36775e34afa768cfdc950834a74beeec5108f6a4561d97c1c2b0f694a5fdb95b

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 03:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
Size 1.1MB
Sample260802-dm6e2atana
SHA256 36775e34afa768cfdc950834a74beeec5108f6a4561d97c1c2b0f694a5fdb95b
MD5 58f9e2f0991e49ce505fcd44295d88ea
SHA1 011924d56146519b916b4dc8ac0e59bdd9f76f9f
SHA512 9d80077656c8f7ff3c7b447f4233bb5df33a06962fc4fe81bdf68730c334754c8cf402065615c7d0d2e4c5064302fa8a4063bc3f041edd1333f36c4812eb98f4
SSDEEP 24576:uCalq2zb2L1uy1uhfaUiSGpiG7q6pyOPYKK6Sqnjrc5xaNIBTGiZ:uM2Gpuy1uhSUiSGpiG7RpJPlJSqnjrQR
TLSH
T139358D0A73A4419EFEA7F176D617C60BD6B1784A0376962F01A46B726F337711A2E330
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Z:	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\E:	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\K:	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\M:	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Q:	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\R:	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\G:	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\L:	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\O:	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\W:	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\X:	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Y:	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\H:	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\I:	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\J:	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\S:	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\T:	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\U:	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\V:	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\A:	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\B:	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\N:	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\java.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 20 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4400	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4400	2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_58f9e2f0991e49ce505fcd44295d88ea_agent-tesla_amadey_icedid_njrat_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

64BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
Size 295KB
SHA256 b1ef6e1278759c264c8be6f0727082c58eaeb1d2a59e303d330b06473c37fa48
MD5 03740318a1147410f0732d5d13de6c26
SHA1 102ebdc27eb5587e45bed9369e587641a584c124
SHA512 1099c96208427399af10f5f68c4693cea19a6a0c40448a2139c547939670257987d35691bbc078fbb8dbde98ac66b37321175158bbea57518402626a598bab37
SSDEEP 6144:hZRS32Y9ElxgFTRbKVy63/fxaJscJtqQ1g6dN0wJLzID:VSwlqH2yucymNx9zID
TLSH
T1C6549E1A37D84CF5E457C23989914642F3B178854B70E7CF6760426AEF63AE0AE3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\java.exe
Size 332KB
SHA256 daa82b156ff298d927f86298f53403c1635e2279279e71390146a36f5fa581b5
MD5 1f2d2e07f4e7addfa995b21e92181929
SHA1 e23c9998c105c10a1ca198b119e8b676fc6f8c44
SHA512 2c2863bbb7ced85d14e91dd70010d127d15918069d6eae17848322399743297248b629d877d065ec35746b5c82cd3d1f280b1e4f530f63ccd60ca3b3e087301a
SSDEEP 6144:UkPLxcElxgvBZqZOjwF7SmumEvCYV/PvyDsf4Jk6cbW4:UoLxVlqvB0ZOrLKcPvyAAq6cR
TLSH
T16174BFA5B3901CF8EC67823ECC558905D6B27C5A0BA0C65F03A4366A5F733911D3EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\javaw.exe
Size 333KB
SHA256 4b2e19ad8bfc80107468d248aac1bcf1ff8c0756af0d32f122bcc058a07dfb4a
MD5 77953bb14f27055088851984ffa26387
SHA1 4ae86f373c7d250c6467735aaabf5076945df723
SHA512 45df49b34c1ab31723b7250522c20a50075064d23ff412f8a93d3063c63123a4d82eeee25ddd70eba205625016549b03ec60b572e871ea514c41d5564f0269b4
SSDEEP 6144:b0A2yElxg92N/8kTSzVladsUfI84ZzCYutYPDvh4+5d5qPqwm:bN2vlq92NbTS5lammIpzC4PDvh4+hX
TLSH
T12974AEA5B3901CF8EC67823ECC554906D6B27C5A0B60C65F03A836665F733A11D3EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\javaws.exe
Size 540KB
SHA256 c8890f29860343f4df5b54d70c9ea71cb4bbc4b5fe1d372ecd7940ed2a9ce787
MD5 a0c13976fc87c7c37acf4300dcd866cc
SHA1 9ed3872ebac7d61e4edb354b0c0762b79f8e66d1
SHA512 b80d31bce83b8d845afcdab5eff9477ed17ca9827beb63895567e5e96e5ccc5f29f15d73172d12b84ac06e5cd4d027cf498d82556551b518f88e9f99d8f420e6
SSDEEP 12288:J+7Ywdlq5IOF3Xs00qjdVyLbbdIvWEbi5mM:JIZlqKOFd0qjdVyZ35mM
TLSH
T13AC46C90F3E414E8F0B79A358D764511DA767C9A1B61DE8F02A8261A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe
Size 596KB
SHA256 7dd12258a5a7fca2f2c26fbcb7a91c35ffd2712917c24566733960d65389b5c2
MD5 c53ef61ad750663b962764630b24291d
SHA1 de7332e537e39498f707014cb400e1cc1210d513
SHA512 3872b474428fda3e5d2d944110a20e159f4f5ebd7e3798d82774c9da5843603f2f95c94e7882b13a3fd6c570adf99c4eb108934127fcab7507288bfc99d27588
SSDEEP 12288:clqxivwO2Akp1eaCPirNSNaGA+WDiiG8tidHrp:clqxivwOq1Y2GApDiUidHrp
TLSH
T1A4D4BF41B3E846E9E06AC134CA538642EA7278960F60E7DF01D0927D2F37BE55F7A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe
Size 6.7MB
SHA256 a9141df05ba6ceae0909a16f702f0641025395d5dae77f1566e3bc2465c72cac
MD5 d67fbc52dc9ca6383ee405645d0237a2
SHA1 02acfb71ec292ceb8a4dd4ed9ab5be4206a26953
SHA512 02b71ec7205b3a0ba7dd6ca8122c9f27e9a8916c144b313fe8f1360af4dd894927f5e590694639355f87e280b9fdc9de789322eff1020ce3a4b96060a3153c62
SSDEEP 98304:Dl8YfTaJ1+W5BB2L4HrZtJKPIieK5M0uR7F5epm:h8YfTaaLPIiFUpIpm
TLSH
T1D7666C47E3A600A8E46ED970CF2A5521DA353C8E57B493EF129476E81A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe
Size 1.9MB
SHA256 cbdde3e6d416750bc9aa6a24bb4da3117747edfbbcaebac5bae7161bb129a94f
MD5 1f729137297e4a218705741bc7b97dd2
SHA1 e0aeb595e4fe32c0fb9ed551eeb16861156f70d4
SHA512 3a9a6d5fd430934f6bc632c6db9ba1762177c0c4da40a80016ad44106b605c534d048475e50916b022f1b21ba4203a1a74e0c9be3b8653746c07885e32fc755e
SSDEEP 24576:TOxUzpO5dUzBXFQO/AelqKhh8gz5L2NLb9Ld25PTOocJuJ/cIsY6WfvaJW7:6xQpOXUb/AnKhTRwpZeToMJsex
TLSH
T138959C03F6D941E9E06ED578C7469136E972BC890B20A6DF0290B2992E77FE45F3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe
Size 1.2MB
SHA256 11a5a2b3f2dd95f88d19a30d4f17a4f73a2dc39cc1bc6c64af42e815c1907ca3
MD5 b3dce387c5f497f6157148c360f82ea1
SHA1 aff39d229944ce6bb8a8ec151bce94462d3260e8
SHA512 0bacbe535a1776513db9663dc11819d8d8f0a4349a291f415dd41485506c5b8128536af164b694d06681b926aa3315619446b7abb0668befed753c99e723dd1b
SSDEEP 24576:tDfOTwwrtvwSXBN1lqyjJwIeKCKU5TvpPIVprSIdHImZ7mY:tDmMwrtvHsyj6DKV0LwpGoz
TLSH
T13045AE07B6D841E8D069D578CB568132EAB27C460B64A6DF06D0F25A1F7BEE86F3D310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe
Size 3.9MB
SHA256 be82f7714cb9b9b2a40adc69558960613047c5f0af8665c3665210cbe9dc37e0
MD5 23a192b2f5aad75189accab8f2f4245d
SHA1 a52e4a03829ea7e8a21a10e0ae926f9d8d74bbe2
SHA512 87323288ceaf240b43c34f187fea2e1a2838b976570268b808dcc46d4a37e77ed79bd51d247f7aacb7f749ffb1db112c38a076562d89580a32c9ba0ec015e264
SSDEEP 49152:7S6Moc6kvkybrSvbNeHFbP8onc0GD0AGCXuVEusJ6LNzOeL0GKVIeCjIp26If2yo:unSSCXuVlcm7fwKA6NH8
TLSH
T1C0165903F29940D8D059C074CE5A8132EB627C8D47F562EF3694B6EA2A73AD47B3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe
Size 1.2MB
SHA256 15ea561a6cefb479c6d06c3ff9498f47bc6da3f49051c856edf51bb6955a7f50
MD5 0d5882ec2ca5d9c6e771677e3a16ee26
SHA1 40d32e97cb05c5bd0d14cebe58cfa67934c13add
SHA512 8bee0f077a0251cd1a6be3605ce584de7ffb9bf8405bc188eab885a7f733ad3fb50eb624d6de167b149c5d900e708ba10298a37ff5677ea7ee205ade78665a62
SSDEEP 24576:9fQPYS/DFAnX0jlq1+olbOzFSql1ri2jZ08mW5c:9fQAS7Fm1+oNOZd/O29Nx5c
TLSH
T1CE45AD07B7D941E8D02ED5B4CB568536EAB27C820B24AAEF0690B3591F37EE45F39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 1.6MB
SHA256 c0f3fb9459cb2eefa5f55d3580c59d01a9a1dd5c5855210921a48b78e731da02
MD5 79e50bd70876fae89b22962cd03af11f
SHA1 e53675b2210ef06bae4482da94afcabf08dd1767
SHA512 6c37c1af740ce781805685a5c2ad2978f8a6a9fc18a5b8da27ba1f307115d95ae464cdc95a5ab9a121e0f023996b4d50aa114efd76c45646029ce1e3d9b09844
SSDEEP 24576:WKWcwcXU/S/0KwXLzEXLhlq9rvZOwocblVdrleRlkkkkkkkl0T3gAQe8v:WcwsU/+0yX69rHocPZ8PQeg
TLSH
T1A3759C03F68A81E5D09DC2B8CE764B30EA717C655F20A6DF0190BA252EB7AD04B3D7D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe
Size 3.4MB
SHA256 41f5756180d20300fff7ea7a976fd10fb2ac7aebec3f9501383f6b1b1a017745
MD5 500c8761159345e6a59138a180fff89d
SHA1 fa69a1b4fa6e0e2a4b00237bc8e0255ca3f85372
SHA512 acda8217dc2cd59cbf609e45817e8680ac9791a2f8ac2c92030b77abc8e61aac116d4e839e0144a0191a5f6439ae2de6cac7e79abb24f3c59d94dd2251a626de
SSDEEP 49152:ysYkdzgr2SBAEq9s6Wlkt7beyBe5UqMzADFXulO7Udq+KqOuBk7bVnU7wF62JtYu:79smJ1wFXul1EE4ws8ZI
TLSH
T1AEF54803E29900D9D199C078CE4A8632EB627C8D47F562EF3290B6D52E77EE47B39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 1.4MB
SHA256 1ea75dca19b2db676cd9f5f6b43bcd30131e6667d008f003016be61e28deff3e
MD5 cd2004859403eccdb974fd3d235662d2
SHA1 85372970cf7ce18a42b493ffe3134bce7534880e
SHA512 633af855959a8b806875a0bdbef53e61fab176a0c905574786dfa41710e6db37befefe791d4daf3294f2628f5964a6fff06442ebf79896ddda7e2edb2791b8a0
SSDEEP 24576:zXoEcq8R9fwjvRXY6qlqDuJzt9mW48wXrUsre1qRAwJ4J5q:7oxRmjqKSJBYb8wXQsrSD5q
TLSH
T10265AE03B6D942E8E06DD078CB564536EAB27C460B34A6DF0698B2592E37FE45F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe
Size 1.2MB
SHA256 ab034858cbc5b1b1a1708bf19c1238d4cc12d085860914112efaa4050942528f
MD5 48b2d6b21ede8b2d454ebeea176b04b8
SHA1 5806f99ea52567d6285bd567e9cab81681a5c8be
SHA512 7e1282e1972390c4949d5f4c078f1498129f87d27c64af0cb8b21e8499ac99d86f4f9258536fbcc03df313cbf4a2a4f88fb1d7cf82d6468078a1101caf6145a8
SSDEEP 24576:0eJNzPygpomFX0simlqC1hF+eVuByvQ34HOpT8htm0Gv:0e3DygpoNhC1b+eVSyvQmOuFW
TLSH
T1A245AE07B79840D9D02AD578CB668532EAB27C420B74A6DF06D0F2592F77EE85F3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 248KB
SHA256 036bd0e453d2d8f77f30990f9158bfc3b21c27e4361d9f635b12bf1feb7f8781
MD5 1bc2c4a5bcef438768ecd1335e198ec5
SHA1 b1f8c47ab224a8c9d1f972a7de05b0cbce95149c
SHA512 68a7068a33d50ba1ef8b3320b94c0e1f53e6e18435e76f328c94fdc258cfd15ab499d5ef21b70b0c869c83d902cae7ee07678f44dd8b4780f0718398ee23b981
SSDEEP 6144:EElxgLfzomIYwAb4kLkR/Cuoh0ofyfXlGB:9lq7z+LmkRo8fX8B
TLSH
T103447D6976F910E6E036C1B48AD49903F334F87617208E7F4390426ADE636519DEBF36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 265KB
SHA256 83c9e3c8d72e7a57de769ae972b056c61752189c10c0d780fbe7efd9f91384b7
MD5 7ce9da7555dfac9f7ccc46d2a01303fe
SHA1 29d528bef2110d3cbdbc60a5ea25b3fd5b87981c
SHA512 97f3ec759b204af06a3accb28af9e3bef44a4e968ef1cb31f548c724f3ff27509b889360ec0e84929b234f85cc556b2a529cc8e1a9c86017495319f9f646f59a
SSDEEP 6144:zElxgjXIDgravpBfnbJdYWoht+uoZZ8WOQmm6ZblZA:olqjXIBvddHo3K6m61lZA
TLSH
T164444A6925F814E6D176C1F48FD08903F235E87663108EBF4291835A9E23A916DBBF3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 610KB
SHA256 d223b6e66373d42d3b5fb19867f3e724124923fc4ccd3c892ac707d92932a21e
MD5 423c281617ddae10e136b10d2ee5baa8
SHA1 282826f3b5b0fe74ef704147b1aed406592334b7
SHA512 018a3f383c74e20aee0c758c9333603e20231473233e4188f7f482b0ccc9b6355e4e4bd7a46b77d9e2df75ebb7815387920a6942812dc8544fc089daf25ed846
SSDEEP 12288:zlq2zJUwcMAYu/tHVlW/S9ZT9jZO15rkasg+1rg:zlq2zJU77Q+T9jw3DLv
TLSH
T1B3D4AE81F3E847E8E06AC534CE528546EA7178960F60E6DF02A0527A3F37AE55F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
Size 7.2MB
SHA256 271b9bfe0b986c02c9ac596676b2f605b44d7717ce9a743ec40753fad643515a
MD5 0d0ad276e50f3a4c007a7a8a1fb950b2
SHA1 bfc07a2aaf11f1390f1367ee94a7875aa37110b5
SHA512 b7e4fa97d917be34c2943ae71dbd54b2831f1531b0333d4479422abd2a71d13ee3719d101b63893de30b2c88c3c33b25afb4da1fc3157d9e16cc451d44bebf08
SSDEEP 98304:X6CZetahq+WZgOt/wCsJB2++fGZXOxRj2vJzRN+T6frwem:qCZetaTO1GIGMxVqzRdDwem
TLSH
T1A3766C07E3E600A8E46ED974CF2A9521DA353C8E47B492EF169476E41A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe
Size 3.9MB
SHA256 d8fcae97bbfbb1f7cfb10958cd24b2f2b9caab97913537c71c9b9be61360592e
MD5 0c8b8512ef58097bcfac0a6c7c6dbae2
SHA1 8a78dc266cc84b4682a15c742ee1adbb9e998415
SHA512 4f5dd662a0722c7df339268cab8b30afa65fc2d5e8e8efafb3dfad742a67a85b552ab1f6941ba74a490c8ec196fe62ca730ab24ff5daf9c536408044c5a7f176
SSDEEP 49152:bzph3/cGRldVRy3kbbmhLbKqm006NPpIupE8+Vu+e6NqcXToRzvUqIzYHBigdQB9:v3nrdD8k3mCCp2NUhIUBbE6M9
TLSH
T13E165903F29900E8E05DD5B8C7568522EAB2BC850B35B2DF0650B7562E7BEE4AF3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.3MB
SHA256 506d0a6594a3f698eb1be73c6e370ad301e9c1a5ef39a17022d0613d7f8160b8
MD5 cf8675eb9a160fa92ca8cfb67a75e9d5
SHA1 afea606944258554cdfb639c57c7bc9b4b5254e4
SHA512 ae64de2e6a371205d773ae89a51e0b7695857173707e892391ccff3e70a361439a894e1af0aca1fb0838aaf930623d3979a35fb7d97a0bd1baad80a1941b31ad
SSDEEP 49152:obrnxcNfU+P5YYiE6SKstBhuXjfS4LWxnc1/bgXF:ox0WCSjBNbm
TLSH
T15AB57C03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 1.6MB
SHA256 0e5e119509efbd7e795ebc300048a4ece221cefca17d9436da973ce57d152695
MD5 db8fb9447ab3c70dfc63cc3e4951e018
SHA1 ed27dc271357076b9169a75155f2cb27e13b6ea8
SHA512 a9c1a9a8ef772028fb65f1c53759516e8f8da2d4c520e222a809e0fcbd7a115488b5b2dfff506127b0a7ebd8b00ac0e49355c61b5c5280dc3d760d79fec7adfa
SSDEEP 49152:adZBeMl7Tjn+TrGpQtzTgJDtTlXrk9dBr2bz1T:W/9WeDtO0d
TLSH
T15F759D03F39900E8D05DD1B8C7568936EAB27C450B34A6EF0A90B6562E7BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.0MB
SHA256 429326a02998195a942313343375b0653019f2277dd4caf2dd7b4efd0d6a2ebb
MD5 b3a08dd7d73381ffb1769e3210b048dd
SHA1 9f63b4f4f1cacdc6e56f11301f64409eeebead16
SHA512 5c9ba27018ec5376105e58ada96edb02ed766c6f8084b2efd94cf3622cb2522e152c77f208ab5dcaa1b7d3a17784130a4f44ab3c4bec7c620b0b63971746da0f
SSDEEP 49152:wjEKlG/CpCTv5RCZ52ZrSdHBAVfEad+9h7:uDlXXOwA1EAC5
TLSH
T190959D03F6DA81E5E05DC2B8CB768B35EA717C554F20A6DF0680BA652E77AD04B3D390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 3.5MB
SHA256 0f0dc49636eb4f02e78b0aa0be2b0a008b5518ba1acee46de5b75ec26ea854ab
MD5 8c8578cb4e23628e6e334b593cc99290
SHA1 054e39ff785a633658b40bef11c536d3c6f4148c
SHA512 1d61a07b07c08942e45c0339cfd45511037a3eeca07fc6e1fedb351c75a07b2dc138a0248a8f6c1d6605c90a7542f9bf6709bc37c6b9d4be49601018800ef3c1
SSDEEP 49152:6uoesC2Zx42+CTlh4NXSDY8Ib6YErgPz4AkOuaRoBISCaQZCLlrrwLXjg:J7wDSLIOnZFLXjg
TLSH
T114064903A29900D8D059D078CF4A9223EBA27C8D47F562EF3690B6D52A77EE47B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe
Size 1.7MB
SHA256 608f0fd934910a40afe120a770196f65a85e1ede175ac0ddd1d8d153171ae18e
MD5 bec9d5ec14e3cd7a2305bc8905ccd6e2
SHA1 24278fdcb97f0ba1e5ae2ccb40a2866455ffdb14
SHA512 0dcbe3968bffbf9620e1a5200521b7d9c644d183497942a6b94f330016c817d0c15446265e514a36831fe1727a835fd7b7f3449983cfdd1204d81d1d6ff22e56
SSDEEP 24576:DQnL8G6QtXbcBGwNuxE40IqC7Sylqb9nlqNeQuJXlPnyF4mfHU9YawsN7Y6vDxE3:bGJFDb0IqYSyls2NeHX04mfHIE6GB
TLSH
T162858B03F2D901E8E06DD2B8C7468532EAB27C450B34A6DF0691B6562F7BEE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Size 4.1MB
SHA256 8f71227d6de9840affb9975b00cd43e78b919556224a5195c91373bb6d5cbcee
MD5 ea9afe8a09970a52515021d352f37086
SHA1 24a08d511eb6dd61d1df8070f41a667e009c456e
SHA512 6200c26621b2136f303aa46de47c25f3a5cf3447be90822ea3ec20c67978450676532fb41f47860d901586adb60c3899296357930bf004217b5b51d8497da1fd
SSDEEP 49152:DufoFSKwRdu52qItxcRpts9+TjEN3zExldDwUIDtaZHWRdpev2y/BaLROmJ:7nIoqpsd+RaAtpJ
TLSH
T1DE165903B29940D8D059C074CE5AD232AB617C8D47F162EF3690B7EA2A73AD47B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
Size 1.6MB
SHA256 a8821f65210b272cbaba257f076f4635bfcd71197b4a262f0952df2bdf37c630
MD5 bf2dec0e07b8b4292ac2a45b0dc2654d
SHA1 d603c3c6b32a75cb3850f017b78bf1bf38cf5b40
SHA512 5cf1f376519054af518112c436d709362dd8ceb3b0c89e5ccfaa5f56b89a812b6554547d3daab1fc8557a7bf4e9da711d310af63cd003aa5d162b3e1d5a23393
SSDEEP 49152:m+pzx4yhk7PXEP7WH9r6Bo7EukU1aKmMm:RVx4Ugr3hm7
TLSH
T166759C03F3D801E8E06AD1B8C7568536E9B27C450B24A6EF0A90B6552E7BFE45F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 1.5MB
SHA256 c13c5f2979d7946cb55ea9bd4419b502796598f512acc0792facc3b5cb620443
MD5 20fd139fee5b315b31d3bf85face5c6e
SHA1 82a877d4ce40e00d7a0058b820fc3b6aa2c3f0ed
SHA512 b289ccd01225f4d9b4cb6f296b45955a1a062cd7f8d97b6daf74edfdb7f483c3e9fb3d749c247db8b2ea2e91211358ee16dc1647a394090b846a0a1aa3199d94
SSDEEP 24576:FYVCN6otjQDnlWEFus4r7bTWiV7ClqPGsVa4i6h27d3Wl6FQEK:cCNHR+Ui4r7bTWEHPn+6h27dVF4
TLSH
T10D759E03F39940E8E05DD1B8CB56893AE9B27C450B24A6EF0B90B6552F77EE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 329KB
SHA256 36aae6d4ae4696b73e5a96bef79e65591ed27e253de629d4df3f9db305e3dd30
MD5 d5c8a0aa41008a1e576456350f32deea
SHA1 c8ac6b426b998d48218d88e6552015cb39777742
SHA512 a4b28cab3f7688c01df4030e07f4563a07a77c32d2e9b1f5f7a3cdb1ed99cd898458e0985659b1a75c0b25e252bd771f6268e6b6ae206fb63623d5b39217a8ae
SSDEEP 6144:ZLElxgc19Cq0bF5BVwU341O6E2lRmoy/iJPsfUrcAmDBBixsq35qm:ilqc19Cq0B5PF3B2lRU2czACB4xssqm
TLSH
T18A64AE24B3E408F9ED6B827DC8A18516EA73785547A0E7CB03E4C6265F233D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 671KB
SHA256 5af977dd790026a97b6d09e2a0c737fa762036ac438fc81d2758f935b0391369
MD5 f8af59ea7bd56369bff36fc01d97afc0
SHA1 e7b2d55a19fad1e54dd8e199f781e896c46f16b0
SHA512 a4b21df6d4baa599f1aaa71e8d0134e9c6d5dee8503f026f7bc722fa1250cc68bcb4902ab4079e5bbd3aa120c992b35a52fc0b7962cdf257ca0c238526482a85
SSDEEP 12288:S8U/iVzdKUsv7/G/40ydYIlqErHstPn+3pKWIao:qgzdBsv7Fd1lqErMtPaKco
TLSH
T1F0E43A16F6748731D073C0B9C5D2A69EE97230861B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.1MB
SHA256 2f60edf799742a54495ff5de5f8606b038030fceb13c078befe4c097491bec7b
MD5 0e21846068e8ab4b1c5766e6f3abc79c
SHA1 213dace100e87dcf8e837f57123ccd6c35e253dc
SHA512 5566e342b29cdaa42d3aa2797d7c690c98480c5b534a8344d55aab3d4c373441dbe6e943a5f430e8cd5276328c106d34dadc08a1a7af2cc8c0906a48c9f11d47
SSDEEP 24576:eN9uezSCfv2CTllsgrvWXlqe6q8wyujwue:0uezSCfv2Wxv5eHjymBe
TLSH
T17A351A15F5788323D0B2D0BAC5D6AA9AFE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 840KB
SHA256 081ac4fe11b4a68a4b71f653ea1e74040657ff932ecd022e6fdfd479c5802350
MD5 256345e46b578169e80f4652a4336eba
SHA1 56f4adb1d1b209c038baa6c30edbe6683ce53eee
SHA512 b48d5a3d529db353fc7265ec67b7ad020635cb1efc148b0f848119a3271fb0b5e3889da3e5cfdd749b0f6719ba36658f09edd3a22f3710a029e5d1d1432cb7ad
SSDEEP 12288:U4tTBav3vWk4vhC4kDCjpwsEWdWakdlqLf0Im980AhmBnhBdxg5dHSIedq3Ms:U4raXW1vlO3akdlq10AhmbBLINeU3t
TLSH
T1E7054B66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 350KB
SHA256 0815099c8d021ef679fdf460a2250f394724e97c6ec5f412346a6f24f5a89c5a
MD5 8005f62e053680a391228a055b1908f4
SHA1 c76c952ad7d3b442c749845344d47cd56c34e31e
SHA512 ca353dc824249b0878f7dd54282d2218a163924b914f5e08b3e1c2f1c9de599b3fc6c0b4a5f8c33434f21b7c5b432a83dc6399673d3638a691c5dfb3df3d03a7
SSDEEP 6144:EOtElxgvBJ/GKWWBNU6ITLBi0qttclOKgU91ByISKYsZdj0a:Clq+eBNUbTVO86UQhKYOOa
TLSH
T1DA74397BEE28FCD2C67E4DB85A918640A77278704F52A3CBD165C20ECE235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.2MB
SHA256 718d7aef327d6777d845292a0c4433e8e7514735becdaa589a70e1c5ff75dacb
MD5 7943e02acd141bac246184531dbd2242
SHA1 0af8edd2921ddb7ca39f32f7b0ce641260680e4b
SHA512 bec3b570e2576c13ca01d7269b9427a8d2e7161089005eb9422c761ab9a9bcc754316691eb1e357465b534cd25f61046e60eb714588eeded6dfa705e3c3b255c
SSDEEP 49152:S0btl9hyA182sC0NyWxE4zKYhlc+LRdcaVcaT5+H5gUU0w36euo9H6XihlrPL6Ir:SK11826m491LskDPPLVZL5Cq
TLSH
T16F265B556BF880F5E0A7E178897ACAB2F7B678420D31EB4F0191C62F2F336905D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.3MB
SHA256 e04418b73d0340c40dbcc2a31dd3bfec41cdd8afe5a71f97e5e24e2317c2d080
MD5 9abb3836169d6bb299993f55fe9e9dd9
SHA1 61f32e2d321bae766399cf34a5de6c6b9a17c47c
SHA512 9ddf14ebe7c6f36aa075fec83d908278b8b7dfc4288f11cba9ea26afa710fd7f49fc3634a8f90f9ca61f86444e1635e9c19befd63467b3255b0fc5ce542e0e0c
SSDEEP 49152:kfaNd4Jun2yL5zavfFiV+XenmE3/zAJH3:jTLo4VjnmlX
TLSH
T10EB56C0976B8C1E4D1F6C77886A2C647F37178154B34ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.2MB
SHA256 a2dd2016cb9790c0e01a0f8d5edfd9f1f9c33c4690fdc816a4dd18aa4280f4e9
MD5 b14c11c018c2ad9edec6f75bfb99a383
SHA1 4bbc4124ccc06a46ea5b71d1da5118a745cb740d
SHA512 9d21782a9fce656a736dcebee4b1587ef1172307330c164fae0eb8a4f746538dee146ae8bdd5081498989edfafb562ba27c15a7a0e1daaec8d524a377b7980ba
SSDEEP 49152:7joUoawJzZHBp3DJf5SUYLoDpgLjSTYlQcGevZAaLSF259ruMHwpXMi4FqJLd23n:wBRQyi36YOcPvZLvw2gAf+PN3WJ
TLSH
T18F666B43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 02ced2e9191eee602145a68a8bd7a56bac45f336aaa6fcfdd8dfe6b35a8b9280
MD5 2a8c5ab15e0b6349668f257e9c87013c
SHA1 c0b6c025cb75acb17b5224b39f40a9cae64edbfb
SHA512 51382eb9a3a70ff2a22ad8c7260392b3c7d84f880d8e19e6948a358c10d38a9209b86cc056f3358df3526a0901f1f6a63dd4fe273a06ac6b1625854c53b7da5b
SSDEEP 24576:8nvVq7GtQirdUUDbodxyBMMlqv7DaHGTNHu7PNU3/5W/ohL0uHU2Kk:F7UQs0UBUveWu7PNU3/p0+
TLSH
T110952733B2F200A9C44DE1769F4A872196D27C75CFE0D3DB8551721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 3.6MB
SHA256 611ca5a28ec4582d485925b8785485bffaafdde5d08dacebbc08f5c6960cc0b9
MD5 6eb9f2ad51843dfb8cc1a5854d312779
SHA1 0fa053e90ca7fe01b856c947dbd81dca06cee27e
SHA512 02ed8d6a85255653b8b4dafd28765d669fabb71cab41b0fca8f3805addba2015cac37c3fafed05b0fa4a1627565c7d89ca652645f0a53119eeb75de6ef26c7ef
SSDEEP 49152:LWv2X0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbSON3Oh6tznm2FQ/nho2qkrk9/:Ky5112gYy5azzVvON69nLKnhZJwJ
TLSH
T12C067B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.4MB
SHA256 40a3a02ebf4c901ba0857197c495949fdfefb6dea406889aa7bed5b411e42eb3
MD5 0b815bd67b2aa1e5d369b7cdde98677f
SHA1 81a5873c242af49078a82a6e4144f3aef1123749
SHA512 e94850aed4f308c1c1b66c4cbbce820e221dbf85f45f954acced29930263516ee11f4d2af1847c81d1c5e670e435711f8035ecfa66d79b3fc56b83ea8f8c8142
SSDEEP 49152:1XuCpBZcjKd8OBr4tEG+W0bqx0z+n217aau1glzoJoD:EjSJmQmxd2ds+D
TLSH
T1DBC58D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 1.8MB
SHA256 c3eb51a54e616faf927b1679fcfda4cbb48568749ebb91ae157db652b23019a9
MD5 b85389e3e45363161ae63e7b4f9c8f7a
SHA1 cb05eb4260c946b3176d20f57fc825270c4dc266
SHA512 c8f63a168e5b2916e4e48f134280d3188fc668660bf2a254364f893eec6a668853af75c08bebb06dfc9154b95a70d2bfda2545e89a85f654a2922762952550a4
SSDEEP 24576:oPvyhk3BrcrZqm+ocufzm/wuCMIJpAnBlqgUQ1zNOgLLwH7ReaQXx3dSCc:1hIBrcrZq7o71JpAugU44CwH7R4xICc
TLSH
T12B859D13F2D900E8D06ED17887569632EA71BC460B24B6DF0A90B6961F7BBE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.0MB
SHA256 ba62f304601d957d161480a2e843a59621c155e6a6ef09b90a60713f0bbec2d0
MD5 9c495da97dd4fdad2d0bcf97c0cbb77b
SHA1 5385db6c8ae853dbfb6ce261c2aeb2fc52bcb48d
SHA512 8c1e06de1c5d6b0a0528ecea900ff0d4ccec2a3d79cfd339363c5858da13eff7d0f953200239c3f0136018ae716f09d7226b3e9b7b1511ff9900b6a938d41b53
SSDEEP 24576:ERlv/zRbz/JQCazRAa+3Pa/iSVHWxllq5R04FxGgVG2Onks6xt4bSMHnqdsUWY:6BzhQFSTSV2k5RVtOnks6NMHqddWY
TLSH
T131A59D03F2E940E8E0BED67887669632EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.2MB
SHA256 165cbd87c570ec0366345f09402bcb7b02620dd8eee1eeb68485ff4eb75bbc5a
MD5 b3e473f0746f082d4fa17a151afe5992
SHA1 8428f7c51dd744a9b9c1adcef00ef80d504eedad
SHA512 cea9f1fde4c6243fe9567efffd4197000b63e3e347b4fd35f3703dc98aa4f354233c64a3c2aad3763f35ff0038aa4feecd5c43c0ff2befd364f8c35ea098094d
SSDEEP 49152:/WG7U22vlf4cjLAE3dGGj8bezEGcjesaNkYQd0XNJKcvaAcPTY6Y5ArE:4J4ivjL1BDlZ+E
TLSH
T15EF59D13F2D940D9D059D078874AD232EA72BC494B2166DF0690BB562F7BFE06B3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 21909cf34998b3aef40ad80ced7faf5e14a149127c3f33776932e5125af964eb
MD5 4bc8ddc87fd5e0076a7376118b083c20
SHA1 0812f8073cde710888882d875597c5feafe555cc
SHA512 751536bc0968a8d3bca4406fee2bbb27f56bff6223b6969f3782b59bae44a9ca16330e6a5334da0e68cda8e6088a00fefce85516d45aaa79489a5f8d0045e51f
SSDEEP 24576:kSYvDvxLtd+Ey3n5VNyUgunvWjlqTi3iy9CTn0AP5+2QLg8Ov:k/ZLT+EyXFnvbTgiDn0AP5w08Ov
TLSH
T19C75AE13F2D900E8D05ED178C7568632EA72BC160B34A6EF0A90B6551E7BBE46F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 332KB
SHA256 85e0817d38cce26683d418e6225398214857768aa040d03626c27a086a65dd3a
MD5 3275efa21b7a35c48000591680769aad
SHA1 b236900846107876f301074d1f542ba0df319adc
SHA512 2a5d2fc049e68d65f198a6ded0a5b83fca99a966ce0805c5ce8a1705f7adb622345d8ad1f7724fdd6babbe91e87c1709c8594c0be1267475c11a1d0a8cb91ae4
SSDEEP 6144:VTPf6lElxgsY6CKFjQZMWTB6fa4YV/PvyG5uNu9JOj:VTf6GlqsYVKFyITcPvyG59Y
TLSH
T1C874AE95B3A00CF8EC67813ECD558906D6B27C5A0BA0C65F13A436265F733911D3EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 333KB
SHA256 2bcfa8abbe1fe552ed8f37e834f5b8431a0249cab94bdc5c10549dd6907267be
MD5 4e106344494d5581043bfa58a7d577f4
SHA1 4434456002ec9abd7401c397e8067e75611eb95f
SHA512 a6f066b9dd8fabc00ba1b5e77a66d06dce49da846bbdd84b9a08e523a2b9ddd1edbfd3964e7af0569ab7f8c9d7eed2de4fc63848136e550c5a4db0c656761042
SSDEEP 6144:MBa8KElxg56p8N3Ei1HsCMe4yEXz8YutYPDvhk2mTB9:Mw8nlq56p8NUi1MQ4tz84PDvhJMB9
TLSH
T1A174BFA5B3901CF8EC67427ECC654906D6B27C5A07A0C65F13A8362B5F333911D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 540KB
SHA256 c580f0d84e2ed3c26fcb9dc0d6e11521cc49b996d20c53ba61d9f933adcdbe6f
MD5 e7ae0b57a1f4979d0454a511a64c40dc
SHA1 c72553b04a8417ec072573c01415115431514bc1
SHA512 7a0a340e492eb13d5b8df6562c29bc0588c5ea24bb78c1b5a8cb2e57797d88b8492b5254d6c523471458533256271396ac92e7d44f06d2f095d27255613d352e
SSDEEP 12288:MQoEU/lqL7ksp/HlUGl04mLbbdIvA4BkZg:MdHlqHksHUGl04mZ3Zg
TLSH
T13FC46C90F3E414E8F0B78A358D764511DA767C9A1B21DE8F02A8665A1F337D18E39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
Size 332KB
SHA256 74a2cc8892595c0b209fed02981a0ad754a2ba0afd95606e9917aaa1caa5a517
MD5 10eb1c708fea57cdac4fbcc3e90f13fb
SHA1 050670c76de247f50d779501553f2b025f6cd052
SHA512 fdc895b85a0bc461feacb018a9dfff3a58466f4ed6184cbf97adc936d91126be1793281fc4ce8cb8c885906be4f008aaafe2158fa06cd97510d5308269632fef
SSDEEP 6144:8IPbokElxgk2TV2lsjf48eEcjv1yvYV/PvyJBDNvS:80bodlqk2Z2iT0tccPvy/lS
TLSH
T11874BFA5B3901CF8EC67823EC9558906D6B27C5A0BA0C65F13A436275F333911D3EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
Size 141KB
SHA256 3e16bd84553b400f6815f1d614e061633a870dda9e4e908cfc609be512f82ea9
MD5 884f4d9f42119c71842e16cc40478650
SHA1 b772c71d4ff4fb7feb8a465d618d5947a7cb1851
SHA512 ade2ab9046222f933ce271da80bd0488199a96bc0871f18aea79debe2b70b92c1ca4996538c7785d10eb65d4f7afde5d5701e438d223777a9e4b35a189e8382a
SSDEEP 3072:uEGYx6KAMijlXEo43udtjZqMNbjuxsU97n0sK:uElxgBlw6vvD
TLSH
T165E38DA1B3E85484F5779E72A8B8CC21487BBC9D4DA0CE0D2295710D0AB37E19579F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
Size 333KB
SHA256 52d5b999e339bacb58c36fc7f1e3c22ed529c0f6f9a28c44ad33bc931bb0be92
MD5 5c020d8b7d55a19e4456944052223799
SHA1 4651888831c11e0a8f35592c2c145077241a12ca
SHA512 2c01de417b07edcc0acc65bd2fdc9d924f1c19e03a411da245da3994490cbf16564be3d62b9ecc1125933c4751f380bcb3e75b6d787c5ae616e109a2465face2
SSDEEP 6144:m+1jeElxgQuuvr1ncu0sAe0elZzwYutYPDvhfhlqrDnc2mv:mWjjlqQuuvr5cupj0szw4PDvh58nc2mv
TLSH
T16174BF95B3901CF8EC67813ECC654906D6B27C5A0BA0C65F13A4366A5F333911D3EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
Size 540KB
SHA256 cff0127f2f7135375855e44703c636aef02f38c8225a0329c49acc6a5013de2c
MD5 093d1889f599c97d39df1948cad182db
SHA1 e1e4e10c707af3d91d203d9469ffcf3313eccbf5
SHA512 8356683094ab1a57f56d069f74aca84fa2c0c028ea258f08d4cf768ea24934ce44ff9f4402a1fcea7bb30569a08e2a18fbb702bc308d290bacb7df12588f8ec7
SSDEEP 12288:iPm+aTlqpY5dWNJ3YV6AzrLbbdIvBsmZl0z:iOXlqy5dGYV6AzrZCZ0
TLSH
T1FCC47C90F3E414E8F0B79A358D764511CA767C9A1B61DE8F02A8661A1F337D18E39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
Size 195KB
SHA256 54676e9b666f8d43c229c87f997a7faef6c019dcc96b715fb2530dcf55025d13
MD5 a8918205349395bce32afe538aab1c10
SHA1 a0825204cd1cf3d11fce7403f370629631035798
SHA512 1008e240e3bd413b8fc76c3af71b2977e94aecefb7139a8c5f77fb102ecf8d367c4b942a62862a1d9adb6f9629edde22a5f122d3acf4ebb4dfd7cd3f3ae49ee2
SSDEEP 3072:pTQcxstPqnp3SEGYx6KAMlY5DEmd/MjgvhagI/f1OFOPqxn9HVobQCcH1m5bv:puPe1SElxg15DEmdggIn1ULHVdc5bv
TLSH
T1A3146C0133E80494F473DA7999A04541E7B6BE521B61EFAF6384715A0E3A7E1EE3CF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
Size 137KB
SHA256 f84e348730667720ab4a35d7f4198af13ec149c2d6daba6112f98434b248fc35
MD5 ca18c3232f83d9133ed799873cfcf626
SHA1 4d7045117a87c6d4001508292af5d2da6492a3a5
SHA512 fdd43a810a052fd823989386f31b0a27d5a19ebbb799e3d3fba96c75426ac42bf6a7b4b6f13a1b13e67bb54bc9620572990c25cd5d2d1c2e71e0540fa5194eb7
SSDEEP 3072:LvQb8REGYx6KAMV28vJEisdBziuxTy3jvTB7E58i:bQYRElxgr8qdBm37t7EJ
TLSH
T1B2D37A5263F91898F073CB75A9B481158F3BFE525A61EF5E6280510E0E7AAC1DE38F31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jre-1.8\bin\java.exe
Size 332KB
SHA256 2ce9ddff0d99cc621f7ff823fd3fd4ed2e153b7df05173d4328d39965980df04
MD5 9ccd129094b1bd94f7f98011e774431d
SHA1 9e267bce79a7d4985a3ae5bff97c24f2d7a24d0b
SHA512 f0b39149ae06c6f354c97ab7660994798061a5f6ff8581a64e51dc2a946aa031b42759b339cfa7806449433a3a56eaae10d35c47724c03c00e3cd98c6bd5aa5b
SSDEEP 6144:5XP38BElxg0/MYo/jhvxIPSD2NoYV/PvyyWaKlhiMLPhN:5/38alq0/Jo/9SGcPvyygwMLJN
TLSH
T1E474BF95B3901CF8EC67813ECD658906D6B27C5A0B60C65F13A4362B5F333911D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
Size 141KB
SHA256 4a6e10e1c45067fb4eb076897b410b7ae5efabc8812d7806c5bf4fe20427ebf6
MD5 d768f1070b601f5c68f10b5208f560ec
SHA1 f04f7a83f7ab3351aba83c6c0195582f8e672de4
SHA512 8fbc3707d1bbdfcba7d41657a9266ccf9c4e3c2abd369cea1fd50e07ec3721e33b8493bd7927dcc550d60bf279515fe8769475e250165e42c40c260d3a5ff174
SSDEEP 3072:mEGYx6KAMijlXEo43udtjZqMNbWwx2pf/0BgGm5MMmx9qtr:mElxgBlw6vvW2B9Eggtr
TLSH
T136E38DA1B3E81484F5779F72A8B58C2148777D998DF0DE0E6294720E09B37E18479F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
Size 333KB
SHA256 bf6e2238ee41c08081d32ead1fdb9ab6b5bf83a4429fe050c39e80b608ac363b
MD5 0f4293f6596ea0323e7b11c08a2a1f1c
SHA1 b21c63b8f39406e1181abef6e3c38377836d51ad
SHA512 53eb554eec046c6ae7ef071ac92ceae08e89ccf04bb93986027744cbf7a606e901b836f27bb53f8911048f90b3cbc618ffc845ebca89d6f6f903299dcbac9ce1
SSDEEP 6144:fXScUElxgXH0mTjfHPRsfbkvF7zgYutYPDvhxm2oN:ficNlqXH0mTbHPSDkFzg4PDvhxmzN
TLSH
T13674BFA5B3901CF8EC67813ECC658916D6B27C5A07A0C65F03A4366A5F733901D3EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
Size 540KB
SHA256 f0dbee3e9541c18fbc13afb2bcc48322f161364924c1a485374034da08e38c82
MD5 73e0f5b3a09d0be64ab7dc61248bd4ee
SHA1 beb7e0d699ddcb0ce726166840b725c71a2911d7
SHA512 fc36972600a300033be5c1ada86f0ba601dfe5581c9d987e531f7c08914ba4332fe4bc67cc9b39908261fd6117cfbf8cc566a3af11f8349335c11ba5ef452ec7
SSDEEP 12288:5TRiHmlq5+pxPEDtsRElbhNLbbdIvWsxvG:59NlqMpx2sRElbhNZGO
TLSH
T18DC46B90F3E414E8F0B79A35CD764511DA767C9A1B61DE8F02A8261A1F33AD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
Size 195KB
SHA256 f6e7cbad6c241e7c0b2db7cc7195b56cf0712aa37db10950aa0bd28c7a68f5bb
MD5 b9328296c08630b2fafd8e04c45ed296
SHA1 3e3c2f2600728bdc4ceb6c31b3ad265b119460e8
SHA512 a16b9e5b1416e43581162b0d133ecc0f7f62cfda20b64cd5b8af6214231f43aab645ed9f04c7912095469d53e6d344d456b48c76220bde6a9cf60888d4253877
SSDEEP 3072:WAcOxNtGPJr7ZEGYx6KAMlY5DEmd/MjgvhagI/f1OFOCJGxkg++Usd2c:WOGRnZElxg15DEmdggIn1Un9gN/d2c
TLSH
T1DD146C4133E90494F4779A3998A04502E7BABD561B51EFAF5384712A0F3A7E1EE3CF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
Size 137KB
SHA256 a8441cda978327397d194bad57bad4ee2a730397de81875e4de3fc384a9b7482
MD5 ce85e66210ced1af10f5739772d0044f
SHA1 42296266710447a96b380315f2c3806e13e99e82
SHA512 dc6e15b480c7d452d86adb17e07e6bcc6d2bfd4aef6513f1f499953cedbcf5366a3c320da938c28082cf94de0b42ad923fd9b002ce2f5e179145c122a341254f
SSDEEP 3072:0gQb8oEGYx6KAMV28vJEisdBzYMsxM/ECpeI+G08VevT75H:/QYoElxgr8qdBpZ/E6eIQ8SR
TLSH
T174D36A51A3F80498F473CE75ADB044158F3ABD625A61EF5E5280520E0E7AED1DE38F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
Size 4.2MB
SHA256 27f177fe62b2d789d85b8fbae5a09046ff023368d07b159f366dc99ba59a4b45
MD5 5fbf71600816365da34323239d8b8188
SHA1 d6d926481f4b1017085af97e2a5a9f691091799a
SHA512 32a3c2c280fd94467ebb84ca4aea7ab2af1927211791e46c93e4c4d968a5aff20bbeea38e66805f88136018a3ab0d6085d0fa74b793d6298b38909dfe41edfc8
SSDEEP 49152:V93mlaw2i7Odng09U6D9KFyXqLDdLPWBXUVYze3ueuOvHENPIxVaqM5YdIB8NRVt:V9niqG6XaLUUPaxCdF5CM
TLSH
T180265C556BF880F5E0A7E178897AC9B2F7B678420D31EB4F0191CA2F2F336905D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeClickToRun.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
Size 4.2MB
SHA256 5b4830c3c7e3fe6338876cfd656e6617e25d820a51efcc30b3903bcf0bb2e096
MD5 d57aa431ab22aaa141c71dbe24c788de
SHA1 a8f55617c061a987aa292300f5b9f9804434f2ae
SHA512 3a11f43fd1e8cd7ebef15587766a4079603b4c106e078e69030ac985d72d4bb2aff077b7937213b7cfa5b73c4c88a80b871e89004c68787db55deacc06475255
SSDEEP 49152:kTJ97ZWGiEVpIEC/YDiy+N8FFJLWdI1ujfjz4h38eu0wVfKJQtVVxS88O58NRV34:kTcEnliW3L0lDVxF8b5C71z
TLSH
T103265B556BF880F5E0A7E178897ACAB2F7B678420D31EB4F0191C62F2F336905D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVDllSurrogate64.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe
Size 274KB
SHA256 61ff6c1e592a020918b67c42b3a0d0cfd318e4c37344d3a38275b8a38e05efc9
MD5 ac90ecf9d0034d4159585365301766d0
SHA1 4b8c80ffa14e16c22f33138979e92f555caf0656
SHA512 45786ea19220a468c15a1b2b17a9bb12c04ec8cf5919907f0070ecc4b635473a4acd743dc5d8c313bcd3c0dc5eb46cead84f2ecacf09105cd1d82d6b74671b93
SSDEEP 6144:3997XkElxgSWGNTNYdMzATVkQNUO7q5CplRIPaczX:NxNlqTGNTCWsTGQ4splaaIX
TLSH
T1FE54397BDD38F8D1C27E5CB867A1C700AB3271714B42638BE175C26E8D136E15E6AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVLP.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
Size 588KB
SHA256 969ef3fdde001df867f279b306cd9f79515d3f98c066b4180d6192c59c9738e8
MD5 25df5283b6338b31f5f183b1bb1aacac
SHA1 05fc10f3943a4ba2e393a85f1388edea362d47fc
SHA512 fe93729ebc9dd0eeb8d42fc25d782e079c3c0368da9485fe57c17a4f3ce35f30cda37c3324414d2bfae0bf205ba067629af3360315f42544d30bffe3853c254c
SSDEEP 6144:fAD6Uw5zGT2AO5QUNfj4tElxgvsT3C7JX/Ummo4Wp4hzvNUXITiXt9Z+M47iUlfh:oDX2AGqulqmEluzvNU4TEYickgpIgYcd
TLSH
T12FD47D76EE28D8E1C27B897897968600E6727C110B61D7CBF16CD27E1E236D05E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Integrator.exe

Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
Size 6.8MB
SHA256 5c3a8427046e3c755415b821636e81514eb9fdf075def6b8cf420755a4b9e586
MD5 2f16c4c23373f0a473b39e0b05b484b4
SHA1 35e068a7dc4d2983fc120db1524961dfe112040d
SHA512 de16a804f1cc7f146433541132b7ec9bb4d4d89755a7a423bee71090dee9a740ebd860283610a68dc86e6c1b65651ddc0aa9aec6dd199b464ee9f3c9b77ce7f5
SSDEEP 98304:WxmNvY1FVxv1aFB1GWoohrrmqJjeb2G8Msd:WxwvoFv18UWx5Szn8Msd
TLSH
T1036629596AB481EDE0AFD1748D778772F67278428E33661B0261CA1F2F33E588D19732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Mashup.Container.Loader.exe

Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe
Size 100KB
SHA256 102b223556841002d2e9ec3455e132bc12e77d3a47d8e332b132e4fd9e2ac658
MD5 a6f75c7d5021ebeecc78971b6046dbdb
SHA1 30ca8e18353520283725c9a1cb7e62fb1cca9d02
SHA512 4ffe1e9b29549106bf0b96dbd1be92f2277959baced45b67b3dc1ea5bde9c1ca436e6e8b820b6a019f98ba6a4422cb41d6eddda6f73cbc2908db9171b049924a
SSDEEP 1536:0KDniKEG4Jx6Ky/Mjo3j/eAMpldERVAjkEs/JxbYHo1FSp6clJ2vhw9qM30Fe3fx:0qnDEGYx6KAMaeAcI9EsbUYFbIqG0FK
TLSH
T1F1A3DF03BB8908C5D11103B468958A8AF376FD624F52E7DF9196D21E0E337C2EEB1A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IEContentService.exe

Path C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe
Size 448KB
SHA256 a7c79402cbb1636e15f1721825b87d2c267d6e502ab98ab0ccb35da87df1c480
MD5 8d37220b990d6311ca7d7394079ed482
SHA1 dc0b30702a69c0d489bcc1b510be486370218715
SHA512 40ddcf419a6b7539e566a2ffd0bcb12b7d8b53e35c5500c85e58cbdeedb702b6201eb42744bb00cc80a689179d7e50e994f10d38a5d77827d8c67eacbb906ab9
SSDEEP 6144:VVaBsGXjB6TUugPInTTiue+IfT3FElxgKyov5jfcbvnmwVFwelrnDeBSg/VS:7aB7B6T5g0e+SjmlqyRfM3BenQ
TLSH
T134A48D4AEB9484F5E657A238C577C671F7B2B8890E20674B16A5C76F3F33A506D2C320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerfBoost.exe

Path C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe
Size 876KB
SHA256 b0ae487753eb3829ba06b0d411a0d8c69e2d52c3daf4697ed6487a2cf9af7a1b
MD5 855192e21a162cdadc30db4fe1469bf4
SHA1 7ac2e6173393d1f030867a54255d1e161bc8b6c1
SHA512 5477724eaf313173dd649db68564b287b0d7cd1e3a18bec2869811cdb15c6cf011809ca243531716ccb296710cff2c47add6f18e3f5fc41246a09f58b50ac325
SSDEEP 24576:b1LVIzURQAKtlq1Tu2sUVpEKdUnHBt9Jiv:JgAKa1ypUnDUn/iv
TLSH
T173153995ABF945E9F1B3A67499B68571FAB2BC521D30D31F01A0C21F1F37A808D25B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDXHelper.exe

Path C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe
Size 188KB
SHA256 9d7472b82bddac2b4fa1628dcdae61a80037c864542f314b9467f6f1aa816ab1
MD5 d7d82215352c75c499ce38874e2a9361
SHA1 e57679a05517fb63ade4f0df305872c9d6ae002d
SHA512 78ca32d7e54b1c8620c4485769435d05dec9e45f37515ddc0d08cd0b673b48bea1c4900b509ddd997def0844d346f8d7f6a4e0146af7755f3d6d4a86b2c143c6
SSDEEP 3072:/rxSCA3pLNq/DBEGYx6KAMv21Q2+zT6lZdAh3SJxfFrgrwHo5rC//UEx:9S5tNq/DBElxgKPelZdGaFkrD5rC//b
TLSH
T161149D067BE4A0EAE413D138D5A9DAB5F3B6F5B25D20631F5661C20E0F33391BE24B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoadfsb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe
Size 2.0MB
SHA256 6275419236044a1d25b90609bc2319aa84a78c2bdf624539a29292e164f70ede
MD5 9c8850cb5c3aa1c3705fb572bfe90372
SHA1 92ff55715d83162cd3011c2e7717cd50fe991fdc
SHA512 dbba8172c6da7da5f01a7ac84bff71d2b48af3c9217eb2d4216547ba5419f937f9153491bf9334463296f5fed9e3cb65bd490527233c3d083c88ee4493b7151c
SSDEEP 49152:9D4BHaq8myPcOa//dcBvmZ01GFT7bhlgI1:yBjSON++
TLSH
T1E5A52946ABE8C4E5E2ABE2789975C9B5F6F2B8414D31974F2156C70F1F336604E38322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoasb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoasb.exe
Size 340KB
SHA256 a9f230d5076add0f4622e8048e1e0cbf1f39007b86d194328fa5f07c1b7527f3
MD5 5b19b3908c5c18d091c8d35beacafa08
SHA1 a78a624ab73245efd318914b72a1fa028c3a94b0
SHA512 2c1b9c3f6af2e0be2385e2cd098e5ae966e67269d3f86fbddca1bc640304bb416ca6368d0595b28d45c60546a5240749a2114bd62474bb5e414588f7c94422f0
SSDEEP 6144:HcN5Elxg5RHU72PRZb8EpaspuFVE4d9bhvRx9EiOwZexhn/gXmdP:HHlqHG2PRZoEpaspV4d9bhvTmw4/gXYP
TLSH
T1967439577BA88CE1D817A1788986D2B5F772F8614F21D30F6952C32F2F37261AD28B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoia.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoia.exe
Size 6.0MB
SHA256 7be91cd921b04232fe4758592f5da6ced3f7252ca16a59bc66f9df153ab6c7ce
MD5 1b5d158abdd414cc45f336e0dfaedf5f
SHA1 0889254f043cac7135cfdff091d7514491be293e
SHA512 d17cc6e9d10c982d6f12e4ae13416537607cbeee7c8308fcca86d7e97b8656fe71e85bf9b7e19061db3ffea2bc120fb050117e3e169a59fdc1f7f68240e22f99
SSDEEP 49152:EbRiYQelZjJ6ag5vASlaQqwhcvYpmX4yufr9aawyjEgEBtASEK293+XQK+P5jGSV:EllvgBq2XUE5KZCLw21maGI
TLSH
T15E564A55BBF982F4E1B7D134CAB285B6FAB2B8555D31A74F0551C30E1E33A909E28332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

officeappguardwin32.exe

Path C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe
Size 596KB
SHA256 cd3c52c52c165927d7d2a59d8421758a4f72908d62c800db52a7b1ff44b90a07
MD5 ec262128cfa3485c8279e46e0a00cf02
SHA1 d8add028d35fa52021ef8219b1067d7109cdcf6d
SHA512 b242c94c70d70a6c51db5bcfaf4bd51db84673a5e3cef945022ec314dcb02ad880c867651a4952a3501a9d07f65be4f18b5d587b336204c01800be5eff773fdf
SSDEEP 12288:wSR/eHIUg7kvtZgWVIlqfcIPr0lypFpMBqJBwX9T:wSRWHImjVIlqUcAlcgcO9T
TLSH
T17BD43941F7A881E2E566A1348A6685B1FA77BC170F70D70B3559F32E2F33640AD29B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocolhandler.exe

Path C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe
Size 6.4MB
SHA256 9d68d3330d0940ff0e27d7d72625343d195df57f30e712490634983bad41c60b
MD5 12601a4440949a68caff40bba208aeda
SHA1 1ae1ed3ac472a36392495b3e815f0f076a1281a8
SHA512 58a1e0c5a4ef634600623bddf5cdb993d8782bd8019cf025df59c74204b7ded6fd06f13892d7d90dfa8c9c418396296f0c535c21cdf694416e8d0ba43fdb3bac
SSDEEP 49152:RKW76wGQ1QKX6o7KBToVbjS1HNJ0mmfIH7482pWSnTRs8AAV/N+eaVu4F8vpGd59:BBuSpzAoUu56NL5RzHj8C
TLSH
T16C666B417BF880F4E1B7E2788A3A9675FAB278425E31AB4F0151CA1F6F776508D29331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OLicenseHeartbeat.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe
Size 2.0MB
SHA256 3e77e2b4abbf5ee9152a0757b24c07787b8d076ade9445e0c32dee820626fe8e
MD5 3b730b50d271a286f81934aa3022a70d
SHA1 a87cb4524bbd7cdd97d439eaf2b96cfed3dafe57
SHA512 a4bb6d2e812710582e68cff8663315901f7badcd416c3260f3ec179a95ae8382237724d3b394df7e6f9f94fde20f0be22afe54a996b9dffc7e322aa6b38ebdfd
SSDEEP 49152:/firGbor5BYlE+/h2Lu/nEPCkYrU98xjqrAA:PWWyx
TLSH
T116A517406BE881E5F5BBE7B89AB68979F9727C521C70E60F0156C60E1E73B408D39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLDumper.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe
Size 222KB
SHA256 f2595acd69b7782bdee60a17ecd87aa969e9d50047c9d9b4d64caf24f2a4b3a7
MD5 a41274c2a6d69824f757e7142c1cbb98
SHA1 554486e39f4f9eebd4cc1d598538b33f84885a90
SHA512 a9904e8909e4fc18883e30e9ac453da320ce20b30853fb7f5135cbc919606e44ea6ef1e0e254280bb90cf2b31d1a7969634c06dbac78f6d9b63fd86390955b09
SSDEEP 6144:XBPRart9Elxg9aj4dizmzxM9OOzgnpjUV:XB5arUlqRnzWoOzgnk
TLSH
T1D0245B4077F91058F5B3AAB09EB582526A77B8956B31D7EF0518C22A2F73BD08D34723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohub32.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe
Size 2.0MB
SHA256 1c1bad7bfaa13348817f5b27ab4a6b58610e601d85c84969978cf19e10c065ce
MD5 e7288eb8d3ac2a6ca1e5812ca9cc4329
SHA1 eb45ea6404564b73f8602abc6fdac4c142b776e0
SHA512 d20dc7a90e2ad555cdba66a917dabbacb875766cb1bd1ace6f7f268567e126ec345b20e8ad67846be404230f17c80b3f9a7982d0c2b91d3b07a7abe812e36a52
SSDEEP 24576:CA6yDeF+pYGgR8assR0JhiOJDM52A2NBH3NRLOmNfFVwQPdsZH5+lqTb4FgwPqe7:CA6yDemJEqUf4ULOH+MYu8m1/p9827
TLSH
T1B2A55986BBA484B0D526A17189A6867CF7727882C9334F47318DDEDEBFE32604D59331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreporter.exe

Path C:\Program Files\Mozilla Firefox\crashreporter.exe
Size 3.5MB
SHA256 d6439bc5a535060b25d68a31ce01b52350ec2715936b7dcae33ad7c8765f3e30
MD5 fa6e95ade7c1269e8b9d427dd603ee69
SHA1 8e72c3bfbd97ae925f17bd519f0118adce988b7e
SHA512 23e3a8cc3a22823864aea502e58d9dbe40023c17fe4aed09b99964e8c1f9d0cefd4085df2315eab61b2491738413b0217ffb3ec67795376795520b78f5473963
SSDEEP 49152:KY2cJhjhsh1SVEM+O28wsz3iDT4JmeDNB05FQz/4DTmXLhm6kV9/F:KYZxsuE62Jg9f05Fy4PaLhm6k
TLSH
T172061842EB611DDAC025C0B482266723B760FDBD073036F74A906735AD68EE05FF9B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox.exe

Path C:\Program Files\Mozilla Firefox\firefox.exe
Size 777KB
SHA256 30d9768d88c83d82b065fa6789d58874f86e8e5aa1a56a1c81d18d6ffa79a0a8
MD5 75349d8ce24ad53c8ae2d2a9a9c22c2c
SHA1 40a3c99cf8d9ee0ea9f66bd2b9af7f29fcbbb0d4
SHA512 a65d5d0cc5c8cd46c7e84d4a279a3878a7e601d73668ae79f2a6fbe2ef6f9adf145f923473647f6055802cc5167ca88f3a5d8d0632dc015ee5044e01a5bf2e45
SSDEEP 24576:RBi54ZtAlqaKp4llEQ4SwpemIwpelzEuEVvXC9:Xi54ZvaKp4llEQ4ZpeapelXI4
TLSH
T14F05AF03F38516B8E08AD5B89A46D133E5723C880B51A1DB1BF93F2A3D71AD15B7972C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
Size 329KB
SHA256 0c329bc2497de8d054edcdd003778fd774dcd50e2ea77a37b3290466a132a3ca
MD5 f8284cff0aee34458b95de5fd5493592
SHA1 a2685618766db524e4651c9ca3edff854b2266d9
SHA512 35411be0b59a30a59358143d4726319f13891efdeba54ac5c88d2f2a29240a7f0b0884125bfdf7475b0d909bc40fa16c88e364e97b34ff0e5684006c45c086d0
SSDEEP 6144:KVElxg4cB3sKvX5yLBLl01PKw2lRU3c/iJPsfUrcA1wQSUFR:jlq4cB3sKf5SRlS2lRj2czA1wQRFR
TLSH
T16164AE24B3E40CF9EDA7827DC9A18512EB73785547A0E7CB02E486661F233D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nmhproxy.exe

Path C:\Program Files\Mozilla Firefox\nmhproxy.exe
Size 654KB
SHA256 fca7d9fbe891b3ef2318800b15442812698df22747b5604bd49250b61e07e545
MD5 306373aebddbcf00aff4d9479d1b5bec
SHA1 f3910553cc97e6865a1ab96c66c733f88054e841
SHA512 e5b2e63379569d55ca461c22d6d9e798827aa916b3e287b01a1051ecc4ef82eb103aa200fa5f7ef681d9184885c6faa304dee56fc37d0a12380b3b92735e27b6
SSDEEP 12288:oZXemI1qzSY5TLI2h4wi7yKOlqZqc/waheNaAwpFrExo:oFemIIz35o2CDZOlq+aPrEy
TLSH
T11CE47D02FA97D4ADD51EC078864786327932B4CD0B30AAFB63D85A353E59AE12F3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pingsender.exe

Path C:\Program Files\Mozilla Firefox\pingsender.exe
Size 125KB
SHA256 4ff2152f76aaff83a345a15836c53a9dd7983db139b6417b16d7123a462242bd
MD5 65746eff524f4ea285b4121e78ed52b1
SHA1 ad3ac350ad61e20f0bc94a2463bc566d7ff974f1
SHA512 2e46087a5d5817d86f1fe659a8d1d00472a23025ccb58134e15c05e640de6b25d5142522920884879c63ab334509d05800ecdbae5e9cf12bca1265957a88ab61
SSDEEP 3072:gXrwNjPEGYx6KAMVsSh2SdWASUIvTrqtJPt/eOkpZYZ:tNjPElxgGvFd8UAI9tZsM
TLSH
T1A2C3CF43962468AAC421C3F0F4EB9932A7257A468BAA67DF6354C3112F453D02FBD7E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plugin-container.exe

Path C:\Program Files\Mozilla Firefox\plugin-container.exe
Size 201KB
SHA256 4c1ff0b647afee7bb4ec06ef3168a5c1dd66f2573e07497df39414080ac9065c
MD5 e1e7367b705dd30bf6733694dc9b19cc
SHA1 e44b1f842801f687953cb31dd53692959b49ac5e
SHA512 45c8e78660d05aa03523dc81686844c4199760257d8959952f150077a3db064b6f13c5000a151adf6a30727ec967e487b79c6ad17144689d0bbca6c4d60cacf1
SSDEEP 3072:jtkxqWG7EGYx6KAMSAEiWyviYREuaPu06jqhhjG9GjeXyNwPPLOYH:jtkxqWG7ElxgahWyztEuDK7j10PL1H
TLSH
T1AA14BF13FB8D00E4E889D278A7D29222A7B175870B21A3DF265555203F56FE8BF3D394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.exe

Path C:\Program Files\Mozilla Firefox\updater.exe
Size 522KB
SHA256 6072c23d84e5fed1f01259673ffa83e0670d56148989ebeffbca060f578dcb50
MD5 81cd315ae35ba33edb63969d1565009c
SHA1 209461c605096bc286c039eed691115bfb2245a1
SHA512 d8b42fb84de29b3e9ab1d97dbb812dfd1c985d8435edbfaf97881295e73200cf2ec105da1b11d16e4cb1053087698ff892bc8366172da6616d66d207712dfeca
SSDEEP 12288:WtGkqa4lqQz8VsaqqTbJxKq2ZeFtSOJAdGyRRyfAgJn:UGkqa4lqQz8V/x0YJ+RDyfAS
TLSH
T1DAB4BF29F3900DF9F42BA274C9A68511EA73FC550750A7EB22E4D6262F332D41A3FB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 188KB
SHA256 0ff57468de7b5e80c67cb7360632be0a4de0759e2190d09d922cbfc55f2a20cc
MD5 b6439caa0af1d69b0f51f63e63e91a61
SHA1 ab1967174c6941d9cc29d4398b71974d057a72df
SHA512 30fcf7ef52d34d8e6b0dc105f936e1078c55bbf4f55bda5cc955f96775cccb65ea67d4e88d0926c0c1cdb847fb55e8c6e0f8a7d675761b6eae9f1562ee66adb7
SSDEEP 3072:Nttv3YFPNEGYx6KAMgzaV8pQFq4XKF3QPO9/R+PnMD12axI8gADsdBh6q:N3v3YFFElxgJasQFqT3QW9/2nMrI8pD6
TLSH
T1DC147B5AD29802C4D06E5175CB968641B7333C6287E1E3CB66C0F53E1F766C4AEEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4400-1-0x000001AB558E0000-0x000001AB558E5000-memory.dmp

Download

memory/4400-0-0x00007FF71CCF0000-0x00007FF71CDFB000-memory.dmp

Download

memory/4400-6-0x000001AB558E0000-0x000001AB558E5000-memory.dmp

Download

memory/4400-2-0x000001AB54100000-0x000001AB54106000-memory.dmp

Download

memory/4400-3-0x000001AB558E0000-0x000001AB558E5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads