9c97965246c78ca376fae6c216603b329ecdb33001d00e857d77a7882108cd4a

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 11:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
Size 1.1MB
Sample260707-nvkhmsgz3s
SHA256 9c97965246c78ca376fae6c216603b329ecdb33001d00e857d77a7882108cd4a
MD5 d9acfd4945477ae8af30c9a41f504fd5
SHA1 04330d53f743d0c23b46e1240146d98d0eb6bca7
SHA512 87e2f44b31e8493820bee622eb5a0e706fa23a9a52214681c5381b932b912d1da908162510fef66596e1b7d7eb56945011cc2edcfd92f8a20f96db459a2502cb
SSDEEP 24576:KZ+Abn41QyEHHSbseS+pHFRHGpyO5RKt5Sq/jrc5xaNIBRiP:KA0IQyEHHCseS+pHFRmpJ5A/Sq/jrQa/
TLSH
T139358E0A23A4419EFEA7F176D617C60BD7B1784A0376962F01A46B766F337711A2E330
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Y:	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\H:	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\I:	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Q:	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\R:	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Z:	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\B:	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\L:	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\M:	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\T:	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\X:	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\A:	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\E:	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\G:	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\J:	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\P:	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\S:	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\U:	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\K:	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\N:	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\O:	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\V:	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 20 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1236	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1236	2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_d9acfd4945477ae8af30c9a41f504fd5_agent-tesla_amadey_icedid_njrat_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

64BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
Size 296KB
SHA256 64392091eb1e1fc4e54bb045622ea9cc4443b71cf847c1b72e6f7b2b42e177f4
MD5 eec7b43beb72c44c5084fd2530de7aaa
SHA1 d419b5978ad5da4c16e6cc42118829e79036e0ad
SHA512 a622bf530c1d0cdbe436456cc938dc7efc7fb00b13935c306b26480df4dd8b3c24ccf5031d7c3be8e3bd802a52ba1d86fd1f8d1f69e130d5f3547397784ab2e2
SSDEEP 6144:hc0fno8s9CTQaVJB39/4x48EcJtqQ1+TBzWFxVFP+:60A8s9gbBdcyZThWFlP+
TLSH
T10D549E1A77D88CF5E467C23989929642F3B138954B34D7CF5760422AEF636E0AE3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_101250\java.exe
Size 333KB
SHA256 dfe8c034318b0e2339d98e695d645fd47354c20b4da3d71aa0dd33ae633f83d0
MD5 9d1bd395f945f1741d27f0e25e4fdd9e
SHA1 7d54d46628cb2a5430eb156aa7571d8512ebb25c
SHA512 b6d5d9883250e20b5f004e69803f1aee0114f7eef9f9948ffeed3f8156b31bf53d6cd2fadbd007b8a8854f6619be4be06472f08a166561874357db5fd3f8a34c
SSDEEP 6144:J0PDWos9VvS83hjojgykH2LXKJYV/PvycEMar:J4DWos9VvL3hDUmcPvycTar
TLSH
T1EB74BEA5B3A01CF9EC77813DC9568905D6B27C590B60C61F03B8366A5F733911C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_101250\javaw.exe
Size 333KB
SHA256 5c500ed047ebb7190e4764ab5cf0f2426dfad986ea433c8377046c981285a244
MD5 3bebcb69ecaec08fcb3067c5dea12397
SHA1 e773d6e4dba2710e7300c4cd0d61c69aa34e76d0
SHA512 4cdf9359323e4f3386cff0f89150578af69110e2a8bd15e322e5c50813be08423ec5a7af39b66dd26bd5ae6399b6fd7e12e0ff883a2d0e0d196540fe0a2b8e63
SSDEEP 6144:AGWUNs9gEIhOxsDcWvsDRorYYzhYutYPDvhaLqkZNS1ZSMPi3jyXXjBrxT:AtUNs9gEIhOxacWUtoNzh4PDvhaLV2T
TLSH
T14874AE60B3505CF8EC67413EC8554A16D6B27C5A0BB0C66F13B836665F333A11D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_101250\javaws.exe
Size 540KB
SHA256 01005f89c500d5b809dfc743f918f89517d97999d7cfd192c3ca8a94045859c3
MD5 eda45e28a6ae0fe7eca1618682c146b0
SHA1 8077add6287be3318a3fc1533cb4506708990ce8
SHA512 06858de3ff9512590400a4356101cef9916d7dc29158f6762de6debaf7f5de2e1163a823648ebfb7354a9c95a9df47cdfe0d4a5579c744a2434f2582b216ef6e
SSDEEP 12288:vtRx9Is9GQXOQMF3J4RtFdLbbdIvWFJqF:vrjXOBJ4RtFdZ9JA
TLSH
T10CC46B90F3E414E4F1B7DA3589764511DA777C9A1B60DA8F03A8221A1F33AD18E79F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe
Size 596KB
SHA256 4980531b9a9adf165c65fe219d99d2d7215d1dae3659a1b57f3257397164f63f
MD5 b26dc2148e0fad1c1fa16e0b51dcc6ef
SHA1 11ebeede86f1312a33c8a0549043fcdb613501e5
SHA512 24646b98b450c8684a5356013c7308a84b57eab96dfea96fcb69a1b4f02e67daf6b0f2d263614724c9d31f3608597b3a38bc216322ad8f120afc9f5c5c4d6502
SSDEEP 12288:rs9s2RNXQc8WSjjpzpGrNSVXjo+WDil67nmb:x2RFQNj/DjopDilmmb
TLSH
T13DD4BF41B3E846E9E06AC574CE538642EA7278560B20E7CF02E4927D2F37BE54F7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe
Size 6.7MB
SHA256 76bf7b7f913973b79bde8790b756c17501a25135a02f4fcd896edda09b9d5376
MD5 4a7ae9d0ba3bdc392ad1789499cb0bca
SHA1 2b1da1a9835a9a51a4281c9eed1a7d0847644b86
SHA512 c45ecb51acc55a393387d67f577bd88e610815bff4e25bf97ce792325214c87143c399b75dfde3c9816e71a7d8f62f5e5623a6d4a0e6f628fa80ef9eb5d6c624
SSDEEP 98304:Dl8YfTaJ1+WAZB2L4HrZtJPIieK5M0uR7F5eg:h8YfTabL4IiFUpIg
TLSH
T1F0666B47E3A600A8E46ED970CF2A5521DA353C8E57B493EF129476E81A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe
Size 1.9MB
SHA256 0f49a85b10f810ee77d4684390c0124fa06c947a255592df69a894ca5cbd8ae2
MD5 b93cde86cf9b8cf4edc0a42716fa4ba4
SHA1 bbd650ac76a5be465ca445ef6579d9a00db1cb0d
SHA512 5df0386ed45ffc975d338e532639857f517b1b5739baedec1954becfd09059989f734ee39598266a4d55ce65e6f938d8339c3aa2595a288e1c547267a9aec209
SSDEEP 24576:caXiYfahj0Ui3XVMm4q+o+LEpjL2NLb9Ld25PTOocJuJ/cIsY6WfvSW7yXj6:dXiQahYUjm4q+otvwpZeToMJseiW7z
TLSH
T1BD959C03F29941E9E06ED578C7469536E9B27C890B30B6DF0290B2992E77EE45F3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe
Size 1.2MB
SHA256 5b2ada3cc22e1b3ea71dc94acc61c8a7e1e5617f33868c691a938b7364e75ad9
MD5 673e35b8a10e3f88fed2beb4b662d99c
SHA1 c3206e6c00f9c9d2294968a65da7f2dbdb331414
SHA512 ee0cca0d18f8ec5b6fdbdd959be49155bc629460b349a86a021b35eb491d76c2e747114a69f25df33480c45529b953d2cdd36882179c54a6ae98a80c0f24f2e2
SSDEEP 24576:zAVNRBD/BvyFX8v3A9Dk6YwiRDrGVk8TIVprSWL8b96:zAXPD/BvrvQ9D/lipSCtpGWL
TLSH
T14245BF0BB39840E9D069D574CA564132EAB27C860B74A6DF06D0F25A1F7BEE46F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe
Size 3.9MB
SHA256 8100bf0c72398a2146852578e2cea24c0cc55b43dad40e4441b0e5615fa452e4
MD5 bcdb829190e1bc0f165aa82c5c0945ed
SHA1 f7fca186fb54f10b02cb9cf97044321d84664f65
SHA512 e881ddbddcf901faa3a8289c242a165bf475cb2e92204da26a41b011f6c07b395d6bc103f69f5e1d261fca846674f2a870b6a395a9309a7556af7fc1c872a920
SSDEEP 49152:/KCcdWUMbVHQk+S0iJR+/fTHj700GD0AG9uVEusJ6LNzOeL0GKVIeCjIp26If2yE:W/CS9uVlcm7fwKA1
TLSH
T14F165903F29940D8D059C074CE5A8132EB627C8D47F562EF3694B6EA2A73AD47B3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe
Size 1.2MB
SHA256 e6102a91f8b3a20f3dab23c1743afa2ebd17897b08239bae4e37f5718a8e85b8
MD5 bd359f906313ab8f188656a3fa4fd1ce
SHA1 2411451f4c0f602abe40dac5976ce752d657e561
SHA512 088a0a8db67724196d2713e59578041ed0840b07aff7355502060a3f362729940d1dfe6021fb2b1b3ca566c6240341c9bdd2e60d61a381957d736fc23521bd17
SSDEEP 24576:4UaY3MhoxFsmXmPrwEFO5jqB4gtACU08m4awg:4lYchCFqrVFye+YAzNy
TLSH
T10645AD07B7D941E8D02DD5B8CB568536EAB27C820B24AAEF0690B3591F37EE45F39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 1.6MB
SHA256 55e0565a4242d77e3950c4b6f9a5730ebbe42c09b1efde3355692ade33bf2583
MD5 bcb5e5ebb2ebd039527f756b6022eaa0
SHA1 ee69b1ddccda06e65eae9b26fc9d9ee7073183ee
SHA512 9b685f4d5e01e2e087106f2b36390a9412641e794efbca2433193982337bfbc884b365e637424aa85bb6d7bc16d2081c334c56757bcf90f872c41a64c989db62
SSDEEP 24576:rV8l00qC3jw0nuX9WO2xUCr58EOyKoctLLWLlkkkkkkkl0T3gAQl7Sm1GvIS:Wl0xC3k0W2CCpOMKnqPQlmmwvIS
TLSH
T143758C03F68A81E5D09DC278CA764B35EA717C655F209ADF0290BA253EB7AD04B3D3D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe
Size 3.4MB
SHA256 c6e80abd6825cdbe8d8992b0aeb5c1dfffb23f3e6f9d33b803566e8f6cde7a54
MD5 b0a982adb74a4e9c057f93bad47565f1
SHA1 a8603390094da88f74040ba8ac55313a8f0d8367
SHA512 c75cf2eaad9e6b1247994a9b3285d0c35ced6d37966a3f0de4777c71b022c43eab25dfff513885042194621f131587e0933ed0df17a665af1850beab294fde8a
SSDEEP 49152:rHJ+E0+vrJQOhq/tcuj2nXgO3UqMzADkulO7Udq+KqOuBk7bVnU7wF62JtY5rrD:HWTwkul1EE4wsmrrD
TLSH
T1C6F54803E29900D8D199C078CE4A9632EB627C8D47F562EF3290B6D52E77EE47B39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 1.4MB
SHA256 0b3020af1be01e6a8f266976384e284bcf726900fba16c301483fadd049b8f6b
MD5 092bcaa9967aa9cde1ada1d9b71efec7
SHA1 35a596ecdf8cb0f6d04f6be35d82c3d7e7352f84
SHA512 9b686c8a043d3217b1463ade7948a4351df8011b6a1827c739ded63971c4bc14160222d0ff250faaa790374d2d5bf82ecd0016787915ade628a11960b0d391ae
SSDEEP 24576:uEcFcekIjQjfrXepSvnyrkwwlDLDckiZe1qRA1+IEEa:Xc0I0jimn8PEDLDpiZSMIEn
TLSH
T1C3659D03B2D941E8E06DD1B8CB564536EAB17C460B34A6DF0698B2592E37FE85F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe
Size 1.2MB
SHA256 daf1dce515dfbf863fad008f9709a001934150747943030de5298acb8942986e
MD5 9cf0c6d44cfba6385f9026005e9de680
SHA1 0b2c2e9decf6667dc39ae1fefcde1449569f192e
SHA512 a2486cb41c66ada0f556c3a887a90bc727ba2cb0b33a1daef505b3270101729b93560836955ea798998c559e8a4c9b8dbecce1a25f790a6ebee8247a1f0b5d9f
SSDEEP 24576:m/cXpEHK4o4MXDiIJxyRfV3QZyq9kHOEPpE7rrTA:m/YaK4on/JQRfVgZyqcvPSrTA
TLSH
T19845AE0BB7D840E5D02AD578CB568532EAB27C420B24A6DF06D1F2592F77EE85F3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 248KB
SHA256 8677dd479c78d8acb5f421d37d685ad50affeabeb5cc677cfbc6710553fee496
MD5 503a10ef8092e16fc44358871b27a009
SHA1 d4e07d7129f46bbee405fe2f702372704004233b
SHA512 5783b0301f5958346c14c476e37fa3320ea369a02aba9a195f918f8a0dec0eca15eea653c6df44de2321b135f6cfd2164f096c49f6d02e31c4f859728da1303d
SSDEEP 6144:Zs9b6J0YDPaigbF9LcR/Cuoh047KmSrhscT5J:Zs92JfrmcRoVgt7lJ
TLSH
T18D446C6935FC10E6E077D1B48FD19503F335B8B616218EBF4290421ADE63650ADABF3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 265KB
SHA256 4de308aeae55e6825118169265cd3e11e2c3879f3b89fc20f5d6cacf5ecc1f2e
MD5 3288588301f9dbe856d5dc78b872b4db
SHA1 e5335bd06aa7aa1b4fdb29a540a05da74c6aa76e
SHA512 32e2d87ccb6f43a0c1b06fb4a0a04da7bc5629ee02acc7be54bb17a0e19c1b2fa61de1c3172a149ff0fb268d50ac5842410f2d7650737f2c98edad4b7c631423
SSDEEP 6144:1s9O11mAVraxpBXo3dMYWoht+uoZ1XPVHx6pxPSC:1s9O11mTJoMHo3AXPVHx6L9
TLSH
T139445A6925F910F7D176C1B48BD09903F231F8B6A3108EFB4291435A9E13A916DBBE3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 610KB
SHA256 31f0512092690badbcb7a94aedc7031841867dd41737c5940737ac54552865fb
MD5 f6285f0000ea0b53c963abd2444d125f
SHA1 62b5beed3893268baafe700d14370e77016f0895
SHA512 1881a2086f1b2a63db9c89cfee9e5acfc5e7742946636cf66a0ffb46608a6a01978d7452580b5c8c46ecdc123ccaa418432300dce6111c270e28da5ff64ffa84
SSDEEP 12288:Xs9SY/hHEp6uDnHVlkGSoop936N15r3DItwZd7+:PY/hHop0bp93I3stwZd7+
TLSH
T177D4AF41B3E847E9E07AC534CA528546EA7678960F60F6DF02A0427A2F37AE55F3F311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
Size 7.2MB
SHA256 cd6151f8162946299a7863d3c33ca9a09ed6a998227a9ad547ad0c8552dbc510
MD5 7fbac7ab6a4f409da03b0a7188956528
SHA1 7c6305783b3aa7553da209ccabf12fea23f898cd
SHA512 25c63ad0660f07534b3ce36559850b7ddef58c9a56bd16facb6cfe7a272635eeff6ae0fdde3ff5a5c1a9cfff9b906b6d7a402d7816be164b94b73f465bff66a5
SSDEEP 98304:h6CZetahq+WZrblwCsJB2++fGhOxRj2vJzRN+T6friW:MCZetaSxGIGIxVqzRdDiW
TLSH
T131766C07E3E600A8E46ED974CF2A9521DA353C8E47B492EF169476E41A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe
Size 3.9MB
SHA256 e0e3c8f7e9c4696adbf3baa0caddaec8c1d74d3d184f4db193dc33cb20991f8a
MD5 e282614846b0f8d86181e7fce3ec9ad5
SHA1 184ec5c4e59f0091cc65cc8b98035428a92f364b
SHA512 d6e07a8cbddd02a55dcf3c785db8c32d53f85a0ef7525bb83ac4a8c9cd463c46b859a6cd4bf03bc794230885d2c0c0084671160d374ffdc402971cd00ccde838
SSDEEP 49152:vOsVf50gLSQ9zvycbmhLbKqm006NPpIupE+Vu+e6NqcXToRzvUqIzYHBigdQBuiG:Bf7GkjyCmCC7NUhIUBbQcnz
TLSH
T1A3165903F29900E8E05DD5B8C7568522EAB2BC854B35B2DF0650B7522E7BEE4AF3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.3MB
SHA256 430b3d7cc8360219ac9b128878ff9729e9643aa40bdc848617661c8ee364ac28
MD5 08ea36ee4d6adfbd3978a40453746fa8
SHA1 522ae2c0956842f8dd0c3e1f4f59a5e591a629da
SHA512 98a02dba0cd65214813bf5fc09aebea624230450a6b44cd055be9bb126f78d3a5f628ca028d56921a220b7ab95f5c5532b60bcb71f739941601c8f949ca40794
SSDEEP 49152:Asj4O1CtAP3dZNRdE6lstBhuXjfS4LWxnDKyBH:sOcU7jBoKyBH
TLSH
T173B57C03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 1.6MB
SHA256 7c2e271901f65ffc4941263df9384f811fa5cc4fd3922f46cb53a9fa5eadb399
MD5 471ce945c3a5e9acae29fb77c7caa0d4
SHA1 c4185c74e7ad4db4208addbec1413e2747454121
SHA512 13d64beeebb5360bcd244f69bc0d0c1cd3fbb16480a327489043c28ede04f9cbeebe6e684daa6eb01b1aebfa3e8634e3a47e26cabf965400fe9536e48bda45ad
SSDEEP 49152:UdvWyRCecRTjMzZnpz+uGyYH2TlXrk9dBDjjLJdD:YOLyg2OHLJR
TLSH
T122759D03F39900E8E05ED1B8C7568536EAB27C450B24A6EF0B90B6552E7BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.0MB
SHA256 f80d45aa2c5307325dd44f1d0bc217d7643787d768f371ba621531075cf12eee
MD5 a904c7c39f5c1736ea591fe211bfef5c
SHA1 ad2f5855fe71f86b41e9d6eb5c4fcfa57d969fcc
SHA512 f490bbf74c88c3415fe949e1d5fce4a47fea6d738698f3b6838f82dc97135b13bfe56493778c6c4afa81b114d2bfbdff043019e5251cecc7501237e5a1429c23
SSDEEP 24576:k318WC6U4QNWwf1jutYqkIWPNF2Us7CtW7KSdHBxmRkkkkkkklQXBysWAyZD90wq:k2WCmQVCYqkIWlFxZrSdHBAVfHwq
TLSH
T1A1958D03F69A80E5E05DC2B8CB768B35EA717C554F20A6DF0680BA652E77ED04B3D394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 3.5MB
SHA256 bd4bda9136af2058168610062da62fc19b00f062f86d5dc5733242c37253b6b1
MD5 82cefb8adeb897f9d7a1fec5d4a54799
SHA1 c583ddcb9a7557b639093b782548482bfd18c8c6
SHA512 513dfa2a07d8ed8506374d514ff3adf125b9b2d231d5e143fd85385907630b673fa9021bfef42931f764d829f5ce058b00da1daa4a1b12135a086fb4fbfb287d
SSDEEP 49152:6u08CiYFjT+zFoBPqu+E2zryb6YErEz4AkOuaRoBISCaQZCLlrru5:HnJrSwOnZR5
TLSH
T19A064903A29900D8D059D078CF4A9223EBA27C8D47F566EF3690B6D52A77ED47B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe
Size 1.7MB
SHA256 2d0b6694c812869ff6574daf7485dcc5087c141f54cf9b9097a690c8169929ca
MD5 f4bd750f4a3701b66f4067821f493275
SHA1 1399d8f98c6dae0cead081a227250bf4ede66ff5
SHA512 f805a7bad8822bedb07ca556b5bacf937bf8ae54a9b684c2106dd12c77d3a01fedd3516afeebf20b21f38512d01fa6a046c46b74a2bffa2c9da140f8c34a81ac
SSDEEP 24576:O6dz3y6SdbNEQrw7fumDN2fj/42wnwb9teQuJXlPnyF4mfHU9YawsNl/BVzQlDD3:LyvuBR2fjw2wnuHeHX04mfHIqi6
TLSH
T1CB858B03F29941E8E06DD2B8C7468132EAB27C450B34A6DF0691B7562F7BEE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Size 4.1MB
SHA256 d2e84e752cad4be45ad27cac7de6492065c85fb26d78980c16832faa1a77cbd9
MD5 909288f5726d62d0a1aa124fe8fb9fef
SHA1 c85c14295c3e8bf2c5ee98280cdd377d71cb43f7
SHA512 9122e6004b556579224026cc2b36645407140c8469b1cc7caad3a9e6f0ef0e9792927ae2ba397af4136d0b85700e7f6a554fdeca39a9adbd470ab1e1678d4a4d
SSDEEP 49152:DuvbjX81sdl9RCa1humQses+TjEozExldDwUIDtaZHWRdpev2y/Ba4Ws:QF3QQNd+RaAM
TLSH
T11D165903B29940D8D059C074CE5AD232AB617C8D47F162EF3690B7EA2A73AD47B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
Size 1.6MB
SHA256 9795bef17d39e1c506e6c027f53c6b0fd269be3890fdb587b4b4e376180cf23d
MD5 5cbbdc24a285e29b46ca05929aa7b17c
SHA1 929438cddb80ef82dbb1a585a9c1437e33ef5ffa
SHA512 b16e911f2d17f3a25f1799c64d4cc9276345dc1ecbc25eff963a5f972412eae75d2f11afe1025d653f8e96d243d0869bf0dd0b55a11a8b3c8f8518bed9a64c88
SSDEEP 24576:1Cc+dc6oFrDxKkOoZkuV97h03LtvLgMakW7L1oaedpEukUoygGmq/SZLsTPw:1Adc1pDI4L97ibtjgMa97Bo7EukU10Mo
TLSH
T1F1759D03F3D940E8E06AD1B8C7468536EAB27C450B24A6EF0A90B6552E77FE45F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 1.5MB
SHA256 39446da24771aece832c28f9e150f2464ba4a6c95b697c4ef5500cc6c65e44a3
MD5 37eea268734bf9479041ac429eb02d41
SHA1 4b1e9dfd249a1507b93b9f53f94ab7eb44e2b0ff
SHA512 38bc9ac0275a1f16dd6d6f54405f73ad8ba1c3a4530ef1e410197e3fc1edcb4dca868af0414d6997b42f1c6b69769cc6b5c7f3ea3690f814305395c28d755320
SSDEEP 24576:DZMFZ63p/jHBnNhXuIDfCzNaExfAGsVa4i6h27d3WlnyF2tG3v:iFZsllNxDfCzNaG4n+6h27diyF20
TLSH
T193759D03F79900E8E05DD1B8C756893AE9B27C450B24A6EF0B90B6562F77EE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 329KB
SHA256 67374c1052a355229ac035e793496b64272a6c1f9e88ac011f3881c6a586ca77
MD5 40f26efe9ccc1aae30967003988396e4
SHA1 291f350ff10dcc19b9ef8444bb6c9c88d83960f0
SHA512 da5abcdb5f94d1752551f640a3c9cb79cfe35632ecf5f87a4124f966a627a4e0351c70c5b4bc6eb7b13224d498afe81dd98d2281806b1736f09d757898b4c08b
SSDEEP 6144:qCo9s95ICdgYNs5TC47Bp1l6K2lRemA/iJPsfUrcA4YiUO+V/PY:qn9s95ICdgYm5+uB92lR82czA4YiUOOo
TLSH
T11374AF25B3E008F9DD67427CC9A19515DA33BC9547A0EBCB03B485661F233D89E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 672KB
SHA256 0a8ad3910f2d0924addeaa59610d4537838210af978adf5b868c102bf31ec766
MD5 8d93c970290b915aac380eaad89f0cb2
SHA1 3c1d10b8ceb88c0d9037e0f4cdd2157683633464
SHA512 005dbef2550f7f419d604264148720227318c89a9ba32702e739c2de9786856390560a9d43d4c8e6d7ba8354150c715a170ac7eeade403811ec07a57148fc3cc
SSDEEP 12288:qSyZnVPCWUJP3SHjTP8QHas9ErHs57haxLBxsROoSDGl:OfPCFJPidH6rM57haxNOOoKC
TLSH
T135E44A15F6748331D073C0B9C5D2A68AEE7230865B308ACB4286D77C7E67AE68637731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.1MB
SHA256 f23a3bdbebcaceb021315ed2951dc04df186e3fd24acd4f197a1d37c6a96891c
MD5 010ad99bf8c24717c6d5b4d94e355b0b
SHA1 cef1013da7a14f9165c7ab3e8b817e450c96feaf
SHA512 b93ef7c6d42aad7325f36341f3a29154e8c98479f2dbb48e13dffac024b68cc27c68ab1a7b7b8d025db97eaf1cf0a5e4e1bdd668349f5f69193f661d772071b9
SSDEEP 24576:ltkLezSC1v8k7opjWgrvW56q8wyuqEhUh:wLezSC1v8VRbvIHjyJiUh
TLSH
T1CA351A25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 840KB
SHA256 557754a0a6d98d04fb6ec82681034fc830c8ede854d66a20edf4e77fe651016f
MD5 9177a53e941edfb658fedc0f1be6b362
SHA1 f7e5d935e54c5d7d474717b90c04845094f25b71
SHA512 7a5c7e9dc7f2dc31f285f30be2dd6ced3ed2767db4850f97575fa05c80302d9e79d302cc4a851e85b4a0c341b75c2da9164c3d0dbc639bbdf364c20765b67717
SSDEEP 12288:/n7IBDn3vPw72WV/PGrLFwsEGhWcpFs9Lf0Im98ml5VcSObNdm/5c8:/nuDfIyWB7cpQml49bNdm/5c8
TLSH
T1BB055C66F5748331D073C0BAC4D2AA9AEE3234425B318ACB4246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 350KB
SHA256 3196ee7e8a857c92038925abf79246b104c17c7f30e935221c544f7365868721
MD5 dde0d46c104b3d16f60601afad1072a9
SHA1 2e890dbc3e02819d16ce1d0c331a7904711a8887
SHA512 f96cc7b9c0766cac61e75c672c310f11ce60b8c82d1d828c091417e24670f83d6977fe8064ed1f13025b1b6a22729c77e1305524d55efd353049e6292210d7cf
SSDEEP 6144:H+O0s9iBJ/GKWWBNU6ITLBi0qttclOKgU91B8cr4DJ:H+s93eBNUbTVO86UXr49
TLSH
T17074393BEE28FCD2C27E4DB95691C640A77278704B52A3CBD275820EDE135E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.3MB
SHA256 252eaf4e07b1969bd61756ce93b5266cd88c1ab7c1b557ec8e89424044b1c5c8
MD5 add4f7866a824f77fd096e31c1469b3d
SHA1 073cd61d3bd6c71efc04219b830d2bdb18fc0396
SHA512 3037f4281634d065d114a4f52e0b4eb22a1f699774ca84287664171a0af0320789671f0f9bf15933e1167795d2512f8e8328366ff9a1420bdbb5f5fc5f956fee
SSDEEP 49152:IJwtyDsYi5S8UL6xvUD41n3DoXLidMWkcJ8yCT3BeueSpH2nd+CJf9lBy8NRV3T5:IJli5M/DaALXxgJFl35C54H
TLSH
T1CF265B656BF880F5E0A7E178897AC6B2F7B678420D31EB4F0191C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.3MB
SHA256 901c36ea220e4c8ea1b715b772c221345cb03a28a2c65b98faddc8261818132a
MD5 40a74a9c35fd08118a6efdf36e0d012a
SHA1 09af78df275ba909e19a89abfba140184efecf78
SHA512 bfa947297a8215f013857747c110c8d875f1a3e0c477ed921b70cf910b5fc5168bf978654e930e14ec57687f190845fbac0cef368f8d132900260e3ecfd1eb33
SSDEEP 49152:HZh56kpqkN2yL5z5fFiV+XenmE3/zP6jb:tjRcVjnmS6v
TLSH
T1D3B56C0976B8C1E4D1F6C77896A2C647F37178154B31A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.2MB
SHA256 32fa7e82c5ba6137adbd60fb60490e257c292d406186cc0281d2ac288a5e6612
MD5 80f496e3a7e49c171d69e9002e410f31
SHA1 0f4bb6d9aab86697de1cefb19a04b02ee93f41f6
SHA512 994fa534f43cc9ce06cd25d7c3e91ce01dbeaf2271fab88ad23f1dde1cec839ad5d7f41a852c31f2beeecf565ce93804ace324ddfaedba9a136b0ec00841d7aa
SSDEEP 49152:Jj52OYsiHVDIp3DJf5SUYLoDpgLjSTYlQcGeOAaLSF259ruMHwpXMi4FqJLd23Up:dZRQyi36YOcPSLvw2gAf+PN3SfoCFY
TLSH
T15C666B03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 642b69531bdc0a873bbb000b42541a5caba427333d0e2b14c4c598eda8bce135
MD5 082e8dc5afd57e708c0ebd5d26f1170b
SHA1 b0cd5d65f4dbbb39ef5738197f9f5ced98ab24ce
SHA512 464a717424a7eed73c57aa0ce005a63cd05f29998368b9293d554716d1d2e52dcc0154dca7dd5a6c666c4c0b8970271b1514bd02a99a1ea06332c82241667f60
SSDEEP 24576:+svEd14EcQ4rcAkDbopPUb3Az7DaHGTNHu7PNU3/5W/ohL00rhVwC+:W14QqzMbWeWu7PNU3/BhF+
TLSH
T14A952733B2F200A9C44DE1769F4A873196D27C758FE0E3DB851572161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 3.6MB
SHA256 0ed5eb2e3d17043af59f5606d347cb45028ac20a905fbc2811f82b3f27695924
MD5 ee8f6d15fdd01f9e4547d1be68a683ac
SHA1 f509c9d66e51fc6d64840f19e649ad738a6fecb3
SHA512 33e10ea3f68447893f098394b0472f53c69fd2ba4c5d174f24ee0cd2d6425d8d2e7243b7aa0ca75e393bc04abfe6b8952c816ae20531a5164b373dabf2edf14e
SSDEEP 49152:tRRCbY0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbbN3Oh6tznm2FQ/nho2qkrk9D:wy5112gYy5azzVvY69nLKnhZRSx
TLSH
T124067B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.4MB
SHA256 602fcc21c76cd65876212880045cea4374f8c6c2c32f24402dd05238fb7f5191
MD5 07bc85c1f09749211830729de8564311
SHA1 9744d8386ff2fb83f4e6c1d82c1f7a2fc1207249
SHA512 e1fbe6529a0a3b7622eaf269659a6ed106cbddbc5af5f78007fca4731ebf31fd97d11472402d15411a55708761b5f04a69beef3f1643537b663f215a3b3d0c55
SSDEEP 49152:kjktoZjcepMOBr4tEGZ0bqx0z+n217aau1glMZ:ccqJmbxd2dA
TLSH
T180C58C13F1DA01E8D06ED578974A9233F962BC490B34B6EF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 1.8MB
SHA256 c63a90b6f28f3d92afd56b629423347b938bce121c3769e9933405661ce2a6a8
MD5 37258902ae74de46ff42957fb3c2a891
SHA1 af4445b3fae5b951a26afe1eab7be74aa1a8b293
SHA512 ee78942591b74d44e15ece78ef7550b415607db75d6a0960a010e690d6b20f620177f251b0ecdb2366367c3c42ef3f413aa3dc73e062977340e3908eb49e2ea1
SSDEEP 24576:JTnv0drhSbZt+o4aszabauCM3RiARyUQ1zNOgLLwH7ReaQXx3rMkO94tM9sXXi:JUhSbZwoqURiAgU44CwH7R4xusni
TLSH
T1E9859D13F2D901E8D06DD17887569232EA72BC460B24B6DF0A90B6962F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.0MB
SHA256 a6e40285fde6c67d30663395f3c5741b867c4ad14b60749d9850bdc1e9aa3d8f
MD5 235d890932c59e67503189401832c751
SHA1 11a02e051d8b05d704acd552e57bddc2d59f5893
SHA512 2080e9deffd4c96f2d3c57272022749138e66a2852118178a3060f145f5ff6348ed7c4543107297a24f3ac80e52313acddbb771141fee8a2d27786c6df8df6b6
SSDEEP 24576:ckqvN21CkGcCQam2FARNEPa/+vOHWxYR04FxGgVG2Onks6xt4bSMHnqla+:8/kiQp58vO2mRVtOnks6NMHqlp
TLSH
T13CA59D03F2E941E8E0BED67887669232EA72BC464B34A6DF065072551E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.2MB
SHA256 7e914668d06719c54175e39866ca675171c7654d3f3420eaea5b2d5ddc69106a
MD5 60ea4217274f933fbd5db924ecdae9ed
SHA1 5db9b7e8db3082a5e3a33e425dc4dd9887d2a7cd
SHA512 8c6c7089d7fba27d1d8b3466d00df15add6e165daf5c1e0a09dd5eb5d8e288a0f505acccd9b9acc8da1d53d38a0ddf698596765caeec17b85b7cf0aef539baea
SSDEEP 49152:z3IcGKcig/hjLAE3dGGj8baEGcjesaNkYQd0XNJKcvaAcPTY6Y5ApMNym:v4tvjVBDlZ+MF
TLSH
T17DF59D13F2D940D9D059D078874AD232EA72BC494B2166DF0690BB562F7BFE06B3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 8b6271a1120b2808ba3e3be90abc7466c9159a948ca66192dc57acd85807eee1
MD5 530c08818e24dc8d6def70dc88946d5b
SHA1 546b3eddbe07048cb82250b80876e5cb54ea8758
SHA512 db0af64288662a2ab8d9533f98ce06e944cb1ea13ab8700c4862a59bc2b7c6859a15e2bd66127b4084d4829ea63cb459367fe07db6b4ccb368f5bddf6cf90658
SSDEEP 24576:OiWv7UDJCcEHqn0V5yUgNggQBi3iy9CTn0AP5+2QLSvy5jTWpnBIkMne:OODMcEH4RggAgiDn0AP5w+3ZBIk7
TLSH
T13B759E13F2D901E8D06ED178C7568632E972BC150B34A6EF0A90B6561E7BBE46F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 333KB
SHA256 e390cb9d7b1e1d07ae3476cc7534fbcc9cd66e25cc82cc00d84bca20eb0b4f2e
MD5 bf749dfa5dc4ecd13b9c0fa4f8497f98
SHA1 b59100a747141eb1eb1c68c4c5e0a83020923444
SHA512 654b415907a9ea9fbba28a40ae83c47c81eeaf3f0dd2a517de01307e48b0ec4fc1d77e5b7275fb7986ee2d183a361e346f3958345fd32008bb8eab8da57d02de
SSDEEP 6144:9yPoTnDs9vPAyiozj9jHxTVR0gZYV/PvytHcd8oAz2:9G2nDs9vP5ioz5igcPvymdlS2
TLSH
T1F674AEA5B39008F5EC67823ECD658915D6F27C5A4BA0C65F03B436265F733910C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 333KB
SHA256 7f4cd98602916e8b3b618adf9dc8243cfc4545ebf2935e3e769ebf9cccd8601f
MD5 9e0430f7eb6bb2de0c5a23cbb1a58d84
SHA1 1620f9de4a386afe5963f887cf84298d39f39f85
SHA512 c9c30218b242dd78c3b559bca0d7f18ad4c9513bdec65e89b108ed1cdcac66d66b6305f40f50a09f30a9d2e2f1fecb85ec6a4f922d928736c9b6fdf3e7aef06a
SSDEEP 6144:kmxlIs9Bl/72U3XB4LsjguWzmzFYutYPDvhDuoe2+QJVU5gavt97kf6v:kSlIs9Bl/72eXBpEuNzF4PDvhS21Ji5r
TLSH
T12274BE99B3901CF8EC67817ECC554916D6B27C5A0B60CA5F13B8326B5F333911C2EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 540KB
SHA256 57fd8f6a3d50e6bca488e027297602c36c51ca31eb6fc0d791b8f890d3eadf97
MD5 5f0a3551053eae99c3b396eb64ded14d
SHA1 1faa9973edca65e954bd555d8a288864b48efbae
SHA512 657fe081d972c78db9ca6106707279d71c6ec277679a76d367599acaf26268111db30df08f4ab875e777010cfadbeb6277858059b03f8970fc21db6c70283af6
SSDEEP 12288:kCPnqJs9pgYvezq7eZcw5+LbbdIvXQz3avBE:kkQYvpeZcw5+ZuK3eE
TLSH
T149C46B90F3E414E8F1B39A358D768511DA767C9A1B61CE8F02A4665A1F33BD18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
Size 333KB
SHA256 1fa433786bb0e4235d61f1bf09ec93f9de0b5a10fd11a5ec1cc0dd45973f785f
MD5 3557daf124406cf00cc24460bdf728fd
SHA1 e0b627f23480b030bc3d8af8ffbe6c281bb70533
SHA512 9cfe0961484b9e93b9cf4432e4a827715271e5ba6d54d3566bbe8bc5d4140416352b5c8c7aed3aa290abd7c363049d565d9422fa95ffce55cec39adcfe116c28
SSDEEP 6144:96Pw3Os91+khbWjeuYXyTeruUYV/PvyJk9H8:9+w3Os91+8bWDYPcPvyJGH8
TLSH
T12274BFA4B35418F8DD67823ECC559D16D6B27C5A0BA0C65F03A832675F333A11C3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
Size 142KB
SHA256 f831b1ab46d2bc6f67aef9c986e09cdf9cc01f85d2b6f38d9353b42f2e8a41ba
MD5 27f7564803378ef01071a8a3d84d038c
SHA1 e9d0807c1a103f3475b7b3d1133c7e7db79846f7
SHA512 efd72057c5737c770a90df3c1124809e511be9796fc37a51148467dc0a7ca96a6073f68656e212de60c8769abf8d1820b3ae819cc2e936574daf038eed1a40ef
SSDEEP 3072:oU39hjlXEo43udtjZqMNbjuxT+u3HXsMDt:os9Blw6vv0+u3HXVDt
TLSH
T13DE37DA1A3E9A8C4F2778AB29D75CC3088767D9D5EB1CE0D6294310D19737D09838F7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
Size 333KB
SHA256 b8817f77fee0b7ce39bca270288f55bf8d20972ac4c193710ed93d7f26af02a3
MD5 c1d63315ede389961526e52b2847b55b
SHA1 0b47235d52ced27b4ca508865a28b8181bda5068
SHA512 7b752d78098d1b182d5ffb160876911d2441d6bf1ee2d1bf6c10ab9d3ad3ab3d5793f4fc24cd5e85151fc601ae420ec069b1e64092798644634fc563a23bb7cc
SSDEEP 6144:CUreDs98GLIX6mgfKs43F+jbzHYutYPDvhf++LkA:CGeDs98GLIX5gfLGFgzH4PDvhjj
TLSH
T11D74BFA5B3901CF8DC67813ECD659906D2F27C5A0BA0C65F03A4366A5F733A01D3EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
Size 540KB
SHA256 5f53d0a2252812a84aff28f2a9b3c3dae491b08d6395d1adfa21b81e4f4e5c49
MD5 e3f4df6a1a5ea0bd4ba144e881f2f76e
SHA1 1e2deb745f3961e50d8b8775e01f0bb606723d81
SHA512 ec0b792b1e1ad0052059649b6fe2f66cf89632add381e0b8e62ee963a34f6f5da1ef7b7da7fec2aa26067eb4d553e2b537703a15d3e0113e855f60e0471a1eeb
SSDEEP 12288:CIeQ+As9gts1OQUmzsAjSAvLbbdIvbIz8VRg3:Cv6s1jsAjSAvZ7z8VRg3
TLSH
T1F8C47C90F3E414E8F1B79A35CD764511DA767C9A1B20CE8F02A8665A1F33AD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
Size 195KB
SHA256 cc756fcc323689ecf0ea36dfcb81cb51b3326d2744373b6c19c2a724304b3c43
MD5 9396448769b86deb24892bf66e865d84
SHA1 60c01268594cef7fd6e3f251498863b4bd8a3f05
SHA512 7fb08a2f5bcf57405f470f56da14b4862eef1630d324ee88fe94d933b296982d26acdab7cff5f1585b7994fab87ed6378c11e1fd9aafab3262296d5c30c7b38c
SSDEEP 3072:XLSzxItldWfYSU392Y5DEmd/MjgvhagI/f1OFOPqxLvosHpnNB:XTl8QSs915DEmdggIn1UJLpNB
TLSH
T149147C0033E40994F473DA7A9CA04541D7B67D522B92AFDFA354205A0F3A7E1EE39E39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
Size 138KB
SHA256 b8ed15cf7a2f9a6ef7ee2d482e155cd4d7347b88173fdf17c1ce78978a86200d
MD5 358ece59ddefce9ff9b1dab95388f248
SHA1 98df54b608bdf7904b88bad2165ab9161ec911d7
SHA512 b249f57e54917dc1f138968d8feb5d5ea7d1a7cb1aa398ba70f4274c9c912edf52ff9027f00eefe0b96a44c6ff6036133f134e88a3e894af26402f2c02ba38c1
SSDEEP 3072:VIQb8HU39+28vJEisdBziux3i67dd1KvBjq:WQYHs9r8qdBniq8BO
TLSH
T179D37C5563E814D9F1779F39A9B084158F7ABD925A21EF4EA280414E0F3AAC0DF38F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jre-1.8\bin\java.exe
Size 333KB
SHA256 4cc2cdf35d9de1c7f8e52b2c0a3ffcbda589bbf33be1f39740bbd58b164717e3
MD5 1c109283c79915bd439fea6913841113
SHA1 662b205a9aa1d33d6a7bae8ec4a1245816d2aa32
SHA512 69b8dad494cae4e3df47bd778f93f137aa0734024b41ca1b185ac54576415c27ae42e53a5ec01ca6ff4fce5c661e8218ceb104d7abd29d9c319008501913d206
SSDEEP 6144:pFPv35s96ghCQejk3LXrWKFZ5YV/PvyTjqkbJAEcFb:pVv35s96gYQeX2vcPvy/XJAESb
TLSH
T1AA74ADA4B39018F8EC67823EC9558915D6B27C5507A0C75F13E8322B6F733A11D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
Size 142KB
SHA256 da2540ddec4c6071cf64689156ccc91e3aa698c4f20d0fcfade3f26c2f471d7a
MD5 44efc1b11f2c16a6621e42c914970928
SHA1 36af2d5cecba5322f8f671f35e70ec9e400e9c9f
SHA512 6685520893641c83d2049ef4316377ae676720a09f01f8d42228283c63df2762cfa9d440996346d1469b28890b865bb299820ab261ddd72864b20c44d1703edf
SSDEEP 3072:zU39hjlXEo43udtjZqMNbWwx2PUZjAdIMnXw:zs9Blw6vvWPUZOnXw
TLSH
T15FE37CA1A3E824C4F6B38F719D798C25987BBCAD4EA0CD1E5295311D09737D09838F2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
Size 333KB
SHA256 4532cd840a82bfbbcb87a6109c292d4bcb233588d3400fb8b07ab1f9d762633e
MD5 60583d52f185bc33d36ba8025795d579
SHA1 698f2f0e3e07bb1366bb97dd8bb83e5287c6c547
SHA512 f4bca1959a2444cea4a5837dc044483c2615dd0af9f0e634c743b73e372fc0f85be81e85d3f7246e2a96fafba167df4ce72aba003bbf7c736d8f8ebb1d6849f8
SSDEEP 6144:bHrY0s9cs/6UjN468svPjanqz9zuYutYPDvh/ta7WNdZsw9:bLY0s9cs/6UB46Rv7anazu4PDvhlJsQ
TLSH
T18A74BEA0B3A01CF8DC6B827ECD555906D6B27C560B60C65F03A8376A5F733A05C3EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
Size 540KB
SHA256 d303969f77bcf06eb090999f3c949f4f9543191b26ffe4952febc5cccdd1e905
MD5 b68202ee33c8667ebd275c73a79b5607
SHA1 8bcda21d51c70a5ff726de61d37881db2a9b76e9
SHA512 fd118452937578c2d3a20c5eebe87b296997378a0834a005315d6c58e5c2635e4d7a6c7facd2e812b100266b8eb06f02534e3d9eed20f97e4464e683267d7290
SSDEEP 12288:HKpzCqs9SuR4GNf3SuaUhzxLbbdIvW8I1gy:HiiR4cSuphzxZkCR
TLSH
T12EC46C90F3E414E8F0B39A358D764511DAB67C9A5B21CE8F02A8665A1F337D18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
Size 195KB
SHA256 ea55de1ded23a8a2b47f6860195f634070518abc547a46a62bbf0eb4205138c9
MD5 9013467d14e2dfdc1d4722ac3995a63e
SHA1 74885bd8420810e91d12353e94ff47f8cdeb2e1a
SHA512 64be2e48ed3cfebb7b4e8889a8988c1335ba09c22e53ab459c85d1eb3aefd80be78606f478f154864860d42ff7efc5f6904d09e01edaf4f3db035d23d44488ca
SSDEEP 3072:LYPBxJt3BM6L/U392Y5DEmd/MjgvhagI/f1OFOCJGxV5GTadkmXNCAptAVKa:Lo3Ow/s915DEmdggIn1UnIkmXNCA0n
TLSH
T140148D4033E90094F577DA3988604506E7BABE921B51EFEF5394316A0F766E0EE3CE25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
Size 138KB
SHA256 942645ebc7ee1ff65f32bc4aa992f1da6355a30c32b1f8ef952e29721960cabe
MD5 56fee080145d3aa8867f430c59ea3f2f
SHA1 ac7121282ba3a43acdc5f8c5db3bb6a2124790cb
SHA512 ea0f803149f862be87b38ed0b22ec4f4059e489b8cc1ae3a6413561db081463d6c526e9a9a990a79d6a33e072309632bc84a637eb65bd232edc475e806d3b7c0
SSDEEP 1536:9CoQb8FavXuhi3ugYXjb28W1VLs8h8Us8h8Zs8h8ise8MJ2zfQ7I8Pxu9bK3iC5+:9lQb8TU39+28vJEisdBzYMsxtyKmYoZ
TLSH
T1EED37B4163F918D8F4B38F75A9B484258B3ABE915D21EF6E9380510E0E39B90DE78F31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
Size 4.3MB
SHA256 ad0c736f9d44b8e55b7997cb9298aa8aee41232ee7a0b92b67a67a6493198ba6
MD5 a497d3b565a0f242774ae07841a9f7ab
SHA1 e6d4d77e7553bea513e6edafc039a25917745a37
SHA512 e948cd8fab039c8e77a7286f4a51d428e92f6da3b21bcfafc9f616c9ec77221fe98d7b43e1a433982f7f62d3d5c07182f127cb65f34c427b37f1df8a139135c2
SSDEEP 49152:o34sL+oDooIaSOTNJd3RsZsNebLSdN6NYqximjp3heuNCDgmV+GX7FCbKn8NRV3p:o3wo/p3b2L9ad7sbd5C72
TLSH
T168265C556BF880F5E0A7E178897ACAB2F7B678420D31EB4F0191C62F2F336905D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeClickToRun.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
Size 4.3MB
SHA256 2986b118edc7333d436fa4aa652e1421617bfbb8e8088e4404c1ff0a3742f77b
MD5 9b83ada2c232370b7a10e4caf2a20bb3
SHA1 d29591a366232a42e87cc3ad1c355d276055c909
SHA512 7490a391c9262f46afb725f9abb2a06575324925313b2b9205de4b8b107a68876bc80b4c1afad1fd41fd2ff7e7f0254ca6a656acad1993bc119f5dbf2a39e9c9
SSDEEP 49152:F7vZYsxQ5Mbwf4siealas1WKzfYLNdJo9WBhf9t3yeuYdL+BYLRnh9fnkS8NRV3R:F7IMQMa8gL6qNhxni5CC0XI
TLSH
T14D265B656BF880F5E0A7E178897AC6B2F7B678420D31EB4F0191C62F2F336905D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVDllSurrogate64.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe
Size 275KB
SHA256 1509dfb12f8ec020f43207571daf2dd04e25e2eb64909932a85df943c2985ff7
MD5 101c1f4a3f9c775d70548f316902a63b
SHA1 2b17aef7adc9c99db77afc40b8688c350c28877c
SHA512 87388b5c40683545887459223b72a40afe39ed678a352b4aad444d6662fe9ea9810655a14c602832641f1c00d71ce6045605c48dd046a4766f01a3599f436505
SSDEEP 6144:3x97dTs9xWGNTNYdMzATVkQNUO7q5jlQE0Yp0:hxJs9MGNTCWsTGQ4VlQJYp0
TLSH
T161544A7BEC78F8E1C27E5CB9AB90C740AB7161715F42638BE034C26D8D136E15E69C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVLP.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
Size 588KB
SHA256 a6aa7ca875ce7ae958c206417f5acce3c8596a1ca86b66afffab4a44d06bd71d
MD5 4c989900fcb72c44ce506b64c73654d1
SHA1 64ec72ac48f6dccb935e3f4103b5477571e18ca9
SHA512 b7c1d3e32a0540de73c7f1c08733f2f4fbcec98c70318cad05105e289b62dbaa35c0f7304eb7901523ad5a017c8ebb45e28ac13aebc09c179bdeb794fb22bcf8
SSDEEP 6144:Ql0KCwAbaTJXpNFjqfjbAs9ZpTOC7JD/U/Oo4Wp4hzvNUXITiXt9Z+M47iUlfZtl:m0cJXl8As9CRluzvNU4TEYic0w2sRHcc
TLSH
T1ADD48E76EE28D8E1C27B897C96968600E6717C110B61E7CBF16CD27E1E236D05E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Integrator.exe

Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
Size 6.8MB
SHA256 af4e5b291b60432f12632bafd181bbb104cd8768497ec45958b07d27606b98f8
MD5 e6591e9c01340dd071695edca2fa15a1
SHA1 2e9105552c0cb90870b7c8af8683fa2be08f2c75
SHA512 ad42d8a719ef61349c01d13a9603e0f4bd3496b4c52f3f4492b6cf9ccd8bf2c79d650412e2c8e9915310166232d01747142051c3d9cb8d95f437d87d7e907d4c
SSDEEP 49152:PRVMTxNF2trKcqI5QPNi+gLkBTyTJGumHMAT2fiThY9Ua2AtcnSc2Q9zOB17/xYU:P47GKrLIN6mU0FB1GWPhrrmqJjeb2tcI
TLSH
T1BA6629596AB481ECE0AFD1748D778772F67678428E33661B0261CA1F2F33E588D19732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Mashup.Container.Loader.exe

Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe
Size 100KB
SHA256 8d29d006c97fea26efe780abedfabc53119c400b3cbb173ae75b5c003f205ee1
MD5 3790ca2c24569a59f49da43968bbc9e9
SHA1 0ccec108ae6d926cf1bd6a521d5666f81068bb99
SHA512 68925a496a96802db808ab73d00a3311e2dcffcf112cba3d82861965d2b1704e783dc90f08a5975ed33a5bcc3cdfbc0393811eca78b78cdc672f70c789739001
SSDEEP 1536:0KDlvXuhi3ugYXjT/eAMpldERVsTYe6rtAhDwn+0Ra+Z:0CgU39oeAcI6T2KhDsR9
TLSH
T151A3CF11B7EB10A6C1158AF49891D379B9B63FA02F1BB7DF5290B22D1E733849C31B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IEContentService.exe

Path C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe
Size 449KB
SHA256 8f32d1ec687dc596e675f781a2cbe25d72e7ec6846364217f5265666975c1322
MD5 4b5cd8e895c4151e45181711a4c47ca1
SHA1 49b74e68b58ce2e3bcbbae9c174c2a2d50c147bb
SHA512 ebfec0dcbac8910e767d886d5092cde1bca8999f2529e9d3275953540a282d416d001eb79564e3aada84ce6da0e7b1f727225524e4b5ee659f66595840556469
SSDEEP 6144:htysHdBUPapBugjMsPWrle+IqnxOs9K7oV5jfcbvnmwVFwelpkZ:vysgPapog+e+bxOs9XRfM3S
TLSH
T17BA48C4AEB9458F5D657A278C57BC572F7F2B8880A20670B16A5C76F3F33A506E2C310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerfBoost.exe

Path C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe
Size 877KB
SHA256 88e342f9bbfa542e269c6deb1f87e96ab026a8dbfbc4be4b2fe8247316212f15
MD5 7196f79ba8f116e570e02c514989dbef
SHA1 2efeeba7192b1211afdb7ff4c21041ffa0309394
SHA512 8f247ab52c52a4a7b6d74f2e164b8651315f7f5614c97574f8ef4b7e22cca771ce1b6f2c65dd452aa7b454db9c0e725f253dd73e6137eb35f82d1bbacf68a259
SSDEEP 12288:tTTGuc4/VewNtkGs9GhzjnLLgob3TOZvpEeZob4UnV5BMw9dvPF:1T3c4/VewNtRn/FrTQpEKdUnHBt9lF
TLSH
T107153895ABF845E9F1B3A67499768572FAB2BC621D30D31F0160C25F1E37A808D25B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDXHelper.exe

Path C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe
Size 189KB
SHA256 6ca97e2ede407ceef5a7d82a99abf4017db259baa98b2a93908ac003c4ceac0f
MD5 81acfbce7a69125f549cdd3a6983ee79
SHA1 ec192103e247fec67efc0bf2ec80020d9434fdb9
SHA512 f393f35f22704e3f7135662bcc0505e8f25d598e8bee18dbb24385747c68c6bf1c0f8618470bda6312e4ce575b5d75975d92686934ed368b0f16ee048a278e1a
SSDEEP 3072:KF7SC3pTNq/DPU39KdG1Q2+zT6lZdAh3SJxfFrgrwHeD2ig7Nrm:qSsFNq/DPs9K5elZdGaFkrFCig7Bm
TLSH
T1E014AE127BA4A0EAE403D174D975AAB1F7B3F5715D20736F16A1C20F1E73391AE28B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoadfsb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe
Size 2.0MB
SHA256 cb24ec9771b4d21a163a1b9044dae70f67df078a0d9f3cec9a031a6547fd9ec6
MD5 99901238af49165db994000bc3f501bb
SHA1 b9629acc0075e5fa4c6679ffe1df56cc4b5d207b
SHA512 0b18e10c5f13b239d842b9f9db61be7fd0a8240e90eb8a2202148d07014f407384ed006c7f29c2d28330cab45c62e09cc789e8e2119ccaa110d91cb0e6f924e0
SSDEEP 49152:VhsxS08UAWJwmfN/lv7yt01GFT7bhlZHf:kxYy4D
TLSH
T1DCA52946ABE8C4E5E2AAE2789975C9B5F6F2BC514D30974F2156C70F1F336604E38322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoasb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoasb.exe
Size 341KB
SHA256 8934f1440f72173368cec3620563571842e3a443a551fbab2a6b2e4de43f1c7b
MD5 3850748985cdec29d99565e64a4e78b2
SHA1 a6cb6a2682560c032d818a6427d9bb41cf1d80ae
SHA512 317ced7d3577d7dc7882c0b5f5debe9f9da2737d2bc83bd2e00f90bfec5e5086b0450d9ce282e5fc9dc065c8c6715f2934bd6155dc461461a92de9901361dca2
SSDEEP 6144:t3Nes9YPJU35PRZB8Ynaspr+InsO9bhvRx9EiOwZexhIU+k3Th8uWJ21AW1V:tws9qq5PRZiYnaspBsO9bhvTmw43v3Tx
TLSH
T14E7439577BB48CE1D91791788686D2B5F7B3F8505F21C30F69A2C35E2E332A1AD28B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoia.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoia.exe
Size 6.0MB
SHA256 cd56d6cc1f53f5c507af40d3ebaed578e85f5c45cc0b03604a9f3e4a475077ad
MD5 91318067625de68dc2f6df8b0508152b
SHA1 b0dfcaa4ed4eddc28e011ee4da911a5ec260a285
SHA512 08433ee100eb31f4bef2cc6d16a025e3a6bd491cee8ea1e2837df3339fdd87298dba1bd05a6d22e3ce70a0eb1d0de7662f3912673ffd3ae3fe8cfe123545defe
SSDEEP 49152:5gvK8TPQZblk7qIOfdQSp/K1EQDpW9fwMv6C3zHEVpvt5R3K293+XQK+P5jGSUA4:5Gt6FfpNw35KZCLw21maEug
TLSH
T110564A55BBF982E4E1B7D134CAB286B6F6B2B8555D31A74F0451C31E1F33A909E28332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

officeappguardwin32.exe

Path C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe
Size 596KB
SHA256 73ea9128b14c677b6349b4d652f41aebe394a9f0f9cd14ba0f33027f8f664755
MD5 2e83ad1af7a519594657c9f7af0877d6
SHA1 b1354e0a5bd96e888e642a937ec1ddd82a08846f
SHA512 2b17441ed8c1773d6d0c9c6b1b7a07ed944adb099203182675c45c0e06fa164940ef771d3c458de24990d7e57effec97989fee85376d0b926545eb586cb1d1c0
SSDEEP 12288:iVIbPPhjgdLvtagEVks90cIPr0lypFpHDA:iVIzPh4WV9cAlcfA
TLSH
T1E7D44A41F7A881E2E566A5348A668170FAB7BC170F30D70B7559F32E2F33650AD29B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocolhandler.exe

Path C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe
Size 6.4MB
SHA256 2f36c20c7ae438cb5d5c3bf367d5a51d5ac50de31f8d1003f5337aa82d4d3633
MD5 1df4a5dd35798174ec14b379d702118f
SHA1 c21b38125d2fcb3ada42e27efe84a8077cd93ee9
SHA512 b6210e4d3e7718f71b1c87c5d1df07ee2d18f9efdba914522e4c33a32df3fd39b4bde49c71248de7d09542c164115b7e92ea598ad85379064f973ce24fcbb747
SSDEEP 49152:cRI2RsGQUPIdlmKB9CTcj3lV/w9qWltx4Mm1GYjQ4lZ1j4apOpauIzFISG/z8ZQE:2QwY1J1U3IAi9nHzHjLnlkuD
TLSH
T1B8665A416BF880F4F1B7E2788A3A9675FA72B8425E31AB4F0151CA1F6F776508D29331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OLicenseHeartbeat.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe
Size 2.0MB
SHA256 fdb9bbaeb75950e8cfe25fb4b2e430323671d2a1f2b596600f6bd3d779ca5957
MD5 9ac78df9459941b6ce85ec44b5b1dd34
SHA1 5f9e1743d50d603c684269112a0bbc23f596230b
SHA512 7f1b9a213d7b4f268a4f1ed77f048f30a0ae2262460427161c5425b06f8216e8c311f1202be8a02e95e7760010a8c4458968cca7c74344d67f15baf5fdb58f6a
SSDEEP 49152:6HH9GXiVKaotzxj28SAvEoWFlYrU98xjqrA3N:zzOLO
TLSH
T1B3A528416BE881E5F5BBE7B89AB68979F9727C521C70E60F0156C60E1E33B408D39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLDumper.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe
Size 222KB
SHA256 75972db64776e1ffdc42ebfaa91b892546b255e81aecf5247a9a40c90a98c3d1
MD5 4b3f0e9839fd74b4529887465f83d52b
SHA1 323113b750753dccb34c4547b4c24a7f7bee56df
SHA512 a65cebecb7d290781877592882f260ea2f12b5286c744732718c81d71864ed65cc72745e898e24c8b91490ec7a0d7f1ad31fc1ba418ac6b26e26d28f911ba02d
SSDEEP 3072:X9fRwLOrKtSU399aj4+qrSVzN2Bmt+hlQ8TpvW2wNF3YdF71X:X9fR6O+Us99aj4diznYdFJX
TLSH
T183244A4177FA2058F4B3BAB49EB582526A7778952B31E7EF0118C25A1F73BC08D34722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohub32.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe
Size 2.0MB
SHA256 9c35ae744f743c2f6f4a0bc3b79c7bfa50e0049308e2f0fca3dfee9ee2c14f41
MD5 3eacbd34d3fe581ebcf8f494c1aa7762
SHA1 616fe123db7da79d0fb29e08a59cbef63434863e
SHA512 e0edb9337082f6092e45cfc0f88f49eeed649523e3f27db2e0767a9090efc9eae0a9f5ce427d259a6321d1712c6e5a4598e4b6e2f774a0097f64a9304b2c9b61
SSDEEP 24576:JWbWGAF82vYGgRjassNXJnZbRDM52A2NBH3NRLOwPGFVwQPxZgNb1b4FgwPqe0Pu:JWbWGA6YJZlh4ULOH+MYu8m1/p9Z
TLSH
T107A55986BBA484B0D526A17189A6867CF7727882C9334F47318DDEDEBFE32604D59331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreporter.exe

Path C:\Program Files\Mozilla Firefox\crashreporter.exe
Size 3.5MB
SHA256 7ca0b5379617fdc7b2c426510be03dde3e7f14a4153d0045a25038aab4c98ff6
MD5 d5bd2bb546d044489d11709e17d4790e
SHA1 b3cdb3ad07e2c167788981b39cd47486c83d4d68
SHA512 e955996b8922005cdfc9fc31aa8e305ff805237d25e90008934f6abe1d810d2dfe70c65cf39ecd2a025fc23fd7527d378b37d9beeb646aa4caaf7a7b3b8a5ca3
SSDEEP 49152:J/vnuBhY74ocHYcJO28wsz3iDT4JmeDNB05FQz/zTmXLhm6kV9CvaB:JXue4J492Jg9f05FyfaLhm66B
TLSH
T11B062842EB611DDAC025C0B482266723B761FDBD073036F74A906735AD68EE01FF9B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox.exe

Path C:\Program Files\Mozilla Firefox\firefox.exe
Size 777KB
SHA256 efb60eb5f3b3ddf47ed2c558046d92df2fb7ed986468a80a72efadfe8591e514
MD5 d41a2d2147dbb0adde154eae9251e2cb
SHA1 8725b8be702688d8b15e1cc957b39abf2220019c
SHA512 2513bd3967225c55b3730fd846c3ce7f16ebe504e2dc069eb04a3f46832fad7d2c2f282099fac2a18146a1ea77b72ab3d2e45b9f195c677f9872e91d76beb613
SSDEEP 24576:MV5RespKlRGCYyG4SwpemIwpelzED7AlV:25ResQlRGCYyG4ZpeapelVb
TLSH
T16905B003F38516F8E48AD5B89A42D233A5723C840B51A1DB1BF93F2A3D31AD55B7876C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
Size 329KB
SHA256 41600af3ec3de73062d7494f540844ed63a5973978e1fca32e1cd38dac1f2515
MD5 a6b7b7352144031ca4817d69c5ba3c2f
SHA1 26869d890909b543ce1f53ab360fed6ccbe30ab6
SHA512 008a43f9957dcfba4bfd9c350650cc02fe51d7b15384a256480a7a492ccccc0cff082dcc401653a0c23365d60c0943e375549ab2ac5bed65db38f05ece588f53
SSDEEP 6144:H0s9cKQt+dqO5kZQ3Cv15RB2lRe8O/iJPsfUrcAZDEKrICv7Z:Us9cKQt+dj5WCCP2lRY2czAZV
TLSH
T11074AE18B7D40CF9EDA7817CC8B18416DA73B8554760EB9B02B486664F237CC5E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nmhproxy.exe

Path C:\Program Files\Mozilla Firefox\nmhproxy.exe
Size 654KB
SHA256 e796c8081345947afb7955666f7b44055254dc925ca71a2a68c64c5f10b40f7d
MD5 3aaaeb533cb53d35b927b1108fa2e140
SHA1 9caacd4a911adc01555034ff3e9a34866420e7df
SHA512 9187f42bbe3c296146e6cf0fd913772dedbf7b76ba3e18e7e3b832d0d40ad34e53442f6e22d1ec8b07b13f87474a79aae74d7a135942980ae75f9d838211e086
SSDEEP 12288:4uSXJow/5bjQ1NgCwH3yDws9moc/waheNiNZG5:PSXJJBbkNfuQTiNZO
TLSH
T1B3E47D02FA9BD46DD51EC07887478636793374CD0B30AAFB23989A393D59AE12F39714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pingsender.exe

Path C:\Program Files\Mozilla Firefox\pingsender.exe
Size 126KB
SHA256 4cfe6711ded4eaad05830063dffbb0f8c71cd75325b6b9b2e5ec88c5fddcbde1
MD5 2185c4f4b852a445c181e7e235c34abb
SHA1 80f6fec7fa8ab453fd869b8bcd6e713f0d6724fa
SHA512 a07b3f045f0bd762033d68c99f7576af02896d052dd808c7bd1a215df4cdf00b9319194c214330d2aa765a951e348baac19edc694c3769121d0416022ec43f87
SSDEEP 3072:oXSMzjpU39nPSh2SdWAKPypQ5ip6J2RLkRD:izjps9nqFdEyyH
TLSH
T12FC3BF06DB04D97BE91692F06CE76032E6A135488B36E6CB634A81802FD53F41F7A7F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plugin-container.exe

Path C:\Program Files\Mozilla Firefox\plugin-container.exe
Size 202KB
SHA256 c91ba513d3f0db352ab12463028c56663270b747137624b4dd35db8178442323
MD5 34ef7cc44336eb017a9faea249cdd198
SHA1 8099632131d4552a2afab48a9f06104a19dd29e7
SHA512 e8f2741595f638a44409dbc078463d0eccf839082d3c08096aa20792de3bdfd39be264678a7f659275107f118d6ecace8918f6be9d6598fa02e286a137f9f0bc
SSDEEP 3072:BckxqDIaU39m/4LW005Jx3vaPu06jm5DdFXPgjbE36y4djawPF:BckxqDIas98gW0qfEuDqDFXPW46F
TLSH
T10514BF13F78852E9D6C6E23867D25231A7B071860721ABDF329916203F15FD8BF7D294
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.exe

Path C:\Program Files\Mozilla Firefox\updater.exe
Size 523KB
SHA256 3ad07ffade021c23026c925178250b3c96347769567d23023394f386dee35016
MD5 ca659fb9ae8e87b9a424119c15d11c11
SHA1 b5e944ab4298953e63f9738a756eab66b0b26cf6
SHA512 77c5237d983c65f0e5f785534477efa6cb68b812cdc8d03d270252071b5f943fb77abc56881d48e940ea3e9b6e968b3e1234e04823b115964c4205cac708049f
SSDEEP 12288:Kfvgefs96Kw56m/KIboEZh2ZeBHSOJAdGyZeQUTCgyQFzd:YvgefKw589oLJ+RZLQzd
TLSH
T15EB4BF29E3904DF8F427A278C9968512E773FC55075096DB22E8D62A3F332D45A3FB90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 188KB
SHA256 45d285699c52a0cce4f2c2bee1d7abf5978097bc0690b0a16565d1b85c23371c
MD5 45c26232c3a14d166e64740c9fbd9fb0
SHA1 d29a23fd275a5e123c5f070ddb3f6a963c220271
SHA512 efe86987b64d9efb1753fad8ea9ae86dcb45b533d18e8174b6da345fda5e5c649cebb3fa46a4b52452c924151d9c2b3d2a53cfcffdc1eedb58e96f0946abdea8
SSDEEP 1536:ZVIdiM+wUIvXuhi3ugYXj5sxbdpVJqp+uIBQepE4XKF3QcOzjvBldIOyGjoq:ZVIdiM+LU39Bb3V8pQFq4XKF3QPZJF
TLSH
T177145A1AD28812D4C06E2239C7969A41B7333CA287E0E3CF66C0F57D1F766949EE5B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1236-1-0x0000024C3D810000-0x0000024C3D815000-memory.dmp

Download

memory/1236-2-0x0000024C3D7E0000-0x0000024C3D7E7000-memory.dmp

Download

memory/1236-6-0x0000024C3D810000-0x0000024C3D815000-memory.dmp

Download

memory/1236-0-0x00007FF616740000-0x00007FF61684B000-memory.dmp

Download

memory/1236-3-0x0000024C3D810000-0x0000024C3D815000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads