1257c64d04e3a039bd1bd52cb8f03edafff14d979fd0f43e1ce9703f5a18abb3

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 01:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Size 1.1MB
Sample260727-b4trfstgpg
SHA256 1257c64d04e3a039bd1bd52cb8f03edafff14d979fd0f43e1ce9703f5a18abb3
MD5 a0519525665b59f9f7c96f81b3af7bf1
SHA1 815a0ca1aa1c1d6122a7d580938c33b31753fb3b
SHA512 222b459874d574a792142dce7f04f849ffef86ed0d89a709afbc99a3a79567f572f6f4bbc6978c8d15181a87557e6961ea7b506852052350d0d90801fa3d91bc
SSDEEP 24576:TfwNybXt1XyV9vbAOBxSapZ7CvtpyO8mKONSqmjrc5xaNIBRxmpuMEM:Tf+KPXyV9vcOBxSapZ7CVpJ8PiSqmjrr
TLSH
T106358D4A23A4419EFEA7F176DA17C60BD7B1784A0376962F01A46B726F337711A1E330
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\M:	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Q:	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\H:	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\I:	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\L:	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Y:	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\P:	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\X:	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\A:	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\E:	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\G:	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\J:	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\K:	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\R:	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\T:	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\B:	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\N:	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\O:	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\S:	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\U:	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\V:	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\W:	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1796	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1796	2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_a0519525665b59f9f7c96f81b3af7bf1_agent-tesla_amadey_icedid_njrat_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

64BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
Size 296KB
SHA256 1d77075157e0419f30dd6d93eca9c17dde9ee79fee5c9044f8769ac3383d36a0
MD5 ba33e043b0aa3dffac4cbfe233b2b664
SHA1 530b389a0e42a6c8faa2e192e0d26487594f190a
SHA512 0a135c3c32062206d90aa4db0d7095232e7ca557925cb1a6a2bcd8c1f60eeedce33fa279637702ba2a79e0f1101beb555567ae8ce1ff4be3918610aea034db0e
SSDEEP 6144:heWazuFs9TMTwj+oykG/sx/GZcJtqQ1xbWVIdvHrPe08t:wWa0s9bLy/cyQyKzo
TLSH
T12A549D1A33E84CF5E863C27989519542F7B178954B34D7CB6760436BAF236E0AE3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\java.exe
Size 333KB
SHA256 5dfaa80e8aa19d2c0abce85e57c089a67a5b189f397f26bd18a3cbf4f9ea17c0
MD5 e6dd4b2b0a4322fb0040fb2900e4dcd1
SHA1 d6b88b6a6fc34e06948c6419c4637797baf89b66
SHA512 58508c0af2e16ebe36f5bb86b84614f406221d8d71e59568ca3a14125d268f33ae9d0cdb3dc0995a6c94ca7bf1f3997c4d739cb8e4ff61419f19f93293fc6f56
SSDEEP 6144:P5PRZ6Ws9DY+7W/XjH2Y9unzNxzYV/Pvyu+8sH:PBz6Ws9DYD/XypZcPvy380
TLSH
T11D74AEA5B3A01CF9EC67823EC8558906D6B27C5907A0C65F13B4322A5F733911D3EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\javaw.exe
Size 333KB
SHA256 2f9ee6f34bfbf2675c5e7c6671f57f14ac55a12e1d4abc7b4a777f3028307c45
MD5 c63d826f6443d70ff8d4eb02eac45bf2
SHA1 c39828bb8ea4edeb1c2f33023184bcf17cbad578
SHA512 ac75ad4d08ff1333b61f28a1633df455a7892fde1154c9ae4c07703741844edc02e5f2e5124e4fa28fae821813c7d18ca7be633de5535c7834b62de6a781bff1
SSDEEP 6144:TDDgASs9Wg9LWbUxzFsRsDTdnzpYutYPDvhGzgmjIEI:TDUASs9Wg9LWAxzuKD1zp4PDvhG8Rn
TLSH
T1A974AF95B3501CF8DC67823ECC658916D6B27C5A0B60CA5F13B4362A5F733911C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\javaws.exe
Size 540KB
SHA256 c0e0557be40551fe6846fd67f49f03fe25e29136ca3009475ccaf086d2e46acb
MD5 d6c3ef2cfd0f1aada2495fd0bc2c0370
SHA1 4ea92430c3b94530117a285d32f374cc82bc9ee6
SHA512 51edba96837a31d682ad2110a70bf0f03ac1d42c24a7644d044ccdbf1c58cf632228804928612a2cb91cd8303f51ce179f364e793937beeea1bbee46f160fddf
SSDEEP 12288:LiZrXBs9Pduu9D3aJ0YVIMLbbdIvWuIkrBB:LqGuuAJ0YVIMZ/gBB
TLSH
T1F1C46B90F3E414E8F0B78A35CD764511DAB67C9A5B21DA8F12A8261A1F337D18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe
Size 596KB
SHA256 ce8e5d9ccc397ef25a369b434245f454975cf3a417a6fdc4da980497a7d4e11f
MD5 bd0be07629b3b297917a4526dfb0b428
SHA1 c91221bf988fbe73625808cfe7161ceb4c32cf7c
SHA512 a0af1459c9c2cfad53e28f1bc1bc43fa689b6cd78a9b9a558a2c4318f62555df0d57fac34534c28509e628ef458b03e999509b63691fd1252f3957845dc9078a
SSDEEP 12288:ms9hEpPqFAaHGjznMIrNSFdQR+WDinY9SzxSiF:DEpPq/GUPQRpDinxzxSiF
TLSH
T10ED4BF41B3E846E9E06AC174CA578542DA7378960F24E7CF01E0927A2F37BE95F7A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe
Size 6.7MB
SHA256 b83a1760c2071dddaeec963c8b2337124573bdc0d77d40166c61156485b94d22
MD5 0ba22e354ed9002738662281ae96d9e4
SHA1 7f49dfec77b6a7c3046fd6cae99833d29de17b0e
SHA512 c15ae67e9eb12de27ffa7632b418702bd4b982b264d189d7e8d6d36d111799b27fb969f7a9a4c0b615f8c3bf0c9e01351846b48c8b2ffda66275671e77a5e84b
SSDEEP 98304:hl8YfTaJ1+W9DFB2L4HrZtlPIieK5M0uR7F5e0xt:X8YfTa+LgIiFUpICt
TLSH
T199666C47E3A600A8E46ED970CF2A5521DA353C8E57B493EF129476E81A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe
Size 1.9MB
SHA256 44aa43d1f3187e4831a613bd18190f95222e742f2cb9889b9e02dd868ff1ffba
MD5 3fd7843c53ee61d1ee62b453c9d1a7cc
SHA1 19d4b3de974ac4802325b5d36cfa0c827eb54299
SHA512 22843f987c0a452a8c16a783311cc3e949171e80cca88d95e9a43da85105c7d14228fcb7e986e87a2db5bb5ba69acb1e57ddddb27f5a47443be2db127fbb3d6a
SSDEEP 24576:dtPb+5iRcUmQX64BYrdI0f9dL2NLb9Ld25PTOocJuJ/cIsY6WfvdXKnvsU:fPq5i2U1BYrdFdwpZeToMJseNXKP
TLSH
T16B959C03F69941E9E06ED578C7469136E9B2BC890B30B6DF0290B2992E77EE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe
Size 1.2MB
SHA256 496daaf482d3711ec9206e2c53782e69173b39366c058ce1cf33844595f4490e
MD5 408cf5c3fb254c9a00a3751231610a6c
SHA1 36e0a4dc6bff2ca1f9116b920ead631df315d593
SHA512 fe3ffc5dfa2f3aa6559645cdb6644eab875d447c7b90a6864394cb7541486776616c29e1b80811aea2d4719b39fc271c068c5d4352c2fb6329b861c6bd3ebad3
SSDEEP 24576:ZkMiS5JHivhTXLQpykDihuueR+OIGWIVprS5S:ZkBCJHivJAyGmuxg9CpGQ
TLSH
T12845AE07B2D840D9D069D5B4CA668132EAB27C860B74A6DF06D0F2591F7BEE86F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe
Size 3.9MB
SHA256 42b740c8a1dfee0a45e6ee3249a8b0552d9dbbdfb0f5d325595100d7fd47b566
MD5 55dfd6fc945a67dad0f019ad7175dc83
SHA1 70af86b21102062b07dc40c5fd6506f24eceb004
SHA512 8e4c6e90bab3fcf66d3b368b55fc15b6b7510d56ac4ac11ac6bc14a4ed9a1a703470ee3262274032c1d369554d5d1b1abb700c65df5dc1472cc1cf74a64119e9
SSDEEP 49152:2YSs1Qj8mCgo7yS5YCgB0C5saIe0GD0AGVuVEusJ6LNzOeL0GKVIeCjIp26If2yB:/SjSVuVlcm7fwKAW1
TLSH
T176165903F29940D8D159C074CE5A8132EB627C8D47F562EF3690B6EA2A73AD47B3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe
Size 1.2MB
SHA256 ebb4539292b0186b765adae72a56094ca41736bb59aa172f57f93f914ce648e2
MD5 4ca3e860eff7b0a9cd3fcf7c321dd763
SHA1 c552d69861a0d842ddbdc8af5c968aa27441bec1
SHA512 d3de7f6a0c65da3daf6d1ca44150ae9d3ffe0c48eb5c54c628f707e395390ff19049e3f5e768feee3bc11e2e1c95735f70d3c7b0b6c21c561d2a2f0213c6aca3
SSDEEP 24576:yoYs8T1tNFokXsG6x7pXwF57OuYmtP08muozbxL:yoYzTLNFP6Rpgf6nm9NubxL
TLSH
T1FC45AD07B7D941E8D06DD5B8CB568132EAB27C460B24AAEF0690B3691F37EE45F39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 1.6MB
SHA256 4beb1be81c002ef98ee01196763b883fb6eb58cfed32a3b8ac84350cf51e1ece
MD5 b390a0dbf910eec755fdf1abea293b9b
SHA1 bd7e926e43724b25b8cfa727c7555eac3b280cfa
SHA512 b915b2c39069b1bf3dc3c1429f4ec0cafd5d00aec279647274846d741571799dbddd6805f2f2a15f04aa0f2f4010a22b8a22adad51ffe21c22a53ac6efc8407c
SSDEEP 24576:Go5qln6C+Wc0YxXnwb5UMcFT7lkPJw1cDnfEslkkkkkkkl0T3gAQ6Dk0u3h6:Xql6C+Z0f51crk26rfDPQmC8
TLSH
T1CE759D03F68A81E5D09DC2B8CE764B31EA717C655F20A6DF0190BA253EB7AD04B393D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe
Size 3.4MB
SHA256 ef3a88a2a64629e0a10bd6d77bf45fe3be4fa6b33580323d78dadc4147448b1b
MD5 dba18be3a55278f177f9c9d05f6b6175
SHA1 40eae3ce4cb49922fc2a5e0a6ead1df30fbf143d
SHA512 2e12d21d21b1db29a5330d12172f5147e0e2ddd7665921eb71e38723e1290376cf19bff6b1f62a7fa98a38527ea54ec2f762dbd0ff68a3f4772fca827fb38906
SSDEEP 49152:lqGQTpfAm+JoRJ7qTPq8QTqsAR6lUqMzADfulO7Udq+KqOuBk7bVnU7wF62JtYEn:yQHwful1EE4wsR
TLSH
T107F55803E29900D9D099C078CF5A8632EB627C8D47F562EF3290B6D52A77EE47B39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 1.4MB
SHA256 6e8b0baeb907ff575deb489a12f85e1db8415e96b6c3ec71929cd381aa4199da
MD5 27d2a73e33af21f82d15ac68c1364f75
SHA1 6be1782336af4d49f1ce3d90b601f9c69184af15
SHA512 a013c801ee36d1f9034c14023ca25df9eaca0025d27a1a6969e9d6845e4c323a3ed688b95c23c14cde4031bbbd47ffccbc57cdc9a0ce4c6a44bc033076bee40d
SSDEEP 24576:EaaqciRpqLjVdXANI0D9/wfbvm8+WWnae1qRAlte7R+/:TaKpyj8vDB4zm8+hnaSltQ+/
TLSH
T16B65AE03B2D942E8E06DD4B8CB564536EAB17C460B34A6DF0698B2592E37FE85F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe
Size 1.2MB
SHA256 18756e33e523a1d17fee84aeff75cb624349cdfa52e601ff35bedd21b2767357
MD5 11736c440765db11d3c7a8fc4857d51d
SHA1 d559e1faec45dc4a456f0d29aae68616c748f2f7
SHA512 bf05b11e74a307caed261478ff83d66eb6784e3072707b09b0e621680395ad3940b9e3849e477cbe6dfcca408638bea543d6a9baa8658f7edf3b35ffcc4d4a05
SSDEEP 24576:wh313dLrodjXt4d5e01QVUwtlsX3GHV7P:whlNLrowd5L1QVltlsXQJP
TLSH
T1E745AE17B7D840D9D06AD578CA568532EAB27C420B74A6DF06D0F2592F3BEE85F3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 248KB
SHA256 bf60a3b8ead357f905fcdd9fa011e11ec277da07df4168c7c763023d5fd3213b
MD5 635c8ffa3edfed99857633922b952a97
SHA1 1b55f63959dc9d254e6edb440ffd06dbdff28858
SHA512 3d6608d5860d3d10f5d17bcc7c451753c2519646e33db3a9c114233e0f5e7d3ab225882e9a1f42256c2cbe71793b89c2fb0b524d4983b29f9c605d93bb6d10cd
SSDEEP 3072:fU39hyeQToCqWAEAgEgnbxKy91ozKuR9CbOwWoY46TW8sgyhNCOV5sVPsmJJJMOA:fs9hgt9AEAgRbUyIzR/Cuoh0viywbN
TLSH
T100447DA926F810E6E137C1B4CAD49903F731F87617218D7F4290426ADE63650ADEBF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 265KB
SHA256 cdef502fd236cdcb315b6e727ebbdb6ce86b301e408f481a9eba8945ac83a46c
MD5 a9d73f94d1d71bcec7f5f6a8edc5d816
SHA1 b2dc8763fdd69072d6ac18734d8a4e8068e4a995
SHA512 6f4b0976cad8fa06e0f40e7d7ed0a0ae4fd966570bc1d9ab8069495e5ff391fb26062d5085ad7bc1c300b9d76e7ea45466919b2ee353dd640b4baa8b7484ac9e
SSDEEP 6144:Js9E0pDmra3pBMc1cCYWoht+uoZoJsbEjjBPT:Js9E0pbHyCHo3PJFXp
TLSH
T199444C6925F910E3D176C1B48FD09903F235E872A7108DFF8291435A9E23A916DBBF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 610KB
SHA256 4f16b5c7886e53713053598c636ca1d63e7cb1b2c7389c42d0da3375dc7fb909
MD5 9cf975facd32d2c82241d4a50b818bda
SHA1 b0af1024609491c626a15f04d37232c3155eb487
SHA512 fe6b5058bbf3883c31d192e63412792619172da6b8a929bc141b21232bda6fd7b5c66d561387b063df8fc8405493ab4d603183f5e0e4c22da1073e0a616acc3b
SSDEEP 12288:vs9hTqKkJdjGKDHVl8KSnEQ9YyC15rege2Sa3HfEwJvV3rRY6:IWKk31QuQ9Yj3ew3rT
TLSH
T1ECD49E41F3E847E9E07AC174CA528542EA7278960F61F6DF02A042792F37AE55F3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
Size 7.2MB
SHA256 c25cab388890e22c3e2a2c337299c7bee0cf3d28a1d8de5a16f35c069c8b09c9
MD5 95b7e2f7ff3d8ba3f5afcad3a3964bc1
SHA1 cb7dd402b0d7cf622ac05a02dea8d2d8cb2fe500
SHA512 14c3c111f898152c936e0cd7becb23fa4cb30c597515feee6c52e7e50a55b7490cbe374b11ced1b1a99132e1dccd373c821a9a7a952c8b9101d53377238413bd
SSDEEP 98304:36CZetahq+WZf0XwCsJB2++fGLOxRj2vJzRN+T6frzh2EV:KCZetaWKGIGyxVqzRdDzh2G
TLSH
T117766C07E3E600A8E46ED974CF2A9521DA353C8E47B492EF169476E41A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe
Size 3.9MB
SHA256 dbd79ab9daee8d32fc7912ed2681f1f08665172a2f66316c237d6b9f7248dc89
MD5 24f28c81236f65dfc9623c76e1f3d9c1
SHA1 d56cee1dae4bb60d6f2bed80b1f0c5f07cc0024a
SHA512 06f36dd67e5955ea4b42f4a6cafbdfd80254441b8393a8181a0879649001c2add2a11858a9c2a1c7faa5ab01ea971307d279da0f426eecf8d3505ed7be6cda13
SSDEEP 49152:+OcDEZePX8F5rbxbbmhLbKqm006NPpIupE8Vu+e6NqcXToRzvUqIzYHBigdQBobc:GEiMnHx3mCCJNUhIUBbsH
TLSH
T120165A03F29900E8E05DD5B8C7568522EAB2BC850B35B2DF0650B7562E7BEE4AF3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.3MB
SHA256 7d016da62d07f1eb85a454f8e2b3bed528368189d82b2a664af3c12682738ca0
MD5 8d60360393bb773a9f1c752e3cceea51
SHA1 2900d35df0fbeb5cfadff513625c68e1061773ad
SHA512 90323ccf46c2ffcfc84c0dc8d14bdfb1dee6d6e2e7836713ae63879df470d2d1025d4c5a3741f960eb9d8f5532b4f96047dafd1070285e833798b8b8df38295b
SSDEEP 49152:HhKL27wo7IBwJ9RSE61stBhuXjfS4LWxn79h:GIlirjBkT
TLSH
T1E7B57C03F29900E9E06ED178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 1.6MB
SHA256 16d7b6fab580d277f49d78aa4e934ddd75d28bdf9bad5ff1254d4b2cd4d1495d
MD5 be67cd19c69532940b0c929a134295f8
SHA1 7ffd0ff3425e5cc72596215930870d6ba93a1e0f
SHA512 b16c8fa6c502d5fc4306086d8bae3a11c7de148285f97eee9a8bc9beda1aaf6c18b42f0bd6a0b06a9da45491a161bd879c58c0cd21411f0ff2ea3c850cd843cf
SSDEEP 49152:aW3I7bROsTj5kxI9U7/YAnKTTlXrk9dBS/HoeF:x4pObKTOWF
TLSH
T17C759D03F3D900E9D05DD1B8C7568A36EAB17C450B24A6EF0A90B6552E3BFE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.0MB
SHA256 494226a1cf07145fc20a0e5a59de3088b467d545cbc8c53f7d0ad796a2fccd7f
MD5 6b1e0434480aea4de49cb67144961bcc
SHA1 17bbf56e288bed5cd731f83460cf6423eb9e26bb
SHA512 5447adf756f37a5a6798871879eed74b164439e814ebb4097a7123e387782bb3d142374dbafeb7bc64f6e3b131cdf5551669b41c060a587ba2a28084c3fc30a4
SSDEEP 24576:6lOnw146EXIrJwSHgueEcalwC+Sfjs7CtW7KSdHBxmRkkkkkkklQXBysWA6TKxcV:6cwqZIluEcalwTSrZrSdHBAVf61826dO
TLSH
T188958D03F6DA80E5E05DC2B8CB768B35DA717C554F20A6DF0680BA652EB7AD04B3D394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 3.5MB
SHA256 78a596ab8cb337f1ad0f651b66a6c1ff60aef9f68376769c35eae398f7aa11ca
MD5 1f02644c80d851d8d90209092da5651c
SHA1 68873c9b1aaf7c7f72af5b0a7122da23cbf30c24
SHA512 0d903eaec229c3e8c9d6f7a9f318ecce0368d918de817b763ba8c1ac95bbc84d8330f41b2f913b11882504ca9e8c063396a6bd85e3aedcb8e956feb08ed9ae05
SSDEEP 49152:6u4xvOcGSGvWYz+OOydxhiJhb6YErLz4AkOuaRoBISCaQZCLlrrgWpn7:O26EKpOnZ7in7
TLSH
T19F064903A29900D8D059D078CF4A9223EBA27C8D47F566EF3690B6D52A77EE47B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe
Size 1.7MB
SHA256 0c6c3485494d7537db053187044ec208ec5f15d78ff1749e474518046432cd3a
MD5 1a87c3f04399a5f19b53bdb75b84a604
SHA1 f738c083f27222a14ad165080705d9e1861ab419
SHA512 6cc0e58eac50cf7757adc91514e5afbd01dc587a12f10764ac29e594779501abe02efde5ac0c3f16e3a6f2474029154a349c610036b778f11c2c1312964a769e
SSDEEP 24576:I6tyRp67RKgDmYfauBX7lwVNa4z7pb9LeQuJXlPnyF4mfHU9YawsNdCr8SWTDoXo:apSxrrlwVQ4z7ZteHX04mfHIhoKL
TLSH
T1DC858C03F2D801E8E06DD2B8C7569532EAB27C450B34A6DF0691B6562F77EE85B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Size 4.1MB
SHA256 e206bc18c9fbca017a9742b27d07fee20271620c0fe4e5f80d3bdf1fec716f51
MD5 cff2a697a905d4d86fb1d866bde2cfb0
SHA1 2455787d1b09b61ffd6d99afd5f5694f5b57db20
SHA512 7fc5fb4be3551f7dbdbe656a60a90973e0aa826594e873e1a9e6f56fb0cf0dbcd438897b84c60a2f0753d871655eb425d587d7a5f56765e8052b748f2982db5f
SSDEEP 49152:DukF5ZDFBP8OcZ4vTUHyej3+TjE9zExldDwUIDtaZHWRdpev2y/BarD:p5zjza6d+RaArD
TLSH
T1DE165903B29940D8D049D074CE5AD232AB617C8D47F162EF3690B7EA2A73AD47B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
Size 1.6MB
SHA256 6bab91ead5b57af45ff22b3cc7935b92bf20fc480cfcfa38676317d756325365
MD5 49c6ffc3a842d7a12875dafba306943c
SHA1 13bbbb6f92f539151c7c7aae809f42de498cea31
SHA512 36e2e1a24b4fc8f97ab1b55b74cb0bd539cc1e52c5be80c62b4238476b4af9e3b637985607d8f8e021afba3ae516510261fdaf013a0c5aad265f35750dd86803
SSDEEP 24576:ruZ5dB6LKadtVtbfN9umLDwINsDttkW0L1oaedpEukUoygGmq/StpdMK:ridB2ZdDVhLDwYsRt90Bo7EukU1CpdMK
TLSH
T11B759C03B3D900E8E06AD1B8C7468536E9B27C454B24A6EF0B90B6552E7BFE45F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 1.5MB
SHA256 8c37d8e7411eca3d1d4b293d74fb7507e6b07a58299e05b42e0063a8fc6c8b4a
MD5 e25f5eee651a8dd1e17149b7aaabf654
SHA1 dc62a66d76068f0253a1bfd5d9a628eab040315e
SHA512 f37eb563734eaa535a93e4785821389a7380d242e980ebc105f80a57f06b6b9ef67ae115ede3ba2271800c860b7e42eaa33229f94e2c5a3f1a5faa3babae3e7e
SSDEEP 24576:GjLTc6ozl+o0/XIPuWVgRB64vcVPGsVa4i6h27d3WlWA5E/:qTcfROveVgRB64EFn+6h27dnkE/
TLSH
T112759D03F39940E8E05DD1B8CB56853AEAB27C450B24A6EF0B90B6552F77EE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 329KB
SHA256 8ba8d5ac642c0f1e9c1fd756c941653764638ef3fe22f716c54fbc8d213b89db
MD5 5ef9ccc10c5c6e7d1b1901bd3503d5e2
SHA1 9e12cb4e5f77e0715c459679c5a10d2f77e74571
SHA512 8fb97c4491ed6e9c861c053963640cb862ff24d1ba32ed42d615c708cfe7fdf98d50aeb687ba67d460672af27b90054629b99f29cdbb46f38c33381acf17eae7
SSDEEP 6144:Tes9JAAg69jF5Gi36501sC02lR7vp/iJPsfUrcAN/dr4N/RM5Ft:Ks9JAAg69h5/K5L2lRF2czApdr4NeL
TLSH
T14574BE2973E00DF9EDA7427CCCA28505E673B85147A0EB8B02E4C5691F237D85E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 672KB
SHA256 ac0f99e335391bb666598c7e7511c3bd72f5d6277075e9db47ce71f3aa66ab57
MD5 326fde04c1f22b97557265e858da5b52
SHA1 5f8793e12a0d8fee53078eab62a95d1c37fd9a5c
SHA512 46429cb1862f11a4225cfbffefe5683af9635c1a6ea97662b0165470137c59656c5a01ab1fdcf484e0297c0cdbb7d703f0094605f84e3f53366dd299a1dc7b32
SSDEEP 12288:NQYJ5VO4tUw7rKv+02x1zs9krHscl5jMlXSwFs:f1O4iw7rD1ZrMAg8+s
TLSH
T1C0E43B16F6748335D073C0B9C5D2A69EE97230865B308ACB4286D77C3E67BE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.1MB
SHA256 ce0a7ba7616b0b349dd94053d4ce6b844d6bcbbabaeb11a0c750f9257fbc10a7
MD5 c5b43129c6e31396be7c450691bdeb90
SHA1 cd0b275bdba5985abdabdc2a0aa310ccc9d881f1
SHA512 57de27a3c41853e8bdb30b6084d0fa20199fe02e45b132c2a8c1e69c5712c65587ab6e8647c0e1f0195b2706a6de4aad8ea19e0a272efb504ac0ca9ba28ca5a9
SSDEEP 12288:pqvxBHWSh6xezSCoveBKutKa3OAupghpSy1TIPts9+TmqCLwKzu/ovovSprOoojk:cxFAezSCovqHogupgrvWV6q8wyuaSoik
TLSH
T125351A15F5788323D0B3D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 840KB
SHA256 f45437f18f074f7b28927119aa0e111c293d763d826330574517fd64473e9eda
MD5 fb2058c8105d271bc577224d0560b44d
SHA1 a4936629701b5f8e95f6ec1cdd8ffd3780907054
SHA512 f30b539b95396439e4c526ba02b580e53cdd608d8f07025cbfc2670fb77d9e60e866a5e06c6dad8d9dabd1012527c2de04d39eda706685e67aa60a1faf519c8a
SSDEEP 12288:dk5XB1R3v1rvdrvx5zUPwsE6tWXUFs9rf0Im98Q/Fsc6xBr:dkz191zd/7XUUS72r
TLSH
T1B5055C66F6748331D073C0BAC5D2AA9AEE3234424B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 350KB
SHA256 9d1b98434aaf2cfe7183c1edf412040109a0c922fb4bce529a5a2ef998c29abf
MD5 fd09b9b4453dbdee366b903521595682
SHA1 3394fa22bbd369483812a74168d7af99e54fa070
SHA512 745f8fdedb190dce546fd16d00f4aa8cdfde67815a199160355acf4e4becc3254a9ad40309c1b280a318977a859c5928bb9c18bded944e71c5dbc8a9bdee62c1
SSDEEP 6144:MOGs9dBJ/GKWWBNU6ITLBi0qttclOKgU91BgyLeRF0t:Ks94eBNUbTVO86UeF0t
TLSH
T10574293BEE28FCD2C27A4DB85A918640A77278714F61A3CBD175C20EDD236E05E76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.3MB
SHA256 e35faf3b5853f0abd00e6d9eefb126271d9d6b2327366a96cd0d6b14cef339eb
MD5 6f7f8153245938499f7333b5cf1fd146
SHA1 10c70fdef14aec7fad8b28a4c48d5bbc727a945d
SHA512 6741df2696fc496f9b2fff56efb3c40c6a7155e98991170d143dc6618c09996590b4d9607f91921d2aff586aba6d0284b3315d5b73465ff28fc7567c67b0fd71
SSDEEP 49152:5snPnZ1o0JINJN6j+1pllecq46KLpdpKD2TXfWn3DLeuw0U+sUhrE7QDA7z8NRV7:5sjJ2lpSgLKoT7UAs5C1i
TLSH
T1A8265C656BF880F5E0A7E174897AC6B2F7B678421D31EB4F0191C62F2F336904D29726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.3MB
SHA256 77e70b41a87e2c3375c3fa9979e8b7a84d6caf6e6405713f1913fe04966e8cb6
MD5 2813a73c7aaf92976f738b0859ccc2e1
SHA1 56a371dae0c5bb3617b03ddfad332f3593b517aa
SHA512 803757e62c4e548645738b0dfe6bd25eace63f88b381e130f541e81b300af61e1116092089e7a84e81239f297874a8aa03c4acb9aabc8394072aaf6f24fb3062
SSDEEP 24576:nqap5rliB/2z+L5WqWrHCYRFiV+XenmE3Pnzc344gL:nqazrliB/2yL5zWfFiV+XenmE3/zv
TLSH
T175B56C0976B8C2E4D1F6C77886A2C647F37178154B34A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.2MB
SHA256 763d71251aa9cf412fa99f1613eabeee3964995296c60e5473aba4eeba82b364
MD5 4dc5ac353b6693a5177691ff25bd812c
SHA1 3fad0a62918cdcd56d4af305e9cb126878f56d72
SHA512 0a1bd3d590b2ac46b625f57537e1040dccba4871ed3c85df60e70e99b4b88cc1d80ea6240c8b0883b947fdc35e44ba11eea1f4462bfb261b0fd5e1afe0ec1533
SSDEEP 49152:jjZiNu4TyOblk8p3DJf5SUYLoDpgLjSTYlQcGebAaLSF259ruMHwpXMi4FqJLd2b:hr4tRQyi36YOcPzLvw2gAf+PN3u
TLSH
T199666B03F3B501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72AD47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 833f81a0c25875793e92f033143bee23603563b6605f6502df75c3a5d67a7508
MD5 51658c19e7bf294a29cd5abecb17873c
SHA1 e9876561d77194cdc4c8eb21b2dc00cc98bc9aca
SHA512 c71d94d84d20a43abb3529e2280ec9b12298cef6eab3f2fc4dbb108d4016ea2c50f8bdbb9e4cffa7641073054ac0bb3f8121d6ceb7bc313376e208a61329a44b
SSDEEP 24576:iCvyI2U+rQKreAmDboJ8sS2v7DaHGTNHu7PNU3/5W/ohL0GHBC3L:wUCQEfZSoeWu7PNU3/zBC7
TLSH
T1D2952733B2F600A9D44DE1769F4A873196D27C718FE0D3DB8115721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 3.6MB
SHA256 094b66b2c6ea53763905b848a47578472b07278f5efc05a7a1a1cdad36ac9183
MD5 601a797bcb6361d23c53c5cdea72f847
SHA1 4394afce297c280b9f853272fdf1ceb0faef1454
SHA512 f7bdc07b9fba221f2afd6ccc12893b2f99e6d0a222831ad35826d345f89ba263bdd1e964ba7bf5aa1da50bb1ff39411231e8ac376d93288b051a05c216f83616
SSDEEP 49152:DVibn0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbFN3Oh6tznm2FQ/nho2qkrk999:Xy5112gYy5azzVvO69nLKnhZVI
TLSH
T1F7067B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.4MB
SHA256 bcaed8a3f384ab29da88f2c480a11ce8fc726ebf9d5af6e3318ad6904a8b53b5
MD5 23a42561e31dfae8a50a0a101a52e4e4
SHA1 ebce42501d6f49f5f89360863312cfd957bd26c9
SHA512 9defebf57f186b91cacfb177d1b77461329ebe46995bc944e64ba916c9674d648defa637db22e907fc4a14317b33c476047618fff787d4b2b5af7c46efaa87c5
SSDEEP 49152:mT5pN3EZvOp0JOBr4tEGV0bqx0z+n217aau1glGTi:ecOjJmXxd2d/
TLSH
T19DC58C13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 1.8MB
SHA256 00cd83d244dc354a8515639953cd94969dd8d8af084a61a7a05507beaaa333fb
MD5 c03c5e506572fab4203fe2263113dbc8
SHA1 15374633131b27b6832484e8c487dbcb2ac3fc38
SHA512 eb596ba54ac44688e4fa904c10bc3041acb885f0a2a92a92b32ab9e5d98e8ed6d43e6bee21f515c83c04acd413d9e263d418be4ef3e9c7e2e7394016e065abf8
SSDEEP 24576:xuvzTy9WX5WP+o3i/z3cIuCMWy7AlQUQ1zNOgLLwH7ReaQXx3ArDNytv6:AG9WX5WWoA5y7AuU44CwH7R4xwrZys
TLSH
T16F859D13F2D900E8D06DD17887569632EA61BC460B24A6DF0A90B7962F7BFE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.0MB
SHA256 486750228f15efddf3a091837ae8d4b1a13172cc8c91b1e30cc987780533c298
MD5 384f64b7449476f7836363ffe3a60cd4
SHA1 41114507d92e8fd370545374f9cb687309d7d1be
SHA512 a19f4c6e35e1f13a9a90c6262a1c500bbe3b14ea7f4d3e5c4eefcb5cf6eaaccb61cc03aae89a8a4b7518976527f9fedfd003d10aeb996c2b1f2f3802d90a282f
SSDEEP 49152:oYa5G+QuebV+yKG2wRVtOnks6NMHqnSO30:7d+V2i61nSs0
TLSH
T1B5A59D03F2E940E8F0BED67487669632EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.2MB
SHA256 3eaa25e52ae75e443f522dfa02c658432ff80fbcf63165a2301f8f9b647fa59c
MD5 649528828164ef470274a448ef90f342
SHA1 110da53644fdf4f9ffc5d5c7171823b0f55966d0
SHA512 ff370a0f21650bb93c36cca0316d861ceadfafd8377b2a5a4a998fb5c4408429a11e8a6d0616b77ab7256db7a667b4249ef764ad16b297ebe403be5d05d32240
SSDEEP 49152:kGRUwhhZXnnjLAE3dGGj8bMEGcjesaNkYQd0XNJKcvaAcPTY6Y5ATWc6YA3Ei:ZXjvjjBDlZ3c6YA3R
TLSH
T1CAF59D13F2D940D9D059D078874AD232EA62BC494B3166DF0690BB562F7BFE06B3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 d752b86e7ed40406d0d1d1b1bd8ddd71635479a19cce99870282ad27a7289d9d
MD5 8968121cf3314ed3f3795a36e0a2c081
SHA1 68132b54e082645aa07e4a9fd6b399cfee2b938d
SHA512 07fa6908ee9e12e6aef895b63edc882faaeae16148c9c087d634bf243d61d8fcfb606efd8226f6a115c7a531ed81d441b8b1417acc2b44a2f039b53a7d8a46de
SSDEEP 24576:Avav826hoy+EjPnzXdyUgldid0i3iy9CTn0AP5+2QL/AeWilIY4:AQ6yy+EjP+di2giDn0AP5wLAeWilIl
TLSH
T1F075AE13F2D901E8D05DD178C7468632E972BC160B29B6EF0A90B7562E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 333KB
SHA256 b31fcfe3218ee02e6347e0423cf6474b0d3a92e62d355e0e3fbf084797eb3ae7
MD5 4c38d5d32715dbfd14ee1f9189e9675d
SHA1 e58b30acae08d5941265f6b5245399e012313a82
SHA512 380a319e2f750fa250be6f73ec39cb141ab8cc0b83c763e136052440c0c54c53b40e35c27543adc230c40c36e09ef878881ec9ffcd1616d3f38c0f7391827bcf
SSDEEP 6144:VZPccls9tRLWgCjsfoj5d50W9YV/Pvyvoqcv/YwkAB/q+Wm9Ci:Vhccls9tRKgCHKScPvyvQvoIl
TLSH
T19774BF94B3900CFAED77823ECD558909D6B27C5A07A0C65F43A436265F333A11D3DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 333KB
SHA256 44e16dfbe260c266cb1d8be02d6dddb3a59a8eb4b90b01ddbf002bbfb43905ec
MD5 9d6eacc2522f223db002e2e5e30080e3
SHA1 566a19f5a35fc631378eb453d14b29d88dfadda9
SHA512 6e2865dc4e9df931eb90f91f23881b9fa4d898b9432ffaf51d9df60cf02a6ce3c392cc2cccfc2e88e52ec6178ee27c566c07a0333e0efcf42475a144522342aa
SSDEEP 6144:5g9tfs9MgrUPfmT1HsX18tUtzbYutYPDvhGXAEbL6:5ktfs9MgrUP+T1Ml8qzb4PDvhyLq
TLSH
T17474BFA4B3501CF9ED67813ECC659916D6B27C594B60C65F13B4362A5F333A00C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 540KB
SHA256 0ab188900b7252660267709b835c5801a9b499de5a32f6eb5f4b1b9758eccb7f
MD5 dcc8d4cc6a35ac0e3d0684b8ddabc1ce
SHA1 f12c2700c42ffee3097af579c87bedcc8b185636
SHA512 c5a121f80a0ad6a9b1356b82ffeec394abaaa8d4a0c2fd93b2f5f25927a946fa695b2a70cc0467c85762abdf7593e3b9e3ebdaf905831bc0155a6ca664d5189a
SSDEEP 12288:nY56xoJs9h71EWb4ydymBpwdLbbdIvJArUiV:nY0v1EQNymBpwdZ4AAiV
TLSH
T117C46B90F3E410E8F1B78A3589764512DAB67C591B61DE8F03A8661A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
Size 333KB
SHA256 56a9c194769d447b7d2170d435fec93b599db336499f47599a6f8bc27d996daf
MD5 3d4494b5b4de7ae006095e65828b8cf0
SHA1 042e0b95a1b850527fd888001fc5db920c8b88aa
SHA512 a528e7a39d093273654e20287eeca8645363822d5d4f11e353a22a4ef41206a44c6fc53eab68bab81a8bb466164d5e6f4ab2826f0382ad378090f61222b78cb2
SSDEEP 6144:iDPRSzs9TZJKe9jNgUHBZjGUaYV/PvysYoEs+f1:iDRSzs9TZQe9TKjcPvy0Es+f1
TLSH
T1ED74AFA9B39018F4DC67827DCD158915D6F2BC6A0B60C65F03A436665F733A10C3EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
Size 142KB
SHA256 115c15f82977dfe090ca1bc2e2bcfdeb8274336591788c37aae51336a47ff94e
MD5 709a710ec05217ffc87fbfd11bc00943
SHA1 2580b6216b62b25bc0a72398fb518ebaa8260047
SHA512 d5a6d02c199fcaae5578fdecaab460a6ac8736c540e2542442431f52a492ebfedb80deed5949337c3ba1b6c5ac984f1409c30936b6eab0af544f0ca46ea61516
SSDEEP 3072:yU39BjlXEo43udtjZqMNbjuxow+20wlel5VdRK31SZoY4rXumExSCb3CK:ys9hlw6vvtVFHDRKFSZoJrXuDxSC7CK
TLSH
T1F2E37D70B3D81885F67BAEB2A8B5882188B67E594DF4CE0D52D4314D0A767D09C39F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
Size 333KB
SHA256 a534aee1695f76d5953829dc39a27b1686c425a1f403efb6bb589971f8f20628
MD5 0ff177a5aba0ad729fdbe7ce551dce64
SHA1 a0fa4f6e6c3e5103fad3915dec1deb98ef2fd325
SHA512 7a2c0fe4b72e9778fcbf7e3bb69e34a5b42cbe35ec15906be86979005927b81288df3a27cffdb03d6f3d9aea98df669ffb8e6553b3b0bd8c3835748ec2d738f4
SSDEEP 6144:GRbF2s9d7EC6gRqF7sd/evA5zDYutYPDvhfDo8/0:GpF2s9d7EC68qFo9e8zD4PDvhLo8c
TLSH
T18074BFA4B3A05CF8DC67827EC8254916D6B2BC590760C65F03F836665F373911C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
Size 540KB
SHA256 7dd385eb6c1934a3d11789981ed02b31319c9f35c7a5f62d0c809e4ae609dce4
MD5 ae51483a688f10bad3eb799048492bbb
SHA1 c46a79ccee2391a4efd44775eaf5215d65f5469c
SHA512 c719cbf6c26665cfca7f4bd98fb5d35b7d71549ce9d5a08b7e03f368c4927e51fafc2f85623508a7b85123f43e3c49128e35881931fc75176176b02ce7724369
SSDEEP 12288:G9APkXs9UdJgTWkw3y6X+LLbbdIvJbqrGghcLfi:GOGJgo3y6X+LZaeBf
TLSH
T1EEC47C90F3E410E9F0B79A358C765512DA767C991B61CE8F02A8265A1F337D18E39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
Size 195KB
SHA256 36e8ba138c164af92436ab521cb6ffdc736f784d4a4b67d0b8a2a3fc08ae23cd
MD5 171145f0e56204511542711cf3d5258d
SHA1 9e68f5832263127f666fe5ccad2a05fc78e7f2b8
SHA512 efdc24a1fb194920efd619e84818bd961b3eb0499fb8365cdcd7f2d4440a53e5676f19f23e23b5af4daf919769b9eb9df909a095330aeddfc11d2a4b013ae951
SSDEEP 3072:5gcTxAt0amvICU39WY5DEmd/MjgvhagI/f1OFOPqxLJGeMoZ2KkF:5W0LgCs9V5DEmdggIn1UxpnV6
TLSH
T1E5148C0033E804D8E877DA7988608401EBB67E931B51EFAF9354615A0E767E1EE3DE35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
Size 138KB
SHA256 47a060f74ba7897b78887f56094c1c5ca8950b3d0c78bc91d3edd12c4ed54bf9
MD5 44d9c059745ec411e076186e5c8fa0b7
SHA1 086f70fbf30b4f06de9a3b2926a6e27debf577f1
SHA512 55e8ca2115cf70bf8ed5ff3d094f70dc72607362b6961463b27fb5d71031ddff3ecd0e7168500a7dbb0fa1753754e68abb76830b42e358542aeddfac58a234cb
SSDEEP 3072:GZQb8ZU39e28vJEisdBziux+3WlCUbOsARZ:IQYZs9L8qdBO3XZ
TLSH
T1CED36C1167E81488F1F38A795AB490069B7EFDA15911EF5E9380810E0E79FE1DD39F38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jre-1.8\bin\java.exe
Size 333KB
SHA256 292ca5c20bb73cebd6fa0a0fb35f19ef316c30b6e41e4a02d05e6123d9428685
MD5 acf44bd1b7bfcee51b0d51f59cf10580
SHA1 f52fe392e5608819db98b2cd49ae6de33843c13e
SHA512 dc2e7499991f0238b8c35a8d80d04469ade87439076b2e557df00926916f3f6bb3ef08faf38dffc16fc35841dcd1bac5e3d15554b6f226318036a4ae05935963
SSDEEP 6144:fZP6GFs9hCPX2rtjPvAfXjUCwtYV/PvywAKbd+:fh6GFs9hC+rtmz8cPvyrKbg
TLSH
T1FA74AFA5B3900CF5DC67813EC9654906D6B27C590BB0C66F13A472665F333A20D3EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
Size 142KB
SHA256 88bbf5a086837da471863bee6b28974c0b7820fa2ad11dd106a7206f7201c280
MD5 821c4b0e78f4c1c205605c30627eed37
SHA1 b31600ddb0b26bab6d46ff1b28fa01ded3b331fa
SHA512 9d6bbcea69c7f6d0eab33977b218aec9b7813300eeb90ae3c5362edd0ff888923234858292e4981e9c53a0e44195b4e9c08513b982c57e7c6a3b2da93c516ae1
SSDEEP 3072:TU39BjlXEo43udtjZqMNbWwx2naV5/rbV6V5QApQj:Ts9hlw6vvWaj/PV6V5QApw
TLSH
T1F0E39EB2B3E81885F6338E72A9768C2158B7BD995DB0CD0D1295760D0E727D48839F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
Size 333KB
SHA256 8dcd36de2ba261d245b8fceb3293861a578f917f5f05fe8206dd74ccf8389995
MD5 96bbad97dff2ce9d413677ef3142d673
SHA1 d2455b39422ad5cb3579ea62871e2c5e28195a32
SHA512 aeebaead334aec9c4e89907d9802445e041bf7978417dda83e324bb7d3d4b8eb1b115b766e932c9dfbe1744ed593b565d84cdd41aef5a1faea735300cdb0d0ed
SSDEEP 6144:gImfvs9yKPgcFuEJ4sqPFlsyzvYutYPDvhR3zCUvp:gnfvs9yKPgcQEJ1gFlzv4PDvh5zb
TLSH
T17174CFA6B3541CF8ED67813DC8559906D2B27C5A0B60CA1F03A4326A5F333911C7EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
Size 540KB
SHA256 951ab30019d9c4bbe151d4e5578bde21950802d3b6cca04c1e3045f70285c29d
MD5 91a997243abfdb6905d28b97129f9b53
SHA1 c10cab73ea1e7bf817821e885e3f483632806cab
SHA512 32034e208f164d97cd78bcb2a5635505a12ea6c22cd571bc9af5ce4897cfa67c4a498f251f79909c8a363fccdfff75b27e20ba83deb6d4f1f8c629acbaeb8968
SSDEEP 12288:wxuUF8s9LkjvlK5wEvxooQLbbdIvW3weXDv:wctjv9EvxooQZYezv
TLSH
T15FC46B90F3E414E8F1B39A358C764511DA767C9A1B61DE8F02A8265A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
Size 195KB
SHA256 ab8d7eea584e49d4ffc537720afffc56ed19392af79ff31c12148efd88e22df8
MD5 8605e3233d13417c1da428a716344a9c
SHA1 774dcc7bbe861ef42a59e14915af45796321cfd8
SHA512 f92e4ca35a777c8671fe7c5da2899fcd9e80d2e4e5a21c7400866b526e2aa24c6da5cc71891dcb87976fdb2a5fb1aa0a94b75757408aba053d3bc11eecbd5fed
SSDEEP 3072:xUUHxuty4myhDU39WY5DEmd/MjgvhagI/f1OFOCJGxiUqF3OapD:xQyNCDs9V5DEmdggIn1Unfl+aJ
TLSH
T18E147C4133E404A4E4B3DA3999604501E7B6BE651B619FAF9394319A0F367E0AE3CF36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
Size 138KB
SHA256 3b47db0c0048ef0d880825fffb1f4b266b668e16418e5cde3a102606d8e944a4
MD5 025179f0367d6ad9b254e1b9eeecc523
SHA1 54a6b88cf96887fa361d4291255c24a07f7ca3e1
SHA512 162096587c71eda359a94b8393c9047cf2d99e19ec5197100afe41eed4074807b128c6d1a88eab0ff330e2211a5f99cf21edcc32531cb927f2c82d288885fefc
SSDEEP 3072:fqQb8kU39e28vJEisdBzYMsxo+lR9jqk9Xc4JF:CQYks9L8qdBpccmMqF
TLSH
T145D36A9163F81499F4739B3569B091109B7ABD915D22FF2EA380000E0E7AFE19E39F71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
Size 4.3MB
SHA256 a4255e4f233d459d4b4135c33d10ec13a21bf6352790e089fce08175446e3b48
MD5 bcb7332ecb002d20bf0313ea7347bacf
SHA1 c1452adb9f5c328116fe9dab7e5c2ded0f44e40e
SHA512 56f931449fe2592ea7c84d3c2353aaab4eca93557a4e416dfa3bc7d0692fdbf36140a6d4677e797a8d511bdf0c491c4a3fddf8a9c0c384dc4b0f5f22197ff973
SSDEEP 49152:AT4JnAGEWPm05rglRsBy+hC3MhJLydWB2mIFH153deuY2L3Y6a+m7pD/bc8NRV3p:ATLWG2yeHLCTa7d/35Ce
TLSH
T168265C55ABF880F5E0A7E178897AC6B2F7B678420D31EB4F0191C62F2F336905D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeClickToRun.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
Size 4.3MB
SHA256 73c496f7a7cf4dbb8609975620e6b7a4eda7acc2447e565850b00c52846a7f23
MD5 6d393a072785b93c1a4b46310d15524b
SHA1 dadce0d8a28a5280d5e91015c1e5f1117b09bb2d
SHA512 0e27a80c8b05a9b52f1d365f44350316da70426394ebfbfb2271d176be00e67a96557ea0c4d585f52937f337922ee4e60a2a84427aaf1c48fa370f3efbedec73
SSDEEP 49152:U2aR/i6ulzymmpMgS6jIlXgk7TL7d+kUBprCliX3eeuRlI8ygXg3d9I3QN8NRV3P:U21zu7j83LAxhdC3x5Cfha
TLSH
T127265B556BF880F5E1A7E178897ACAB2F7B678420D31EB4F0191C62F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVDllSurrogate64.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe
Size 275KB
SHA256 e9ada5d7c4afd1799117c83835cc263311540e355fce953cffed716e0bb3aeef
MD5 a6d1d93705c30c2a0acd577f698e7754
SHA1 ca95b09c94bd7a5948637b07120c4a2c6756c0cf
SHA512 835ac36e4074631cf9e18d48a97d9669a456a65c6babacfb23db0f527b7a1d2eb5ecdfa955278ac3e1cecb9a7cbe015c8f8e70a409696a7d43f78e81a34e98e7
SSDEEP 6144:3097bzCs9DWGNTNYdMzATVkQNUO7q5SWthBR:ExSs9qGNTCWsTGQ4fR
TLSH
T11454397BDD38F8D1C3BE5DB467A0C740AB3161718B52638BE175C2AD8D032E15E6AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVLP.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
Size 588KB
SHA256 8cd075189c83599baa7c7fb1b942e22bf2638407e3dcab60bb0a1c8d0c47ca03
MD5 76fca6d1ed3e2387a45569ad2c3085e3
SHA1 456984b66a510ea4b8a076240ac13c5a630bb620
SHA512 c14d902da3074cadbb82f6a7cdd537ef2cfe518e046606bcbe77a9d3468849c5404a6893ffb3c0641f348601f050b8909bba059c5a467c0de4108e6dd514dfe5
SSDEEP 6144:I1DNWw34ZTy8bqHEFfjaKs9ngTbC7Jf/UZco4Wp4hzvNUXITiXt9Z+M47iUlfZt7:qD6y8DAKs92xluzvNU4TEYicqh/s8ouw
TLSH
T178D47E76EE28D8E1C27B897896968600E6717C110B61DBCBF17CD27D1E236D05E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Integrator.exe

Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
Size 6.8MB
SHA256 5584ac1460f13b79fc17c9ed17da27aea0bba1a8a125bf98c22e14ab95197e3d
MD5 f71ce0331749284e1f990f7fd73795f1
SHA1 1f62cb350297b3d41569697736d6c8e667e29a85
SHA512 ee1853a16f7e956a0336efc1c9140384ba000e25fba453ef6d8502564e0d8ab15ef8d2e731d97c3bfb2a2f0e13d27aa3b2e3a2b2fb14c27e76acfbd43f93e42e
SSDEEP 98304:gzjwKqTcgLJBJgYFB1GW2hrrmqJjeb22SRC:gz0KgnJgaUW25Sz/
TLSH
T1DF6629596AB481ECE0AFD1748D778772F67678428E33661B0261CA1F2F33E588D19732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Mashup.Container.Loader.exe

Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe
Size 100KB
SHA256 1187ca555c2894a81430449c08e592effd04183550f168b7fc38595729dcb9d4
MD5 602dc64e721ca2bdbf2c94d9fab57735
SHA1 e39810f3c7fc27366cd5e9c395268e8f84d651fd
SHA512 495459397543b7abaf102099c400f41d4146df0cc6fdd3a16cf66f0bcbdafdd6dfe108b928502acf4c7605febd07cee6f9e4377f3fb0438387f6feb4e505ff7b
SSDEEP 1536:0KZlvXuhi3ug4XjP/eAMpldERV2oXZX74mZ3DkcnDU+uDGdDFRi/mTiWGq8:0kgU39weAcIcSEmNDkUDUDDwD7+muWl8
TLSH
T1F2A3C00B67C959DEC5F223B85C85850690B2BE901B20DBCFA174E24E2F633C9BD35E65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IEContentService.exe

Path C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe
Size 449KB
SHA256 3d5dc754b47d517008aa4aa5704d84a31bde86d1756c19d2c74993b51b356753
MD5 6d163b2a5069b53e029381d1fe460e38
SHA1 5ee828d3f261d6d1d0e08ea2cff87c4e10b89a54
SHA512 4baf6774c46663dc2bef16125f26e46cc0ecff31fbf3f0c683ddcd2476dcd36c20e1cad649f2997f179c9e8adc28d8ce45a0bfdc550bce23f839579c5a05ab24
SSDEEP 6144:SPblajjr2pZIug+EMVZGLe+XBOGLs9qOoj5jfcbvnmwVFwel6RCRFi9:GblK2pZlgde+xvLs9eRfM3kR6Fk
TLSH
T183A49E4AEB9084F5E2579238C57BC671F7B2B8891A20674B56A5C76F3F33B506D2C320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerfBoost.exe

Path C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe
Size 877KB
SHA256 16012389a73e01504a3e5dae756649646c261c3bbf7d66b3b4d8210821b50a42
MD5 94cf482b22a24f765f59ee5c881496af
SHA1 b4056d06a1c1d92ddedffd7a0aa367da84e8c7d1
SHA512 75fec76b945f2e7df7d2274c4ba6986984f5bf2ecae5a6d636449171cf299607bf072dbfab7e08b981c0cf05b0ef663a40fb0a98dca16c7855bfaee591d14078
SSDEEP 24576:EDy/B+DQk8KcrdvcAZpEKdUnHBt9hFsDxv2:gd8KcZ0ADDUnX2t+
TLSH
T10F153995ABF845E9F1B3A67499B68571FAB2BC521D30D31F01A0C25F1E37A808D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDXHelper.exe

Path C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe
Size 189KB
SHA256 b33e501a41bf10e114e09dc6b97de1026da7b4866d290b8d5012bd786dd294c5
MD5 acce61e633413256def840ff272aac66
SHA1 3496c7020771987fd05dcfdb15031246e6d7e8ee
SHA512 91395f5266f7fd4e526d3263a809d1ab61c685ebcf9d65f2a7eeb4b31094dec38c740d0bcacf3932de0776e60f9415319b40117ccfb333856285ec530f4c72ce
SSDEEP 3072:ZEySC9pINq/D0U39qv1Q2+zT6lZdAh3SJxfFrgrwH7ACXkwcwTEY:ZSiWNq/D0s9qeelZdGaFkr56ZcwTx
TLSH
T107149E577BD0A0EBE412A278D868A6B1F3B6F1B11D34635F2271C21E0E732A27D15B35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoadfsb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe
Size 2.0MB
SHA256 e7d5e99a5cbbcf3623297460599a3a358729c5eeea5f15ece0c9c0ca30aadd7b
MD5 ffb2c7689cab5f3c11727cb4141cfe2e
SHA1 eb1078912dfca39a3cb019b6ea4efb74be20a063
SHA512 ff748097ba9375211cdb1ee8423a9035bc2b220db07f6f5a20f2a08a5eff9f960cc21c833548276ea2b45532bff6bd9918a98717cb6a823ceb925749fa1cf85a
SSDEEP 24576:lBSP4D7/uRP2IuczrNHbAsbkTUh/PDTN4fYDJKMG4aR010dFT7bK7+6mlvKpk:l8q6Pru4NHbAsbeG/lAMGt01GFT7bhlZ
TLSH
T17BA52946ABE8C4E5E2ABE2789975C9B5F6F2B8414D31974F2156C70F1F336604E38322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoasb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoasb.exe
Size 341KB
SHA256 e3ceeac12a888f0e22ec28886b57ad2575ddebf4dba3f1448f8f48335ce54934
MD5 c141e3bae14e87fb0e231914537c7b00
SHA1 91c0a432f9ca5399d06ca95f26b18030abedb0c8
SHA512 352ec2a294387086d148836551015f1f0d402c5a1a8c28117a06cec608e4f5fc1c8e556532c493943563e084b1c0525975dba030363692ec61efc68d96dd2967
SSDEEP 6144:eBNws9oBfUfYPRZB8Ii9aspLBKyPc9bhvRx9EiOwZexhiUhTO1rFQ+i:eMs9OCYPRZiIGaspxPc9bhvTmw4/h61a
TLSH
T159744A577B788CE1D917A1798986D2B6FBB2F8614F21C34F2952C32E1F33261AD18B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoia.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoia.exe
Size 6.0MB
SHA256 308113b7e266bd5f648e07b87d6efaed9335ee2466d71bf9ec6c31e9bb54b370
MD5 5ed1b8c61d6a8db809b189a0b4c3cacc
SHA1 5357efee874465e30f1a540806aec3e8076eac41
SHA512 7adb32c409417275986f248ab4db58270c9125120f19fc6cbdb6c548218d3ec0465554e3aa444540d0a798141cb92d66d4ded43808a6908588f0481cd1dbcbfe
SSDEEP 49152:3UPoXoDhOfCYmUJSZbhLQ/6md4Jmh29cu/jLal0HFEn8JtDvQK293+XQK+P5jGS1:3oz9TqmLJQ5KZCLw21ma1r
TLSH
T1F0564A55BBF982E5E1BBD134CA7285B6FAB2B8555D31A74F0451C30E1F33A909E28332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

officeappguardwin32.exe

Path C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe
Size 596KB
SHA256 c41912b7451f7335e7e80784d01cff32f2c92989a4c74be65c51414f673d9fac
MD5 663fea1f9960779f9d2e67a1e336291e
SHA1 e558186523f888735dbeadf5b17ed935e6be9238
SHA512 56398458112de74f72208ab3a841418f1468ee131db591586a5ba761994c375464c5a945fe5434d1a1468821e8d37024411da3ca626a4bf43541267412b6856e
SSDEEP 12288:7rOngzqIgFTvtyg/tZs9ncIPr0lypFpw4jTZOe1h2:7rOgzq7ttRcAlcUG1h2
TLSH
T19FD42941F7A881E2E566A534CA66C5B0FA77BC130F70D60B7559F22E2F33640AD29B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocolhandler.exe

Path C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe
Size 6.4MB
SHA256 96ac79ea32cdf0f6c766003ecf741b83a4970237afa19fdfbc9bd8e358c7a400
MD5 a0af245cc6ebbb770ba38d4091f41c4a
SHA1 170e3ae4e9332e2f2079be9e9cc208d62f52abfd
SHA512 f2b478052296721943501f4190cd338d1596d2244cf474b73b9d10bf1432d6cae31c923850e5be6e3ba1305941bf798a71687a36578781600870a73ecdb8a6bd
SSDEEP 49152:YjbaK8GQa7BglsKB2NfvjKKKeSK9MRRBE4qRKbizpypBX0WDB6WaZLo7FqP3YTI+:h+g+KNX5ULoq8yMFzHjI0
TLSH
T1DD666A417BF880F4E1B7E2788A3A9675FAB278425E31AB4F0151CA1F6F776508D29331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OLicenseHeartbeat.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe
Size 2.0MB
SHA256 64bc178177c69fffe5e8cd30ae0aae436845751600c2d5abebfda1a539c8c347
MD5 e162e9891b7f0368b1162dbc392da330
SHA1 f58a272fe78cc443a621a11c995d9fbfbb84439f
SHA512 ac4e790a1d682f08bf90a855c9294661834a6ac01779477490da0cb2d4f831a5e89104cdfb0d2d2d61f1f28ff15eb863c64ec4c48ce28094264e383fe358d674
SSDEEP 49152:cxMWGiBbQvRnh1v0ZN2hVcZfT2YrU98xjqrAf:h1Hdo
TLSH
T19AA517406BE881E5F5BBE7B89AB68979F9727C521C70E61F0156C60E1E33B408D39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLDumper.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe
Size 222KB
SHA256 80986396b2c5197e53710a3346b96158446685b253afe1c084648da47d653e12
MD5 170ab22cbdb63c20cb0c4fd0b42a54eb
SHA1 278e52f8d0a1c70ab6275f9d148ce50e77241b7a
SHA512 40a4a3ed4628ffef1ad709d0156bc4d7b00765e5b0245bdb8092bf71ab0542093760071ae4c898653c6f42ec92ffe743e62ebc194d0f9bd5552ad8113f8f6f4e
SSDEEP 3072:XQxR2QOK+tVU39daj4+qrSVzN2Bmt+hl8cMt/WcyBYGTplPpglVcfZWfwLX:XQxR/OvHs9daj4diz9clCG9lRgrcfZWg
TLSH
T1E5245B4177FA1048F5B3BAB09EB581526A77B8992B31E3DF4158C2292F73BD08D74722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohub32.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe
Size 2.0MB
SHA256 dc5c1ea1e9662cece807c8fc9d6eb969629f18a804baacbc3d9582f815212b16
MD5 04f226135b90c409697814d6eb86d2c0
SHA1 14b6c40e19f7cd264c66a1fe9e99b31a25f67413
SHA512 dc7ad21f81829c018259c21ee1b40594d48cada41b16dd0bb685fac070c6f2100d6fa48520e9f462ecbdb5e5555e0067399f1b9f599c2e9edc8629d571db7d6c
SSDEEP 24576:/IdudbEFw0YGgRyassO0emE3razDM52A2NBH3NRLOgReFVwQP71wzsob4FgwPqe4:/IdudbEuemEbS14ULOH+MYu8m1/p97u3
TLSH
T158A55985BBA484B0D526A1B189A6867CF772788289334F07318DDFDEBFE36604D59331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreporter.exe

Path C:\Program Files\Mozilla Firefox\crashreporter.exe
Size 3.5MB
SHA256 c6e360d138e3cd016f4515cbc4f7574c13a13ff22f08e45d9836c1bf30d17c6f
MD5 8639d21184848bfa222661c746151984
SHA1 aaa5867abfcc7448db8da607b95f5954a7c5e0c1
SHA512 272a94b2c4f7ddcc9e7c1ebc524bf3f3aa84327847e509c21e69135814c8c3e77e52cb97cc9def5fcd54f36fc8304c2e625241117e100bf81341c366165427be
SSDEEP 49152:V+3Nv+yNljpnNaTO28wsz3iDT4JmeDNB05FQz/VTmXLhm6kV97:V+dvlFNV2Jg9f05FytaLhm60
TLSH
T153062842EB615DDAC025C0B482266723B760FDBD073036F74A906735AD68EE01FF9B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox.exe

Path C:\Program Files\Mozilla Firefox\firefox.exe
Size 777KB
SHA256 db34adc09a2d4ceda0367fda0a9afeb5d4e89bc09c74dd769e87bbf8d30b1a8b
MD5 2a4369bfaf51c7d10d397b9a2d116aa9
SHA1 48b9075dbd0cab208ab67a3ca795d9de0a9a71bc
SHA512 87c74b9214492733cee34f72cc95c0ec4fd90b6f65c59370a98615496ce3e3875995256c02af765792396eb4dfc1158304f5b3591194b98e9e3bbc24c95d8fc2
SSDEEP 24576:H5llKj8OUuVbJct4SwpemIwpelzEJl3FP:ZllKjHUuVbJct4ZpeapelC1P
TLSH
T18105B003F38516F8E08AE5B89A42D533A5723C840B50A1DB1BE93F2B3D71AD15B7976C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
Size 329KB
SHA256 30533998a0124d84490000776ceda571e1e119e19b4ee9b343095a182646f51e
MD5 9324d1575bffeb70288781ff32313907
SHA1 bdc46de340b9adbd023f6f17ea2b5d6ff09e21a0
SHA512 85aa14dd978d9608d85331ffc14f881f00625484558e54747fc0712aa330bfc28c4d3f46ae6a5e0dc2e531305e13f57d9163dfc73e42edef7e27c296249d2b84
SSDEEP 6144:cys9zQZWJKYG57OoIsq18bI2lRit2/iJPsfUrcADmkrbHROTPqbP:ds9zQZWJK156VsE2lRR2czADPOjI
TLSH
T14074AE2577E408F9ED6B823DCDA28502EA73B85647A0F78B03B486651F233C85D3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nmhproxy.exe

Path C:\Program Files\Mozilla Firefox\nmhproxy.exe
Size 654KB
SHA256 797d7d6ef52b314b20ddc667fd53787ba900a16e23441cda8f3699220d8dd279
MD5 7b993f0b43e62f4f136d1b6b1a783915
SHA1 ab0781229f6088d0b3a68a9119bbb32224e4af04
SHA512 927eb1a79656033b41250cd6820735c68087ed0ef155b4559324defb8bd5bc69904a2ac1adb1f5b46fc0348cc551a94e11e65a60cc85dcda8009a09972410ccb
SSDEEP 12288:tcYxR1Vz7hUnPeiQwAEy47s9Xwc/waheNt5Ako:OYxZfhae/CfDt5AT
TLSH
T14BE47D02FA97D4ADD51EC078864785327933B4CD0B30AAFB6298AA353D59AE12F3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pingsender.exe

Path C:\Program Files\Mozilla Firefox\pingsender.exe
Size 126KB
SHA256 5edb4eb29d2b7b758a0839f94a7e19bdb0979ad1d6045ea4f1ad54053fd72486
MD5 2c21f0d9b5f0262cbcfcec9191aa959e
SHA1 ddc3ab97e04938b49533e92a5de9db9bcac3993d
SHA512 9eccde6ba1aaa6b68b3cdf9008e29ec1ffb2a8231df020655b3f0f63ccc45ecb6f7571e5e6739d223f3a2b3f1444b822f27f34f6f1dd73bc8bb1f6d75d33fe32
SSDEEP 3072:vXH8Cj3U39sdSh2SdWA1f/mDy6tz0QVBBJQD:0Cj3s9s4FdT2y6tz0QVBBJ6
TLSH
T113C3AF43655514F6D99282F0E0F79833E7713A450B25ABDFE79842055F223E82FB93E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plugin-container.exe

Path C:\Program Files\Mozilla Firefox\plugin-container.exe
Size 202KB
SHA256 5d106045cce32c36cecff19e3e52d97f31e12b96568e9da76a0fde000f56f6a1
MD5 820b72d299028f35ebc4f9d98c7d5ce7
SHA1 38b16c0a1208bc0d3c223faa818230a2b0c9344a
SHA512 e6968af68a64d3d657ca04e7c5d34c5a954381c92c7b206d7ada964fce6f0c84a0c3982cd60ee994bbe5b8754463563a4b1bdf66d1ebc74b3818a5f72bff30fa
SSDEEP 6144:Y0kCqYcqs9FXWO4LEuDD73GA0RfSOpx3B8bd:4pYZs9cjbD7WA0RfSOpGd
TLSH
T1D614B023F6DD10E5E446D2B8A381A221DBB2B4860B11B3DF269562503F55FE87F7C3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.exe

Path C:\Program Files\Mozilla Firefox\updater.exe
Size 523KB
SHA256 9aaa226a92af479076c1089669ae693e8a8b867b67cab684a159e4bf8aefc1a1
MD5 67bc08679061708326d4427ccf612b14
SHA1 d1d7ccfca23785593bea5f3fc4f1d18bf5ef312e
SHA512 50b72ba779dd612474d9b4851875874edfa07c105e93591b799c70c9611fd96fbc0953e3d36569b770ced19482ca927c39bc1780679a5089bc9426badc5419e6
SSDEEP 12288:4SOM1hs9NqY/17VWjhba4qo2ZeCcSOJAdGytoaDF:FO+eqY/1k8b4J+RaaDF
TLSH
T17FB4BF29F3900DF9F42BA274C8664511EA73FC550760E6EB22E4D6663F332D85A3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 188KB
SHA256 2b9e6b895ee2c10fe76383f08fdec6fee15d6a0bb1b5b9a8c1ab22bfef5e4ff9
MD5 6d30a66fb019b19f5383dd10e7a62840
SHA1 3af614ec940125f58d11849ede387782c6615842
SHA512 a8cfa7b02239d793068d19cd8b31338fb859765cbd281d9408634308062405b1f3cef26d7d5a43e10681cc4ade7e85ee81f2240b32db18f2309928a23deb48ec
SSDEEP 3072:hNPaPpmQU39vg3V8pQFq4XKF3QPXkUFcYhaRQ:hNaPpmQs9o3sQFqT3QRiYhai
TLSH
T101145969D29801C4C0AE1279C7565681B7333CA183E1E3CB92D0F67E1F3A6C46EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1796-3-0x000002780F100000-0x000002780F105000-memory.dmp

Download

memory/1796-1-0x000002780F100000-0x000002780F105000-memory.dmp

Download

memory/1796-6-0x000002780F100000-0x000002780F105000-memory.dmp

Download

memory/1796-2-0x000002780D920000-0x000002780D927000-memory.dmp

Download

memory/1796-0-0x00007FF6DEA40000-0x00007FF6DEB4B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads