041da5d67292945e4af600f58a31ef52e809db3521961911dc9ddc30e8a8993f

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/07/2026, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
Size 1.1MB
Sample260711-ephbnabs8j
SHA256 041da5d67292945e4af600f58a31ef52e809db3521961911dc9ddc30e8a8993f
MD5 dee3e13b76981e2ed99d8499e403fd2f
SHA1 1310d98529bce8ca7bf6fb5aa48467aefa382e39
SHA512 401e4a6a42c62cab4c786d461568ce4459f9a0e0f9bb74f85587bd4a0c300c27c479969297fdb7b8d292e783f30a126bee9e90dc9c3951f19e1efbdf352988b8
SSDEEP 24576:7IW/bYG1ayIm3plsGSPp4G5GppyOHZK/ISqCjrc5xaNIBPa:7dMKayIm37sGSPp4G5ipJH4gSqCjrQa9
TLSH
T154358E0A63A4419EFEA7F176D617C60BD7B1784A0376962F01A46B726F337711A2E330
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\G:	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\J:	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\L:	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\N:	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Y:	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Z:	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\H:	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\O:	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\P:	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Q:	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\T:	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\U:	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\W:	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\E:	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\I:	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\K:	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\M:	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\R:	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\S:	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\V:	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\X:	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\B:	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\setup_wm.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\wordpad.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4168	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4168	2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_dee3e13b76981e2ed99d8499e403fd2f_agent-tesla_amadey_icedid_njrat_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

64BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
Size 296KB
SHA256 cce0ae12c4b352a36e8007252df29f5b95f35a815ff5143d131c739cc29e36d0
MD5 529652bbb02295aadd497bf22c836e1f
SHA1 4518a6a0de7cc558ac1f9ed1053e8dfdf4a1e389
SHA512 e664d21c3f901b311785f4c70da5175feb6a9589c9074a09e33d86d9bbec02923ad7fe69771bb4f4b3896a6dcd94793c2d7b4f91929aaeaf9ec23f3e99795a3f
SSDEEP 6144:h6JQ+hs96TZ7tBvSo/Vx0hEcJtqQ1g2HPIBnyPei:gJFs9ervJcyfry2i
TLSH
T15A548C1A73A88CF5E857C23989528542E7B178850B35D3DF6760026FEF636E06E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\java.exe
Size 333KB
SHA256 6a14c61f1d872f64496dc0182715d22e6e482481b334189ed6213c999d6c69be
MD5 b844460a81e86c860a20d4e98259027a
SHA1 a60f1544d9d39a9aebf8171eaa49974e4fac0ce0
SHA512 326f8e3e02f0a665d091746b3a4a8205afadb3d7190dfe4b092b955ec5391507c76ff4bcb5ce741754586b9c828bfcd46b9a963971c4f530f18eee7c4bb6a580
SSDEEP 6144:eGPR/Hs9UE7K9djLDYxypbuMEYV/PvyUDc6VOLxb:eSR/Hs9UE29dpShcPvyU4Lxb
TLSH
T1BA74BFA5B3901CF8EC77823EC9659905D6B27C5A0BA0C65F13A432675F333901D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\javaw.exe
Size 333KB
SHA256 9b2581e52380d380a8520a19a1d2c2803841c542b79bc9a0ceb59e65fd842693
MD5 2a900a2fdc3d7dcc56a9e2f8634035e7
SHA1 20c65c302abbe4fab400d0e787c5d28bd47e3aa7
SHA512 0538dd10eb062f24b5940604fdbeb0dbde7d66d4e2bacf59cc34d0d1f1a4238dbf99f05279500c8b65232f455a140b2f7b676bd807433dc79ff4101a6b2dfb0b
SSDEEP 6144:FttHys9b5OSF04C90sUBDR1VzBYutYPDvhvjUrlRcB:FLHys9b5OSFlC9pEDNzB4PDvhvvB
TLSH
T17A74AFA4B39018F8DD67823EC9158916D6B27C5A0B60CA5F13B436675F333A01D3EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\javaws.exe
Size 540KB
SHA256 ec742680c8e1fc688f9bea0c91ef45ebcc754c4924a9ab4e0eacc6d6f6549c3b
MD5 0200977b3a0e594cc4f79eb0c97f4a6a
SHA1 385d9ed305eb8931606f3cb6bc1f3ae0efb417c9
SHA512 eb351efb523c64b21ba6a3caa119f1551e990a8d8451272d26f80f458a25a40402bb5028bed62fa9a0682c04cb0f8adbe76d415c8ad3a39f9da28b5306d72875
SSDEEP 12288:ndAgDns9wJFe49JhzfluCE9bLbbdIvW/alR5:nyeFe+zfluCE9bZ3YR5
TLSH
T1C1C46B90F7E414E8F1B39A358D764511DA767C5A1B21CE8F02A8265A1F33AD18E39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe
Size 596KB
SHA256 831865efefeb5fbacb96b1b198f9c78c8d8e9e66ac9fab9ec665aa088ffcc18d
MD5 8810758b676d594844b252ca402cb0c4
SHA1 9f4c9b44c1a5d25d41624fe92ea24047f8ad969a
SHA512 50daa4d7d731935683d80037e70f19f5d88821cb76223ac1cb09ce3cca4c7721797054febe8c418d3e451fdbcf3a0f9bcaa3e0fc9b777d87784cc68e47b58bf0
SSDEEP 12288:gs9lO+yTELHXpEwlu/rNSoXm+WDimkPgmVDK:ZO+yTWpQfmpDimkDVDK
TLSH
T1C7D4B041B3E846E9E06AC134CA538542EA7278960B64E7DF01E0927D2F37BE94F7B711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe
Size 6.7MB
SHA256 c2253939c3d8a9842abf264b68b278c3f854a53da661a0b98f14aa15045fbd1d
MD5 93b2990ecdf43171d04dee14ade37d5d
SHA1 2886da32d37f8d96d7d5c697bbcb0f328967ae1a
SHA512 a798c8e948e84747df56a935af3b86a0492c91a7e8e663630dbf061e8544e60a7e57a2469008fc8692b450e8932e7c27712e29f6c8a4ae8f581c51af24f651fa
SSDEEP 98304:pl8YfTaJ1+W/GS4B2L4HrZtePIieK5M0uR7F5esT5:P8YfTaNpL5IiFUpIsd
TLSH
T184666C47E3A600A8E46ED970CF2A5521DA353C8E57B493EF129476E81A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe
Size 1.9MB
SHA256 2f2bb977b535c369ff8cdf653a631e229a7a6201f0f365709f4aaea8a83f19e5
MD5 a808eca84ae8b5aa476f80a8ec783243
SHA1 d0d1f6485c781ef4c0490ad4d0146386fd816311
SHA512 750a01683080971ec9005f74945cf2bd71f9d2a8b8da9ade438efafa5f078a4a2e4d9d6774f228356e9ef270752b469bf9f951d7532795ecdf619fdb43525a6a
SSDEEP 24576:99VWj/9ws1jqUscXZF4SAIF1ULqL2NLb9Ld25PTOocJuJ/cIsY6WfvVbG:jVWr9wsIUL4SAIQgwpZeToMJse8
TLSH
T1AB959C03F29941E9E06ED578C7469536E972BC890B30B6DF0290B2992E77EE45F3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe
Size 1.2MB
SHA256 92f0fa4cc09b4ac9bd40aee3579bea47c3a5c0f6a209582b2c3b11ee6087703b
MD5 7a1f33d683933fdb00d9f07633454698
SHA1 df4c27e73b5d9353c56f54a2576e9ef7dbe9d25d
SHA512 a06d3f6837679c342dee580ee39b70f972bd2d4300dc48430de97fce611f276b6ff1b801311b4a98005e9f7f3a9103a4ce5aaf734d3a3b06aeea34344ee14227
SSDEEP 24576:h0MFjUh+evV0XnuVwsRRrH0fwoAh4hIVprSg:h0SAh+eva+wwhHCJqDpGg
TLSH
T19145BF07B7D900E8D069D574CA568132EAB27C860B64A6DF06D0F25A1F7BEE86F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe
Size 3.9MB
SHA256 f6e78a6fd32cbe865a83d8fa61e87597fe1abc4a6fd573cdb5e05632566948c6
MD5 fcd86f3dc4e2e36d6f71b9eb458115ae
SHA1 1191c6e179a1ed817634966af5103cf0bb12a220
SHA512 3848e02b0a1749ce3e202c08b4ad4d4b0ba6f182eae2811d5c0ffcf64deefaff495dde6e0c6a0d575f18437c85f983273cbf748733f190ec3ca273907529943a
SSDEEP 49152:MOXv7M8Xlhmi/SQYxau2tbILpE60GD0AGPuVEusJ6LNzOeL0GKVIeCjIp26If2y8:lNGDSPuVlcm7fwKAWHy
TLSH
T1A2165903F29940D8D059C074CE5A8132EB627C8D47F562EF3694B6EA2A73AD47B3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe
Size 1.2MB
SHA256 f3215e3836e9de80c7003ec0b962047ac7bc047a97de4acf4a0962140df321ce
MD5 e6bf0bd883f05449bde96cd3e1501234
SHA1 ed0bd0207650b98908101bf123ad1de000866c4d
SHA512 18316ad8e103c2252c5ed0b877ccae9afc9b917d5717c204a5c49961709f475c7f0ea9ed93e1dfbfdffd5db040c1dab6f8da790794c34494ba4f2a3e755e6e88
SSDEEP 24576:Xf7smqCeMFOoX1gnulQkisBHE5CXH+08mn53ZS4:Xf7pq1MF0nCQnokcXeNKb
TLSH
T1A345AD07B7D841D8D06ED5B8CB568132EAB27C960B24AADF0690B3592F37EE45F39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 1.6MB
SHA256 56576b0885cca3ec43eed6a073e118585ebae5a0f6d1f5a43e8480701643c450
MD5 45f641d0968146738b6fdbe6d2b79b25
SHA1 56c072aea78d97588786123627b02306464db4e9
SHA512 022d864510b94548b911e88d45e9577a3334efc9805cedc7454a8af0c1cee493968ff70d774649bbc16c7402f66d1da8b937e1130459b3a473a48973b38823e8
SSDEEP 24576:PyJUosNgmcd0D1XyaS+M7bvnX6Q7syEq4zz3lkkkkkkkl0T3gAQ62ynkz:OUoWgmO0S+ibiQfBuLPQ62+K
TLSH
T113759D03F68A81E5D09DC278CE764B31EA717C655F2096EF0290BA253EB7AD04B397D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe
Size 3.4MB
SHA256 010d4af16dc0d023d0d2b47e08a53972a934293cb134512484f62c5200d8f6cc
MD5 70ead36ca5013a002abc30d02f9351ce
SHA1 063c2659aa19eb262f42153f083dd40cabc5207b
SHA512 746c12078946f393c9f2554b962b769424112fa226233df2f3166cb5b06f1742def099e737f5a2a601ab7d5eaa9d2221e95338a4113fbfa7bae5f413b3018741
SSDEEP 49152:hK3AOmXorwdQTqVYRJKm6Wb5uUqMzADRulO7Udq+KqOuBk7bVnU7wF62JtY3RErJ:kRVwRul1EE4wsQ6yeN
TLSH
T15DF54903E29900D9D099C078CE4A9632EB627C8D47F562EF3290B6D52E77EE47B39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 1.4MB
SHA256 d0d006a4de04cf7def1faad387e4a622263b50c32cf90c8a36b8f0fc2e9294f1
MD5 d0b2990b0088c37fbacd289c28348383
SHA1 0cb88f52d781e51ab230d19ead4300b55d11d1f8
SHA512 1f4e3e237ef6b1b8b56fa2dfc6cb98aea07462a6acbc761d8fe148a53ab2b79f22a985340665825d05499a1d9cd36f238bd361fab33d1bd86622f649985e036f
SSDEEP 24576:Sg/Ecvel51jKSXu9dvOmhQ1tCDFyORCdEe1qRAvuJ9KZW:3/elrj+rO2y8DFyOAdES89iW
TLSH
T1AC65AE03B29D41E8E06DD478CB568536EAB17C860B34A6DF0698B2592E37FE45F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe
Size 1.2MB
SHA256 443231d2aa1d9ebab94b9e87af6186fef352c99034035aeb3141b559dc6c2e4c
MD5 71843226c99ddcaaf0c3c70fc48fb2a1
SHA1 7ffba79d92ca3cb7df115770134174d556d3f1f5
SHA512 e44e21a21109dc76929b0d61af18f1e898e45efe231fd0e1c2d7f4ec9ed2f9a6ab32a45a312ebd26ffa0010718043b57504f12f4009159fdb7981259e2502094
SSDEEP 24576:dKNdGenjoN2X9Z05M9vVu7lzHSNHyv+5pdzN:dKLrnjo00q9vVolzHCfd5
TLSH
T1C945AE07B39940E9D02AD578CB568532EAB27C460B64A6DF06D0F2592F37EE85F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 248KB
SHA256 521400601816c17374201e8f875ae9861178f879972098f38b1604158e300ede
MD5 21c72950c37c3d6654fefac6837bbd73
SHA1 ac1b41173946383469966baa32e167c60d66f332
SHA512 c39a81eefcdc9a79c9abc40198ed1fe736dbfbf7f99b91304be32f8b6ec914c0734709fc8fc77fd2653135383954b494d5fb8232d917d0c6c2b338b46d4d8021
SSDEEP 3072:zU39wv7QTIxvLFiFygnbZNq71YMKuR9CbOwWoY46TW8sgyhNCOVI+BlEHmKkAnD7:zs9wME9LFiFbbvqGMR/Cuoh0xmKSK
TLSH
T135447C6936F810E7E177C1B4CED49503F635B8B613208D7F0290426A9E63651ADEBF3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 265KB
SHA256 0fc0770c197b9e9fd896397eb7f996fa53b77e4f67a7a8a9d13fdc1821de7530
MD5 1b4ac51d6359d1dbd1e493bef6bbdaf8
SHA1 5b5418cb4eaaa7544f7167f49e28c3631e49daa5
SHA512 51598de7084ddb89dd23d6f02aa4e0fc36fa3363f7e82c9c1d7428c4ef13e33bd313d838c576f09f72edbd4b39f31b34eb50fe643ff23e3d59fddd2b060fc65f
SSDEEP 6144:hs9p3ts5ranpBpJVATYWoht+uoZYG8d7A02udH:hs9p3tT36THo3L7F
TLSH
T1CF444C6925F810E6D176C1F48FD09903F274F8B6A3108DBF4291835A9E23A916D6BF3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 610KB
SHA256 5e1b78b965bcb9882faa967b41f7d07f361b9d7c1f663361296d297751a91809
MD5 c731b8f523b9dcdf4d62d28920b67e56
SHA1 f56d1dab3a97d3c73a2624aae0ce347c92c14cf3
SHA512 86971695b1a4f613e7059f9538777a2ea17d427f91ef0d00977004f86ad706695d5ba48d88eef8b4abfbacbea66c0ab123a086869f3b2d19acc59a0c78ff897f
SSDEEP 12288:ns9os7TomdKe6FHVleWS/ag97/G15rHZrTHf:ps3oGccwg97O3HZPf
TLSH
T15DD4AF41F3D847E8E06BC534CA528646EAB178960B61E6DF02A4527A3F376E55F3F320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
Size 7.2MB
SHA256 711b4ec9c7e33d48370716d73b163bf9b5446cef07bee75e31ee0ff5e623dd70
MD5 6492487b55fd2d89656caafe68b70c2f
SHA1 ff899563754fbf62455e3075b1bb32d1f7622213
SHA512 1e363c84b059e98045cdf03e8dec336353587708c5841e1978a925519e3ac3919cb158a9511223b5d268ba79959d89e443c71ae8b3728202b828e3337ef93cdc
SSDEEP 98304:O6CZetahq+WZSuawCsJB2++fGjOxRj2vJzRN+T6frTvK5:pCZeta/RGIGKxVqzRdDTvK5
TLSH
T138766C07E3E600A8E46ED974CF2A9521DA353C8E47B492EF169476E41A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe
Size 3.9MB
SHA256 47242c2cfafca150206b83736c86ece03aad06920e6cad0cf4210712409f80f8
MD5 fa685c2027d59ced474b03473793dceb
SHA1 b797003e865c482df5ed757060c9565a4c6b813c
SHA512 1d2499377c4aab46a72aef06088cdcf4b13f9bacfd32ef44457d70242b363b217ce1ddd107e8467cf65a7868c37f588da315cc840113f7368f4907f73df3d731
SSDEEP 49152:9/K6hjIiYbQmW+CUJbmhLbKqm006NPpIupEFVu+e6NqcXToRzvUqIzYHBigdQBh1:dhTcpWxU5mCCINUhIUBbqDJ
TLSH
T1A0165903F29900E8E05DD578CB568122EAB2BC854B35B2DF0650B7562E7BEE4AF3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.3MB
SHA256 d6e6e037ab24b5e087789861bab25e0c1765486de5740c59fe6251f1ab46caf4
MD5 a806034a50d28c4c3f34cfd0d561c4df
SHA1 c95ad321725365e4ac998edbaaafa3a8e2a5fe99
SHA512 d029f88178b4a240c1725d81de13b4c55dfd5e7204676e37dc67b12358a7404b65a1dea5ffac1b1e12e73ffbc02b5716f05ec2bc20e0a25abf4e83504cb6e551
SSDEEP 49152:YuNrgojLdXXSNAM97XQE6ZstBhuXjfS4LWxnx:PgyhHjBI
TLSH
T1DDB58C03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 1.6MB
SHA256 b8f8c785c50630f6712bcc3aa151530dd5227de3f9341e77b278d2695feb61e0
MD5 b7c3cf58611227831c975108e7d661fa
SHA1 fe5953392d77d2267e7d86e57121479e3085b616
SHA512 7c03b64529262701b668b0ec9c5e06089499021ee321b18c7fdb3493577e7d486729516fb431add8ee96e33270374a3463cccce34d1cb1c4b1487dca22214ee2
SSDEEP 49152:2JgBbCebTjaQmbNzEBT+sAF+LTlXrk9dB0F:uoPnTLOM
TLSH
T160759D03F39900E9E05DD1B8CB568536EAB27C450B24A6EF0B90B6552E3BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.0MB
SHA256 a4031cbf46fa2c27658600dac21bbe7f5a0972ea1c307b5fdedf3da19a1d6bf0
MD5 cbbd62467d00765e82c2f7ed536d2ea7
SHA1 a7c8eb537edc331d4a99702c5d1af8ca879210be
SHA512 b45de8291f1b2f96efecfa03b7d0d7745ce8f6bd1328ee94dfc925e3583e5bceec5d300345ce3018bc2d7cb388599a9294234cdedce6a4d11f36bcec47b8624a
SSDEEP 24576:Jcfp+H6go6K7Mfjxu8hfeF5NOHEks7CtW7KSdHBxmRkkkkkkklQXBysWAAnuSh9w:JG+Ha6T/hfeF50HXZrSdHBAVfA7h9w
TLSH
T161959D03F6DA80E5E05DC2B8CB768735EAB17C554F20A6DF0680BA652E77AD04B3D394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 3.5MB
SHA256 a45b8feb628b1584506f09ea762f9069cfcae56c7f1a705040268adf5924f7f7
MD5 89701b1934a506dd2ec3e449a7549575
SHA1 afa85cb714e0d0742d5673deb8987d4b95c0a805
SHA512 0a273ba98b03f5c1a4ea62180fe3153668b02d2d97094e75d116bc0ec6059447155db3332f366f9d6eb993e6f7b17497e14744f5bf657f89126eb0ebf9507329
SSDEEP 49152:6ubD6srOsNLS+PuPA8aHLreEfQb6YErez4AkOuaRoBISCaQZCLlrrnHywTdpsbzG:bZIG2iOnZaHRsnG
TLSH
T1F8064903A29900D9D059D078CF4A9223EBA27C8D47F562EF3690B6D52A77EE47B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe
Size 1.7MB
SHA256 cce33b3199c54bd92baa61577f7595a907bc549dea0f2843ec6bf30006273b72
MD5 e4eebcf0d81b879817c959283e7eda85
SHA1 af2e6d0a5397aab97d5a70a6b9e6eb633b3411c9
SHA512 d04b75b79ef0679551bbb947aed5ac773966e2fc5e368c2c42bc7d317f0fc401c72b6c142ace7fbf75637b8a8f8e28948d038a4420f575e8b06e28a5ec35a419
SSDEEP 24576:ZEGIJz61+KYuIqIJuYqzSzYkGmu+Db9ZeQuJXlPnyF4mfHU9YawsNRdo3:2z0NuuSzYLmu+/feHX04mfHIR8
TLSH
T1C1858C03F2D841E8E06DD2B8C7469532EAB27C450B34A6DF0690B6562F7BEE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Size 4.1MB
SHA256 56ebeae48e744058c7b09d61c040f031b7a4750e6a356dd2e7c79a3a662ea1e2
MD5 0db3ab4064094041689747ff6b7881c4
SHA1 f95fae7cec69a4ac999e42cd71f84ce7c3dff04d
SHA512 f34538c39b8dfc49f7c9caba7ee9c78a3fb763fddda754083d3aaf7cfa7d018080b98d58451025aacaf0b1d55354da9fe27613097279b9aaae246ff6457cf9d5
SSDEEP 49152:DuyWjv/83dkcNaeMsVQP8TdS+TjEKzExldDwUIDtaZHWRdpev2y/Baud:AZgkzbd+RaAud
TLSH
T176165903B29940D8D059C074CE5AD232AB617C8D47F162EF3690B7EA2A73AD47B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
Size 1.6MB
SHA256 5ca98cc8383da97f6e7904c4d1687bddd332555bcd6ffcf3715a905954a0787b
MD5 0d74eb1c38993edc0e151b404592b5d5
SHA1 fbc0af629acdcc71b0b66d5ec53934f567eab854
SHA512 a47f8f400755db9ddecde9bc33bd2ae7016bb8d7dab5af0877fa0e32a45df2d90f80b9121392d380ef6c8cc0f21e0a8c51217c9e9ec0fb656acb8e30e962e769
SSDEEP 49152:UGWMwFVou6KBvVOx/9UBo7EukU1aGqBXvu:XDwFgLNR
TLSH
T1BF759C03F3D801E8E069D1B8C7568536E9B27C450B28A6EF0B90B6552E7BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 1.5MB
SHA256 c101b407a8326afb29c2fa835570e46b3513c621317c74a200b85bb2e21b2eb1
MD5 00e58bc3663a195bd124c68590d9fd61
SHA1 e28da0c002ad6291289b03c84913fe8ed9d71e84
SHA512 7e1cd5765531d628cabee1ab84d548534e41487d447650f95c96d51ca33857b431154441c13d291fd9db93849d46141653460d0a8ddfe2883eba5954062bf3c7
SSDEEP 24576:WVtzf6YLG4Gn/0MBucomc9wsrvdxMZGsVa4i6h27d3WlmbouPSP2e:GzfviJMmHc9wsrfCn+6h27dZose2e
TLSH
T1A6759E03F79900E8E05DD1B8CB56893AE9B17C450B24A6EF0B90B6552F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 329KB
SHA256 435753b9339934ebb2e2b8208c1df1d2acc48306677b845da5384d47b48364e0
MD5 cbf436cbf1d49ff6e89951e5a4f9384a
SHA1 44219f4c8c5c2b335f5679690ef66e409ac48c40
SHA512 effaa3dd87ac986808af627c6a7e60feb8b8baac0c0bb28e13bc36c449dce4c7125c737a27ed7e00f1b3163b05938ef3f8afa8adb502a0fb30cecf7ff2364d11
SSDEEP 6144:Xvs9Gl9lbrbn5zM+c7M11sb2lRnch/iJPsfUrcAZCFRuf/qJ6tl:/s9Gl9lbrr5ob792lRe2czAAFRun0el
TLSH
T1A774AE24B3E40DF9EDA7827DC8618912EB73B85543A0E79B03E486651F237D85D3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 672KB
SHA256 28865df2ce0d47364e2158b7f8b6fb02d37375267acc7cd5c12ec35411ecfe10
MD5 22ff72efef76a5f6b018ed755c6b38f8
SHA1 04f8357d4c0673e25dab1e44ab0e0ee0c9fc9754
SHA512 7027da9781af98a1790ccbfdba38bd835049e0c323039227cda2d06ac41399694d0c57b061deeaa43d9364c586e1d5f19c10104fc0ce9dec4564782695f0f6f2
SSDEEP 12288:g8m7ZVE8oU2sBXStI19dHs9DrHsxQq90EEvUt2:OnE8X2sBrdarMxQrVc2
TLSH
T18CE43A16F5748331D073C0B9C5D2A69EED7230865B308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.1MB
SHA256 f7adc9cb4bdb409c725b4f3dabd9fe019d045530d5b8d3340e4b415ff12d4f92
MD5 92454b1ceff3b2cba51a249bb40a5000
SHA1 9c5545718deb95792681b11830775a29f0e7c68c
SHA512 c8a2cfe6ebf63fc44b0939163416277f864e6c909108cc188b5143050fc27b30449e4c76188f9bd19b95790a9876cbcabcf2c12845782e4c8160b60be301c655
SSDEEP 24576:X54hezSCSvvO6pdtgrvW06q8wyu5Jz0Kx:ahezSCSvvX0vRHjyoz0Kx
TLSH
T10F351A15F5788323D0B2D0BAC5D6BA9AFE3230464B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 840KB
SHA256 8ce9e460d02e47b627db4dfb9793882d0bd97717263a2ebd46affb7c916d2a52
MD5 86b13dea2cb4e6dc4e56e22e431d086c
SHA1 f499b6fd57252e251bed6671c997640024d784f2
SHA512 c263ae24dce58cb351bc41dfb900f96bd26e77b7578aa1f4f2bf3674c0c37acc2fd18e37e6d8fd46f2b5805e3fabb043d1d0b369717352dc4ea6bf62ee123dc0
SSDEEP 12288:P78ABKD3v9APMuIsdklLwsE0zWlh5s9Ef0Im98RWaES3jQsLaHmAZ3I:P73Kj9SM2PlhB8arDWhe
TLSH
T1DC054B66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 350KB
SHA256 7cffc56c2979a9d249b1d288726bec495ef1428bdbf9ac089ed1ba3e6e798f12
MD5 148337fe4b46d1154eb98279214074ce
SHA1 716410c362e4d366c90137d4106edf84a8117cd8
SHA512 2956b8839f6495eb72becf5e4c4d077621ebcb63e508da6a314e634c19b989de31f1d3a8ebe4622a20896f0df6a792bbc2adf0c7be14a8c1ffdea2eecfe51052
SSDEEP 6144:BOQs9BBJ/GKWWBNU6ITLBi0qttclOKgU91BrWiFodjgF6tSJh+s11OcWfu:Hs9UeBNUbTVO86UHkRm
TLSH
T12374297BEE28FCE2C27E4DB856918600977278704F52A3CBD175824EDE236E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.3MB
SHA256 8697ccfed349e7d64f42a17ff9c238b3465e0191110980011f17d48ef342888a
MD5 91b451b2ec86894d871ec9f9534368bf
SHA1 819a9656b94b0bfc396729b50cd3bf442730fb3c
SHA512 e1b308a4beb669e235699fe5d0782703088001191e54f69229fc2bf5e59987ebadfe366e2e17e3e948b26219fbc90a128f8a382398baecea01fc8a1b08de33e5
SSDEEP 49152:UaRFbEgGrTBV2mBkZvlrS4kw/yLMdRJZPIhY+V37euDo6iXSongtUnT8X8NRV3TU:UaYTjIlXaLqmnt0Tj5Cx1bem
TLSH
T1C5265C556BF880F5E0A7E178897ACAB2F7B678420D31EB4F0191C62F2F336905D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.3MB
SHA256 a1cca90b24ce8033ce03ec317ce9a4d8642d612f8573653ee9f902edf0ddceb1
MD5 392d716b2e23b293ea84905d0a3a509d
SHA1 8d312190c8e2aff6516bd0014d41f8da9dad994d
SHA512 52c1a3cd41e9d3d60f721b0305b81f0e743658c18073a3ee2c9ae72082e626496ab96d2b03187de3e50d3cbd27338ef5f9fc36af21763ebf8e826907405663bc
SSDEEP 24576:cCB6zCJpW2z+L5WqRrHCYRFiV+XenmE3Pnzc344mXvesrD:cCB6zCJpW2yL5zRfFiV+XenmE3/z/T
TLSH
T18EB56C1976B8C1E4D1F6C77886A2C647F37178154B30ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.2MB
SHA256 800a5f78282484ee9bb6e0d10da4e2c40ac24dbbaa64cf2a3135eb8b8d77fa9c
MD5 406aec60c7f70bcaf76cd633e5cfa5b0
SHA1 ffd1a5980f5d29d86dde22983540e8a0a116bd4a
SHA512 81acae4ad8f989677ae457362167f99e8d7f97f3e828c7c0a609867c686dec8071824343234d45a69475197b3bab4c5b5beb8260d43cc64efa804c2f4cf9d00a
SSDEEP 49152:Nj2TtpLs1/xRip3DJf5SUYLoDpgLjSTYlQcGe0AaLSF259ruMHwpXMi4FqJLd23j:MO6RQyi36YOcPoLvw2gAf+PN3W
TLSH
T11E666B03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 2028cf590e6da136e9b62af65a6a035c199b956644b436374698d1dd2571deaf
MD5 8a7f1c40bc1d25e9c8b19710ee0e94c3
SHA1 fee407eff749967948d856c8bfcda6ade3f04f8e
SHA512 5cf402029b25074cc1c74d923bc11eb120b172bd1944cdbcc8387f18c96583e322b4c2b6962d649bd4f8b0420d071cea8b5b1546123c411a7c1b82745358deed
SSDEEP 24576:gQvE0hFVQvrKuiDboOkwBbL7DaHGTNHu7PNU3/5W/ohL0WVT5+qr:lhHQjCJBPeWu7PNU3/xh
TLSH
T1DF951733B2F200A9C45DE1769F4A873196D27C758FE0D3DB8115721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 3.6MB
SHA256 68769ed06fbf3272a5a6bf62831527bbccf244413d23f85560fe00a5b9eec77e
MD5 f787ae633cefaa0fcd6a99603158ebd2
SHA1 8431d7b707e11be5973928347d8ea0f3940b13eb
SHA512 ed58ba75b783723a33ccb24f4fd235b952bf3f6f43acefd53114448d769cde3f32d222e06fa5c7cc8e16433417294b7fc7d64cb6a230138685b862b824e0a35a
SSDEEP 49152:4YLM80pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlblN3Oh6tznm2FQ/nho2qkrk99V:4y5112gYy5azzVvG69nLKnhZnfe
TLSH
T1B9067A13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.4MB
SHA256 05b8a7adce144028e94ccbd243ae8b157f4fa9c616108766707b0bea97ff093b
MD5 4cbc2948c9f8a10a54bce8fdb607eff7
SHA1 4e4d3aff8c39aeaca497d8b324eeed9017c2e002
SHA512 ba722ee2fb49b50bf985ae1cf3fce2a756a1d016d531b9ff5365fe0f4b963340d0e0b5c611cf95322278f44f23e15357c4190bccd8b669f6b9ccd68356143cb0
SSDEEP 49152:ZbrG9ZowgOdOBr4tEGv0bqx0z+n217aau1glXRmFk:BwCJmNxd2d4i
TLSH
T1B6C58D13F2DA01E8D05ED478974A9233F962BC490B34B6EF0A9072562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 1.8MB
SHA256 fadb8bc93ef5adb951ba9ecf56157ea08fdf10d8724881c22aed2abc05e37a82
MD5 8f0e912fc7d97f92d52376b81fcc9467
SHA1 c7f9186abd78a4f304f3492d9f0c724f7fc70a31
SHA512 97f1e5da8fcf3b8a9230a10d77d2b2367259ab3a90f067a27b07fea0a1191e979c1e56ae468fea4cdae9b634f3ebb55a7760a3deef25ddce5362f3bc198d1ec9
SSDEEP 24576:SdvdfrfJ1k+okwJFzSCUuCMlBQA6vUQ1zNOgLLwH7ReaQXx34zpTPg:ErfJ19ozTBQAQU44CwH7R4x4s
TLSH
T17A859D13F2D900E8D06ED17887569232EA72BC460B24A6DF0A90B7961F7BBE45F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.0MB
SHA256 f9a1de391598b5517a8b77b571aaab82d3a5a07696b2588a8e164a3113b583a4
MD5 e4a0d7e9cba35f9f03a285cab8e0fd3b
SHA1 136c11843cc0fc5263f8a3a3137398fa339776db
SHA512 90e4f596d9d053e591fb49d9a74d59ce17a3aa2ae1c8c1b34bca2af83795fdd4e80e9049a3de201d205a15da7cf73929590f0432ff85060040825e41e0087cff
SSDEEP 49152:FUwEQ4E+RQnI2eRVtOnks6NMHqy4WONgvAL:mEhrsi61y4WOX
TLSH
T14FA59D03F2E941E8E0BED67887669236EA72BC464B34A6DF064072551E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.2MB
SHA256 42c0fa524419542dff3e56a27cd348549e39da307b939f163af59281258627fb
MD5 c0ebbc653ac67f58320dfe76f81419ad
SHA1 cc439b94565cfc83616ca099497d059660ca86fa
SHA512 fbd07f4a5ec9019513c28c210b24ed8e3484fa6840ca55e2a101d3456784ebc9545716fd2a87fa8dd63228d329c4be15530152c1ffd715be22e474958b4a089b
SSDEEP 49152:flzRpdBPPXyPjLAE3dGGj8bvEGcjesaNkYQd0XNJKcvaAcPTY6Y5A6wV/W:dCbvjiBDlZP3
TLSH
T15CF59D13F2D940D9D059D078874A9232EA72BC494B3166DF0690BB562F7BFE06B3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 1f91689861d9855b68e0760abb552d56c7518c87378501305e19a65d779bd879
MD5 a7ebd1a0131efaabdd4879912bed1732
SHA1 7c813af7f29bf81f6380984c42730f67b943109a
SHA512 c9b8decac7db1c7b4d09a72d40e6c10a26e20bfbb4b823decd5ac138bc2d9d7086c00358efb0a88b928adf5ccd6aa153923abe4da17d06cea11186c87791831c
SSDEEP 24576:dgiv9O0rzMvEQ1nBKJyUgP/1zTi3iy9CTn0AP5+2QLi49K:dzrQvEQNd/1/giDn0AP5w2GK
TLSH
T1E375AE13F2D901E8D06ED174C7468632E972BC150B34AAEF0A90B6562E7BBE45F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 333KB
SHA256 afaf3b0bb38774347c2437374f1a33479f32ae1aea58ff004197bceabcd6a201
MD5 0640827e95a6d7eb6d3fe65bc5cf961e
SHA1 eebe034eecb3cdf9f72fab850d6b50ff3de10089
SHA512 9464990d77500c20d9e83cd743500ce30c18c96d006ad7f03f755c7c6da8bb3450ad88d7df74642bb9fd039bb1cd4ef1621ddcfa39a263981de68fcad6614127
SSDEEP 6144:cOPIMvs9CxWMooj5VjOCc8mGHYV/PvyjSZCr3d:cKIMvs9Cx/oo6fgcPvyOUR
TLSH
T16E74AEA5B3A018F8EC67823EC8554D15D6B27C5A0B70CA5F13B836665F733910C3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 333KB
SHA256 b992a0dfca5b2421b43fa1c1bef0d4490fa95c76cacfb524396ffb5143de97b8
MD5 9985a42fa9f7a7fd4b535b389570a66f
SHA1 194f84d41215cba0d41a1e64b821b297a0846ca1
SHA512 daad16618b17ee76f484e396fd73610213ad59454512fc1e102a9ba87bb89c1c29aa07ee651d0fafea91616eb63511fdddcec67950f72350573f0a987d13ca3f
SSDEEP 6144:7cpcss9WgZrQy0CNVsV0RtTwzzYutYPDvhh1170:7scss9WgZrQ7CN+uRGzz4PDvhdI
TLSH
T13E74BF65B3500CF8EC67863ECC654956D6B27C5A0B60C65F13A4366B5F333A10C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 540KB
SHA256 cf42ad69dd52ff2d5f9fd998f232dbcad9dcf8b6f37aba10090fac2afc931475
MD5 78bb5be918ca45821e8a058056bc5319
SHA1 4907e3843d6cda12d7daefe31c3d3005508a2840
SHA512 84a7d334419d061370b38b1afd5fcce34423d0305876e24aff9dee4afc5ecaba25539362a07e1d1946df7801075abd89d0ffe4336cb9f376135f1e80fd9bc3b8
SSDEEP 12288:q+gfgKs9O3o9yWQWq3G8/gLbbdIv4D/UlBDZ:qj1o9Lq3G8/gZ/Ulb
TLSH
T12BC46B90F3E414E8F1B38A358D764611CA767C9A5B61DE8F02A8265A1F337D18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
Size 333KB
SHA256 15780398c31670344bcfe0e3906413bc59fe8f0a748fc2d47566b85f16e7ed4d
MD5 459039465d37dd4240a3599d263126c0
SHA1 23471812b7536d0b3568e5a106fbc0c694bed332
SHA512 96aa977c58c66344eca1869a9d1873e7363772b8267bf816f4db3edc739e1afe36a866ea5ed6d66191c8f11a5c038e296502ddc9ae929fd53cf64364ee27e989
SSDEEP 6144:qbPxigs9pq73jgjeZFQF6wrAOYV/Pvyz2G9eW:qrxigs9pqDjgAavcPvySW
TLSH
T17E74BEE5B3900CF9DD63813EC9658906D6B27C5A4B60C65F13A4322A5F373901D3EBEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
Size 142KB
SHA256 d9a5f48a0673ec686346dea03d0088e61e2da8c3af50415a76a84c66c4333e48
MD5 2264bd29f98323e86bdd5a9f7e862556
SHA1 a32b1d8257b9ce4545672a0f28081f4737a66095
SHA512 d20fc194e52e025346dc404807698fbb613b35d42a19e44a15b77f042984bd2f04f23e728ebe8a8ab37f285f4942934a71bbba9bccd20e80dd7e446445b7888f
SSDEEP 1536:WvXuhi3ugLXjMjl+5Fs8h8Zs8h8o4On+uvVK7qjh3rmKPNbj7uPxHH/HJEHU0hAr:xU39MjlXEo43udtjZqMNbjuxHVONI
TLSH
T11BE38DA1B3E92885F2779FB2D8B88C2149777DA95E70CD1D2295710E0E763D08078F7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
Size 333KB
SHA256 1faecdfb50552ca4125359ea8d16c168d67b0ea35cf27a33669026b82bfa9ab5
MD5 0c943fc5ee9522a3f4ecba94980ed04d
SHA1 aed4f0bb576365f9c3fe747f30d2d35b254f7b5c
SHA512 f3e88b10fcab540988e64a90b3d03485e7cf32b802373573e978feb7a01251fbdbe4dc9909aa237606f29b9e32328670d6c86d8dd396b29fde1a0ede36647134
SSDEEP 6144:/Tu1xs9FtvWCIwYvBs7Z2v43zWYutYPDvhfPxbKdw51LdJZ2B:/61xs9FtvWCNYvCt2ezW4PDvh3xew51k
TLSH
T19874BFA4B3501CF8EC67823ECD658916D6B27C590B60C65F13E8326A5F333901D7EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
Size 540KB
SHA256 e8b100d937cc5424e9604d86c6cf4aa0c6dbc4f4ac107e4c450b634c1071e930
MD5 62e5619276a622622e82d5fd6a4696e9
SHA1 284c58c48a6dbcd1a9e30947875565409769141d
SHA512 150ab115684e989581aaf2c7a832d4a0516646e7b182c761acd381926f746ef81dedc1b0fe702e851e191ccc27d3a022150b4c8d997b300c598775886456d8e0
SSDEEP 12288:Prsw8xs9fytj0EsUM93y8wLbbdIvNklis:PgdtjpM93y8wZwvs
TLSH
T1AAC46B90F3E414E4F1B39A358D764511DAB67C9A1B21CE8F02A8665A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
Size 195KB
SHA256 a009ac984e6e2dbc5aa36150b6f34da70cedc2128ff7283a49d58a14c100333c
MD5 73a90fa45b61b1115e81fa6318f3cf41
SHA1 342fffd5795a70a2704a02860ee87b42b28cd040
SHA512 aced7b0067861279f9faee9f20b1a504422cf6e5c0bd70707d0507ce669146facd7c6b021b02667906ba75a5ed0ac9d964c424f980378424e5e155590bc453a2
SSDEEP 3072:/kh7xXtQikhjnU39XY5DEmd/MjgvhagI/f1OFOPqxqtOc7OM:/OQtVns9I5DEmdggIn1UMr
TLSH
T1C3147D4133E804E9E977963AC8604541E7B6BD661B51EF9F6390611B0F3A7E0AE3CF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
Size 138KB
SHA256 a3242544452291c90ccfe9cb58002d9956bd71293f61b58cd9b9a1d5dc3bf5fb
MD5 94921fa8187da0805da831be2f335e67
SHA1 3a3f2eba20f8a785a1e80710842112b339a9dafd
SHA512 e560a9610647a24c6d69e3c51af18299e6417d92cb7de67e7eda999a938452a041390aa5ae20df91f4120532254173d2c69b3abf62b319f7022d76fa064e87f5
SSDEEP 3072:I5Qb8YU39b28vJEisdBziuxMmRtV3tOxScG7JE:2QYYs9C8qdBcmRvugW
TLSH
T19BD36B5163FC1498F6B38B75ADB580119F3ABD611A61EF5E9290410E0E75EC0EE38F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jre-1.8\bin\java.exe
Size 333KB
SHA256 4afdac15e468cbbf7ac241adb570b80b23a3498127ecb08b4393437f80ffec47
MD5 8270d6e9a468a49b4c8bcce150820ecb
SHA1 6199725fd0bb9e5898a3f491388f6657ac871479
SHA512 47937ca9f2cf92ffb284f90e4567b276f8f547ac88367fae260557dd3288a90bf5e33079339dd798454567f9739cfbc3931403b485e8c9569dcb034f1b97adc2
SSDEEP 6144:TDPrs4s94iUhDSjviKS1bKsx4YV/Pvyzvi4Kc:TDrs4s94icDSmbycPvyza4h
TLSH
T1E374AEA5B3600CF5EC67817ECC659905D6B27C590BA0C65F03A8362A5F733A10D3EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
Size 142KB
SHA256 585dd3ccbcf26e13cf4cc47f283154ebb805e6594b3d39ef13e91e538389829a
MD5 29dc9a5ef312e1d27948a140c9a2f5d0
SHA1 ca40120b5aa23befe47865dbec13182b3b054d2e
SHA512 a77d47fda84393347f254ab02bd27015a6fa760a40164bb797e0273a2d2469d50bad764b3cbcf0fac731441ed2f53841162047740f6acca17704257164dc1424
SSDEEP 3072:dU39MjlXEo43udtjZqMNbWwx2kcvr04pAt:ds9klw6vvWkur04pAt
TLSH
T150E37CA1A3E82485F6379F729C788C214977BDED9DA0CE0D6294710E0AB37D58079F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
Size 333KB
SHA256 6327e25403ecf2f43e268a1cafe5141bc4b188a154c6f5a8084f90287a199e52
MD5 e942e47b01b17fd2cfd22636830fdcc3
SHA1 e7d2215b4f34899a448f261f9987402efbd3eb11
SHA512 654d15203e177788229d183e24309b2bb26448002a4697ad85fc4203f3225272906fae1b448a56fa905772dd7879b4621d28d28d06bef3521c4638c031debb7f
SSDEEP 6144:Ts2Vxs9LV4xNWYt3bsmr6ZBMz2YutYPDvhqvHmzK:TjVxs9LV4xNXt3I46kz24PDvhqvGG
TLSH
T11974BFA4B3501CF9EC67853ECC158916D6B27C5A0BA0C65F03B5362B8F733911D2EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
Size 540KB
SHA256 caf7690bea4e01cc260b064d1be788fae5e76062afc09d785ced2e5023724250
MD5 5c9930ba96d130db4daf296a2331c8fc
SHA1 2bed43ef765ed3ee4bfc948b015f942ae00007fa
SHA512 4c982e5a1528607ccdf3b41353b3d246831db4d7151031f8cfd15c2bb5857de1736c5356503c63d591470c8f5601c19e431696e444e660b22eadd7050d9fd3dc
SSDEEP 12288:ouVsQos94JhzAXTE6AYfBClLbbdIvWBY2AbH:oOwhzj6LfBClZWZ
TLSH
T1BAC46C90F3E414E8F1779A35CD764511CA767C9A1B21DA8F02A8265A1F337D18E39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
Size 195KB
SHA256 dabbe60ebd358e299526cc1f8731c60f230184415ccb90b156be0a71745de4e3
MD5 aa410345e6ff0b239942db9335cd65a9
SHA1 e4a9a331e224d88503cd8133c75593233029fd0e
SHA512 e58965e0428456f35ca29b62ff7071e335ef39e6783a133b6cdc37a6e7e872a06111a29875b65ffb97508a67d8e5a86b343823adcab09e92a7d2e2ceac2b8c2e
SSDEEP 6144:qUTNqcLQs9I5DEmdggIn1UnWZ3rTBIid0LE6NE:qyNRLQs9IBHdBdnWVf+w8E6E
TLSH
T132147D0033E904D4E873CA3998A04501E7BA7D921B619FAF9395715A0F7A7E19E3CF36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
Size 138KB
SHA256 c5209d74f61808f365002e228459b2398a8b5c25c79dbe52459faba018c38fda
MD5 7a29b75f415486ba3e0584a4469b7d91
SHA1 9f95ff1384f26e51043972d0795b42ea17d05ba9
SHA512 3f0e9a563abadf2c8d8d8faf39db8c2a3b1bd1dfbefcb60e0394d3b80bcbdc32a001d2aab5d384803a72784d86e7056b555cf3308f30a9b0a3065590604bd1bd
SSDEEP 3072:f+Qb8AIU39b28vJEisdBzYMsx8SdzvD/rSJhon2q2:2QYAIs9C8qdBp5qzvD/rSJW2q2
TLSH
T1B0D36B4163F818A9F1739B74A9B449158F7ABE615A20FF6E5380500E0E78BD1DE38F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
Size 4.3MB
SHA256 7cdbb47363f9a03d7060597dbc0ba197a81e9c3c1f6210aa35d4ede7e9ad03a9
MD5 b1d092205a0afe1324a02aa973126f5e
SHA1 03916a0154d2f0bd8012b491caa9b0a9db16b449
SHA512 fec713f479e3f81c2bbd9a7cf2eb4f6c04c0154af0e81b9d5481dceea41a9f153f2f941b9e14e36f97f68387fc49fb9e7fdfbb623f9bb32ab07951e369b2fbdf
SSDEEP 49152:F3GPG+VOabZJrmWuzzF5/X5Mw5LDdLyw6CHXLV73beuuxUdA8ybPrPTCLE8NRV36:F3FqbGfFQOL5jWr7CX5CowTEm
TLSH
T113265B556BF880F5E1A7E178897AC6B2F7B678420D31EB4F0191CA2F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeClickToRun.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
Size 4.3MB
SHA256 d3bcd4dedbf1bd0a068e3c0a21d0fe17c34ccf59f216a448d123c5678bcbc07e
MD5 41066c1eebb04c83b6f0ad2289fcdfce
SHA1 f95c0b52de30215bd5b98fcf565f35af7ce89601
SHA512 293b7a24f5acd296bc05349804aa09cb600f1967d99920a2afead755b79eaeb475c31602cca43697db4edd56be10da84143e7ee01ec38e50cd8491a3c3d2d32b
SSDEEP 49152:9wf4vbLc101hKYbIfW7bYOJwz9LGdJVPeR7kDoH30eub97MNAVC0Puihs/+8NRV7:9w310pl78hLylJPXh25CPw
TLSH
T137265B556BF880F5E0A7E178897ACAB2F7B678420D31EB4F0191C62F2F336905D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVDllSurrogate64.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe
Size 275KB
SHA256 fa88f99cf8fcd3f21a624072f4596fc8e4f1591cdb67dc0bdce3e4fe9c1bd13b
MD5 fed873817cde24ad1de4ecf166520b33
SHA1 554ccbd951228c407e9a8e2adbe5339844d50dfb
SHA512 3abf6fb3a91785eca5a5c0501f7283a8a8b5922f817f8b72ebda544365acd8687db8c1d0f3607e03f78c05306336cfda447cbfcc42433e3c394a0d2bf9e1053e
SSDEEP 6144:3i97LBs9ZWGNTNYdMzATVkQNUO7q5wqAmqF4tZ:yxVs9kGNTCWsTGQ4SqjqFWZ
TLSH
T18B54497BDD28F8D1C37E5CB56791C700AB32A1704B52638BE139C26EDD132E15E6AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVLP.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
Size 588KB
SHA256 f29e62ce9ff31040459362ef4ee12860dd19a72cf40ef9d43130f2b5be13eeae
MD5 302e98319cf266678b73467f1d7b819e
SHA1 e65033ed24b5c9a9a8c9de0523f5d13aacc1314a
SHA512 3c7c7c10df0899ba244ffef16139b6c216e18755e3060c76049607f98cb8876e545512791b62e596c19b47fb9c272d735b727a9de79db8b36e97d030db39aca9
SSDEEP 6144:r2yLswQQ1T99ZLF7KfjkAs9BdTxC7JB/UhOo4Wp4hzvNUXITiXt9Z+M47iUlfZtA:KyZ99b/As9VFluzvNU4TEYichBt9Ieg
TLSH
T19AD47D76EE28D8E1C27B897896968600E6723C510B61D7CBF17CD27E1E236D05E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Integrator.exe

Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
Size 6.8MB
SHA256 d24027f7ff49948b1b80a11c8f366c3b1d9be2027048e0db68c08e0dd13e95e3
MD5 5bbe3508e13ef82c9aed2b4a9577adf4
SHA1 9279d9ebc95c511dccc57cb95a7b98ed839486c3
SHA512 b5a06d0f93bcba9d32cd471087bf9a0ea4ee74c81324d5e528da105060f6b76dd77acf771c950584f19732183c9092f1c74fc44473446ee1419b01e8e8238bfd
SSDEEP 49152:mCQ5zj9M395lCkD0BRKjwm8deZUa/hJecv2Cq9N+9DomTq060gPQ9zOB17/xYtuu:mdZIlz+WtvmhnFB1GWyhrrmqJjeb27v9
TLSH
T1086629596AB481ECE0ABD1788D778772F67678428E33661B0361C61F2F33E588D19732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Mashup.Container.Loader.exe

Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe
Size 100KB
SHA256 3733cfbe0c5d46a467d8bd94f7ccaa3cbda7afeaa2c562d7295f60b8738b8d1c
MD5 0859d1815fb4012fabfadd855a8065c9
SHA1 dd07423547c45331e67ef79b30678c35f1506181
SHA512 ec761a48f11d34073e0681c19451b09b78f502499ecee010970c6f6b4bab2967570e7d3e346412627600830a01e3e03ce4a4ccbfa6fa1c0c1444c561a616c886
SSDEEP 3072:0XcUU39IeAcId0mAyBl2GAyKo+tUVyeBwvGyyWx7:0XVs92d0mAqgIpVJw+yJN
TLSH
T132A3D102378D44D2D21602788592A65AF676BDA10F31EBDF9264C24F1E33BD1C9F4A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IEContentService.exe

Path C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe
Size 449KB
SHA256 c34cbc607f878a8ead0b66df252518dafcbc4e4dd1120643f3fd77e8035aa184
MD5 54eba522145af2294a660b5a12b025f2
SHA1 eb793b4bdde3de91d6e27efb8dfe17b44659e7d5
SHA512 0d329c1b532cb612e44c087f48e047c4b5662072a72370a49ce080fed9e66893ed20120368ccf1ed6d8af9f3ba4edbc6fdfe1cf7b45f4b85caf34a3daabab092
SSDEEP 6144:LGJRCGS3LoIaugusujDZb/ke+QMZ49s9x0oY5jfcbvnmwVFwel83Thwdd:qJRuLoI/gu7Ce+1m9s9KRfM3i3Thwdd
TLSH
T1EFA48D8AEB9454F5D657E278867BC671F7B2B8890E20674B0665C36F3F33A506E2C310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerfBoost.exe

Path C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe
Size 877KB
SHA256 1b3273297c217d0cff8e86e73d35d7a277c553f05d16cb98faf95093eb1759d4
MD5 f88eec6b75587d7b5a241a4236a4400a
SHA1 ca1166a855e4689192c771f1a6357536df257f86
SHA512 856fee55b7ef951fa8acb126e86bf3827c37607470c7d2914f6ba39f9d8badd2707db29d8cc08d73f8ff1bc6af8170c609b1d273149980c7b95bcd17971e5ff3
SSDEEP 12288:YaS4kj9niiFTBYs94kNGj1L7baq/eAvpEeZob4UnV5BMw9dSfS4Uu:1S4kj9niiFTojl/b/hpEKdUnHBt9Vu
TLSH
T1D3153995ABF845F9F1B3A67499768572FAB2BC521D31D31F02A0C21F1E37A808D25732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDXHelper.exe

Path C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe
Size 189KB
SHA256 43b7c03d1632b63b6b45f8dfcaaaa2923f941a1c66fde769965d7eb62e809a2d
MD5 0a030a5bfd46d36e3f8bc9f49fb19577
SHA1 b563579e4d8d365bf1a76945bf369635d3d8e2e0
SHA512 2a9960881d3a018289ca3a43d29eaaf4c737219e0209be86441d13dad1ee62b8bfb49f4311ebbe729ed7c8d6999838a6be0f572790b68e2f6979af24088e3994
SSDEEP 3072:5M9hSC4phNq/D1U39xV1Q2+zT6lZdAh3SJxfFrgrwHSeFJ1VsDUY:ghSbLNq/D1s9x8elZdGaFkrqjsDUY
TLSH
T165148D467BE4A0FAE4039138C9A9D6B1F7B7F1B21D20A35F5265D25E0E332D17E19B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoadfsb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe
Size 2.0MB
SHA256 31f39a9876f5113c5ff76ccff9f496f5e483c0232368f1a48e48a262f290a1fb
MD5 b9df138da109cc7b6f8569ebfdc28751
SHA1 b83d1fbc4896580a5c6df47b1234fcd554a6ef56
SHA512 453ad803818e36dfa19cd315bf26217c96e5d4cb3ea5872f9e87d620e0aab306522e53c63a4b8ceee2851071f2d20931e532c68864b2ea8bf8ceaaed7efecf7d
SSDEEP 24576:2EMP4AGYVqh/09CeaysrqDTWQi5U/2hFZrVf6Ln4izRaR010dFT7bK7+6mlvKp2B:2r5MhM9rsrqDTW3K/OBizw01GFT7bhlL
TLSH
T1BFA52956ABE8C4E5E2ABE2789975C9B5F6F2B8510D30974F2156C70F1F336604E38322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoasb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoasb.exe
Size 341KB
SHA256 421751ca815215027e818607cf13635d9386e8a906fd5ff0dc9f6b40f43b1496
MD5 ac73795406d659865a945e1bfa505aa7
SHA1 43b7f707e0911a25ad9c01b594a3c8f5c3922da1
SHA512 d41813b492ee0de22aa701dba31944f3e6d0409d1886ef760e9dcbbdd37344878f3220b720cfd4765f2dcd5327b5f59891e69f6be71d1ed5902c8e317abed110
SSDEEP 6144:PLNDs9i36UkPPRZ78YGaspINQ8Q99bhvRx9EiOwZexhvwNUIM/f6qkr:P1s9bBPPRZIYGaspaQ99bhvTmw4vwNUc
TLSH
T1027439577BB88CE1D803A1788996D2B5F772F8614F21D30F6962C32F2E37261AD19B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoia.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoia.exe
Size 6.0MB
SHA256 80a24a6102cb37f26cb32f16b6d46896691fb05ff12dc3065735285e3a1572ee
MD5 de5de649e4c749f70d5108160939594c
SHA1 1e48b4c5a0c7e02827ffb6c62ddfac79b3238e79
SHA512 f199a3654ba50322e3b9a1fe04eb6e8d6be414a859d45efe4a784eb1854f8a7b87c1670cebd1fcc5a3a13f28e7de3fb610b8faac5cfd2a3ee1bca4abd7517f97
SSDEEP 49152:cTIePdliGKzs4Xye5H3dxqQZo6yyQrvNUiDL/FUMIj0ECb6tpU/K293+XQK+P5jI:cLWV3QvXiS/5KZCLw21maUZ
TLSH
T177564A55BBF882E4E1B7D134CA7286B6FAB2B8555D31A74F0551C31E1F33A909E28332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

officeappguardwin32.exe

Path C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe
Size 596KB
SHA256 9e3146f328bb687ae1e01fcb56e282ed7b98e6d7e1a789fd4e0daa20f2cb2a7e
MD5 9f85d3a0efbd6f1cc2c5c6db94aae4b7
SHA1 99be8171f28000f4728ab426b82030b30011f25f
SHA512 57e157e2decba3512a08b306c1c1a647df2d0954e9279036df51159345d9aefe11ef844f9513b662350e32d259d0f80f95854ef897be99f6719c4cf5274b3a1e
SSDEEP 12288:XIiBG2dg4XgCBvtDgXNzs90cIPr0lypFpPkRz3dW:XIiBtg4zYNicAlc4NtW
TLSH
T1D6D43A41F7A882E2E566A5388A66C170FA777C170F70D60B7559F32E2F33640AD29B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocolhandler.exe

Path C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe
Size 6.4MB
SHA256 c4b42413085da67bbc102c73ae7560ce873162526958e569f25897f196130ccf
MD5 9b948809458da4136df0946200acd3cc
SHA1 da4dba50b1f92549ea1687ac63d31b688a29371e
SHA512 fa4ed76493d26dd394326757d480d8616136d8b8867b4f507a006b52019d79582a6af74102681fec04836802a6cc96282e875040b282638f38d3206343f38d3a
SSDEEP 49152:cPppachGQowex8iKBv8dJj95aXDaxdDnwyQ4b/iBRwth4JjKwQK6va6NbFWXT38Y:gXsd3pirjc3NS5+oizHj+6y
TLSH
T12A666A417BF880F4E1B7E2788A3A9675FAB278425E31AB4F0151CA1F6F776508D29331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OLicenseHeartbeat.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe
Size 2.0MB
SHA256 160190dc462e0e636a61add6a848d5bf776c3991496d7122db3b8a9693af9538
MD5 0c558222bb3ba2330c33dae542d171ee
SHA1 d2ae383c822fb024c1f9769dd8a29ec7febdcdf4
SHA512 81abf3d0e28c4c46b3e7d8fdefaa64c013faa15fac11593ced8b64021055f130b719e9b7880a15deefc61c1d5d92a62ad2b7a1a72d9754ea84486ff12aaabc51
SSDEEP 49152:4c9aGnjvQRWZawMMz8zZh2N2YrU98xjqrAJ:vJ0O
TLSH
T16FA528516BE881E5F5BBE7B89AB68979F9727C521C30E60F0156C60E1E33B408D39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLDumper.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe
Size 222KB
SHA256 a4e5b16758ef03ecb512102486cc4d7b80fcc45ce7d5311d25813c58aa63c5a0
MD5 e7c6d5dd689452cb0f692204b5f99bf9
SHA1 8b0b4f1036b19b73ebfb68a74fe3c41663232a2b
SHA512 04701c2a6fa766e6dd6928f9347abdeef959788caedb7c1c419960bf391173adce2e01ecf1d3987534e407a35aed02551b0d637b1ff641af5bc8ce593028c0bb
SSDEEP 3072:XS0RSeuSJt4U39iaj4+qrSVzN2Bmt+hlrcg5u2i:XS0RFuYas9iaj4dizx2i
TLSH
T141246B4077F91018F5B3A6719EB682526A37B9956B30E7EF4118C26A2F73BD0CD34722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohub32.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe
Size 2.0MB
SHA256 d7e6fbb2cb7a7555c36c58ebb9f1cff2f853a068962d8396b609cc69bdd22159
MD5 e31f68256f68a7f98192f9bef2839012
SHA1 bd1f9e9ea4dec19d6ca7728044da8e0345a279c3
SHA512 716d9b30cbb123e971a012994048f7d59210d64deb3867ee165b2fccece60f46fb211313ff4a35e2a39c299e5d998308f3659bd7e8abd8c8de464b6a717075c3
SSDEEP 24576:EuCGydFM4YGgRZassaHykIHYDM52A2NBH3NRLOsl1FVwQP77wPLBb4FgwPqe0PjF:EuCGydoypAe4ULOH+MYu8m1/p9+1
TLSH
T1ECA55985BBA484B0D526A1B189A6867CF772788289334F47318DDFDEBFE32604D59331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreporter.exe

Path C:\Program Files\Mozilla Firefox\crashreporter.exe
Size 3.5MB
SHA256 8f02885dbc2f0afade58405211b4a2a1c2dd7ea35933b5ee9cfffeda79581b22
MD5 0cdf0dc33caab2f26a4c80ff17d7aca4
SHA1 cae081d269e8b2b77c88259672e11ac6a0af9c3a
SHA512 d88068a853d9e715ac911923225796ac9276f1f1a4a69b9f2f69dbf4665af663630520fb59dd582f4604eef9da09b323511e150c5e8e622c3560a1db30a6f3d8
SSDEEP 49152:MGAy4LTzOIFJTfO28wsz3iDT4JmeDNB05FQz/5TmXLhm6kV9wjDDGg:MGxaOAJa2Jg9f05FyhaLhm6bj3P
TLSH
T163061842EB611DDAC025C0B482266723B761FDBD073036F74A906735AD68EE01FF9B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox.exe

Path C:\Program Files\Mozilla Firefox\firefox.exe
Size 777KB
SHA256 624b50783d26015ddda6e41f8143464aee6fbf9f65f4b0544e7aad3bf08616bd
MD5 967214b2fd42a491601995c58de92cfc
SHA1 77a0539c30f1440b22e74b6fc573bfeaf68ac93d
SHA512 08bb1b56a295e617ffb37b22afb2549a199284b80da4d07b4cca19294c57aa83641fd24c06abca2348cf52e2a35a70b303bc684dba18ea5257d04de9b85f674d
SSDEEP 24576:TM+79Aq0lp69jwO4SwpemIwpelzEcutJOYGcGu:o+79Arlp69jwO4ZpeapelrutJOYVJ
TLSH
T19105AF03F38516F8E08AD5789A42D133A5723C840B50B1DB1BE93F2A3E71AD56B7876D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
Size 329KB
SHA256 9c4040d818ac049347724d47223b007a90d1b9e1b6d2aec6ac7fa9450adaac44
MD5 e2898ef6145bfca813fe338375fc7b5f
SHA1 a8ecbd40937f800d3a7e9b3397840660045992e7
SHA512 832f935ddc5d8cfb3af96a2530da1950985d444af00cf5a2e09885b50e689f26a11bc79fcf48e88deba271f20dff5666398088456517c2991c780665d41ac3ac
SSDEEP 6144:/es9RB5aym6V5uHtn/E1mvF2lRbsu/iJPsfUrcA5QyjpmVmitz/Q:ms9RB5aymg5qd/V2lR52czA5aLQ
TLSH
T12374AE24B3E40CF9ED67827CCDA18811EA73B8944760E7DB03A485661F237D85E3EB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nmhproxy.exe

Path C:\Program Files\Mozilla Firefox\nmhproxy.exe
Size 654KB
SHA256 685cb68cd4497b1ff2f31e31441f58f64579f7d474b23b85b2ea9e670c8ca713
MD5 21f5192d4971423f1406a34ec394187c
SHA1 999127338a8d86c759275264c255d8efd7266043
SHA512 667c1c47695053c1201ddcb2d7f46b7cdadaecacef56ec2d4b1b0e53fab93cdfa69711d520103af14974af3d66718eccebaae1adc417edea6e5b14abe8a48074
SSDEEP 12288:Fc5/Ynfr86IjxOVwcGyRxs9Bfc/waheN3OMuCPkhPD5:q5/+j8lxS4iU396D5
TLSH
T1E8E47D02FA97D86DD51EC078874786327933B4CD0B30AAFB63985A353D5AAE12F39714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pingsender.exe

Path C:\Program Files\Mozilla Firefox\pingsender.exe
Size 126KB
SHA256 2f1df403b88ac0cb7482ccf7212038387a70974d118d9e225abb95ddb293a193
MD5 49b694987beedc077b0554c562d5a201
SHA1 4c28997a7d9d6f3e3303367845c29053de34ec8d
SHA512 68bf852a448b2809c426e276ea4e6deae92880926cca80b6a1935a15189f4e4cbe09018d9ea604c0719b5c312a52328dd7715255329ea7f86a8fd6cb5ec55d97
SSDEEP 3072:HX2Jsj8U39VqSh2SdWAAL9a2zYfAW6Fxj:+sj8s9VNFdGHqAW6P
TLSH
T150C3CF43970494A6D665C3F1E4E76A22E73476066B6177DBA398A3103F0A7D02FBE3D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plugin-container.exe

Path C:\Program Files\Mozilla Firefox\plugin-container.exe
Size 202KB
SHA256 8e2fc29cc6cdec27a88df8acfd45416663a0e8ed98fcfaa800b8731575edc9c7
MD5 dd9be95d014f76540329909ff988125a
SHA1 8fa364f2f1e23302cf9d16e18dd165b56cd877f9
SHA512 a72076beb029d8d207ab2e81d0345c0f7f1cb716d499b36c66dcd2b337101d12cd203a7589b638d8eff99a2d6d78ded0929f56ead02659f76ba032e5edbf2adb
SSDEEP 6144:1zkhqCbHs964JWQiAEuD6a7NxFknDIS+BxCYElSglb8:OMCrs96Nfw6ZSmY
TLSH
T14814CF13F78810E5E48DC278A6C16732ABB5B4970B21A3CF266915203F55FD8AF7D3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.exe

Path C:\Program Files\Mozilla Firefox\updater.exe
Size 523KB
SHA256 972bad4076381050d198b5f4c9a2df970c3e05160168ba4b06beb6d6ec414089
MD5 ec13e94f9102d4b41d29813c1eaeca3f
SHA1 60aa6caf254b1931b370f622d5e1fc2bca7111aa
SHA512 2bd27ea80c1285ad40b7ccf927bca7c3f320b10273025e20c0bfb78b7e40997d67c903a81462b282ad6e53faaf48705249c02bce7f2598c438295a474248e2f0
SSDEEP 12288:8nM0Es94YGOk7ofEbKA2E2ZeaDSOJAdGyz6xwUa:4M0AYGO1TzJJ+Rz6aUa
TLSH
T1FFB4AF2AF3900DF8F42AA278C9528511E673FC554760A6DB22E4D6663F333D85A3FB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 188KB
SHA256 1be752b897ca7c5bc3dfb0f695edafb8a8ac1778c0154aad9ca5729025485911
MD5 62dde55262b49baf9b3ddcbc4f6ee9b6
SHA1 0abcadf339f0ea2d2b610b3334853563e6a09131
SHA512 1dffeefd0823f21ce0e09968c023bc11745cae58630c0824ed38dd80135a0d4493b5d572e423a97c44f78fbce16a5166b3c5e1f76be05ce5ac1b77e899ab5df8
SSDEEP 3072:AZDjrUBwU39FNWV8pQFq4XKF3QP/F+7tFDwzUT4Wa:ANjrUBws9TWsQFqT3QF0FDwzUT4d
TLSH
T153145A2AE29812C4C56E6274C7958651B7333C6183E1E3CBA6D0F13D1F366C4AEE9B47
MD5 SHA1 SHA512 SSDEEP TLSH

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads