27dbe36451adb3c767a111f804c07cc966c494b8202d1cc4472e6fcb64ad86ff

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 19:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
Size 1.1MB
Sample260730-ya273aee85
SHA256 27dbe36451adb3c767a111f804c07cc966c494b8202d1cc4472e6fcb64ad86ff
MD5 15d4cd79b4019a6aebde50c10f014fb0
SHA1 3b9f0d7ebdfdd8d160ee534caffd44dc5374d8a9
SHA512 9f788e8447401a0183bb4296819e69ee11568b9286e689b3acb8bf2b2c0e92c78410c486d71c0bae5c178191583bb4e547d6e9622548b41255d91eb89c082a0f
SSDEEP 24576:S804qbqw1GyQUoSx9CS4pws5o/pyOhLKxxSq9jrc5xaNIB+mS3t9:S0LgGyQUoM9CS4pws56pJhGPSq9jrQaB
TLSH
T11E358D0A23A4419EFEA7F176D617C61BD7B1784A0376962F01A46B726F337711A2E330
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\L:	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\M:	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\N:	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\O:	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\R:	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\S:	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\V:	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\B:	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\I:	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Q:	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\T:	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\W:	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Y:	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\A:	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\E:	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\H:	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\J:	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\P:	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\X:	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Z:	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\G:	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\U:	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{D85901DF-D0DA-4964-AECD-B8E8AF22AD43}\MicrosoftEdge_X64_139.0.3405.125.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2936	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2936	2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_15d4cd79b4019a6aebde50c10f014fb0_agent-tesla_amadey_icedid_njrat_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

64BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
Size 296KB
SHA256 ccc3a56c3498a8684f803bd37a9121bb2175e70c75c8d615879ad61e932ba9d7
MD5 71527d557f09994c1aae57f24be36a45
SHA1 3b5436ec22c7db8409c7f9058876b14383ff9f54
SHA512 9f5e7ec235bbdd5474454d64ea25f2e0e5c973d68c8ea1ef94490f9af6f912b01b7b7e354513f0c05fafceee1b2cad52bbbc3c307eaecf2fce29e79905b74a56
SSDEEP 6144:h5qd/2s99TYeI1Hsq/exIsecJtqQ1JyMMMl+4vbjm:bqQs9ZQHtcy6z+4v+
TLSH
T197549D0A37E84CF5E0A7C239C9629A82E3B178454B64D7CF5750426AEF236F06D3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\java.exe
Size 333KB
SHA256 127d5a9b12ddc424be4933632549878361a5fccb47e94392c21af3c74befe3a6
MD5 75788df2153744f09d756dcf81e552af
SHA1 3a16205dfe885102837ff18be9a471c64089a074
SHA512 91c74d2e711910a6e1160507acbb0d73f3953108c385349abeed7c3962f9842a9c638fc33dfbfe2f5edfb6e972c606b6f9af63962114d1b3df383376400d9c0b
SSDEEP 6144:noP8dGs9R+RNiejsuBMpZ++9wYV/Pvy/KRwGc8VC:nU8dGs9R+LieGJGcPvy/Ki8g
TLSH
T11474BFA573A018F9EC67817ECD555906D6B2BC5A0B60CA1F03B4326B5F333910D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\javaw.exe
Size 333KB
SHA256 3ccff19ef7863b4f1aba69c8b19809a5ec224359d43783e45570672ad9b27ded
MD5 57a3acd9a956a845c09d1c323bf8d37b
SHA1 cbad9ff5c657e3b9433f92114cda1b2d6b343b82
SHA512 31ebc6645980b8128370f35dc03e82c8a723fecd46f51a23637e1e774282f4d1e0b0efbbe745e42628bf4e88cbe310bb713b5fe674a9b3775843aba8a3bd01e0
SSDEEP 6144:KiLHDs9LByl2Bp8SPsr3CntGzbYutYPDvhtPER2GoRGEnNLh6Oy:K8HDs9LByl2v8S07CYzb4PDvhtm2GoRY
TLSH
T1F074BFA5B3511CF8DC67823EC8554906D6B2BC590B60C65F03A8366B5F333A11D3EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\javaws.exe
Size 540KB
SHA256 d906fc237e5273c90b55371f64295eb783a5c7c5818682325d4e69b9e1cb9017
MD5 c474c796426c35c4a672ad67c7194c53
SHA1 247c50b05b3a9cb97655b41053f7576327fba789
SHA512 a1e119c08849a72ea0ef5f9214dd5c8581cab30514bcb243761b05873b0d2f6d103ff55b524d6a3ddd9a7967e9af102cb32627d239317ca0e1f9e7eccc1bf6dd
SSDEEP 12288:qc53iCs9r4w+o5gtHLlih/LbbdIvW8arDu6R4:q4vw+BHLlih/ZUar94
TLSH
T154C47C90F3E414E8F1B78A35CD764512DAB67C991B60DE8F02A4265A1F33AD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe
Size 596KB
SHA256 78fef67d0c693e7a21190bb92d7fd8f60608ec7e71d1c6b8b14f0ecc40ab64fc
MD5 50bfd4ea3b95497861e67cf5839a3cd9
SHA1 c41f5d928bafb43103ec2eb450baa241236d69a3
SHA512 fee4bc0d2de725b20fe2c6bd1db04f402291cfe064d76d21bf3efef935d99b78457fd41cbd092f393d41072664786d905167e727922e1294f0f2adb8ce79fc0a
SSDEEP 12288:Ys9uWpqxHS4gw2EoGKYrNS4le+WDi5cobcVz/:1pqxHL2VcepDivc9
TLSH
T108D4BF41B3E845F5E06AC130CA538542EA7278960B64EBDF02E0927D2F37BE95F7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe
Size 6.7MB
SHA256 0557c36d588dbca177daf7ef48c65c044c36b988bb7575544e44f0458671e230
MD5 b1b774016f2b5b6a8201ba4782d87463
SHA1 ad34285ece5d83e3c3eea3a3874cc3cd3b5a614f
SHA512 50974ad296869031e4394c7143d1138ee7832d4345fbb62177920aecfb83b1d3c7e7d240ad0d365a42dd8e9b5483660499e6f0eec786be78dfccd6cb53222b83
SSDEEP 98304:Dl8YfTaJ1+WH0MuB2L4HrZtdPIieK5M0uR7F5efzWb:h8YfTabLIIiFUpIE
TLSH
T1CB666C47E3A600A8E46EC970CF3A5521DA253C8E57B493EF129476E91A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe
Size 1.9MB
SHA256 c1bf028720cf09aa48e97c52a1d15d6e66a73d40ff5b834aec7b6c8ee0fe39ca
MD5 e650d5229e6f17878434572b457ae698
SHA1 330f99d16c7e425397272e91db529678437f2d9e
SHA512 9a487237845df4363037946cd5840a590c142b08a45b1bd2d1f8e29901d34a3c6cdecc78e9ec8dc218002fb1f62ea3ff9ac4507bcfe83e24d7b0f5264c00caea
SSDEEP 24576:0ws36tIq3U1DXpYHEW2QC6JoDL2NLb9Ld25PTOocJuJ/cIsY6WfvzCE5CoTA:RsKtISULeEW2QCPwpZeToMJseD/CoTA
TLSH
T134959C03F29941E9D06ED578C7469236E972BC890B34B6DF0290B2992E77EE45F3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe
Size 1.2MB
SHA256 42732b8d0ff874044c6ee59ff74949000afece7e15dd28055de10d26ee232ba3
MD5 9af1657616144397eb1ff50f5767a09c
SHA1 f4e5dbb82b92f03d2779eed13007780ff369ec51
SHA512 edeb3d909264b9249548e38955bfe25b6f7444e2d7e55561302275014e0a21d38ae0585f342f5c5c201ad195c26c94f8e47aa25e7a5a2461a3b3e2b5a3ba56df
SSDEEP 24576:zt0hfPpeN0vUnXNvlIDbAJ9594VkWncuIVprSLfqXo:ztmXpeN0v2v6DsP5K+mgpGb
TLSH
T11345BF07B6D841D8D069D478CB568132EAB27C960B34A6DF06D0B25A2F7BEE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe
Size 1.2MB
SHA256 ad28761b86f5c6b4725d41550f591d8e81783380428dd50eae0918ce79e19838
MD5 2038d63603751fb3634219f3a5bfaad6
SHA1 7116bf2bb86644486ee1f5b80487bf5a5587e68d
SHA512 100d1b0c8a493af3f5055fd44279677f0a3a3fed13e815dd0447b7ee4d51980d8fad0b7f4b5107effad1bcbf8de0c4d3310ea730a6bc8937d877d8858eae2b8a
SSDEEP 24576:ESOy/mCm3kFo3Xm+yUu3/oUXkkuxpG8+08mqp7p0kEa9bEF:Ety+CJFiyP3wu/MpG7Nya9bo
TLSH
T1E145AE07B7D941E8D02AD5B4CB568136EAB27C860B24AADF0690B3592F37EE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 1.6MB
SHA256 04b5c7a8340a8ebdb6b13374957ff7519a299122eb07204e65ce70fdb8b3d6b4
MD5 c57f081fd59a136c9381acaf57bc5d42
SHA1 a8582fa2ead8c1f1b7121474ad23e3b414bff37f
SHA512 6e1b98587daf9011c434cf02b17058b9eb046f0ae54289c5f1d2012d87019601ac6a1e98d57cf7cbf1b1d0ee2e0f98f263daed36e6993fb3a07412aa554826d4
SSDEEP 24576:QWZZrCr38jSeAv0LjXsKRjvyfgzeuj/L+g3hPWhlkkkkkkkl0T3gAQK3KzsXBXo7:pCrsjSew0Rj6fOjaQxwPQK3KzABwP
TLSH
T182758C03F68A81E5D09DC2B8CE764B31EA717C655F20A6DF0190BA253EB7AD04B397D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe
Size 3.4MB
SHA256 35a964ac8d2e17be1bbe3006d845f0b198bc0a6cf7fdaca37ce5c4ea0d4f3288
MD5 0ceaba63291946c8a8a550f0a1bd22dc
SHA1 f76e1e499ea02b61617eee97cf65664f703d674a
SHA512 973aef692cc259c6cefc456584e1d24a8f4c7d594cb384feb1918996dadcaa422d7c81612ae26152d481fe80ba83e7fabce42774770746e41c56338ab722b879
SSDEEP 49152:PrbQg56QBOJmMMqEot8loQce7uIEUqMzADBulO7Udq+KqOuBk7bVnU7wF62JtYWj:qsroYwBul1EE4wsPTiY
TLSH
T138F54803E29900D9D099C078CE5A8632EB627C8D47F562EF3290B6D52E77EE47B39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 1.4MB
SHA256 a1664c9b5894124141adf268541ee9c63e8e10deed7d681e3771fbc74094bf79
MD5 cde4605d1bad7a236f14122c8382efa8
SHA1 001f08545a435fd1cd9a5c7348b93e545a31b507
SHA512 18e66013b56f745985f7bbdba3d48d8535e2260375ed0524ea20227e651ebd2870dda4206f0fdf7b7336fea1da13fc9b84d625e2f289ed080832e15ec74aa0c1
SSDEEP 24576:dh1QcZtvNmj0/XZ5INB0qqC9aFV074yie1qRAxxjcpcEi:/1DvMj2+BjH8FV0cyiSnAXi
TLSH
T12065AE03B2D941E8E06DD478CB564536EAB17C860B34A6DF0698B2592E37FE85F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe
Size 1.2MB
SHA256 35b18817b21e9d24dc3eb609aaabbbbc8dcf7902cbc99987b64ce794b1051663
MD5 d54df17cf7000178d9e6c58f32521f50
SHA1 ad9a01c90fe6fd7928d2abc8722c67d3334acfcb
SHA512 adcd0301bc8e8fe6752aba2d3c49bff157aec034bcb7417dea7c8ae37c9fc017dfb34ea578cc7444e6a5d18756be3f4a89eeeeb843b554c879ad8c4359bcc403
SSDEEP 24576:CzkSEzZfoSKXyAHwfig8VTMnMiUhH9G7sK:CzRIZfoDHTg8V4nMi490sK
TLSH
T13745AE07B7D840E5D06AD578CA668532EAB27C560B34A6DF06D0B2592F37EE85F3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 248KB
SHA256 762116e06cd083cf624b68996f8ee3519084cdc4ce6cd9e1fea38edb1fe8d4aa
MD5 d3d1f35c1806888974f9ece2da62433c
SHA1 538442c644988b667e87b610179b7d5da4f23ea3
SHA512 5e782584ed7797634cd2f71cc0400956bb26e411ed6008193e2ab39fc24fa77275868e46a68ba770c9ea8c2c1d734e71fa8a0a16a21370cd6002001833dbff5a
SSDEEP 6144:ts9gETRrVppSbgO6aR/Cuoh0Nv/bk1Z43nsDIE:ts95TH/naRokwnesZ
TLSH
T18C446C656AE810E6E03791B48AD49903F334F8B61721CD7F4390426ADE63650ADEBF36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 265KB
SHA256 99ddab5901c55466fe4a5b5305bbc1a287fd5e2144eff18ec5ce3d909dad15c1
MD5 89140c2dd41b96e273cfd23d1f256f92
SHA1 42807f2c71c0d2eee2c24f4d01df7c77eb3dc932
SHA512 2fca81f7ef7cf6ae8123a386ef538ebc3af07cba154e28137510df770626844ae3e2f0646043071a9576ccd8f094433e9a9557cecffd71b78ba9cb53d00771bc
SSDEEP 6144:rs9riVrpQraCpBZK58zYWoht+uoZTfDDSG:rs9riVrngLzHo36DDSG
TLSH
T187444B6925F810F6D176C1F48FD09903F274E8B6A3108EBF4291435A9E13A916DBBF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe
Size 3.9MB
SHA256 7c2d6a48b8ceebf28223693e10c87c3913423bbbf1987ef7100eef851fb59342
MD5 0a1b75f7abf7b4ede1abb72d6929dadb
SHA1 8deea76287102cbd9ef86ed92e8346411e055ae3
SHA512 0c733ba9e47f4fe87e585ce65cb9c1358332246db8d913b6536059ffc01c67b330c1cd1707c3c32c0fa9fcd8d043005aad0254038ccf440ab686f8d3a428e5b1
SSDEEP 49152:UnWkOr97OojdBZ82HrCSbF6ueCPyyHfXo10GD0AGcuVEusJ6LNzOeL0GKVIeCjIx:frunScuVlcm7fwKAF
TLSH
T155165903F29940D8D159C074CE1A8132EB627C8D47F562EF3694B6EA2A73AD47B3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 610KB
SHA256 ad7ca5c471cd017d3112419e72acd5f0a8d2239e0e48ede3229e8ae33d97bf44
MD5 f7d5182d6fb406e2a4dccff2b2230104
SHA1 52b009a079d6bb93bceab38dc45b87fde1e2f118
SHA512 9cf05f4538295283f0f6db847fd9c820c2afb2e61ebf33ead42521b1b93986fa125314fa3bb7ea386efc17b6fced6ff8aad11253219fc1fac9d3bd37fac15296
SSDEEP 12288:Rs9famBPY1ZgLHVl25SJ8S9NGw15rPkGySyRe:UamBAYqNS9Nd3MY
TLSH
T1A8D4AF45F3E847E8E07AC534CA528546EA7178950F60FADF02A0527A3F37AE55F3A321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
Size 7.2MB
SHA256 d5883d131d73100f98937b742b48d88c678d3522439ec55b354f4a1171d9d685
MD5 dcc8b411ef27b07bf6e5ae7c0f6da366
SHA1 7ef04a4ca26972de576605b1e272385da2680cf8
SHA512 b3f1ebce94c937c53f51c0f9cf9f5e9e34ed3c038f50bb22be208c2c1aa84bd2b221b458d3a643223ab89c932eea2b9d25c788c931e29f3107fdb693db72ce80
SSDEEP 98304:/6CZetahq+WZC4MDowCsJB2++fGxOxRj2vJzRN+T6frlol3HGh:yCZetaf4M0GIG4xVqzRdDK9HGh
TLSH
T117766C07E3E600A8E46ED974CF2A9521DA353C8E47B492EF169476E41A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe
Size 3.9MB
SHA256 0a3ac01156e7d3e52e2d3aec65afca91c5c4af3879387d5f1b07820a8541ba12
MD5 00bc2624e801df69d981e63d801daec1
SHA1 a24963c1a367ce42c067f8b89f2f181c94cb3435
SHA512 b56b06e91c9d1e8c70d55e81418f44e0a77a1eab2c5ede714a070cf4d213f7375d84eba4301e098283aa89f29458108e344cce46b3a4c712f4ea2ca917e3a379
SSDEEP 49152:GvTlnbgL1BRel4F2nY/bmhLbKqm006NPpIupEEVu+e6NqcXToRzvUqIzYHBigdQR:obImlokYDmCCRNUhIUBbf5w
TLSH
T195165903F29900E8E05DD5B8C7568522EAB2BC850B35B2DF0650B7562E7BEE4AF3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.3MB
SHA256 88da3741b70b91b51a262c33fab35eb8a9fe74ef9c4ba056a9b5917878695197
MD5 29d4908fd9565e767d6d76bf4d259e9a
SHA1 fd133d31452348aac1dd22db7b853e9dedc83b3e
SHA512 c3ef24555b99e5dc8409156e62b140b168553e41b94ddaa0baa44730d7281f5f445b9b07702bd7d80d9184ddc925d7fff88d5ccaad0fec846806c89ac444eb7e
SSDEEP 49152:+4qAnutZtff3caZkeE6rstBhuXjfS4LWxns9U:dujHL1jBb9U
TLSH
T1FFB58C03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 1.6MB
SHA256 f4e5fce8bef051a103f88ddd516f3a30da6094bab560f5766c663ed77eafe858
MD5 344ef0cd3f25e8632501b75e06a04eb9
SHA1 d8b29d8391748527a4897af2fdcf6e957a33d483
SHA512 32c31f7ea5ea4c0b654ad766c33f6aa3e7d0213a48962171adccb583d4773aede36e9ea327f779e12e5727dc5e355522f1272106f12ae70a8e2af14089b2f6f7
SSDEEP 49152:zXGAJVdWTTjhDLZK7JxML+5bTlXrk9dBu7Sl:rDuJ0bOi2l
TLSH
T199759D03F39901E8E059D1B8C7568536EAB27C450B34A6EF0A90B6552E3BFE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.0MB
SHA256 217954ac50cc19c86e69ae52b5aa731da8fae8e4e51b409b78a428aaa085614a
MD5 aec654cf0288689a8843fb9756c78ddb
SHA1 8da606cc68e1e13f9c3570dbd4c5d0a0c2578867
SHA512 cb82747119881736eece277c136ccd7ba8b4d906e87e1a4d415b59c198e9a031ff2140a1d55b4596725f6cf300d34534549bcde3d34b4b64090cc5191505669f
SSDEEP 24576:4sOIHZ6F4GTRvFtv5ue7boFkW30jSs7CtW7KSdHBxmRkkkkkkklQXBysWA2jSb7D:4mHZsT5t7boFkW02ZrSdHBAVf2jSb7D
TLSH
T176958D03F6DA80E5E05DC2B8CB768B35DAB17C554F20A6DF0680BA652E77AD04B3D394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 3.5MB
SHA256 6a043a36bcade0be3069e04fa862ac8cd7d1a75c3430eba55be656830c3fb0ba
MD5 3017a9a7c520ddacc36eb072ba74bf65
SHA1 4803418b142a89973305e390b86ede7cd70c0912
SHA512 790c284f466c1945f2d1173b92f517273af51149812e4b9a91b3a3d876d3d8b831b00d1fa80486530b7ed9e1048a2d3148e3bb7b54f5f7e379a27d6e34b10bac
SSDEEP 49152:6utTlKmJ+OQLckq4avqn9TT6b6YErVz4AkOuaRoBISCaQZCLlrr+3:xNp2yTOnZd3
TLSH
T13B064903A29900D8D059D078CF4A9223EBA27C8D47F566EF3690B6D52A77EE47B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe
Size 1.7MB
SHA256 6c4ed55b68e81a260b65c005ab792010b461dcbfaa8c66122a7a884858f52832
MD5 de602224e4c49ce394357d078848a1a3
SHA1 978f69b010f5e93ee834fab8b374a5b37d43c9e2
SHA512 e4c74b83059daf62107d103985065f4e87c39e4984f063fdb019d62c2160aac5762bd78dc46953a93f41375b5ca65cc39a609f2ff1e17f39ee8b96e7d08a0270
SSDEEP 24576:4+3vlK3M6nyin+dZ5Ri4uwe2MAAtUU0TOb9FeQuJXlPnyF4mfHU9YawsNvbhlv4z:4X3MKgHd/MAAyU0T4zeHX04mfHIjkz
TLSH
T188858B03F2D841E8E06DD2B8CB468532EAB27C450B34A6DF0691B6562F77EE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Size 4.1MB
SHA256 96111a70153b172cc4c76e82fb57eadcac86a2a517e193d415af618bd8378f67
MD5 7dfedfb09a9233b5c1b89190ee6cb897
SHA1 5a669f0fa0e353b538c01d2a6e72839a0fefac0c
SHA512 2c6a1022ec92feb5760ea150d8d0c08fa18a05776d1d752e279c69a382926bf30808dc8c002e6fb57635f568d71b91308133cbc856c1d1da0a5a02468a405452
SSDEEP 49152:DuVMILSt3GvEUWCcVzgDTb+TjEHzExldDwUIDtaZHWRdpev2y/BaRpf/pc0:NOFNz4d+RaAR5pc0
TLSH
T1DE165903B29940D8D059D074CE5AD232AB617C8D47F162EF3690B7EA2A73AD47B3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
Size 1.6MB
SHA256 e2d85915091c306ea02b2256063d71002e1f40e1830036fd0a6a47c91477ba08
MD5 e3a662711d145c8da466be862b9f2ba3
SHA1 7d497afb7808420e696d8f6d3c1ca7eaafc5d45c
SHA512 95baa7dae7f29c834f40637a69dfbfed2f7e285d2aab88153863dc5055a523dde37a9ab1ad6cf63259c70510712cfc7a4e89196e0a892dc207af4020e05cdf4a
SSDEEP 24576:/6hl636GcxE7ercG9muie/Mg01mXckWkL1oaedpEukUoygGmq/SR3pLL0iD:/663zEEiTSe/Mp1Kc9kBo7EukU1E5LL3
TLSH
T1B3759C03F3D840E8E06ED1B8CB568536E9B17C454B24A6EF0A90B6152E7BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 1.5MB
SHA256 25679f81ec8e840aa1519888ccfd25562d7f364a7a635fb8983eda9f010f39a8
MD5 a4d6fd672eba01f88cec09a7e23181a1
SHA1 2d9b6f53d7b5949dd1d49a7dd4dd019bde236e5b
SHA512 1e12bc13a5f478cfcc2b094903dc56fbf991f3f510fef1202231d2c7a14eb8864bbcbc4cdfcffc449ce07679ff7f0302efbdc6d7d48db6a6b6f7a4298dcfca33
SSDEEP 24576:OtI5z6b6zXz5cA9/iuWUYlZtt3wOzHGsVa4i6h27d3WlwUKs:P5zQECo8UYlZttxbn+6h27dXs
TLSH
T19A759D03F39940E8E05DD1B8C756893AEAB27C450B24A6EF0B90B6552F77EE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 329KB
SHA256 12d33d3da449014baf5030324a338694cd7aa66d313fe3ea85d36b6613a410db
MD5 d4ddc781c0c5f1e84ac23ca1c8ecdf9a
SHA1 db8a345c27788c7079e384938b26dfb94430f6f8
SHA512 6e17bea202fa2adc4b5cb3ca8378457759032b8c10b066fba59dc79164469c222cf6fbdb21c47a2a7773e8d132b23d28c6653aa483981bb13dac9203881cb536
SSDEEP 6144:XFLes9sfB70kAD5jS5i8H162W2lRulP/iJPsfUrcAO1VKK/VrWi:XIs9sfB70k85e08y2lRU2czAO1B/V6i
TLSH
T12674BF15B7D408F9EDAB427CC9A18512EB73B85547A0E78B03F4956A1F233C85E3EB90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 672KB
SHA256 82b2cb97cd5ac7bc896c5120da55dcbaedff5c924f5578d0b01125035a757ea9
MD5 ae4a429cc60395c07e00cd1e548fb83b
SHA1 9d2ce9a32ff37db334ef4e76480e06dba2c5d35e
SHA512 d6593478db4d8ae707a50c97e00a0f719fad5c7a6e2c67b504604163417c1c48854abad8b52d350942d6556774e62203e06ccedf941ef5e79a1f88c125b26051
SSDEEP 12288:xSpfyVub7UIBlfeSJeY6ks99rHsGtFzdFck2bs2N/:4QubQIBlV61rM0tysi
TLSH
T1D3E43A16F6748335D073C0B9C5D2A69EED7230865B308ACB4286D77C3E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.1MB
SHA256 30126335b425bc452cbbe394bdd0878501201c0eea97bb512bdda94ee36b4244
MD5 07992482ea5b59551e9c16f137f92373
SHA1 81087ad1cf7ba10a77063a4e74976f0f5239ec27
SHA512 408d2d2a7480bcef34f9073cb48a6976b3884b59acef07ed992d0b679b95c28f2e6e08cd053330791ee9d425219367c63c8419de0192d0484b47655431b2aebe
SSDEEP 24576:v45CezSCZv+ZU55+grvWJ6q8wyuBnz5bH4gC:yCezSCZv+Gjv4HjyoNbH4n
TLSH
T146352B15F5788323D0B2D0BAC5D6BA9AFE3230465B3089CB4246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 840KB
SHA256 8fa73a51be21b6f467585b75fbdd632bf47d636569813395f9cea2d4e1dee00d
MD5 196d54bcb616409e479bde3da221c04b
SHA1 0dc2d6c47c64aa67063258c95ad15b615431ed12
SHA512 1a9fd4ff1ccb54cfac9eb3642ca91cbf7434c98e4c13f94d6ab28738615be6695f3f1e3ad1fc21de5bbad101c47ee0f900e4a081133ec35383631195d444e406
SSDEEP 12288:+72QBiA3vxf3PyLSTUcTwsE5kWKVgs9af0Im98EYeLGPc7ke3JJ:+7digxPPIDKV2EZLtIeX
TLSH
T1F4054B66F574C321D073C0BAC4D2AA9AEE3234424B318ACB524AD76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 350KB
SHA256 fcf9277753b25e085ece385f57150d0441120a808502546a993419aa7b80584b
MD5 30ff7960a295fcf53a69275eac30c692
SHA1 1c78b97acd17800ada2788ed4e2f6f2585d4bacc
SHA512 d53045069f8895d4432c7335ccacbca12d9aff5c095f1aea4883a15212ba61572a5df212c3c92abd36211dfe521ac06dfc3ea5adb7b89e0c6045280213056b2f
SSDEEP 6144:bOSs9oBJ/GKWWBNU6ITLBi0qttclOKgU91Bwq9LJ2K6o+EH44:3s9ZeBNUbTVO86UmMLf+EY4
TLSH
T11374283BEE38FCD2C27A5DB85691C600A77678304B62A3CBD165C24EDE236E05E75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.3MB
SHA256 6557ab1f04806b01313088b584e0ae44d8b1a42c8ef2ae25c67cff07c75aebe5
MD5 d857ff4c25625266ba8d8c8e640bbec7
SHA1 d49a5a0bea8cd438214c3932a5d276f7abb9152b
SHA512 34b35346aa35c64d89221340772480a514541e17fb340e6e83e746d03c2601d518fca7a1efe355fa6fe26a61411046fb005c2f0e6603e083b1325f6af2eae19f
SSDEEP 49152:pjUrrpXHz/P1tWBRyv5AMoxjTD7VLLfdWLn0QVSIz83HeuQBV2vka2N9hXHYR8Nq:pjUdP1lxoFdLq3ZP9RHh5CRLvjT
TLSH
T1A3265B656BF880F5E0A7E178897AC6B2F7B678420D31EB4F0191C62F2F336905D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.3MB
SHA256 9767b6ad03b0419fc808f664613dd0a5f0d4dc5870c09973bca867c76965ffcc
MD5 3ceb57d9df1da2b9dba83535b0cdbb0c
SHA1 08f308b01530bb0db75368496da3e7ec8216d90d
SHA512 c757260f0aef8f637d1ac9335db9f5a8d5a872ceb11923bc7441ac7be5db8e432742dc95f7eef699aeaa994dea5e415982876191721dfdd78be63888c5d9605f
SSDEEP 24576:ps6M5N07s2z+L5WqTrHCYRFiV+XenmE3Pnzc344eBq2Qw:ps6M5N07s2yL5zTfFiV+XenmE3/znSw
TLSH
T1D8B56C0976B8C1E4D1F6C77886A2CA47F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.2MB
SHA256 924b5e51917fea816d1e9455d11d22b7ee16d45de13658c46a49383db13f2e05
MD5 9dc61a7c85bbf157a0004f4faa6cfadd
SHA1 8d51e519a716dba12965e0096483f03cae90fe38
SHA512 bc324ed11fc5d281d1f5c39cf2a5e1a8857dec34620140cdfb07bd3143f70fc08badd0eb6c0f88254b2189d2431290c5ff49afff2d2c9f9a0ab676f6ef6d82be
SSDEEP 49152:5j+Rkpu009CSwp3DJf5SUYLoDpgLjSTYlQcGelAaLSF259ruMHwpXMi4FqJLd23/:btRQyi36YOcPFLvw2gAf+PN3G
TLSH
T1C6666B03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 ca744a6a57ceb6617aaea1c3a082fadeb9bfccf371c33b466e2c27e793c52254
MD5 e8407d7f16f54f50f646deef236e20b2
SHA1 8a34896a5cb34a886d06477a5c261f94fee5d98f
SHA512 26abae07b6471c41a1eb36d63ac7de2d318fe18ee5a105ca0a199421709f37771a8222e96ab34fd5e35fa8f2fe964d1a96e2412ea7e8d8b9b2d11c970a28ee66
SSDEEP 24576:x4v9lHFwQ9rp05DboeRY3gY7DaHGTNHu7PNU3/5W/ohL0DC:eHWQx8m3JeWu7PNU3/h
TLSH
T14D952833B2F200A9D44DE1769F4A873196E27C758FE0D3DB851572061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 3.6MB
SHA256 fe2a2231df2141573694663073b5ded22e2fe9641d595abb2513f4e27486f356
MD5 e207df4f814ac8b463f60d914cfbc67f
SHA1 50b0cc162dac7ce4ba4d0bc1830f3e4152f860ed
SHA512 cb90abcb65dfb613e4ca327217013a66ed74a80be9f623a1938a260d6a9d20f58648b3e082d9db2f566533a2fab72813fabb960ea525d13c0f885bb2a5e8efe1
SSDEEP 49152:SrdZst5c20pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbHN3Oh6tznm2FQ/nho2qkS:ay5112gYy5azzVvk69nLKnhZO
TLSH
T115067B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.4MB
SHA256 7035695567314557a28e3d915e1a3114ff1f0e84c63dff5a38179df93af615f6
MD5 b30a5582c7c68894c6ede64847e8f34b
SHA1 0416eb909812f786e731fd34f8b3cb45978b3327
SHA512 d233b04aaae52d061dc8a340f9e0bd23453ec88bc8e0f15083a948e4b9bebcd6591ef6a4112f108404ce2bd96ceddb95d44fa5f32ed757b0388c1810c4373c3e
SSDEEP 49152:RcBmLmZipbm6OBr4tEGd0bqx0z+n217aau1glTQAC9:jpyJmDxd2dTQAC9
TLSH
T128C58D13F1DA01E8D05ED578974A9233FA62BC490B34B6EF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 1.8MB
SHA256 a6f90dc8ca39fa3a93b4cfae419bf6f3a8144ab3c063aa2b30707e5b756d4e51
MD5 3b144fd7e435f2463eb07b5ac6cf5486
SHA1 f8f9bcbdba8c6908b6d5571374566192eee88128
SHA512 c5e7e21edfc1515884e71fe9589f9556d39c31a4d5aa2d5f700cd88d29fafe3a010e1c2399c6fcf96ff38e3791aea2a33708890dec07288bdab98aaf9dbf1add
SSDEEP 24576:u/v7hT/UKi+oJLCzGF+uCM4L6A64UQ1zNOgLLwH7ReaQXx3+gV9H:uT/UKfoupL6ArU44CwH7R4xh9H
TLSH
T1D0859D13F2D801E8D06DD17887569632EA62BC460B24B6DF0A90B7961F7BBE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.0MB
SHA256 c2f874dc6060171a659edce1339e8315895750d99cb0c822063d42d107c12d6c
MD5 34601f5bdf89b4f0ebe3125cb1aa45f7
SHA1 d97d0ef89bac37391ae4097fae42336521649949
SHA512 eb46be447dbf855281c2aa27ec206dbc9a765bc962a8b53c551c759c909ba92777d2568465da57850ec11666286c13881d674f2c34276502bd22c7d15bbe1850
SSDEEP 24576:/WWkvTt6ql7qQeSD3rAcQjPa/MdsHWx9R04FxGgVG2Onks6xt4bSMHnqepx41kWH:/Qtl+QHsBds23RVtOnks6NMHqUx41F4K
TLSH
T191A59D13F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.2MB
SHA256 a66ea8e83279ef7f21adc55f8fee355e57870173f5ff28899863a34f626bc788
MD5 47c98ce4c3114318b3a851cbfd7216ff
SHA1 5c2341f6730a2276286a60d9a4b1f8ebd6dee655
SHA512 1ffae008b55119ff18444ec725a01f638ef4edee7573f6cc958b1f8cb3313de237ecd865697f95188122c603e624e66eb8071d0d8843d87476c47fb1d0770d67
SSDEEP 49152:8WQnEZ2Rwd/jLAE3dGGj8byEGcjesaNkYQd0XNJKcvaAcPTY6Y5AGu1SR8:g6rvj9BDlZiB
TLSH
T17CF59D13F2D940D9D059D078874AD232EA72BC494B2166DF0A90BB562F7BFE06B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 15cabb260ba2bf6c9fbd0f9c62db00c5ad256cff2593334f7cf704bbf36bca97
MD5 2096bbe5bda4f4d47e8312519527706c
SHA1 44e7388988e516587f2968e7cee10992245950ec
SHA512 65573e50e5fede5c3cd7f168ed113d39c0e7298ea77c597c7680eef706f57bbf865ddfbfed799663801f68a497f22b7cd81014d3eed8694f4c3fdfc503c04911
SSDEEP 24576:3rQvhx3aBtlEeOnDs9yUgy7u34i3iy9CTn0AP5+2QLlMjnEhAfwG:3claDlEeMg7uogiDn0AP5wJAicwG
TLSH
T14E75AE13F2D901E8D06ED174C7468632EA72BC160B35A6EF0A9076552E7BBE45F3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 333KB
SHA256 87bb5e985a1b4c422a52c865a2a3e7af0e53a9345ea0dacee889f3bf1f9bf5ee
MD5 5f843f0b752bd223f0322f2aa8f96f59
SHA1 aaeeff5e15576b579711b6b367def2b40793d7c8
SHA512 9592fabc471398e145753b92cc07a2d8e5d879a6542b09c5528a154b978a2ed36bcff75d40839d496410be4a9c67e526b70669370aa56e99082c7f762393e474
SSDEEP 6144:DuPuqns9wzqv+ujGgUEYMC5WlYV/PvyDzm2leOc3iD9YlvnR:Dquqns9wzo+uL6CcPvyO+pWk9YlPR
TLSH
T14374BFA4B35018F5DC67827DC8658906D6B27C5A0B60C65F13F833A65F733A11C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 333KB
SHA256 2e3ea990f0fdd0f354479e706a0b3b99742381ef8643e024c5df5fe559bd6f9c
MD5 48f6b80ad936157956879337b3e8a596
SHA1 0f01039fc7c76f14ba93ad1db5e5a4a786051b94
SHA512 bc1f52b3653071ede75260f2a7778adba21fc754dc0a61885600517fba69f1eb2b000766ce638b2e8581c76bcb9db5c5817d9a1a29ec357b71e4adb0442fce32
SSDEEP 6144:xf6FWs9OV7kBWXT5KnsHz9uLYSzMYutYPDvhQjBTXHD:xiFWs9OV7kBWD5KsH5u/zM4PDvhQjBDD
TLSH
T13974BFA5B3A01CF8EC67813ECD254916D6F27C5A07A0C65F03A836665F333505E3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 540KB
SHA256 fa7a50e1027dc836504b70e8fecc19d461f343e6897bb41aacd993199d66b620
MD5 af304ae937dcaeabb0c40ee433767063
SHA1 6972e3a693765eee0ec9d580b61d3115397ebdfd
SHA512 6ee825ad22e5e81cb46f11469f71ae790bf901654bbdd6cb6c88fdf3afbf8a33c240e1faeb1ee7e7eec0db25f948b170765763751a637b9dfb2ff0f3c8ff1a14
SSDEEP 12288:BRpmg1s9DrjM29G1V7am9YLbbdIvBEIpFSBjagL:Bf+jMRV7am9YZ41mL
TLSH
T159C46C90F3E414E9F0B78A359D764511CAB67C991B61CE8F02A8265A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
Size 333KB
SHA256 94ce84cf9b32377403d93915d30b7fecbec3c42960bbe75f1670f6f66b974af5
MD5 bf0d69642bc721403c609f34a4fc4057
SHA1 c1f6a3a8ecb47eda118020d032ff9b0d38fa6576
SHA512 42f84bfe1dd92d50c3b02e6cea88b2710f20706b13c65745b1f16c7edf8bcd50698576535aaf10b4815cbd1af9aa467b568163327b7e8ce12fbc15f514d01a7d
SSDEEP 6144:aHPwCas9ATakD1Rjq7laFPRwBwYV/Pvy/fq29iXACY:avwCas9ATaC1RtyecPvyHq28Ql
TLSH
T1EE74BFA5B36018F4DC6B823ECD668905D6B37C5507A0CA6F03B4362A5F733911D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
Size 142KB
SHA256 8788fc48fb70ac6dd3795aebb27630e782ad94d0e22f1ac7d6a7462541005a29
MD5 960d2ba968113cdc2038dc3f2347a22f
SHA1 ea98f772cbb7bd04730deac590b6c9fbc1bf0066
SHA512 a85f5e21b1efec095380e7af7c95044e756fb520a2135c4474dde1094819368afaa03d368685e730b56ca983227c51ed137e98895a8b177eecb87e79d2fd2f86
SSDEEP 3072:1U39ijlXEo43udtjZqMNbjux+uKZdwUIutV4:1s9Glw6vvTuSwUIuT4
TLSH
T199E38CA0A3DC5484F2379E729CB98C2188BABCA94EB1CE1D5195310E09777E48579F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
Size 333KB
SHA256 0ecae17748b7e87e50d89b34ca0965d74727afc365c7938243c7ad44e9c607bb
MD5 599eef10a3daa5b21f0c9e1ead6a7b9b
SHA1 fb6b17ca615e264f199ab0d3faf8ea701424c89f
SHA512 298086c96cbf1ecbc97059ac0436811866462530a5ef5437713019fd593a9b5adbde75561ed67cdccdaffb74346372c15cdb95059a379b3345279d5b155c6865
SSDEEP 6144:iJ7xds93+aW6fE7uJsWLcl60zMYutYPDvhf4Xpuc1u:ipxds93+aW6c7uKscRzM4PDvh+0mu
TLSH
T18174AFA5B3901CF8EC67823EC8554906D6B27C5A0B60CA5F13F4366A5F333911D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
Size 540KB
SHA256 9ac95756bb0702cb2ba99084fc090d75d22520b83121fd0119ccdf279303d418
MD5 07682b9283c153dd17f8bcadf56d4d6b
SHA1 2e493e6fca62c24dbf8e69a860e97c8d3e138332
SHA512 3d4852e41b44e54271164496b1f03731cd16a224a45d3f34d84cd51191ef33f3f6b7a2c7c28150fa01c515f03773ad13dab398caf75b051f712378daaa743a96
SSDEEP 12288:gc7H3Rbs9lABGn2g50Mwh5zOxLbbdIvyQwmd0lT:geHLGn0MwDzOxZEwmd01
TLSH
T127C46C90F3E414E8F0B78A358C764511DA767C991B71DA8F02A8665A1F33BD18E39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
Size 195KB
SHA256 d4bee7fb8e2849ae26bcef2881f5bf32694d0934a37f583c2d42fdd6aef8e4e5
MD5 41fc4917667f14b6f40a35302fed05f2
SHA1 2a86e25bd3e5d818bd327fb7225b0d4a5810aaa5
SHA512 df86213859b287973a4f0fc420f0726ae6132a0e6554097846f1a0da4f2ab6087c344944dbce01564db341d10529b9f8605f26c7c0daf6da0d33188ae3ceb1d0
SSDEEP 3072:RsCsxXtjYVwgyU39lY5DEmd/MjgvhagI/f1OFOPqxeAOC7+W378yU1:RojSxys9y5DEmdggIn1UCC7+W3Qy4
TLSH
T195147C4073E80095E473DA7A99A14501EBB6BD521B61EFDF6384215A0F3A7E1EE3CE31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
Size 138KB
SHA256 f33dfa9f1bf6968a04594402e29c97a67d012f0557dcdafdc3e8685a0c53c7d4
MD5 cd718bea40de6ef1b07351033a38e1c4
SHA1 b14bddedadc4f6cb323dffd11f02f1abb6af8e1e
SHA512 95bf018bac0c7128b1400e39ea1f3dcc2750d18942acdebbdc1938d593a274692e5db93663985ca93facf181fa2b7c114c1f5442d47aae4cea303dd3f0634bb2
SSDEEP 3072:M5Qb8TU39V28vJEisdBziuxaUH1tLUTCdg0VHvD0:uQYTs9M8qdBqUVBUF
TLSH
T1CED36B4163F81499F4B3CF7669B040168F36BD625A60FF1E52A0510E0E7AAD2EE38F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jre-1.8\bin\java.exe
Size 333KB
SHA256 6bb35445d2a5cd946286a27074db6d923e6870759bc1d11c2acfdfd6b71c9032
MD5 22394edce1239258e78746c25b5f7552
SHA1 380313fc615388aff7524921f642e678b8e6778e
SHA512 7ef4586c1a82704ae4fb37ca966f0e2286ecefa37e55c662a0b45595736eca80ca1681add67e11a416fafff8d37b483f04a4b654258e7458b72e4e8735107365
SSDEEP 6144:DwPRrqs9yX57okj3Y1Oc3UTJTYV/PvyFx3ROpjpEc0Qv0KCcMSxQlV:DMRrqs9yXRokKiJcPvyFx8pXLxq
TLSH
T17174BF65B3901CF9EC67823ECC259905D6B2BC5A0B60D65F03A436265F333911D3EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
Size 142KB
SHA256 e1b2fe9e9a557476a7b5db1618b656819baf51140c40c4e033d96bff92319747
MD5 0d455709379cf6866ec972a730eb6a14
SHA1 a6c21d8d8f78b5079f5d6bd225f7093fcefd5499
SHA512 e6cbefa1ede4c6129b7be4b4de84bd532f24befd81584d8e54515fa6506ca9f0de3294d2dd97b3cf2ca61fdf8740f8d5f17d36a9317271cd0d03410d3c4243fd
SSDEEP 3072:QU39ijlXEo43udtjZqMNbWwx2aUrlGrPuL5:Qs9Glw6vvWzrlRd
TLSH
T193E36BA3F3D854C0E6739F729C758CA188727DA84EB19D0D529A320D0A72BD16538F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
Size 333KB
SHA256 031c8334865573f5af0d685ea531dd22c40e7214a46eaea36e01629800c401c4
MD5 005ecefa4ce262eca7c38fd78efc82d7
SHA1 20b532737b4048cb006700f7832666cb2b79f19b
SHA512 0c8d24f91f410bcfc0d43de87c23fa8039969dc9c34644939c5394e3685957fd7eea1fe84063f004d807564b07d607a6dcde31258dcffb708281c1cb52bd986a
SSDEEP 6144:pVln4s91pFAFXolp1sQ7tDBazjYutYPDvhuDAE:p7n4s91pFAFYlpeKtUzj4PDvh5E
TLSH
T1AF74BFA1B3505CF8DC27817ECC558916D5B27C9A0B60CA6F13A8366B5F733901C3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
Size 540KB
SHA256 e70f0cbb4661260c5525d7621530c823b57d0a029750d3a680fd699e2ccc912f
MD5 7cdfe9e9f9db574476b4415189d61c8c
SHA1 8f4098dfc43111eefab9d6111c814bbd588fc3c5
SHA512 dd4928f1b60382c4280c236e41da77b1c5d0eb97009511571c35fc74845d5c7ee8f21c75739de762fabd024fd8efcc3a73ec03fc025bde43957480d2676f72d6
SSDEEP 12288:yDREX6s9WoxR2rCJZ7kB8gtLbbdIvW3Hki2:yFWxR3Z7y8gtZvt2
TLSH
T166C46B90F3E414E8F0B79A3588764511DAB67C9A1B71DE8F12A8261A1F337D18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
Size 195KB
SHA256 2e5e300f42834b19ee6f41132b9904db62ec0bd65d9216da62dd34dca46dd0e6
MD5 f1637b80cfd0cd74e2d7201aaf4c435d
SHA1 c68bd16ba73f44b534497a753ba226d2d82feb4c
SHA512 43593adf699bf7551cceb7e86b4d68969a2bced5db97aa6d3d0c529d2563aeb5ebff7998d273453bd87cb7c1edc43a83505c8dc4c3a7256b136f008edf291eca
SSDEEP 3072:HpBcxatE2erYYU39lY5DEmd/MjgvhagI/f1OFOCJGx2tBZSqPGopBwuBrvC:HJE3MYs9y5DEmdggIn1UnttB0qOGjBrq
TLSH
T10B147D4173E414A4E473DA3988A05501E7767E621BA1AF9F9394315A0F3B3E1AE3CE35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
Size 138KB
SHA256 22c28c18ac8077cc4a91ed0e5588abb8009fe5c442c20e3566f13c9b4ac545ef
MD5 f55cefee66bb06bda6474a31866d4e5b
SHA1 5b4aadba03f479ee4d8a181fc9045e71c4e14632
SHA512 04a4e5173f4770510f9fcf6ae0b2b5ba3385a1b389adeaa2b770be61e378771de83530d560aeccec68711287f3b5c761fa231d3de44c5d09c929d52f6097075a
SSDEEP 3072:F4Qb84U39V28vJEisdBzYMsx0XLClyoBa:2QY4s9M8qdBppXkyoBa
TLSH
T1EAD35A8073F914C8F077EA7569A145128F36BEA11E25EF5E5250104E0F78BA1EE3AF36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
Size 4.3MB
SHA256 02a6c882cfcd227843594b89c4811ebf3ff2b22db7f4303d591a279fdcebd6d8
MD5 0976f25ca5d6d4be312bcfbb8a20b9b3
SHA1 47dbd561ae649bce054c78911885841516b57835
SHA512 a9b1ba95d7361d7de4c5c0bf63c24d86e1e10caa2d9c09ee2a78cb9c387f6a011d5a4031917c1c9cfc3c05c8702e03a8ca6580f84416805767869ba4f0a94af7
SSDEEP 49152:K21PGi8qObpjsmqjG1SLt5rXzZuL7d7Ai2zNdll3IeuIFqO8MsIQnnw4i28NRV3m:K2NO3dSroLphZnw445CgKj
TLSH
T13A265B556BF880F5E0B7E178897A8AB2F7B678420D31EB4F0191C62F2F336905D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeClickToRun.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
Size 4.3MB
SHA256 be358754f7c4148d476eb6603def1a2efbc3406223941b3f626c556d97857e82
MD5 f2d3729e8fb3307db56a1954e401f301
SHA1 5f9bbf009ec1ce5ee8ef7fa7ecb0b961d772e458
SHA512 3797d0613465e2ce33581fc4b8b107c9242db4fd218c9de20847e8e96bb2f0c45f0568b2df7f88f342925a560084e0465eb24d14bd806b9845292eaa741abd7a
SSDEEP 49152:RhJwHSQyy9ZIb/xewwVz2oRcxLwdBg2YnDdZA3+eu3JlTNkIrZYwqQPy8NRV3THG:Rhhyovw3+LyWFYpQl5CW+
TLSH
T120265B556BF880F5E1A7E178897ACAB2F7B678420D31EB4F0191C62F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVDllSurrogate64.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe
Size 275KB
SHA256 6886a7ba57d17b236e36f8dfd19644c37634dca0cec6a48b402ba4cd62c6fdef
MD5 fc8d9e18acc5edce0dfe02cd26250801
SHA1 78c5165e6bb2071ee105d9dcb671eafcec41c61c
SHA512 0eae7c40b65466c6391842427b25617a8e2d80da10522e5b62aebe110d6e702d308372dbec317b6991425a0aa191044e007d9056b4e889c0dfc1652849ead0bb
SSDEEP 6144:3c97Wis9gWGNTNYdMzATVkQNUO7q5LmxAtzLjG0X:sxZs99GNTCWsTGQ4Jf/qy
TLSH
T16954487BDD38F8D1C27E5CB467A1C700AB71A1718B42638BE179C26DCD036E15E6AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVLP.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
Size 588KB
SHA256 2677307310afdc737f8e4592917d0929517fc816ed68c0358c5049d30b74cfce
MD5 32d0be49951ba38328d7b36251dc53c7
SHA1 a651f586e37355cd9483be5027192178d49c5d0e
SHA512 5c0ff3d267f64db00c49a258039392cde51ac59d7964375c00d903576a5baaeb512b864828fb24d1d976f4ca127cf66807786055b1908382feb37b9afb035a0c
SSDEEP 6144:XGEC43wUcxTSEVT36zfjbfs9k4TcC7Jw/UGWo4Wp4hzvNUXITiXt9Z+M47iUlfZF:XdCJSEgzfs9ujluzvNU4TEYicDL
TLSH
T1DFD48D76EE28D8E1C27B897896968600E6727C110B61D7CBF17CD27E1E236D05E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Integrator.exe

Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
Size 6.8MB
SHA256 17b707bbf96f4786feafb4dfd88e76923dfa389bd79678ec4406207b8abc8623
MD5 6577eed06e91884ea4d425687e11fe63
SHA1 822f43acf0ba1c49a00cf4823f3d4e4ae4f3908f
SHA512 018e4741217144f8b7143770382b160991b847a4fa03dae6e6e54aec7c897a0930c54798ce0e938c4a2d3edc85f6aca70c8e70dc9891ee91aa2c988974f0d0d6
SSDEEP 98304:e1RviYLmjOzYsHFB1GWAhrrmqJjeb2kslAr:e1di+xzYs7UWA5SzrslAr
TLSH
T1A46629596AB481ECE0AFD1748D778772F67678428E33661B0261CA1F2F33E588D19732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Mashup.Container.Loader.exe

Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe
Size 100KB
SHA256 d9c68ada14aceef549d8abd4b76e12453db38ad4b93ceb1db0f35e15067fe260
MD5 e2c9bf84beb50250baa3a52fc4a5e150
SHA1 49eacd09fb6f0369a511b906a289ad2284cbc25e
SHA512 3ceba802cc4f075891559706f5323bced55ad1bad0d221e5ef2d84d6ffc507640279c5b3fbec53b9c8ada06fbaa64fbc883798aca2ea8354cc22edcce953703c
SSDEEP 1536:0KJmvXuhi3ugNXjK/eAMpldERVtu9Q1CehiW3ZcKb7O136AVK6O:04hU39yeAcI29Q1zh13ZDv6KOK6O
TLSH
T13CA3CF0127EE84C1E76502748571AB9DE6733DA02F22974F97A6D24E2E333C5EA74327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IEContentService.exe

Path C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe
Size 449KB
SHA256 f5607e510547e76bc94d6c5180878e89e0180b9969dc7ca1879f5e3197f3fbbe
MD5 6dbeaa61b0a9285aba430511e42b24da
SHA1 d1638b7716f7e1a305ee9adf2f1eee376e0f7d1c
SHA512 cd3a1afebc79ee9e665b28b59d9ee7ca8d8e9bb9e9b4e488b22d941a7b2dc20f773b7a28854af7a03619d7701e3bd4b5e2f4db85d158244460b7b1fc43b14a3e
SSDEEP 6144:9hDVjGSGhhzwiugKsNsYFhe+HxUU+s9vAo05jfcbvnmwVFwelTd86z3anr7:HDVWhFwXgFe+Rb+s90RfM3dm7
TLSH
T117A48D4AEBA094F5E257A138C57BC671F7B2B8890A20674752A5C76F3F33A507D2C720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerfBoost.exe

Path C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe
Size 877KB
SHA256 78857430e4819b0626d4fcbdaf4cb81e734f9605566a81b58f8c507c2e4a5672
MD5 02c9392771591075398e0146228a3320
SHA1 2f9178649ae3807c4073bf651c4284392263aa51
SHA512 b9d9033da0fb3e9c5beeaf0aebac062149203239315e00dca9b6f111129e6e90368ea7d396676ee4a55355bb032f29b81af8a82bb7161afbf1e62aef1fbeabec
SSDEEP 12288:kXHBxO3lP2/dMpFs9LWG/ZjLaoTvQKTvpEeZob4UnV5BMw9dugh:QHBxO3lP2/dM+ZnfrQKpEKdUnHBt9cgh
TLSH
T106153995ABF845F9F1B3A67499B68571FAB2BC521D30D31F0160C25F1E37A808D29B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDXHelper.exe

Path C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe
Size 189KB
SHA256 953e0cdf91c0a562a831826187c10add4dc36f194da0115fc98bf7b53d56b500
MD5 f1a69e5edfb577510d0488ed548e3b5c
SHA1 a6cdeceffb53fbb008b8a7d927123e6457e6afb4
SHA512 79fa9ab216a6dd785c6b80cce697290231d65ea042042626375feea25459efa015c29c09ed70ab21c54f48fd4d91126c6586533e97733ea11e87b067ec62bae4
SSDEEP 3072:aWISCFpfNq/DkU39vM1Q2+zT6lZdAh3SJxfFrgrwHoneK7k2CLC:USORNq/Dks9vFelZdGaFkrTeQCLC
TLSH
T13A149D477BA4E4EAE4529134C9B9EAB1EBF2F1B25C20631F5291C24E0F373D16E29711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoadfsb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe
Size 2.0MB
SHA256 20537040791a1977b007b6bcd4058f7c8ba1be3f5bdfb6f263799831ad885b03
MD5 eda009748a16107dbf73fda12d8235eb
SHA1 e5c2c2650a2e135afe1a4c58e574e5b236875f2e
SHA512 5f06d0e5a8f1b03e464994c41b973fb3e5b1a51046a0e02722b639e3822594596462fbfe83afa3d2c34614b594c52b268439b105c0b3e59c1e3ac98ca00ef531
SSDEEP 49152:aaQ9wuy3kq4ZSCE/GS0Aq01GFT7bhllfJlm:M9XXxHfJlm
TLSH
T1A3A52946ABE8C4E5E2ABE2789975CAB5F6F2B8414D31974F2156C70F1F336604E38321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoasb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoasb.exe
Size 341KB
SHA256 afee2f6fee47d0df0e34290fe0d69f37f9656822a5070b82cb8c4741e1f4b1c9
MD5 83e0b22ef384788c6c920867b6c36236
SHA1 f899b6b35e511002fdf32e6fb14a5efe5526c005
SHA512 9e3c741a36c4af0b530405248550d7966086f36708d6f74122f93f753b5da4de5848f1136747bac233443ef40a3958dbc836fe68d5d568123d80a471c2055e25
SSDEEP 6144:XpNss9FRwUz2PRZN8JhaspvjYiy79bhvRx9EiOwZexheDNCG:XIs9Aq2PRZmJhasp1y79bhvTmw42X
TLSH
T1FE744A177BB88CE1D907A174898696B6FBB3F8605F21D30F6992C35E1F33261AD28711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoia.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoia.exe
Size 6.0MB
SHA256 e3fc15ecc4037427c48d99384aee456b74510630190dc5587f5cbeaef8fbba1b
MD5 87466a59169ce3b26f5019ab4ac1ffb0
SHA1 5980b9e5c6e720d168c673cf2706cfe1cad3f89d
SHA512 0e0ab08970bbaa8bc07a062e4a7e322051797f7dc45596f2e0df79bd74c77c04c9ec976cac89949c15cb0a93a689ff486a027840e89f9e0590d7120a9de58d7b
SSDEEP 49152:ebA8eWcO3qcJkG0bC5Q7OleiTEt8tF2AFvHPpHHE6LjtJuLK293+XQK+P5jGSUAZ:eveWVtR9ML5KZCLw21ma3Q+1
TLSH
T1A4564A557BF982E4E1B7D134CA7286B6FAB2B8555D31A74F0461C31E1F33A909E28332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

officeappguardwin32.exe

Path C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe
Size 596KB
SHA256 fd6da96c37bfa76b0d6a35c3b3289df075f81b3224a8482c81d6680aef277b34
MD5 e2c09981d0ce0f69dea681d4bcabc322
SHA1 15d6eef1a6ca82954285cd73f12942c3933bcace
SHA512 ca816fe1e63fc536542fdef0d36a8242f4f58194521cfbe24b398d05724d93a76b4030fcd190e507d71393ffa3532be984efdfd6c534262ba7915c3d19a0ae4b
SSDEEP 12288:6koEr9+zg15vt9g1PWs9zcIPr0lypFpc8JB:6koC9+KQPmcAlcIg
TLSH
T1A9D44A41F7A881E2E566A5388A668170FA7B7C130F70D70B7559F32E2F33650AD29B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocolhandler.exe

Path C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe
Size 6.4MB
SHA256 ecaafeb2285022b5473ab3fdb3b18bf07eb3a8643c9fdf86f2027885cb11631e
MD5 b431fbb7d2d94d9121191bd3e74ad9aa
SHA1 5ac810908dcd24fd49e01cdfc0ae669f546c686e
SHA512 b8da376adcf684d38ed03b4808ce068567fe346de753e82913d645b1de8fe9627eb85126c3b969f0392e979eb70a130c9edbdcfc14a6bb7084c495048013378d
SSDEEP 49152:mU3dpqGQYdoRawKBIqWBjf+98CIasCFC4EqkbvH60IJhRlHAjSa4uzFyEVookL5d:xLj5kyhVluDGCPEzHjLWiXx
TLSH
T1D5666B417BF880F4E1B7E2788A3A9A75FAB278425E31AB4F0151CA1F6F776504D29331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OLicenseHeartbeat.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe
Size 2.0MB
SHA256 6183be30c44d93ea461f1b4c767da51dda642e04afbefa63dcb30f71d22a5367
MD5 f9ffd7bb35d5a8f19806d6afd417ed20
SHA1 5f137ce99e6d1678ef6a648723ecce697ea98e74
SHA512 5edc9014dbbd33642a97549daa47c169cf41fbd3ccfa9ac2456fec320572c857f6eb6f6894bf971196d3d244df1989abdf0bfea7baddf1ed64314dc59886ff2b
SSDEEP 49152:m2GGGal1RxfmVRuMoo8UCGDfYrU98xjqrAJSF:uW+USF
TLSH
T1ACA527416BE881E5F5BBE7B88AB68979F9727C521C30E61F0156C60E1E73B408D39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLDumper.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe
Size 222KB
SHA256 9246ce5e17a69336425c2645b498c6eea8b3eb95432108c26fe7efeeede19fa6
MD5 21a14422a9f20a612f33f3689823f52b
SHA1 c8ef50817eea9a61f63c6f9cc9456320c08a5ef5
SHA512 39d4ee2fdb30fafd1985de444eba4afb9dbb8e0fe54737e0e6f2823b93c96a3728d0f785e125c61d91faeda4238c561f486b5f9b86b63b7158b83b3eaefa1617
SSDEEP 3072:XjhRKoK+8t/U39Yaj4+qrSVzN2Bmt+hlSG85eKuUYa6oAbfo88XMCfp:XjhRzKNts9Yaj4dizgjbf0fp
TLSH
T109244A10B7EA2008F4B7AA71DEB582226A77B8952B31D6EF055CC5592F73BD0CD34722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohub32.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe
Size 2.0MB
SHA256 e539325f48ba673d7c686fd24738b85fc9aa0120667230858d58b6dead988d48
MD5 2f86ddfdf3e7a338e033628be3570fd4
SHA1 bb2098cf18966cf3649c9733f8142333f046e7ab
SHA512 1162a918cb2698d7fa78dfcdb4bfd1016af3036ed56d4e51c70df4955fea38850a3c13dc4c743e7b7340b97852e278ff8849f0bf35f96008054711d6c7d26316
SSDEEP 24576:aKee6rFubYGgRVassX1H6e9+WDM52A2NBH3NRLO/bzFVwQPHrOtcmb4FgwPqe0Pl:aKee6rU6S4y4ULOH+MYu8m1/p9OD
TLSH
T15AA55985BBA484B4D526A1B189A6867CF7727882C9334F07318DDEDEBFE32604D59331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreporter.exe

Path C:\Program Files\Mozilla Firefox\crashreporter.exe
Size 3.5MB
SHA256 5ccd59e207dac41043dc2ef686c2eb7d84ecf2b292456e84f44b80e457734d51
MD5 87cd7ce6b90710da0808f9b8acacb117
SHA1 7b3cfe4ea5424e6aa0d1e4bc7b909ce3b886747b
SHA512 0321ecd533e6ef2616530eb6ebec8bbe514719b0beab77911b5dd8c30b3244034c34f0c01cf53483127732434441cc10ba6c69b6ced5571ce5b53ee72e36becc
SSDEEP 49152:E0MCqXDCG8QZENGO28wsz3iDT4JmeDNB05FQz/uTmXLhm6kV9e1:E0dFGLER2Jg9f05Fy8aLhm6V
TLSH
T13F061842EB611DDAC025C0B482266723B761FDBD073036F74A906735AD68EE01FF9B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox.exe

Path C:\Program Files\Mozilla Firefox\firefox.exe
Size 777KB
SHA256 c8a768cc9434552df6b52c5608a47604acdf5b928a41706f4de2751ac2153c41
MD5 070b79ffc029308b24ed491bdf868225
SHA1 f3111a4e5a824632e2d2054acfe0cf042cae4ba0
SHA512 057704f7ab621f8af3074a79ebc06eabddb4733646807f887603005740429c93fed7a65cfe965b2a7d18d00431e890849f4a2bc269614e9d52e6831eda1e0745
SSDEEP 12288:wScSUAfteEOggJXnJoel0+s9qjc7BAQwC0k+Az36LW9zwHJem7OzwHJe0Ihf7EL6:wSzbfm+IjciQbhT4SwpemIwpelzELo/L
TLSH
T12B05AF03F38516B8E08AE5B89A46D133A5723C840B5161DF1BE93F2B3D71AD16B7972C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
Size 329KB
SHA256 1841cdd510e621650ebd64abfc4a0159497130403478219032b6fb484368ad30
MD5 a0082106576d58212e63f918c3f202cc
SHA1 47e1d9d774e37f9a06c5a55c422ab62293b63491
SHA512 ed3edd3a582d6baae437ffe150ff1c0d76ae2269df50a701be81f4e43c781df12a6966082a72d11655d4d5eebf2a095f8c65d29675ae8124f3bc9c1cf665074c
SSDEEP 6144:XHs9eQ3/vsbH5Minc321rpn2lRRic/iJPsfUrcA2prpPLg+qVCPfB:Xs9eQ3/vsD5Rc342lRb2czA2prlnB
TLSH
T13274AE14ABE00CF5ED57827D8CA18519EB73B8918764E78B03F889661F637C81D3E7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nmhproxy.exe

Path C:\Program Files\Mozilla Firefox\nmhproxy.exe
Size 654KB
SHA256 687db9944c0642848f58fe3a912ebbf4ce0a3a621b024e1b589b00fe6146bf50
MD5 aff1eeefdf896eab90e9ccc49fa0feb6
SHA1 e1d84edfb4956d22ea96ee3834cd2e8c25d14c06
SHA512 1f66c206309e37f0d56623763a2502d3e39187985a5f20fa318395c9ea26288e58bf8393ffdcd98272b1f47f62c74d245563da81535e6a0b57e610b329a3102c
SSDEEP 12288:b3i94WmvgAwTPqLr7wEXy1As9ayc/waheN5WEPrkt:ziSWUZweL3BWhMcrkt
TLSH
T13FE47E02FA97D46DD51EC474874B8632793374CD0B31AAFB62D89A353E1AAE12F38714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pingsender.exe

Path C:\Program Files\Mozilla Firefox\pingsender.exe
Size 126KB
SHA256 77c412c7dc66bcf417a415599e77637a761d5c24bf3415352eec2317313f1fd6
MD5 1e3295231b979e4a6df45659b431bd52
SHA1 a69cb7fd756a23122d2e74c711a379a3f5bc7546
SHA512 cb37c4d8b8b62f085c4f45f389f05952f5e8ce402c21d2a5d03f770740ab3be96b001dab2e641527e4f2b2fcba77e2cbe3e733e2b73d90f5cbaa5ae791936a05
SSDEEP 3072:LX4XrjJU39egSh2SdWAx/EOnSATRK+XQ90Qx+r:CrjJs9eTFdjA4RxAm7r
TLSH
T188C3CE82555C969BC094A3F1E9E66833837B350A976127CFB32783191F113D02F78BE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plugin-container.exe

Path C:\Program Files\Mozilla Firefox\plugin-container.exe
Size 202KB
SHA256 1468b969a8d157505368c562a07c756403a9171aab1b7361ff43b931e9cc5d2f
MD5 53b1e78328f7579099e63b603b07e1b2
SHA1 44d1aa5be8405ef992f21a0b43864c4790ab68eb
SHA512 6ca8a9aec834cc273cfd9655766355761666fa1d13a7b6e647fa3b816fd3221191f564edf8a3103d9237c785a76d1072cc1de4bc8e88c9766c9f2891e56ef8e2
SSDEEP 6144:L2khqPwws9DwWLyIEuDcUZcpMGcFkli8J9BwCWnP:RMPbs9tuIXZcGUioF+
TLSH
T14B14BE03FB4C00F9E489D27877D29222A7B1B4860B21B7EF25A961202F56FD47F7D290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.exe

Path C:\Program Files\Mozilla Firefox\updater.exe
Size 523KB
SHA256 15d23895cd1ecf4cdf4ebd5f72f25c0149c27e477115c684b57680c711208ac2
MD5 69ac79bfa395d07a79003a8488b20c6b
SHA1 9af3fb83782f9c15a8e317049c004f2bd27185d1
SHA512 3137e70421fbabeab1e4e79ce88406f29fc45f8a78cefca4944c795a7f90b8c595d2031176a672b683de90faf9210766fb90023347abd2efe627a0396f25de64
SSDEEP 12288:GR+7voUs977E4/huMKbvvQy2ZeoGSOJAdGyXnm0zC+yBV:M+7voD7E4r8IKJ+R20zC+o
TLSH
T151B4B029F3540DF9F427A278C8A28511E773FC95075096EB62A8D66A2F333D41A3FB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 188KB
SHA256 5f479c421f85fc74f29fa43549c20b02f1fc0b85ce160ca7f7137e59ebfe756a
MD5 e5893ced4fcb9d221600d4d0f67b2924
SHA1 05f55c8e68eb3c81d0d414972a5a8174ef51fe7b
SHA512 7d7773463470e6d3988ebc36cab1808fbf824b0663969f476ae9c16dc4c2ee7aaeeb5ab7282d1d45fc969aceddccc181facba3ede7deafb1366636382b44215b
SSDEEP 3072:jMBbDDGUU39P5kV8pQFq4XKF3QPEuM3mPcHXEWzKer:jSbDDGUs9RksQFqT3QO3mPGvTr
TLSH
T1D014491AD2A852D4C0AD6138CBA58A4177333DB193F1D3CB92D1F67D0F3A6841EE9693
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2936-3-0x000001E3C6580000-0x000001E3C6585000-memory.dmp

Download

memory/2936-6-0x000001E3C6580000-0x000001E3C6585000-memory.dmp

Download

memory/2936-0-0x00007FF654100000-0x00007FF65420B000-memory.dmp

Download

memory/2936-2-0x000001E3C6550000-0x000001E3C6557000-memory.dmp

Download

memory/2936-1-0x000001E3C6580000-0x000001E3C6585000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads