
T123E47D12FA97D4ADD51EC474864B85327933B4CD0B31AAFB23989A353E59AE12F3C704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pingsender.exe

Path C:\Program Files\Mozilla Firefox\pingsender.exe
Size 126KB
SHA256 6f793e97f3296e1f1f71f42c6956f3ea672be45aa1329e174344daa632645127
MD5 fec865b81c5868d39527510c363d86ee
SHA1 48403ab16e72881f951b86c2696d84c22878be7c
SHA512 a618365e1698587f8caa03b43bb05ac58f536da2414c80d4703d61bcbcebc0102bcbf353011cadbad0525f9845d71d8f64d7e8a055021f5689c4688f7fcf17e2
SSDEEP 3072:PXz3qjkU3919Sh2SdWAuxHucn/2vb5ldsu0rmg:jqjks91YFdsO02vb5ldsu0B
TLSH
T1CEC3AE0B9608549AC552C3B0F4F76853E32536248BAA27DFA3B953013F25BD01FBA3E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plugin-container.exe

Path C:\Program Files\Mozilla Firefox\plugin-container.exe
Size 202KB
SHA256 67d567a789207dbfe73f67d611c681549e17d419c429e7207ac936c8bd1a7f2f
MD5 ca5b55cfaab8716a952460f38541e77f
SHA1 8b23895659e76e20fcce7ea122dba4355564e54e
SHA512 950ba9a4614a24e993f35c0397353554ce7637cac012777cb6d7fd61305414c258410350f8219088e1301e471ac73c037339b5fe8a203456cacdfad01884441b
SSDEEP 3072:qSkEqz8ZU39moHeWYc9woEbaPu06jJqUdCedcsnN71jQ2uQnYubIU7ce:qSkEqz8Zs9D+WYQwEuDwUEGcsnBjbae
TLSH
T19714CE03F74D41F9E489D57D57C29132A7B0728A0B21A3DF22995A202F62FE47F3D2A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.exe

Path C:\Program Files\Mozilla Firefox\updater.exe
Size 523KB
SHA256 5ec96842c04c754794559cdeaf6e4f716f95a3b4b1f4c04566ec469d9b4e6a94
MD5 7acaa1d7a9533ad70574bae3dca5e081
SHA1 790bedecfb15b8b57c9eb5c28615db9e80d967ac
SHA512 83e2e19f1c7dd22bdfda816028c5a9c50fb5f1351769be47a84b216621697ac5097499ca3706fb646854dc91cfe4a98488cfc0b36a25f8cb2d1074bd96aeaf46
SSDEEP 12288:dtxNnlRs9u3t+rKMX5bEZd52ZeSYSOJAdGyyo1:d7NnlF3t+FaHTJ+Rya
TLSH
T127B4BF29F3900DF8F82AE274C9568511EA73FC55075097EB22E8D6662F332D45A3FB90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 188KB
SHA256 b74c576e65647dadd5d9b35d77f5f133fb4c579814ad8d8b60a9334224766794
MD5 e255ea9354aedd092d9639c876086689
SHA1 ee114f8fc4596cbd086a84d51ad2708a908e972a
SHA512 80f36f7b7589b8a69b299908c42119b72cb9fb8fa79bb2ba62c63beb1759940a56dbdc0c120d916fe0de9c1c55e7137fa1cefea54374830c0861f99964bccd3c
SSDEEP 3072:TzPnDgdfU39fnPV8pQFq4XKF3QPPMmxbEJfObUdrhmAHh3Xd8l15:TznDgdfs9vPsQFqT3QsmIObUdrhmAHhK
TLSH
T1A1147B49E2A822C8D06E5176C7554A01B7333CA583E1E3CBA2D4F1BD1F772909EE9B53
MD5 SHA1 SHA512 SSDEEP TLSH

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads