3c164093353d41063291eb7b1bbba5fe2de6d76a19323dcaa4e76421a7735d7a

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 03:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
Size 1.1MB
Sample260730-d8av9abc36
SHA256 3c164093353d41063291eb7b1bbba5fe2de6d76a19323dcaa4e76421a7735d7a
MD5 392d8daffdc4fbc972776ef318c9e9b3
SHA1 6c65f47eb85fd00c3cf4e97d942d6671a9e52d63
SHA512 63176aad6e0435630322a9a85d2b035204cf4e75ff7659e47fb154701416ed442c8843ae7a84467c221814cedd83a0acb59e7803eb168234e586f7a05170ddfd
SSDEEP 24576:KB8pb/p1eyjodBFk4SMpVNmH2pyOgqKi9Sqqjrc5xaNIBdiyJNM:KOFbeyjodbk4SMpVNmWpJgbiSqqjrQan
TLSH
T13A358D4A23A4419EFEA7F176DA17C60BD7B1784A0376962F01A46B726F337711A1E330
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\H:	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\L:	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\S:	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\T:	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\X:	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Y:	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\J:	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\N:	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\O:	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\R:	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\B:	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Q:	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\U:	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\V:	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Z:	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\E:	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\G:	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\I:	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\K:	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\M:	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\P:	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\W:	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Time.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5576	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5576	2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_392d8daffdc4fbc972776ef318c9e9b3_agent-tesla_amadey_icedid_njrat_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

64BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
Size 296KB
SHA256 95fc7352ebee5bc14bbbfd1d870b51456516dd87fccee57df83ff1a11bb3edec
MD5 fb7dcaa4654716b0e9026088082eab7e
SHA1 89358cb8ab618e5ab8acb981483994bf63079b5e
SHA512 9c5e349ed3c3d2475850ee875fc66ce96a77de760de2f605e30d2005d36d197cfea01feac37ac81a556610f9fbf86a69418dbf704d615ef568d99a2171ba23bc
SSDEEP 6144:hUzTZ9ws9STyPXf5HF/YxzYvcJtqQ15epYoe44vz:Ozos9Xv5HcySepu447
TLSH
T193549D5A33D88CF5E467C239C9929542E3B178994770D7CF6750422AEF63AE0AE3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86921\java.exe
Size 333KB
SHA256 65103ae5d0f1ae580184b5e6a0513d4092da97a68dfbdeaddd872d994c0f7591
MD5 15dba6b731ac98d6f253c93a81da4f2c
SHA1 bff8b7fffbc2358ff687381b60446a7498d717e5
SHA512 39e129707063e2ffd947e4b327c1304723ddf2f4d665b5e016667c7fc630d8617a26825e8e4e8ceabf5c68d7f1290345ec163039e2990f1e753f7d43eb8892aa
SSDEEP 6144:frP/cos9ZJiEv2j9MNa6BEtCfYV/PvyNqZXs:f7/cos9ZJnv2oUwcPvyNks
TLSH
T13474BFA5B3500CF9EC67413EC8269915D6F27C5A0B60C65F13A8322A5F333911D3EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86921\javaw.exe
Size 333KB
SHA256 ece9435c62ab5b39f0d6e24e5408afe99521a015fc2c8a838a31f1293a1e6234
MD5 9229f0823d2efc17c4fe7e38a8da7c54
SHA1 f194da78c8e394d64fcc08a61c4c0f637fb2a84d
SHA512 e1a9561c03fb1da88e3701fafe2362e2ea88b1d27b483387c3bb58c7eb4bf9325da0b43207073e9793c61ff8b58c5e80e9793310f220069e0e0f6a1244816490
SSDEEP 6144:wE9QZs92Jpk7dtcDKsTE1ZGJzTYutYPDvhbtfV:w4QZs92Jpk7DcDLQ1kzT4PDvhD
TLSH
T1F474BEA0B3A01CF9EC6B427EC8559916D6B37C590760C65F03B4326A5F333A11D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86921\javaws.exe
Size 540KB
SHA256 2f92d7ce8d126336b46e02caad6a903ddbda7184b5ce4fb0daca79d28d283f91
MD5 6021e34f8d81e903229336c06587db55
SHA1 0680a8ce27cb534ddaac8948a2eebfcfb7e0b83b
SHA512 6785b46126742428615c6f9f3c5357ccf0f5f6d668a373ed024242ce2d1d1b3374ba3fdd08e15baf7d1528ca04c60769ec47a732c7312b805158ad4d02b6d133
SSDEEP 12288:PIMf+Zs9rLCh1aRM/9TPn2LbbdIvWAIp8lSU:P5xCh9/9TPn2ZIuM
TLSH
T1A4C47C90F3E814E8F1B79A35CD764511DAB67C9A1B21DE8F12A8251A1F336D18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe
Size 596KB
SHA256 7f4d5ae4ba1d339f99fb80183efe78f8839892b6ea5310c79e563c7546713c81
MD5 d2cf211ba77fd32d09567a6bae197079
SHA1 d286eea2f081a42480645e27a91ef3e3d1138b71
SHA512 493aa6c13fd47e9733b0db646a678f2e579df134ecc1207f1666bd89984630fbb37608d411e024480fb848c1189b10c96641adaf2657b1532b388fcfca8521ea
SSDEEP 12288:is9gKiUpLK826wTFT3crNSqFdZ+WDixHN8k:yKiKL/w5kZpDixCk
TLSH
T100D4AE51B3D846E9E06BC134CA478542EA7278860F24E6DF01E4927D2F37BE95F3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe
Size 6.7MB
SHA256 25e7391d16b47895277c57f50cf3d97eaa4f72eed91e32236db92835d8acd4b5
MD5 6c535e8319f07fecf12617584406b73a
SHA1 6ec8c582d3fe803e8fce2e692ccfa90ee5a7420a
SHA512 5e315ae8590deec052f8cd5795a6d455e525bf9c5634efcd329d619fd4bea17509715d91986594e6af497a74bfe91ddf58e77eeda6f45bc18fe8e51bc31d458e
SSDEEP 98304:Ol8YfTaJ1+W33cB2L4HrZtGPIieK5M0uR7F5e6gS:+8YfTadLpIiFUpIk
TLSH
T199666C47E3A600A8E46ED970CF395521DA253C8E57B493EF129476E81A32FD87B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe
Size 1.9MB
SHA256 50893baaf16c9eb7c64311a051ac9e0a4a0996fa380bd6e25cdf9096829e9264
MD5 3d3adb7309f64d28a89ee8c293e4627f
SHA1 0113ad3c5e9702cf931238a17d88b2f66efcf2e8
SHA512 c7f773c3c0bd678faafaf888f2d7f38d77c030fcd9e2c0b906363e4950948caf31c28dffa71be5a8229d56fba8e0c22464c0dbd797c5f9548efd9f9c7a379c90
SSDEEP 24576:E//CyStEtiUmoXGEFm2eObphkL2NLb9Ld25PTOocJuJ/cIsY6Wfv8h3i/Vp:O/3StEYUdFm2eMmwpZeToMJseKS9p
TLSH
T13E959C03F29941E9D06ED578C746923AE9727C890B34B6DF0290B2952E77EE49F3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe
Size 1.2MB
SHA256 6885e06a7b3e383ecb7accfb295550fe2c0b0c4873499428476874cdb4d721fa
MD5 225c82bad7a93d40e78ba8b17fd3828c
SHA1 2c77791e4a8a5c17b4711b4b8073a0771c4fb64c
SHA512 3a04c5185d05c00963eeffde09fc5b550503290558d22bfa74f111e531f695f663b3260ff1e7effa186c4b64c4b45c81439fd5b14f9599fffa7f8de7cec66b8a
SSDEEP 24576:aS/0JN8davtvXWnqlOhsL20mJFtaCYIVprSBDr1pz:aS8b8davYqluq2bf0kpGBL
TLSH
T18345BF07B6D841D9D069D5B4CB568132EAB27C420B34A6DF06D0B25A1F7BEE86F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe
Size 3.9MB
SHA256 d984eb9f87f0b83a83757238250130abc37166a32d38db397763eca5d4e841b4
MD5 721c50efc3effa45f108648e7a8fdb4f
SHA1 3545bfbec707f0ab8c10a1c855ac9f149ea04233
SHA512 805786dce713bb8cba4147bb00b361457e54354c0b4c34c30d7f5622713183ef45f6ef5a54029542b7e6a870917e5a60716fea29003fb0c1a60deb32a80f4ac4
SSDEEP 49152:K7xUO0ePrAWtmSe0ShxAlUSV+Dcl0GD0AG8uVEusJ6LNzOeL0GKVIeCjIp26If21:sCAVS8uVlcm7fwKAAnqB9
TLSH
T19C165903F29940D8D059C074CE5A8132EB627C8D47F562EF3694B6EA2A73AD47B3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe
Size 1.2MB
SHA256 edbbe7d209ec09249bf1d732e83e7d7ffcdef29f456dccf636632d9a18d53214
MD5 4c8c8df32f1c4c2677eb49f576fc862c
SHA1 6cb6d8c5438450e55ff45701c14c5e5590568b4f
SHA512 2357eec6f945ebd237969d172f096f9f0735bca3dd520ba76d59e8fe53e82abf164373bf8edffb31ef60438dedcdadbfda8f36e6dfde548f29b0e8a6466daf61
SSDEEP 24576:QOUdS5CmF/gXOBL4MTEmc6go+XZf208mtjw8oH:QOUc5HF5LFTfrzYZ+NbPH
TLSH
T1B245AE07B7D941E8D02ED5B4CA568532EAB27C860B24AADF06D0B3592F37EE45F39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 1.6MB
SHA256 3f3cfc1f670788a786701213e9ac292397d6793bb17cb721e86e1702534941be
MD5 faa75e5e6b258afd150181cbcdf8c7b3
SHA1 d7d4e9dc0614f7983490647433740c165e77f43f
SHA512 765e84f49f62090ddc56fd261970c213d060f16048761f9284f384e2896dcecc5e49e33264ac2ccecd9290ba0efd2320af51bcdfb242cd0651028038c6c0ca97
SSDEEP 24576:w3R9c9F6iKf0uiXeU8QtFhZz+xdTU2FnIWW8Blkkkkkkkl0T3gAQDIrPygP:M9cX6iW0ztt3ZkTXINaPQA
TLSH
T1A6758C03F68A81E5D09DC2B8CE764B30EA717C655F2096EF0190BA653EB7AD04B397D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe
Size 3.4MB
SHA256 15330c296a6da31374ad565ddb48df0b582034a296f6c8eff534527669084cac
MD5 ee9b25c90c549aa656840b77f7cbc720
SHA1 d130b2b84c562feec6e1742b5eb14a5614017e85
SHA512 23e443cb06120410d0a1910224614de722f4d562c12186a315d02a1b081ffc6b3ff77d737425b9903f9074bef7275e04bbfde87a041c14be8ab495925f84e219
SSDEEP 49152:97Qd4bfNbztqPq9VF4i//TDY3UqMzADiulO7Udq+KqOuBk7bVnU7wF62JtYTOtof:wDEwiul1EE4ws3t6
TLSH
T1E9F54803E29900D9D099C078CE4A9632EB627C8D47F562EF3290B6D52E77EE47B39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 1.4MB
SHA256 470faa6991ca8d2da1344db9c231c241678aeeaef7c93eb1a5c039134f956b5b
MD5 bfd0767706823a5df5680f11d97cee52
SHA1 5131145878206164386c853515bb4be2c7ae1943
SHA512 76e7a742da8ccd06a9bc5d304c9d03ff655194c8134a95fa7336d60c064c16dc2f34c38c4978f01497936c48ee113413ff30fd6c7984f9a5efade6e36a112685
SSDEEP 24576:/Um9cVmmgIjXQX8Qcr8gj/Jh6YqfwbnTe1qRAqNXFz:smtmLj/78CR0Yqf2nTSq3
TLSH
T17F65AD03B6D941E8D06DD4B8CB568536EAB27C420B34A6DF0698B2592E37FE45F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe
Size 1.2MB
SHA256 6851cf7ec5455fafbba85fd8a007d560ef0bc93dcc1a7a5fcfc411be70f0c8fd
MD5 65b705752875f3218ee078aef7897ecf
SHA1 7d19b1bda33764270753e3ef1fcbcf33a4c31703
SHA512 18e5e98b37e4a29079c6383a4c0714fec5417be3533e6ff357f14bbaf91a50463107ef78b82c3b67f17607350fa355f48a34e0f111bfa6edf1958defad266df7
SSDEEP 24576:mngsMzzQ3o75X+qEIvLCVcOLa9/zHHyTwp+NX:mnPszmonEKLCV7La9bHyUkNX
TLSH
T1A645AE0BB79840D9D02AD578CA568532EAB27C430B74A6DF0691F2592F37EE85F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 248KB
SHA256 e1ea1f22bc475b5a91e0a03a07f9df8c36707fb67450ceba0c39a21e691223eb
MD5 5cc7030d4a50872919b2119fe562410a
SHA1 5c80753da769c97808568a346970b0fc2686c405
SHA512 22312f5c937fa8a27b581ef7a6471d4e93d6185598b6ab40da55725ee56c795c9255d6ec70ba8023959630983f4138af1db132900f634da5605e2bcf673df869
SSDEEP 6144:5s9z8+v0q9obbZAoPR/Cuoh0SdVUs06d7:5s9Y+XqvPRoxVhxd7
TLSH
T183448E6536E910E6E036D1F4CBD19903F335F87623218E7F4390426ADE62690ADE7E36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 265KB
SHA256 c05bc716a2844d4aa258fe55b2846453da36f560f4e43874a9a175fb5ca8994a
MD5 5aeaf338cf289bedfda7ea8c86e53407
SHA1 c07cabb609b15ffcc42875ebca317db1d4d0268e
SHA512 faf254040ea52f1cac5c5927eb377191f7b7a4de02cd77581f97278dd8034117d5504dc331de8581eddd95e1c17f9ae429dd6fadabcd682db9a0d392896173d8
SSDEEP 6144:Qs9UR3cjrajpBdoPUHYWoht+uoZDs2ELzRmh/:Qs9UR3VDfHHo38s2yzRc
TLSH
T101445B2925F814E2D176C1B4CFD09903F275E872A3108EBF4291475A9E23A916DBBF3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 610KB
SHA256 fd403021f4fd1399725ffbf9606ebebbc4f23b5ce7dbe5d43ec9714fc71ae7ae
MD5 4f4b54e711165a5b514b3783a16897e5
SHA1 56d4430fba74c7e62cb2abe3fe6f3f49f608105c
SHA512 020adb4b89998573c0dc3e1d89863e2fc6d340b5d0bcf7e2f372458f99e2738abde7ac825ae3e3ffdff18af598d94f4770649d8a04dbe6f562944e8f50817b8f
SSDEEP 12288:ys9gPKT/OJtC1HVlNsSHXL9IsA15rrU7clVxBTlH6Uk:SPKTmKzbL9I/3Qm96x
TLSH
T1BCD4AF81F3D847E9E07BC534CA528546EA7678950F60E6DF02A0527A3F37AE55F3A320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
Size 7.2MB
SHA256 0334a1efaf68ac7e2e9b98801ac56ebcef26f4709e695b3d8f9b38095a059978
MD5 e6223005ed09220ee08c88c801484284
SHA1 fec81cbc14647fabacbe679063523d314024b59b
SHA512 6ef7190119941a825cb7fd9106c72c2a1be0cf86163a0b560fedfd5fdd5911728d08856f112921bc49db585fac33b557825b0e69ddc3e6265d991f113c3b8b49
SSDEEP 98304:r6CZetahq+WZ6SoQwCsJB2++fGROxRj2vJzRN+T6frfVi8:uCZeta5SRGIGYxVqzRdDfVR
TLSH
T105766C07E3E600A8E46ED974CF2A9521DA353C8E47B492EF169476E41A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe
Size 3.9MB
SHA256 c278f9f2dd4499ada0239eb083da54093c43105ff519d85aeae21d6d80f5c229
MD5 e9737b2a2bbaf4f1447521ec25c6dfa9
SHA1 b22662633d7b898e2b2e14cd5b10e680ec2ba0a7
SHA512 7ec2f41c21d399f76204653bcd5f5d437b9bd1e46a10bcdbdea206d4188df4cc58b20b1672893edccbc0d6d249439438ec92bf907b4dbe1316991145814addc7
SSDEEP 49152:0kfFF6vr++qHku0TobmhLbKqm006NPpIupEdVu+e6NqcXToRzvUqIzYHBigdQBJ8:7F0+/EDT2mCCINUhIUBbsa
TLSH
T1D7165903F29900E8E05DD578CB568122EAB2BC854B25B2DF0750B7562E7BEE4AF3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.3MB
SHA256 617084fab6d795993da705e1804872ad52e6c2a5151d9199c9d7e0d70895e4ef
MD5 54ad578cc4394736616a21afc8b882a2
SHA1 72c1e579298bb65a42bf5db750ebda49df9d0940
SHA512 16ea3462bf7946f513b0222a522d2e5b06d7390ca9090400e877d1301696008804dd6dd750c58ed1c309535384fba363140623ae23e7bf6a8e4c2761a89fc44b
SSDEEP 49152:g3MglxT0YC0yAwbE63stBhuXjfS4LWxn+O8:yl98JjB1O8
TLSH
T1D5B57C03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 1.6MB
SHA256 92a2cdf7fe0e4c4fc68fd90197187267085963f425d0e8f4b1535ece8aba752b
MD5 7faed2061ec4b2c0b0537df5261fd762
SHA1 d6ce25b00d9da818363a4d2cb0da1fc3a0a7f84a
SHA512 ed8c41fb74fbd71f6b0824bf35bbae7edef8cdc01e37cd012b0e42749efa1d31e6d72cfe155a96ac618e75bf3e6e15c12e1aaecf43d6830a6fb94f5b64c92384
SSDEEP 49152:ez0enIGHTj41Ep1UIHZBEKyTlXrk9dB7PsI:UzZB5yO3PF
TLSH
T161759D03F39900E9D05ED1B8C7568536EAB27C450B34A6EF0A90B6552E3BFE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.0MB
SHA256 ba57e476c6bd3a93904bcad6111a30c3f2f09cdef08e6abd78281b81df734295
MD5 8d437e2d7d48d32024c56d3fe91a897e
SHA1 26221557774bb66c1b98130ac92b04d50f2c2885
SHA512 5b27f48dbdc4933506793a1e082a51cd6136ae53f7034b9015ea93dc4b735ddbc7bbc600e7a9c02a32bc6d68bc344118379a6fcc9234a9c0469fd02bc9fc6464
SSDEEP 49152:MKmWPm8kMedTYnzXtebZrSdHBAVfmWZ1O:fVuYkwA1m44
TLSH
T14D958D03F6DA80E5E05DC2B8CB768B35EA717C554F20A6DF0680BA652E77AD04B3D394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 3.5MB
SHA256 0afe2008c0efc5d2838ba76a27b8a98e5270f9df41bfc99717f833b0ed1cba9c
MD5 878a684c2255bd7212b6875bfe74d422
SHA1 8aae169375a94e45c4019bb6a4a91885876788a3
SHA512 3873df58383ec7cf3a02c1c9b5a5da56a0204b0459358d5b9266d27d14cac87a268bbd0ad23c3dff7a0f01e533588e201c429a8cdca8369b0867da75410f7ef3
SSDEEP 49152:6uiF2Ps3re8RXwQp3BY5wISb6YErkz4AkOuaRoBISCaQZCLlrrdpbiSt:kTdIQQOnZiOe
TLSH
T1EC064903A29900D8D059D078CF4A9223EBA27C8D47F566EF3690B6D52A77EE47B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe
Size 1.7MB
SHA256 6f0aadf2c3191c540c7773c9c691db7d112e5169010d2325a6bac4f3c18b066d
MD5 071c5a83c809239c8325fd43140aa019
SHA1 9d00bcb764924f0188a43be99ec4881d5e68e64f
SHA512 28469a87bcf9417a4474447a627a4df6468fe55b1ab8e486ed7a6be699f3a3472f8e69fdf43794ddc1472aca56cd8eb86982f9040af215f54f7d62dd87a6f5bc
SSDEEP 24576:KpJKTm66bMxlY2okftuxvqT0EuWy0fXb9zeQuJXlPnyF4mfHU9YawsNUjxm8qyAF:Kb624QST0Ely0fLFeHX04mfHIU9m8lO
TLSH
T114858B03F2D901E8E06DD2B8CB568532EAB27C450B34A6DF0691B6562F77EE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Size 4.1MB
SHA256 f0fb543b1ea63bb5cc74840d58cd519b16edd9d896dccaf3acff4f9582862e2e
MD5 df1714f3d25c36d1c9c821aabf2f86b5
SHA1 88f28e76c5e98e1fea202965028cb996966ba4e8
SHA512 4a7c15e2f6b3181d9622033b7d79491ed459a6dcaad304b81ef889c6ae7bc754cb0cd7eac7cc3c01bc0a3e0ce568703204c891e7ee90fc225c31dc37984ea93d
SSDEEP 49152:Du/PZm2Hhme3Ake3U22BUCOI+TjEpzExldDwUIDtaZHWRdpev2y/Bad8Q2:MdwMnOd+RaAw
TLSH
T1A2165903B29940D8D049D074CE5AD232AB617C8D47F162EF3690B7EA2A73AD47B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
Size 1.6MB
SHA256 c4eb52f4979946895cce7a53e9397534b34ff859984500ea4efb73f1dfb57554
MD5 622f5b96677bd2531f01e1be72d4e257
SHA1 cf34376ee6080f584f1060dee104fa6c6439fc0c
SHA512 d7548662ed1cba2f4dcb9b1bc4e03d99205ee726b153cb9515c096d9262f1c4fa0608883871d35c7be81b1f3f4d105240154e25f2067b04ab06759439e599b96
SSDEEP 49152:7k7ET0kDzkLvOcgpjfV9rBo7EukU1sYbW6:IIT0+vs7b
TLSH
T14E758D03F3D840E8E06AD1B8C7568536E9B27C450B24A6EF0B90B6552E7BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 1.5MB
SHA256 97fb9632846ce5741c05087dc32958bd81a86abf2ac7a19a661be7adee5dbd8a
MD5 fff66d0dd9545ff37705c7ea81e352ec
SHA1 b67bdf7c2e9afcb88a3c3dc9fa9845cb091e190a
SHA512 9583f9e1f2fe92cf3b5a0db62707a776dba8d761c6d5e8a21ac2016428c70c28a58dd37d9660d6905d895b5b707d3dc5d0a109b6a32285cc6a551fc60c9e8743
SSDEEP 49152:9LI/BuLefyL4fbVkwn+6h27d7DDRNfuxFVS:9c48SZttDDRNfuxFVS
TLSH
T11F759D13F3D900E8E05DD1B8C756853AE9B27C450B24A6EF0B90B6562E7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 329KB
SHA256 6eb68aab9c7d16600d43a9f3d4028c334b150aef896d23f14bad07ca6d63b8f1
MD5 c6e18cf50ddd3bedea3a2c8f93cd399c
SHA1 8aceba504b1eb56c28345543023e3104b65f87ec
SHA512 7a7a3cefb927655813a02a1af6824ee1954b30447dffe7749b9ad0122e607140ebde13f4c1cb39e484ff5727c7e81d186be8d540df50bc590f1d33fa251b0521
SSDEEP 6144:Eess9LmUW3BuS5PMO5C41RdR2lRcz2/iJPsfUrcAVUS3npSPq:as9LmUW3Bb5ECCe2lRR2czAeS3npP
TLSH
T16E74AE2563E408F9EDA7427CC8A18506EB7378914BA0E7CF03A4C5691F237D85E3EB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 672KB
SHA256 e0cf4d5f7291f09daf0c8e83898ada7ff3b30d26563325bb2fb38b949188c696
MD5 ec853d5c71b8f6b11f81220215680cdc
SHA1 ee7a11ea574935e60935b5410a82a9b65af130d7
SHA512 0882a929aed2cbc0f884b28af82d4b234b3c32a43cd60d9b39687d9ccf6744e2803c7068f3bd48893a95733b0a2bcd384c04d5e05fcbfe97fe9156c0f8ae6d04
SSDEEP 12288:EbtifVpUsUpnBVyzv2Asps9GrHsj4E8Nt+i:sCpUTpnBgsNrMj4R+i
TLSH
T1DBE43B26F6748731D073C0B9C5D2A69EED7230861B308ACB4286D77C7E676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.1MB
SHA256 a3dd46a839ba17fccab249307e26f34df6209f11875c9a3d77678943e5241a36
MD5 af7cffcdbf83fc85188815b4608328a3
SHA1 9ba74d3345b79a3f9744d0eee1a73910260abf72
SHA512 2d05458ca0eda6554f9ef6b490055b8bf401581b919f32c8076621e7648a1c02c72c96a44df29127b116039c6157efdfff75f39621c579c74735e409ec5afc7b
SSDEEP 24576:ZK7sezSCLvYRwmpygrvWX6q8wyugSIz7rB9:AsezSCLvYXXvaHjyFSaR9
TLSH
T131351A15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 840KB
SHA256 8191bf77ceb4a15cf3599b6dc7c2b1859e22519e37b3a909a829b89e0dc09c22
MD5 ed957ec9fcf5a0b6db6c27c9c360d311
SHA1 8c708bfcc4192f118815ac35a5a16b8a5a23a08d
SHA512 ecd4517193b4023aae76182a39269d9c5126f2a88dcb828b712dc8f641b1af8b038ea39a5e67381d67fca269ad508170a8912a7c4182cee70b7e0f59b6114551
SSDEEP 12288:gmKxBvH3v0/6s9Mvb8fgcwsEASWdnms95f0Im98JDiq8RCWV:gmYv/0isQPydnVcq8AWV
TLSH
T139054B66F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 350KB
SHA256 3459f7cc4f36a662453da764297d8e2c502be88f4f73c216f14c86e6fc259866
MD5 5e95164c9c71d5f6feaa17ed14870c06
SHA1 87f40323fc7aea594ea4714d6976c705b84a6801
SHA512 3b1ada344a5d33dce3a0ddb88e912ec88116fe8013957b6ed8b6666d33e964405e87b38c72615aa0afaed8d9470a9353bb0bfbe890e4ab602ce72597bc7e76bf
SSDEEP 6144:NOBs97BJ/GKWWBNU6ITLBi0qttclOKgU91BVhm+J90wLk7:us9SeBNUbTVO86U4W90wLk7
TLSH
T169744A7BEE28FCD2C27E4DB85BA18600977278704F61A3CBD169824DDD136E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.3MB
SHA256 b7fc9e1df560f4396499df2abd0133621bd40b0a7aee8a94b05b09fd8759ea22
MD5 e0d15f8ef2101ec6958360b0fdd3e96b
SHA1 b6fe40b3a724666b3d22aee16db794b3f2b6cd19
SHA512 79b44add16dcad7952b3bf8dd8ccd1a820de49654dabe575f8a383da2dd9a710669cbb92a48a93861bfba331bddf36db3723bb6b98271fa092851dfc8454a329
SSDEEP 49152:0+E3RfviE3ThVrOaU7rfPg33iLWd4ieI8l87N3/euUkkYJzxTB3Z6+FY8NRV3THe:0+DE3o7uyLNpI3M+Z5C5
TLSH
T1B1265B656BF880F5E1A7E178897AC6B2F7B678420D31EB4F0191C62F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.3MB
SHA256 19a9612c500b59e5af69ff7fe7db1124578c81ffdb5d4483cce8c92a26de9974
MD5 ba4822041f3af8ccfde27b5f3d4c0477
SHA1 dbfc650c2bd24ba13fd39bad348b871c5cac1b70
SHA512 58d8604f2c0cf3751bbdcf80a13f83458ccde46d740d43637218ecc9b8b2c672879985d9156aa851fc194ab40d2f17dcd9fc58cb25b78c994f06c44b9ec1002e
SSDEEP 24576:t1qafygBi2z+L5WqkrHCYRFiV+XenmE3Pnzc34453fZ1Wcc:t1qafygBi2yL5zkfFiV+XenmE3/z4Z1C
TLSH
T17FB56C0976B8C1E4D1F6C77886A2C647F37178154B34ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.2MB
SHA256 16d6f7fd9ff4aab7fb53ac3a0a1a10346f2ac2db0e309d7b409816b67cc775e4
MD5 afd99bd2e1a7061a7ce81e017b09884d
SHA1 64acad21a645b8937eea1e5e146dd940c512471a
SHA512 ef16b6b43ece31f5b6e93c8bf067bf299863e92bf65f48a2cb3e3daded22920a6a7dc21d3cab08cadcc719109425156803cc90ced5d0adc99e71c5dfcb326c57
SSDEEP 49152:kjv4iIGNb5rhd3p3DJf5SUYLoDpgLjSTYlQcGenAaLSF259ruMHwpXMi4FqJLd2Y:fmRQyi36YOcPPLvw2gAf+PN3FeE
TLSH
T150666B13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 f6979a2aea34918c28a9303508dae126fd1371b708b99885c9912033d3a42347
MD5 1cb6cf8d98e43fd5dba75c4b84aca0cd
SHA1 14f8c40abd546aadc27278b181a82799f3949738
SHA512 55694337caf1eadf52cfa0cfa0ae35b91c8d7adf0a8261fb45edb8c1be590aa5e07911b21a335cbd1e87158d798122e0b92674a0f66276297277ff030ab33a71
SSDEEP 24576:0Lvd/dF4WQpr0FZDbovfVzJBH7DaHGTNHu7PNU3/5W/ohL0SEJt:CFhQFxtzJJeWu7PNU3/LE/
TLSH
T104951733B2F600A9D44DE1769F4A872196D27C75CFE0D3DB8115720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 3.6MB
SHA256 41923840dd5246a6c6d4c76d4feb1c8e4bf9e84a52d6fafaf053928569b7c71e
MD5 0917fbecaa597da2d2d96eeb58ee0f8a
SHA1 f797add1bfd7a48e3d2c197a2e0b80aa19600c9e
SHA512 e932e953bbb31ef47ffad8ca33843e50a04a47b7e160cacb40344c2af193c72f98f761d95f04f4281d79c4b3d130553f3756900ce2e27ea35b995cf4357da917
SSDEEP 49152:6Ay6c0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbsN3Oh6tznm2FQ/nho2qkrk99f:Ry5112gYy5azzVvb69nLKnhZuVoBq
TLSH
T186066B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.4MB
SHA256 cc1a92d13d2941f2d3c889b2d29dfa55463251119be196b3dd01739b99bcbb59
MD5 54d4801828ff05c6cd6e331ce72ebacb
SHA1 d0700d62a3d89deaf3eb70bebdef83e9c1f85627
SHA512 422e061d56261e7be003aad7f9a581b9eb82256a6afec4add9ec32d85a56d03b111642919138dea1976794d9f126e4decd7402ced3ee48a074b44c8aab05e0a3
SSDEEP 49152:8VPwt6Z7s0+sOBr4tEGN0bqx0z+n217aau1gl9bzF:cspJmrxd2d1zF
TLSH
T117C58D13F1DA01E8D06ED578974A9233FA62BC490B34B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 1.8MB
SHA256 84cdcce8eb25f3d021006012bed31c8a3729c4a58ae568b8118d63e87027aece
MD5 6fd61ac708c902d73d88e626e2ac5805
SHA1 7608f7fc2a9140d44a5eedf36b557cef0115d06b
SHA512 ca6eb7f3eb09c0a080c16ec3f701a95519bfa5e8012b1d5d1cf4e464365f28df01945bba812e15e67519aef993cca2c353f522793184b7de1466f23965d91179
SSDEEP 24576:OivCtWj1M9+os4rzsXFuCMnUyAbKUQ1zNOgLLwH7ReaQXx3W2p1BuhhR:eWj1MAoxLUyAuU44CwH7R4xGe1ohH
TLSH
T146859D13F2D900E8D06ED17887569632EA71BC460B24A6DF0A90B7962F7BBE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.0MB
SHA256 5300013c366b7f1162b2fe36159bdde975a055b1417d63d16d1aab5422d2f72c
MD5 449ec3c80d4450ba763b76bbdd3c896c
SHA1 b55ab9a95e800547989b3358eaf44b83f82444ec
SHA512 4dd7157a8f244544e29a2837162b5a7705caeb2606c899427bf8cafc0645a8bedfa002b455e54c34629c5db64d1f78bc115850921b50d043a2d15faefaba8116
SSDEEP 24576:1N5vbaTfB0chQ4oHhARTGAbPa/FP+HWxXR04FxGgVG2Onks6xt4bSMHnqG143wU2:xIB/QteRaDP+25RVtOnks6NMHqG14392
TLSH
T1F0A59D13F2E940E8F0BED6748B669632EA72BC464B34A6DF064072551E77EE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.2MB
SHA256 d9b34e9f989cd79b5aca54cbe1b68c7c105623b48200a9631362388f35fbcea1
MD5 afcb131717d2986f64de103f369053d0
SHA1 25fa81eb2cc7f57da1b4af9a14a190e816d2a6be
SHA512 72ea9b26bed2f3323943b85b4521ad8665ce9b8be300fb4ddc7b5424c38f2b3378ea0016a3a3b7cd577fc3916ffa6d53b2e964e262bdf7122c5bf13e7aa2cf1e
SSDEEP 49152:8MfGM1qngwTjLAE3dGGj8bCEGcjesaNkYQd0XNJKcvaAcPTY6Y5Arlc5H9IC:IrXvj5BDlZIcV
TLSH
T1D2F59D13F2D940D9D059D078874AD232EA72BC494B2166DF0690BB562F7BFE06B3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 cbb3b3413143e56b087c0d98c382751e0ba8d7c04f5de8974bab50da2c80e9bd
MD5 3e747b68cdec0fe299de86c53814c9cd
SHA1 303291655aba9d054bb4deeef13483a4ce1228ce
SHA512 4e6128eca7f47ab27350f12950b35d1e1862443ced065f58ffae79b99f3027d65be7f0348c36b8a8e9252574edcf35aafadfff834d9a28bb7eeb1ab90eafa678
SSDEEP 24576:CLev01WJNw/CElPnEOnyUgph6O6i3iy9CTn0AP5+2QLyEu/R:CH4JNQCElPOh69giDn0AP5wDcR
TLSH
T16975AE13F2D940E8D05ED174C7468632E962BC160B39AAEF0A90B6552E7BFE45F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 333KB
SHA256 94cffef6669ac066676ebf1180d704b02a857b0e08fb40e377cf523d218c720e
MD5 98d3c88e7a7d3230edc3985abad95399
SHA1 69edcce390faf889c72189a35abd514f239c4d8f
SHA512 a6c6f0e194115ed1508c68954b6e93d394815c4e2a9a0825b73907ea577d2927430961af9883c70ef64b050c10cc4d1fce8f19425c23718953f59e9cbc7bd22c
SSDEEP 6144:wjPfB+s9+/da67j/e7yPh9/ZlYV/PvynCZG5/EKeO:wjfB+s9+/8671t/cPvynzeO
TLSH
T1C174AFA5B2901CF9DC67827ECC659905C6B27C5A0BA0C65F13B432665F333A10D3EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 333KB
SHA256 79c8ea5943cec677549cd4c89f994c716ee4d44da4e72d79de0f615213cb6ebc
MD5 2904d7c09dbfa3ebf33170ed495752fa
SHA1 edbaaae2db17dbaa623028b56a218c0df1fb2ecf
SHA512 698e42f37b84d1679d586688027f22e7963974904f5368e9d25c1b324faf2982f5e3f3b5397c751329963e4198a4f7a57d185800ede595d4695408582505b26a
SSDEEP 6144:MufE+s9jiyzKvDMzoC1sJjDxYJzkYutYPDvh/A3:MYE+s9jiywDqoCelD+zk4PDvh/U
TLSH
T1E374BFA4B3A00CF8DD67823ECD654916D6B27C5A0760C65F13A8366B5F333910D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 540KB
SHA256 af4c86b94f971d29b4ddd6fcceb72a9779134644c900bc714eeb2411c6fd2223
MD5 f55610019ae87dae4f88aae1dabdd2b2
SHA1 4191e2fe8412e15fce2a571c6159af2389736332
SHA512 2920af7c43f498fe081cdc4a043a543a0cb726f7303aee81028155eba0753064d96f897bea13fe674af6a80871a9ece20fbd9f75cab2841a915c0f5aa01fbf55
SSDEEP 12288:XmodSrs9/0cKRlHoEVgV0pLbbdIvar0x1sO58e:XzWcK8EVgV0pZbr0x1sO5X
TLSH
T17EC47C90F3E414E8F0B78A358D764511DA767C9A1B60DE8F02A8665A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
Size 333KB
SHA256 520bac44d347be50dd7ebe46f2e114ba1aaed159aaf83a1c9ddefc27687fc78a
MD5 7acb67656dfcb2f8f95892ad46acb561
SHA1 dbeab8b4b05a2d58b7f736600881ce566ec45030
SHA512 ee5731a67a06024d2e4e38f02fae4915b81e29d1775135fa7ac5317f1b2c3fcc2584a746ca31c86e7cb0cd3bfa00c71706977e0a1efd1ff92cfca67a30bafa1e
SSDEEP 6144:EMPLzxs9MQTif7jGaELyj6Ho+YV/PvyoUdJw0rGHvxToC:EALzxs9MQOf7P8jcPvyLC
TLSH
T17774BFA5B3901CF9ED63423ECD659906C6B27C6A0760C65F13B836265F733900D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
Size 142KB
SHA256 29baf9698bc725e0a14a5a335cada8f39e87cb523812dbc40a0b69111f457ca3
MD5 88aa1fa8e11ec896bf029a9df31ec1f3
SHA1 fc3a324817ba8de5a730bddcbf0e4ff422d5a091
SHA512 d55b33647a27a720fc27ec5dd70855b3eff5458bce32284ae3e6d41a5462d82f553096e8843e655c27883484153766a0fd9dd4b43f69d5f179ad94b9166ab29d
SSDEEP 3072:eU39HjlXEo43udtjZqMNbjuxPCFBjwNThTZD/WC6:es9Dlw6vvsCFBjqD/WC6
TLSH
T1FAE38DA2A3EE5484F6779F729DB88C2118BB3C999DA0DD0E5295320D0EB73D10439F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
Size 333KB
SHA256 00e696c366454cf74c5077435a2ee1bda0b9f0c7907fd97d818f1bb1dc477448
MD5 858e9751b0bbefedb68f5e404d693bb2
SHA1 7974d27904a72305483e202cde7f44ab749e1547
SHA512 484c110c968ace30390adee8f4a7b3e2186e00157159d260e20956d63851cd871ee2dfc1c4e544195664fa9a76acc51ce2e3ae08f4f3333205d9db8051d0b5d3
SSDEEP 6144:GUksYs9C4gPnoEVxu0sA4baA8z9YutYPDvhfrUGmdFUeYf:GlsYs9C4gPnhVxupFbuz94PDvhDUF6
TLSH
T1BF74AEA5B3501CF8DC67423ECD554916D6B27C5A0BA0C66F13B8322A1F733911D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
Size 540KB
SHA256 c3796dfeb74b079790614d74f1c70dac2dfcfcb00c79ca02ce32c72acd0c41fa
MD5 da2aed68af2999758ebf705d94e768da
SHA1 2849df073cff6610c77b7940977db30f92aef656
SHA512 cb6983e58736e97ecc61b910a2fe5de27db3f42e814bcf083b6cb76fe856585d91421398949d2f6198e5a7815050accb33790abb5ddbfd76370af1fc8d081c20
SSDEEP 6144:e9Yc2hxGHs9qT49WPUIy2EoQkzHpfQXQxxuJ3aLbpqmHdIvWj0vZD2PE3g:e9F4sHs92cWPUX2EopcNJqLbbdIv5H3g
TLSH
T15EC47B90F3E814E4F0B38A358D764511DA767C9A1B61CE8F12A8665A1F337D18E39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
Size 195KB
SHA256 47b6759aff852ea2f578d641f8f56cf46865e3977a5ce2e60c3a94ffa901bd8a
MD5 1ec21b2db5bb280719e1f176ce94a8a2
SHA1 ef3da14b5124bd68437f93f023c2951b25c3b193
SHA512 b7e6b4c1827ff0b987eb7e180b42373419ef4f2c4329445b70b03d14b15dbe260b01f9ba7b6244f74ad45a50260de9fe34bb85b1e93132066a10799b3db9b0bf
SSDEEP 3072:IPGMxHt4osFtYU39UY5DEmd/MjgvhagI/f1OFOPqxSrpD4nGp9GDOG:I/43HYs9P5DEmdggIn1U4KnG9Gp
TLSH
T1F2148D4033F400D4E873DA39D9618501E7B6BEA35B519FAF6351311B0E3AAE4AE3DE21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
Size 138KB
SHA256 1db60a83824842dffdc655ce3fe69fbb69e07dc7e1245d658e2097ed96f24000
MD5 edc24f6d12af06ce755b15004cab2cf6
SHA1 7741813d9a0dcbde2e02c478c43844392ca17904
SHA512 ce380e93a604879de06875ec9f886694990f0f67d33259ecca0df8fde93e302d1a26eea1f4cbfa81a26faba33386ddd47fc49b4fd9662cb1c5c81c2708b460a2
SSDEEP 1536:qBeQb8FQvXuhi3ugSXjb28W1VLs8h8Us8h8Zs8h8ise8MJ2zf67NYPxvQh8fqg9D:qsQb8xU39A28vJEisdBziuxvQhk74i
TLSH
T177D35B4563E81499F1738EB4A87445158F77BD622E21FFAE9380410E4E7AAD0DE39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jre-1.8\bin\java.exe
Size 333KB
SHA256 ca11e30e0d19392a4868dca9dbde3523827ddfc93f9cf5ba12811a4e1025b178
MD5 008d5bb5ac97c9d8c58a970a8c995fd5
SHA1 23b55e38b58e5bf1c7565b6762d45d397a0a402f
SHA512 63e432fa9a014fb7a51aa2ee7dda2309a9b0c07b46b1394d4af422c458a22a3c4421352a610b4c38f66e84bd574720739c24f819a189491517a89bc91aca561d
SSDEEP 6144:rvPDNAs9fHVMYNjWBlOFnUxUrYV/PvypLDZgJZ3:rHDNAs9fHyYNzwScPvypLaZ3
TLSH
T16A74BF95B39048F9DC77813EC8569816D6B27C560B70C61F03A8366B5F733912C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
Size 142KB
SHA256 353da0fff02ed19bcdeb04008b603355f396e8c619c464310717c95e72a1832f
MD5 0ba94631f8fdc097591023c7dcc1ca37
SHA1 8a4688055f9501fc69eef65ccde0e187e549b75b
SHA512 f33dd061a375b0320c8db2efe7c972d8c97273b2f8e495752fe9e692582ff9345ff506cc3cbb95e7f070c7da58c0d4623317935cd43b2ff64eddc27d1b61de2f
SSDEEP 3072:nU39HjlXEo43udtjZqMNbWwx2lvvv4Iq1OddtzScm:ns9Dlw6vvWdvgIq1OddtzScm
TLSH
T1D1E37DA173E96484F9338F7298B8C820487B7DAD0DB0DE1D51A1364F09B7BC095B5E7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
Size 333KB
SHA256 829aa7b608340bcb1ba38f6cc4144f0c84cda86ae2d8107276e128773c119114
MD5 94d406100d1c561cbe2b21be55c79513
SHA1 e5cf8ce4378a0324e403e2a88f347773ee303405
SHA512 d9cd8bb4c695f04ae06852b23d07b76536572730abe69c5cf953f322e7de1f7eed7660cc6e209d10894ff55a0e936fdbbc4be4dd059b4010c3c0d3b0c0b0ce53
SSDEEP 6144:7wL+Cs9mjYIbfOKjo+s7vgFy4zrYutYPDvhtrvag/:7y+Cs9mjYIbWKjGDgpzr4PDvhsg/
TLSH
T1B274BFA1B3A01CF9DD27433ECC594916D6B27C5A0B60C65F13A4322A5F333911D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
Size 540KB
SHA256 048de1377cdd782bed673392d4c55a0f48529aaa34510eb5cd6fd20bb811b9cc
MD5 e2040590f6eb9b5c15a25e944988c92d
SHA1 175008c5a393e30de0e049975f2b986223fafc69
SHA512 ba710e070e5b9bd76607eecd2ed79ff9f257bea325d5bfde2c2759c4ca4e699f5520871f1ab942dac69aa007f3300d2dbe9b7c98e74e5df161e6ecfdd9d60439
SSDEEP 12288:eUbMc6s9/mLhV56dXiwo8hLbbdIvWLp4M3:euILh+Xiwo8hZTpx3
TLSH
T118C47C90F7E814E8F0B38A358C764511DA767C991B61DE8F02A8665A1F337D18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
Size 195KB
SHA256 88309a02c0cf6d7709d57fe7c2171c1cbbe812e451a9590eb1d69f02a2846bbd
MD5 7bb9afe2fd9121852a4adf95662e7592
SHA1 579facb95f215dcfa82f9c37e948aa13360d0680
SHA512 97ff0779d038237901b0c4eeedc196223931a3a131d768106bceb31560267f2d6316421a27af0a918594de7810d94ca4b653f9f76f98a636c28dbae247c5375d
SSDEEP 3072:zHlrx4tITnWiRU39UY5DEmd/MjgvhagI/f1OFOCJGxhOP1wo2T4KsQ3Zat:zmI7VRs9P5DEmdggIn1Unv1wRTnHZ4
TLSH
T194147C4173E81099E573DA3A89614501E7B6BD612B61AFDF9380311A0F3A7E1AE3CF35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
Size 138KB
SHA256 48292993728a9057b3627229626aebf0f2c80648b4b157f05275698697401824
MD5 172c1a63a6197e718bbba15c2c171331
SHA1 0ee0200bf81976ce754c028a3062d0882f5acb46
SHA512 3b53bb6de8dc4fa033db1b0470309658b7c6438edfd6b49d8abcaefbf9ca50b9be20b21794e49f85a16df2636c8a35b7c2974c43082cbb843f619f27afc9e838
SSDEEP 3072:u1Qb8uU39A28vJEisdBzYMsxSdiWOEBdcv:kQYus9V8qdBptAEBdo
TLSH
T17ED35B81A3F81499F173DB71A9B045168B3BBD626E61EF6E5290110E0E79AD0DE3CF31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
Size 4.3MB
SHA256 20da28495065db9b6a30c2d82f7e0e48d0da854a4ef7d91c489b1d0c6ef018c2
MD5 f969558a793d76292973802bb0117681
SHA1 73afc2af0a5a2aa0e0774788f1f51d08f087305d
SHA512 589394abfc08f18913ee0cf0ef240e4d1c8e9755cdc1d2f8a1e3e95daef64b12388484b9100ae84fa91a100631f8388d16dc9e99ab33872b0d7ce712d3e28cfe
SSDEEP 49152:RMypKFETjyPyxPYvtU1QYvcMyRmILMdCOs59jx5x3KeulpIQigpQVYIF18F8NRVk:RMij+HYeNLzhBY+1B5CHHb
TLSH
T14B265B656BF880F5E1A7E178C97A86B2F7B678420D31EB4F0191C62F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeClickToRun.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
Size 4.3MB
SHA256 948ace8d315776689ce02e28c30c5ba9b971fb3fff902376d85a07862824e638
MD5 a7f5d904ac0829d1e71c7f648fc1e7c6
SHA1 5639a9346450c7a43ac1a818221e5aacef479631
SHA512 ea2b482da0be15bd246a596345fb19f75bfedaa6af3ec21f2f44036190762d2e8b30e7fc3e880f83e8c592d2cf5cc60cbe2f22ad7d6f31d3a3fa47d0cfe81bca
SSDEEP 49152:NSD6Rk8eQicVnZqPJlRSQjZULiLSdnsRgnHIXg3MeubCdlXa+1EEHc2ppz8NRV3F:NSAigSRw+L5wJPHtp65CGJv
TLSH
T1B4265C556BF880F5E0ABE178897AC9B2F7B678420D31EB4F0191C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVDllSurrogate64.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe
Size 275KB
SHA256 7cee28f6d02c3fc9ef3f8dfe77efadc76c987c366658d80171cfbd065f98ecb1
MD5 f6971054bfa1beb2c6ccda3dc5bbfd99
SHA1 6b830b6a2f9e902a994a4fabbc3d86b79d950e71
SHA512 4bbf986323e7a26908fec0aeffa022506e20172da1bbc6c05534b85858d7f28e3340b3b8d71d8c1ce34063cc175bbe2cb099febb547c45cefb423daeeca46472
SSDEEP 6144:3E97uDs9cWGNTNYdMzATVkQNUO7q51czQtKGpA6agr+:Ux8s9BGNTCWsTGQ44KphaU+
TLSH
T16454497BDD38F8D2C37E9CB5ABA1C700AB7161714B426387E175C26D8D036E05E6AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVLP.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
Size 588KB
SHA256 37d74fe2f129c072f58edfc81965d90b757d88861cd4f2b61e6915fb73b18d4c
MD5 8dffe03a69f410555cc73a6905e079da
SHA1 5364687452f080d398222a8e3cb55c86f463752c
SHA512 a3f0d84fe041b502bc2a44a8d9786c44e61fc48167e9522fc13fc840c2dc29a7f52e9466bd03a9c14e30fe546cd94b670f3240813b20d74559a7e634d1aafb7b
SSDEEP 12288:PtWK62Tdjs9rmluzvNU4TEYicyYffUea4jMLYt:AK60Yq/czsC
TLSH
T1A6D47D76EE28D8E1C27B897886928600E6717C514B61D7CBF27CD27E1E236D05E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Integrator.exe

Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
Size 6.8MB
SHA256 ee623005eedefbb0174f9f81609aeb567068c344a876164797d6a9d052f3352c
MD5 e0ae09ac6124d15352c09565fa78b619
SHA1 1d3084f4017ccfd558ee31392396570e305e7437
SHA512 db4fbe009d9d9a0d3bd44147dc20bfdc429da9a960827dcdd3f19811312bcb4fc8ec551626f1b7f82a288bad4c89548c48a659346bd8299da229255586a90073
SSDEEP 49152:77fCmfmMIazWc1cn+OT4hYz0iQp0ob9eRO2PiIm9+20TUvIl9xQ9zOB17/xYtuHx:77+2W4msSBYwhFB1GW1hrrmqJjeb2Hl
TLSH
T1286629596AB481EDE0AFD1748D778772F67278428E33661B0261CA1F2F33E588D19732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Mashup.Container.Loader.exe

Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe
Size 100KB
SHA256 6430e19ad01665eceb6d5aedb0094a64f340fa42c1386ca7c3969095b414d9e7
MD5 b6a5e887544c50942de28556a4e3f3b1
SHA1 18c84e55851e15f317e9e8e2fa06df4be28a594d
SHA512 52d39b73d57f96d71dce30f2e4841852bb46d519ee71ff1322dd1201d62fe3d1b2e4c8bc98e7c1d2d3a150a2f56a4dc18fd2ea60029489efe411e21adec112f1
SSDEEP 1536:0K4AvXuhi3ugSXjP/eAMpldERVMlOPqZhZirBw/mev5Nos9oAn3W:0hfU39ueAcI7qCBAmev5Nos9rG
TLSH
T131A3C091779940E0C351077440A2865DE97ABE910F22FB4F91ABE34F3D133D0DE7A629
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IEContentService.exe

Path C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe
Size 449KB
SHA256 f920365777b4c89d07dd9135c8d435fd46b9328d6f1c79a8bb7b70d600de1782
MD5 1f399c23780bf5ec07890ae179bd43b2
SHA1 75e0938511bc93756a98eda950f2ee78c920b933
SHA512 4e223e62e3a3afbc674b5017766fbd5014f6b0141eb11a753d825cae97d586ef187601c6371d52e2403c58c43f1fe84a0b0f649ac6a3d811f364a15c56aa51d3
SSDEEP 6144:YsBltprT8NDXugAfaPfxpe+seEKSs9wQom5jfcbvnmwVFwelNN72SLOv/Z354:DBlT8NDegze+bBSs9bRfM3xcy
TLSH
T17DA48D4AEB9444F5E657E238C57AD671F7B2B8890E20674B4665C36F3F33A606E2C310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerfBoost.exe

Path C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe
Size 877KB
SHA256 df58bf57bc636bac2397029b48b07fde20b44feb6ac2756241c310672f0a79fd
MD5 dc64175bcfdc96343251e2987aafff51
SHA1 e9fab5908e5c32df2b521b67cc444f00a85f0298
SHA512 903c49ac73e787f5e87464d1a13796bbc74cc582538c1bb351feaba55cef17f322a3f05040b4252eae516cb0f575be74142fb39999c18a21e3916ac65a806d58
SSDEEP 12288:cnivtbNJ88bKyts96jAKK3L5gSZ/+UvpEeZob4UnV5BMw9dKJG61n:4ivtbNJ88bK+KbWU/5pEKdUnHBt9E06V
TLSH
T1E8153895ABF945F9F1B3A67499768472FAB2BC521D30D31F0160C25F1E37A808D26B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDXHelper.exe

Path C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe
Size 189KB
SHA256 6f23802fa392da8a7c80c22cf7c52bacecb61e2f075653f08359ec5b57507e64
MD5 594f79b0b1f004bdb06183936236b285
SHA1 444392c3f1b9fc4b3f60e3ab737ae1b300f44a92
SHA512 8237755a8668836ae22e892257ff0ea99e5825ecd6d1d6369ea20395345bfe40f28c66109a53e5ffc4682cf91a8f11d75ccc3e0b4447554ea090aa6ebd9a0d94
SSDEEP 3072:sZGSCUp5Nq/D6U39wj1Q2+zT6lZdAh3SJxfFrgrwHLDsvSux:FS3DNq/D6s9wqelZdGaFkrbX
TLSH
T1BA14AF0B7B94A4EAE403D174C9A996B1F7B6F2B25C20639F1265D30E0F33391BE15726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoadfsb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe
Size 2.0MB
SHA256 459aab32be5a78986fe69565d470717ab6212f5a405115c29926f9f9c4c6028c
MD5 1e9dddf75a7e43a0821c67507c0626c4
SHA1 1d5f31d9dad90f9ebe97f62ad834e9f9ba8277ec
SHA512 4769eaff1df05e5f6a512b2e320e9dbbe5516ba3be9b628f72239f24c0c2cc11696eb998476fe7c0d9dfc151133333c05159adc5a70c1f3e51b736a8f0b9e6eb
SSDEEP 24576:w/UP4LiT30z/LBlpK4xWXVBEGFa/6qQW8fLXp3VJAaR010dFT7bK7+6mlvKpvQ:wsXEzTBW0WXVBng/xwVJl01GFT7bhloQ
TLSH
T1FDA52946ABE8C4E5E2ABE2789975C9B5F6F2B8510D31974F2156C70F1F336A04E38321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoasb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoasb.exe
Size 341KB
SHA256 c9003725b64d207bacdfb9328966dfb8b543dfaf3dcdbffc017c00de50065f7c
MD5 249592acc26a9bdd0f5da7bda01d8256
SHA1 27d234133cb841f6baee9cf9966c189d43458242
SHA512 fe5563d6f122e891ac43d6513bc4ccf0cb2183090e59a21f8fe8f325015383675facbc6193377ecd89de8d17d18a810fff3e661c1345f968f6d322d143b42e88
SSDEEP 6144:53NIs9L/CUZGPRZG8yWasptVkBZ29bhvRx9EiOwZexh2usSdrc5:5ys9uAGPRZnyWaspiZ29bhvTmw42Cdw5
TLSH
T1D0745A477BA48CE5E813A1B88586C2B5F7B2F8515F21D34F6952C32E2F332B1AD28715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoia.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoia.exe
Size 6.0MB
SHA256 b3e33a4a3c67130dc40db7f8301d70c820b309218d624f1c6486d1103cc4830f
MD5 80de7977f861071a2f09b521b39d3d8a
SHA1 e40f24257636f4eb8912e0815d2257a22b9ed772
SHA512 f1aaa531c211121c27fc0775e72e5407d496451cc9d1b287e01cf4458ec6beff7cff3c4d5882a9e78fdff59050588a81300addcec441859c4654101e3973c200
SSDEEP 49152:Kkmmx1SNkw2BxKdfomZQXyEXLWVZBAPz2Zz5tLOqrEF5ttmgaK293+XQK+P5jGSE:K66zNuQ5Qa5KZCLw21maWg+z
TLSH
T1E0564A557BF982E4E1B7D134CAB286B6FAB2B8555D31A74F0551C30E1F33A909E28332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

officeappguardwin32.exe

Path C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe
Size 596KB
SHA256 f70cb1f45711a854de88d32974f5628b66c632b3c661cc016571efb7b6dba7f5
MD5 bb703d7fa8648adf8c94135aa5cde6b4
SHA1 9d71466d73d586ec63e39494782d1f3aadc8e473
SHA512 6ac054a8183d56342284511d76bed7f79e38adc9a58b1d17be6894758f4a17ce9cd64bd4aab2da810c8835b059780d58b4adeae66df6b6076f4030cd33472670
SSDEEP 12288:WKSOl+98gjQvtRgAj5s9pcIPr0lypFpKuA:WKS++9WNjfcAlcM
TLSH
T1C7D44941F7A881E2E566A1348A6685B1FA7B7C131F70D70B3559F32E2F33640AD29B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocolhandler.exe

Path C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe
Size 6.4MB
SHA256 e3c428901f8e1fa2972ef7d51d512f098fbdeba30b235071094a353ab42dc987
MD5 46f3c00761b832f7594a15e40be928b5
SHA1 4bb40d0d4aec7c0737994b3ef142bbf2de4a6a93
SHA512 6f6abb4e4973b0ab961991a027ec4784388a155e8c6da41354e3f67b04266f6981889902eccd3ea9493bbf7cb80fb535c32467c0cb0ade9ad80e0752b1854c8b
SSDEEP 49152:9N0XsRGQBSzulfKBzDPajh0fsEodZ0mL+4C0/mJW49eeIt60+xDaPl6Fdm0I3CFL:WyP5x/OIqCl0nk3hzHj2
TLSH
T14A666A417BF880F4E1B7E2788A3A9675FAB278425E31AB4F0161CA1F6F776504D29331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OLicenseHeartbeat.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe
Size 2.0MB
SHA256 1e1b5892f74a7a5d5707638349a794f40a1c16cf5f27b40ca3a1ff212fe08348
MD5 4b5f3509671019ba445516abcf712662
SHA1 d3d8a993004c54b9d2bd7a57fb7b6f29698f787f
SHA512 1fb471f5f81b2143919a9562378e2a5752dab6f7bd85307d3eeb1afaff11562e224581423099a1251fbe23393a6f738432e1ccc74a98f9f8395c7fdcc014952d
SSDEEP 49152:raAPGVV6l3EQfeOdxff7pmq7YrU98xjqrAvsC:JdhBC
TLSH
T11AA528416BE881E5F5BBE7B88AB68979F9727C521C70E60F0156C60E1E73B408D39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLDumper.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe
Size 222KB
SHA256 ea31d2ed35f86ff3a9e17c07a52ef2e4ac16e92487c7ebaf6520764ac518ef38
MD5 48919ac09908282bb4b0944c12bafae2
SHA1 bfdd5c979b6f1c564bec4b42577d8471cb638178
SHA512 92216c29a39c71f18a64ec1135ecb0ddc1e5ca019ab665e1a83901e7af5778069da3fbd6f98f2238e8e75408ed83e198f2ffca7fe0b33a9bc63412bb2b344d38
SSDEEP 3072:XrTRDj1t61tSU397aj4+qrSVzN2Bmt+hlkVgL65bvWvBng2GW379LIMXcLjpVtcn:XrTRDZtEks97aj4dizrCLWWJqJSJ
TLSH
T19B244A0177FA1054F5B3AA709EB682132A7BB9956B31D7EF0518811E2F33BC48D35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohub32.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe
Size 2.0MB
SHA256 b0a3616a5b885ce42ab49884dffaf6a95b4ec05496f976994b654bcdc65e5343
MD5 45628a19c311a4436e853bfc6fff9046
SHA1 dc09aaa7d88171b03a746a21930998cd53fcb86a
SHA512 44445b56369dee9dc0c5f4a9fd357c1975dfd4f8e9c6590b0c0205b301c7d3384cc29e05e26cbb494c1c8e16a65ba149afee49a764e05ee24a8e9318c9f38fcb
SSDEEP 24576:JUF901FZ6YGgRHassVzcyNQKDM52A2NBH3NRLOhR7FVwQPwhUfwNb4FgwPqe0PjG:JUF9012cqM64ULOH+MYu8m1/p9iw
TLSH
T141A55986BBA484B0D526917189B6867CF7727882C9234F47318DDEDEBFE32604D59330
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreporter.exe

Path C:\Program Files\Mozilla Firefox\crashreporter.exe
Size 3.5MB
SHA256 4363b3fa9b8f688cea660811cfb9b2f7bfe49af293f2cbbbab1813365aa57733
MD5 4f3fa4d8b3f8c09fc1cc18ba2f1980bf
SHA1 fd9521780de65f10a41dbc0199b3d8ed5085fa6d
SHA512 63940ca91f10322f4deb66e6aa0feac4d96eeaafae120d4fff2e1e7c2028f460d49d64bc5805bb32ce2d86192e471d6dcb8b583e8ceb0bf0cca359c22c4b5c2c
SSDEEP 49152:szWqOCdakgL3UV3O28wsz3iDT4JmeDNB05FQz/BTmXLhm6kV9N7z:szbNgTU82Jg9f05FypaLhm6Q7z
TLSH
T173062842EB611DDAC025C0B482266723B761FDBD073036F74A906735AD68EE01FF9B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox.exe

Path C:\Program Files\Mozilla Firefox\firefox.exe
Size 777KB
SHA256 9769a2142f4efb72ee33821c5bbbde1dbd041fefa57f701eb21d8ad925f78f61
MD5 09fb5cf91f963b7462d9dcd51e61c440
SHA1 5dfa303282f228a52371f61fcad54fc34655786f
SHA512 e6d1a9c0b50ac5bdd6b7228f4842a3307c0d3d1ff51510e46c47e756fd856042372f1c6210a829e0ff123626a40608370f6156bd7c03a77abc28dea5788836e6
SSDEEP 24576:fUSm5dTxog/r27Y4SwpemIwpelzEfYaAr:cSm5dlog/r27Y4ZpeapelEYTr
TLSH
T1F105AF03F38516F8E08AD5789A52D133A5723C880B51A1DB1BE93F2B3E71AD15B7876C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
Size 329KB
SHA256 9fd8b52e9ce98259f5d205bbc4b435032bba28fc95f171cb43a40b2306062722
MD5 7faa36dddabcb730555cf6f566969599
SHA1 f8c5cf4d1d68067c4459c6b55681748b854d4a3a
SHA512 bb0d8794a835af31841509cdb0293225d688cd699cd365bffcf4d92d7043ab5636d0770e13d4c0b03d1f546f55bc9ec741b840e1bc24dac55f60223cd82b7da6
SSDEEP 6144:6NKs9+EU8tPoBB5ynDRvI1nZm2lRV3u/iJPsfUrcA9B6r8PHBSY0MU:xs9jU8tPov5elvz2lRo2czA9O8PHBSY8
TLSH
T1DF749E2573D40DF9DDA7827DC8A18912EA33BC954790E78B03F48A661F137885E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nmhproxy.exe

Path C:\Program Files\Mozilla Firefox\nmhproxy.exe
Size 654KB
SHA256 40e507c396306305ba8d5ad48a6daaf9963ab85a56106d422a8e1f01e414700c
MD5 14b61d3836ae48421087cddac6fff17e
SHA1 9ef876a62d34cb19d1b513a0623f1796033a13d8
SHA512 f7ebd9b435c3a61b62d0ac3eb46869e60f825c7ba6d692c55bcfcd52088f06036ceb42fc508ab818f6f7b0d5b8689afb35dc905dad4afd9ff05878c92898be5d
SSDEEP 12288:SxpVUrJ0w0+xIIIwvlyVYs9Y5c/waheNbYyhmaVlQ:CpVq2wTI5MGcDmElQ
TLSH
T12AE46D12FA97D8ADD51EC478874785327933B4CD0B30AAFB62985A353E19AE12F3D704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pingsender.exe

Path C:\Program Files\Mozilla Firefox\pingsender.exe
Size 126KB
SHA256 0b64b50344994ecb15e0b16d208bd32f080b87f5be756d3a5013ae87bf25eafd
MD5 095c41fbef297418faa5991c32a7b85b
SHA1 8a224c545aee91bda9313c2b515e48f420802bc7
SHA512 e70195ef2add3698180bc657f3080ab25ec6bdbb0df3d7715af653e3c1f98073c0911d277a909f8cb6523156b4c47386d4284618627406d5fb17f0d84eba21af
SSDEEP 1536:GXQ+/y5mgjvvXuhi3ugSXjytiA1SRn6dhSdWA7gA8aN0IBuJAkuk7KcHo:GX//yfj+U39FHSh2SdWACeEj7KcHo
TLSH
T1F9C3B0439A1462B6C691CBF1D1D7AA21D3273A054B753BDBE39042092F263D4AF7D3E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plugin-container.exe

Path C:\Program Files\Mozilla Firefox\plugin-container.exe
Size 202KB
SHA256 6a5a86dd0757d56b4e5da5fa501555573c93a3fe8a54f9159d5c5f8c7e40381f
MD5 e9148233d7bfecb09f4c442e552abe39
SHA1 7080bf31c0bdf3d14e0f560ea3a20e6c0582bbc8
SHA512 78a3b2999adacda53c5018d3e427b718689c75975fa6a05f3dc24d66f4d04efda2b7720b5686b2a5650fc5421592976b6f4facfeccf67188c1dc7ce27fd161b1
SSDEEP 3072:qkkoqrKRU39KJN5WveEYoLHaPu06jwHZL6DCZOcWOE9/cQ5l:qkkoqrKRs9S7WvprEuDa6DCzWOicQ5l
TLSH
T13514B023FA4400E5E84AC174E6C16A39DBB0788B3B2067DF265815613F66FE5BE393D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.exe

Path C:\Program Files\Mozilla Firefox\updater.exe
Size 523KB
SHA256 ed62ddc2f94fb3e4dd9dea071fca9e08bfe7a8f321f5dfcb864a71891e63dd4b
MD5 a37f198ca2f891b53646f8cbbf975336
SHA1 dfb51b79c248a923a68a67acbf3f8916aa220511
SHA512 91834831e0b5c7b19bf274cdf055eb6ed6d4e67835dec6630dd4c242009b35e6f0dd975323678abe0b722763e707a12109a0f47cad54b7806eb05299873b5853
SSDEEP 12288:FePHZ4s99mKmZuJKcbrBhL2Ze5eSOJAdGyKJpjo909k9RO5:QP5BmKmrODOJ+RKJpl
TLSH
T184B4BF29F3540DF8F867A278C8928512E773FC55475096EB22E4D62A3F332D81A3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 188KB
SHA256 55ec8b77c7cd7914f6f273ebf31da8270de7d3adf6a5d936a77b9e4efc5d77d4
MD5 9dc0e2f79231e7c1857fc55bfe034f7a
SHA1 7ffdf91f626e505fa46edd02ea824d56afae5808
SHA512 81ff5af390d86aa5d776223a89ee2d5dfd49c35600b133c49599ef6c41fb1d4ac340326613399550f4907f3717f2a337789aad8f34b6c2b0e454796c28f71258
SSDEEP 3072:pxiaCZleU39QhAV8pQFq4XKF3QPUnbZqmFH7LDJEDkWt:pwaCZles9iAsQFqT3Q8nbgyHfDuDXt
TLSH
T188147C19D28802C4C56E2175C7659A41B7337C2587E2D3CB62D0F63E2F7A6806EF9B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5576-2-0x000001A6E34D0000-0x000001A6E34D7000-memory.dmp

Download

memory/5576-3-0x000001A6E3500000-0x000001A6E3505000-memory.dmp

Download

memory/5576-6-0x000001A6E3500000-0x000001A6E3505000-memory.dmp

Download

memory/5576-1-0x000001A6E3500000-0x000001A6E3505000-memory.dmp

Download

memory/5576-0-0x00007FF709530000-0x00007FF70963B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads