b9515a2b1bb1551944118b0e5d6c31ad3212168d723651d9a942ee43c683de31

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 17:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
Size 1.1MB
Sample260803-vxfe2acg89
SHA256 b9515a2b1bb1551944118b0e5d6c31ad3212168d723651d9a942ee43c683de31
MD5 9fadfd357c98a8af33003245febda6ad
SHA1 412b3b10514100e0371047b2655c8a713fd5e35d
SHA512 5133b9628a9d8fe0e887de708e4a4c84c573b95433a3707dcfe8a1084a65dc1a0a04d6a4bc7597f6175139ec1742365d2be8c1125e0070493f8dd39bc716dd75
SSDEEP 24576:KaUlJbUT1iyp+4HZviS8pXnQ53pyOvzKxpSqHjrc5xaNIBemD:KaGWRiyp+45viS8pXnQRpJv+zSqHjrQv
TLSH
T103358D0A23A4419EFEA7F176D617C60BD7B1784A0376962F01A46B726F337711A2E331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\N:	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\P:	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\R:	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\S:	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\T:	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\X:	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\B:	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\E:	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\H:	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\M:	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Q:	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\U:	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\W:	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Y:	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\G:	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\K:	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\L:	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\V:	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Z:	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\A:	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\J:	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\O:	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 20 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5036	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5036	2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_9fadfd357c98a8af33003245febda6ad_agent-tesla_amadey_icedid_njrat_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

64BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
Size 296KB
SHA256 6a56cfb1326c954b04ed13a7dfd148eea04e1c7caf103196771b41da1f99bb8f
MD5 4b52bfd101374b56a8dc4a9050f0fe7a
SHA1 00471dfb850b24e9d9826194a08b76745a025b5e
SHA512 2c7c136361a65e59d930a29d1e4baf7051c7ab56311a01c457a13193e650e7dbbe631239f87dbd651d06034a7859b09ce28394b4bda1cb239f149e6fb7f64d2d
SSDEEP 6144:hxVDJXs9kTB6/+NSx/bxyeMcJtqQ1alNfqY:PV1s9FWNTcylNH
TLSH
T1F0549D1A37E84CF5E467C23989925542E3B178994B74D7CB6360032BEF636E06E3DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95875\java.exe
Size 333KB
SHA256 5ef51e869c7459c3bec33889a666dd5617b1c63672a62bc7a8225e2ec3c44928
MD5 60f3590d44df3764319c91bae91a6224
SHA1 3d4470f41dc087f7c28a2e1966a472860a09136d
SHA512 a8edef7fd89b0f9348857361217f24468a521e7c7d01404c0378ee1b3646fd5a710b534933d5fa19eebed7230fce5669dd47d61ac80f436e3ebf53ac89aa3da5
SSDEEP 6144:TtPNqBs93TJA3Kxj8hxG90VicP2YV/PvyTWRsZdLub:TtNqBs93TUKxqwcecPvyTYs3LU
TLSH
T18E74BE91B3600CF4EC67827EC9658A06D6B27C590760CA1F13E4376A5F773A11C3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95875\javaw.exe
Size 333KB
SHA256 fe884cdb363f654c8f941a511a6c424d8c0351232d39fb994e7f07df6ed398e4
MD5 2dfe07c71ef6497c6ada951710a53fde
SHA1 13fb608bf23d129f47138c9ea7d5074cff45b14c
SHA512 2570b7dc5be8baeebc80f2d52674b00424fa94d19e2151f850263ad183e3214761dbbc59f3c312f5757b63ce2e24acaa1af9dc52b0810690608f0dec3555487b
SSDEEP 6144:un0E4s9PbBuoNcxlrsqneJkGzdYutYPDvh/M+lj1eE5+/CFrx:u0E4s9PbBuomxlYweJzd4PDvhE+l8C
TLSH
T1B874BEA5B35048F8ED67817ECC664906D6B27C5A0B60CA1F13B436675F333A11C3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95875\javaws.exe
Size 540KB
SHA256 38f6b7498efbc451c31813b5d675b2b661c9050ed11f123159f715fa77c8deca
MD5 bbb2b36a115d9596bf9f56c21c23a9ed
SHA1 0ee8f3c5ec23d96b17463c853d2d11b6af39859a
SHA512 026e4a3136f2ad9104f7ef34f2a0e8f2b14c7e9bcb5d3f13e770c4f4324cc6856fe8666c6346a40be06ec2428e0ab5949a873699d439db5f36deb0960676d684
SSDEEP 12288:8miQyjs9W0VTxl22fvJq4tLbbdIvWz0dU9TTc:8tYVTlfvJq4tZ70dUZTc
TLSH
T1E4C47C90F3E414E8F1B78A358D764511DA767C9A1B71CE8F02A4661A1F33AD18E39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe
Size 596KB
SHA256 4994c1801de29a5f867c5691b6c5a02f4892ecd2f3dc0bd8a93e2560f5bb118b
MD5 461875182f39ab505667742121d83339
SHA1 31ed005ac64c388abd30cfd1d933af299ca44060
SHA512 0df60cd4a021b5dcc33ae9167c40c48de05e3a63c5ca7201296bb23557a3c37bc261c432dd3749684b10c3579b3428d0528e1d4968d26581d70b25a542cc1f37
SSDEEP 6144:Xes9R4gCWdq02vBFZbZLVsmJB++1ru4erNS+u8VK6GLC3FvGvu6SiZKsjpHW23pM:us9R4grQ0+BFFZvM4erNSHn++WDiiqW
TLSH
T1D8D4BF41B3E846E9E06AC134CA538542EA7378520F64E7DF02E492792F37BE55F3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe
Size 6.7MB
SHA256 c65dfb93024104393534990bf43880e371e07c7b09e73a6af7af224a87527fb3
MD5 c4e0226a30a32b81853cae98342053c7
SHA1 b22b997610daeff75c340efc92391b144b8e377f
SHA512 7d4c8b56fc930c4d5489dccf33707ba65506c3195f16fdca4a4f4761fb32c70a8e8dc6dbee2f2810096d75f2939d58996b34b4ddc203d9e9a531b12e06b7812c
SSDEEP 98304:xl8YfTaJ1+WTwB2L4HrZtQPIieK5M0uR7F5eKVb:n8YfTa5LnIiFUpIA
TLSH
T1AC666B47E3A600A8E46ED970CF2A5521DA353C8E57B493EF129476E81A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe
Size 1.9MB
SHA256 65d10c847b8a61d864778a02956ec83e4334a9f2468d25eb266a1a167b603c9a
MD5 488919c9db93db578d492b0cfcdf3500
SHA1 50096bb67aae900cc2d808351c9b1a388d11031c
SHA512 c452c545e0b8a83171619524b902db25c03e04189eca9aacdc3e3e652493ae25c210db8eaec7c939b0d286005bf9926275bfc54cca614d5bf2451c056f93858f
SSDEEP 24576:U+bPQJH/zU/xXCu/dKV1gF+B7cL2NLb9Ld25PTOocJuJ/cIsY6WfvH0DGYxnW:nbYJHLUn/dKV1g0OwpZeToMJseEqYM
TLSH
T154959C03F6D941E9E06ED578C7469536E972BC890B20B6DF0290B2992E37EE45F3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe
Size 1.2MB
SHA256 892229ece6460b522369a42635faa4db8a4414e2d35345bbfb5550cf73820a92
MD5 0b6190ddf0fad843cf614927a52dce60
SHA1 87547a9dbf89b889e97116ee3e01a72904847c37
SHA512 a5f157c091fa25287f0484161ac10d93c710815ade57cb749aaeb0c3281aab4ef9bb8c750216d9e317c08d4499ec28a939936206f23bbc8ae21385e390e34b0f
SSDEEP 24576:l/ANlXXL8vMOXPGaVr57RPxKfsQ7yaIVprS8mqmOY:l/65XL8vtZV9VPIUEupG8mqmOY
TLSH
T15245AE07B6D840E8D069D5B4CB568132EAB27C860B74A6DF06D0B25A1F77EE86F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe
Size 3.9MB
SHA256 f5b7626c28f21c1e0904abd56982e69d88012e33042b8b1fd1570f069582c71b
MD5 624d7684d7a5916a408a875eaee384b1
SHA1 da6c6bc0c414611046799c3419257ba3d0f57f14
SHA512 fa20bdbf1c34b3c567b45c5df9f6505e625a9b92166a8639d06840462b704fe534477df372eee915b22cd053962174cb0254b9d24c2f5a4a1a40aba806b143e7
SSDEEP 49152:IMonOuQ8GSftoSYLPSYyd7AWF0GD0AGFuVEusJ6LNzOeL0GKVIeCjIp26If2y/BO:YDBSFuVlcm7fwKAp
TLSH
T16C165903F29940D8D059C074CE5A8132EB627C8D47F562EF3694B6EA2A73AD47B3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe
Size 1.2MB
SHA256 e16ba8e398684b5edd27705130c25db9233c70b63bb42bfb5b8582a73828c335
MD5 50c87d402429b5b4271d5e42cba4c9a5
SHA1 53d38c5ec8700f08531cfc9b8780d0e975c76792
SHA512 2c99545d58ea886c5486aa2da4e3ea1311f6abbc7bb93ec6bdf6f9e9fb8fc0ec93217708b2ece17b0aa0085dd0a063d8e69f0ccb5070dcb80b1f00723d6e4d57
SSDEEP 24576:HaWNN9wtqFELXkeQmvvDXSdp/O722408m9NszMMnZqSaFCx:HaW1wkFgQ0vbats23NbkH0
TLSH
T11445AE07B7D940E9D069D4B4CA568536EAB27C820B24AAEF06D0B35A1F37EE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 1.6MB
SHA256 bbbc0e3b38bdeaac9617b0ec74198792ec0dd24f6921ca1d328a4413808183bc
MD5 faeead4f0d3ee857efa762efa451bf78
SHA1 dc94a19bf2f4313cdf4c68233a1e3ec50e3ce82b
SHA512 ce3b37633a8ccb7b44180d37e63800465111eba6300fb8e4f3c991de76fec566f5f9ae9f6823e75ce16d5524b3d6a55e68978a91b54ae58009cdd67ba40e3835
SSDEEP 24576:7YlaBCIqVIIO0ScXPtPpYqmCUqrDJeSY65NENlkkkkkkkl0T3gAQ8IJ2bDOE:sMBCRVIt07pbm4Djhf2PQXlE
TLSH
T176759C03F68A81E5D09DC278CE764B31EA717C655F20A6DF0290BA253EB7AD04B397D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe
Size 3.4MB
SHA256 1504cea9e15958016295778cb6c511f4fe312b127915df8eec03a0d9c93f8df6
MD5 a3947b854cdf94320c4c127ac22ab321
SHA1 60c763507dbf848694fa5281184108dbe4fa2513
SHA512 aa6f293bda259ca0249009618280955bb3673e20a901b07d4f1da0c799251d7d67a0b1c067da93de24b0a766645fb02078a027f3625ac06bde549aebc495be07
SSDEEP 49152:uTmCEE1IU7nq+qzSpu8KY0WrpUqMzADsulO7Udq+KqOuBk7bVnU7wF62JtYiNeQa:tZrwsul1EE4wsET
TLSH
T14FF54803E29900D9D099C078CE5A8632EB627C8D47F562EF3290B6D52E77EE47B39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 1.4MB
SHA256 cf25ffc0d2311a0d154577271f15a23fe444489d89da6c65df1c0baeaa0bcf30
MD5 66f8d7bd82d75952b8068aa0ba6f4fc5
SHA1 1018a845148cf0aa1efc72c5bff10e22b213152a
SHA512 7b911243144e19d59011a1b2e68f62e18c86c795523225f546d25014ef7a2e1865a785e77cf6993911cf2273b9de5ca55fde269abea44069fcbe6cf97e3db150
SSDEEP 24576:KnC8cgkxpIjfrXA3UILsGR4CXfVC07nwe1qRAcLfjBgZ:ACjxijsZLn28fVCSnwScLfjBgZ
TLSH
T12D659D03B29D41E8D06DD178CB568536EAB17C460B34A6DF0698B25A2E37FE85F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe
Size 1.2MB
SHA256 272c3e229a5bc96ed81089483066c5eff60f068a24ef017cf7f57223c7ba802a
MD5 0aeb4d0c608fb5217a5c725cec6c84e7
SHA1 9dadd285b684dfcad997b5aa68b896247976230e
SHA512 334684d2aaa27cf93417034aa78959bcb709d21662e9bdb9d0de901109364c3fdc72e48293bc1b9e461a512f625edf4947bb56cecc067b737fe086815fe6d980
SSDEEP 24576:vwWosuYWJUoemXCB4gck2VWAD+j5yHB8k:JoJZJUo24hk2V/D+jKB8k
TLSH
T11045AE07F79940E8D069D574CA668532EAB27C420B74A6DF06D0F2592F3BEE85F3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 248KB
SHA256 17577d23038dc67690880792bf2a57196e99e6adaeaf5d5f961e34bff7aab901
MD5 1a4524f261af8462d07c16b54cf24612
SHA1 f41f4b923fc0f6e63d58b6c03fb1844d109d1ece
SHA512 9ba810fce4c0a85d55f16f06cbc0827d7ac9df272fda29fef6d49779879538d59b7154ea3fd1de7feb012dd323722b82ea93a081b609d1e8a12dd86bc66534c1
SSDEEP 6144:/s9pInFu9lXIfbIy3OR/Cuoh0LytHQz2J83sOdPTLSp93fkv:/s9Gn645ORonVQzo8cOBTWp9Pkv
TLSH
T152447D6536EC10E6E07791B4CAD49503F330B8B717218E7F0390466ADE67A50ADABF36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 265KB
SHA256 a646a5e7f5e8349134603990f5fc4bd71438296914dbe7e5adf941ea7176f9f5
MD5 e9306bd5a8c9f68b3abc29835c1184bc
SHA1 408a72fd4b3bca8cc883be1406a3b8afca018129
SHA512 7ec578687640c12172c13c38ed1a19d508d741e768fb6ecc71a7a4bc46ed67f9c8ceaef8b8835903fda77a95e876ee09fd1e97f5df89d625672247ead7ce1de3
SSDEEP 6144:8s9g8MbROeraLpBTTjzUYWoht+uoZ2R1r1iS:8s9g8KAb/UHo3RD1iS
TLSH
T1BD445C6925FC14F3D1B6D2B48BD48903E234E87667108EBF42D1835A9E13A916D6BF3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 610KB
SHA256 754f0441bf228035ee54bdb45e27bdb0d44e685678165d95af8fa79c3c7d34b7
MD5 8d55a0c425ffdf55a20800e73657c788
SHA1 14efbfc64a90ffc4ec8563ef37a6a58fa792ac61
SHA512 2f2c86f9059cd7bcf45d446790a656e2e82ca635215f0734d8aeb020320a285bf5b2c0ec3120076e31df151cbbfd3517566c0ece79336f613d8a3f2041df8d8e
SSDEEP 12288:tEs93sVmZFJnB2PHVlsBSRrO9BhK15reuf8x6NOTAAOd0:t/sVmZP40SO9BE3eK8x6N0S0
TLSH
T1EAD4AF81F3E847E8E06AC534CA528546EA717C960F60F6DF02A4527A2F37AE55F3E314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
Size 7.2MB
SHA256 e8bda284219a38ce261540ffeb40ed51b3638136466fd305b2c103899db751c8
MD5 cbf459caa29c67e1630722e05a96657f
SHA1 7e1a4055fb78dbe561808e5ea9ca2e81097030c6
SHA512 0248762fee1a247fd82182d04df00a34bf4db90054f2feb3b13cc6d43287b61c728872055ba5b3bfbb56805830c5dd03ad7de53f4f52f65b4b3cacef8460d078
SSDEEP 98304:g6CZetahq+WZrg/wCsJB2++fGyOxRj2vJzRN+T6frnnJ:TCZetaKCGIGtxVqzRdDnJ
TLSH
T143766C07E3E600A8E46EC974CF2A9521DA753C8E47B492EF169476E41A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe
Size 3.9MB
SHA256 60db7ca8358428e774f0a5675d10982447963af2784761ed0a9b30dd68327780
MD5 8eb95d042cfee007549af99759f2fef6
SHA1 a7c56323df5fbaffc9d72981daf81b179e1bcb21
SHA512 529f04f65fd380ca5d99dfc9d09d5b55360f3dde530f61850be282a498c5623b9e68851ef53df6f943d2147125f7071a5a7357da8e4ec5c2e7c438de51bc2de2
SSDEEP 49152:XZrdsVBsyh2hytBPBbmhLbKqm006NPpIupE8Vu+e6NqcXToRzvUqIzYHBigdQBSp:zsQgyiBPhmCCxNUhIUBbdp
TLSH
T104165A03F29900E8E05DD5B8C7568522EAB2BC854B35B2DF0650B7522E7BEE4AF3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.3MB
SHA256 48d4a879be4323386a582c7fa33e47ebb18deb6901e28d730474608dd3e8296c
MD5 b15e66b3bc8901c2cc0e15d806a0b348
SHA1 658bed940c2d4773c4a6068f3a89a192ce38b540
SHA512 319537abbfc8f610ad1fba7c416cb94657652cf07c9087d10e79f39e79d289efaad75322a08cc50d9f3487cb29f5bf8491852c87d7cc5bc9df6941c5a5de1120
SSDEEP 49152:8SgnEpNEADwwSSIYE6PstBhuXjfS4LWxnvRQ+:OEp6MBjBkRl
TLSH
T150B58C03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 1.6MB
SHA256 248e807ad0d91970386e7232352c013a032ab141e1933551109065bd1d2d6915
MD5 1fb1599f68ba021fa4a3ff4a6706855c
SHA1 f340e758bd2540c30d94e742d73a0d99b395adea
SHA512 245f18dcfc64a7d2d245ccad8b2e6d47061968efe5118fb2fe202eef770aeaba65ffd40a59a967866ee61bdf4a1b01c4c8dd210b3e61f81379cfcf0d5ca139c0
SSDEEP 49152:H+f8vl9hTjKLeoCf7hBOpUQTlXrk9dBTR8:eUDyGQOe
TLSH
T16B759D03F39900E9D059D1B8C7568936EAB27C450B34A6EF0B90B6552E3BFE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.0MB
SHA256 3c76f2276924d66609ab61c0c3131c32ac65564b984278f1452ca7333d9f738e
MD5 45ad137ea4bdda48aea500fbe2cd121f
SHA1 3fc57574926337f50fd75715d2668e0f46b17d15
SHA512 8f828b8b3f00e163edbce8c5770a3cef585dacb1a57b411592ba6ac118d12cc79286f87bc0f826a882f8aaa47440e26a8abcb9d88b0c885cd58981ba00bf4eef
SSDEEP 24576:VPa49569I9v7dzAEIuOYGL8ldJJ5Qs7CtW7KSdHBxmRkkkkkkklQXBysWA78YhcF:Vx9579jmDYGL8l/JSZrSdHBAVfRcF
TLSH
T155959D03F6DA80E5E05DC2B8CB368B39DA717C554F20A6DF0680BA652E77AD05B3D394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 3.5MB
SHA256 760611dc6b48939acbe40d9d6eefa9f45d0878701df49fbeb168d9ddba4dd892
MD5 94bb1a33c1f8d9fe1a0bc39acd8c3532
SHA1 dec0508f57f3dd940905c18b990b40a8e957b46d
SHA512 1f9eb9078d0cb032e9e4cf85e3cba6e75c1d0deb1a960099a8304ee8e2dcd53886bcb97f5ac2cc1dcc17f808b2306c9216ad215be732dfbcbf3c25c78a8458fd
SSDEEP 49152:6ubSPTLol2hng5aEY3g8wK042b6YErVz4AkOuaRoBISCaQZCLlrrUs7BFm2:KtgsKKUPOnZE7bm2
TLSH
T14A064903A29900D8D059D078CF4A9223EBA27C8D47F566EF3690B6D52A77EE47B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe
Size 1.7MB
SHA256 0b2fa44c283a240e2726a1164ad43debd9d5e4bc8b28a7a76e1a605bfebdb11b
MD5 b3133fcc071b6023f1f83c113b23d4d2
SHA1 0ca26bfb731ce76b9a0a41fb783f3a725d6cae94
SHA512 5c1e61cd3127efcbf1c04cad76f3e4a30188dfb391886ab26ff210965c5efe09979aaf18b613b4414554ae9468040396248896231dea8055b4bfa16af05d4a7d
SSDEEP 24576:4Fmu896NSMtLAEsluuKrTki6JLTG5Sb95eQuJXlPnyF4mfHU9YawsNp0KY:v98DkSTki6JTG5UXeHX04mfHIp+
TLSH
T13A858B03F2D841E8E06DD2B8C7468536EAB27C450B34A6DF0690B6562F7BEE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Size 4.1MB
SHA256 f986a9226b402096baf58016590383ef83451299252b7a1716fc8d53b6d2f67f
MD5 ae175796d788a3de3890a7b7c9abd254
SHA1 7d0a556f8f9c7640845840b268571514d8c1297b
SHA512 6b490122b3652ff03cb358c47ca992155e4ffc5dcd6b07775a9724f433f2bc39533f6f2e4b98cd242ac5df3e924dbe38ce7bfa383569a4de0e561164f327206a
SSDEEP 49152:Du85Sjn9dze4jyHLPK320R/Ts+TjEOzExldDwUIDtaZHWRdpev2y/BasHsS:ZRF+dI/d+RaAsMS
TLSH
T18D165903B29940D8D059C074CE5AD233AB617C8947F162EF3690B7EA2A73AD47B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
Size 1.6MB
SHA256 a9cfac03fec0b7bc2a71ad0dc0caa93aedf81c3f1968f03c9dd29ffa6b1549f1
MD5 133c14276edcc967968e451ffcbeef29
SHA1 5159340b984da0e58efc10d35d7202a354bbe05f
SHA512 d1507962cdc4eae21b86d65e255ebd00a399f06f62d80bb9b617f436bbb8d598c98d4b3f4ce9b71c3ac85e64d5369a5af3b4b77c9c63fe8bebfaf27ea52f41be
SSDEEP 24576:7zIzcw6r4Cp8mcFdu5uRPgeHk8RYvekW4L1oaedpEukUoygGmq/SNi8dnP:74cwenpv8dgeH5Rce94Bo7EukU1pUP
TLSH
T154759D03F3D801E8E06DD1B8C7568936E9B27C450B24A6EF0A90B6552E7BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 1.5MB
SHA256 2d527fa59a205448e87d77b4a9b47f86d4b38c0047af961b174c86270080f765
MD5 7521d84fd53769fe9f2a6a3cf9a33f9a
SHA1 12ce46546762e1b92d2069d7706b19cef6605460
SHA512 58f10acd0b616cd547a2920d71fa05165d95c23bf38f9559beeb99f67135522a12393b2cf5f76531a5ba30a84b5e98648423c7ff7f9448816be4e9dff2e525f7
SSDEEP 24576:Odom2d66+RJHCr+1afuBVHlOC9yPxKGsVa4i6h27d3Wlpe8ajc8bg:fm2dhqkCrVHlOC9qgn+6h27dyy3g
TLSH
T156759D03F79900E9E05DD0B8CB56853AE9B27C450B24A6EF0B90B6562F77EE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 329KB
SHA256 20291646c63a0f389f63cead7e974ab133649f88fbd30e683a678087362fa71e
MD5 4816ba69246aa61afd5de7ce1aba3845
SHA1 f86cb60036fff4187da16d90cccca67e4f7a9d04
SHA512 6ca8979b779aece34dbc430ad17890f735f668899c37d83f1edd1fd3d250a641b072107db1599b74682f2799f313c357187b60796d4bbab5a0303b67238e91dc
SSDEEP 6144:nZqs9Rv0M/SBq52coV/P1oqG2lRDx1/iJPsfUrcAdBGNoranrs:Zqs9Rv0M/Sc5tk/U2lRP2czAdByng
TLSH
T1CD74AF24B3E008F9ED6B427CC9A19501DA73B8518760E7DB02F485761F277E85E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 672KB
SHA256 c394e2803361677fdb8cd27b8a4cf24eb84cf2263132f8a71a36e90e6acfe4ec
MD5 b3c341e6a4186d7748c5e59bba862c84
SHA1 74ded6f09e45c3897b3620ca3f115553d06e32a3
SHA512 c8c25cdafd7fd6f1fc7c42d3fcf5eee78734719a1cae0dabff9159a86b5ae88a0b037a679b213ebce7d6e4f809dc1e0f05020532d1b35b64394f5ab6eaa499d2
SSDEEP 12288:MNnkOVPBOU33KACWsOMr1s94rHsqn/Rm/uMF+u3JP4C0KKC:0JPBt33KxrvrMm592r3w5C
TLSH
T11BE43A26F6788331D073C0B9C5D2A69EE97230865B308ACB4286D77C7E677E68536731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.1MB
SHA256 23868a0f55ff96fdc89c23a3f02d79641819d150ccac11560ed8b6d53db9acd8
MD5 3442813c4a2ae429553b0cd7a1a7a106
SHA1 6e0a205178c5eefab959c99d2141df50c04f26e9
SHA512 305fd81999497e1f74a2c47f2f7f3fecf8bc2a8f16bd1125ec12ea07599e87f02aefb84d0d24b8ccfd8c216dc257f73913cabd44f82d69063d67a5d829d555ab
SSDEEP 12288:8/vaMd/uJlgezSCZv7+tqkKyjKi5jghpSy1TIPds9qTmqCLwKzu/yIo4pi4Kq0:aajOezSCZvagFm5jgrvWR6q8wyuKYUdx
TLSH
T11B352A25F5788323D0B2D0BAC5D67A99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 840KB
SHA256 2ab7f48a5d20940923d5ab9cac8031eda67bce3d624c0860b537f80f9d20f0cf
MD5 3b587858d64d9bb21ac0a1ae2fd128b8
SHA1 d0188d27a8d5a951f2d62bae3a9079c1d79fbf2a
SHA512 7e12ad349945776877e708c330bc7889ade167bdef18301b3b329dfc7ce0462b488c314e82d99dd9e8bece0cb28473b091f40e413e7402ad16b59322daaeb084
SSDEEP 12288:d/cMBND3vx+jQiDaJjYyswsEW0Wdrbs9Pf0Im982f6N6O1sk+C:d/XNjx8QiUydr+26Z1/
TLSH
T16C055C66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 350KB
SHA256 db75e47db7f4e57dd2655de88394016f86ea6f415e538041c24130d3babf580f
MD5 596fd251610a189f212fcd057ae5b1ac
SHA1 f57d22ba3a44177600cb342497005b88eed58dc9
SHA512 7a385fed3caf6cffdf1606a0bb6c8f1592cc833d3ab3df70a87264c49ac886c0f27e3ac2ef60b49da7ca907b64f3967aa69b9b095e0baac6748c9716123f1a6f
SSDEEP 6144:J6sOCs9wBJ/GKWWBNU6ITLBi0qttclOKgU91Bmk/2h4pWd:Rs9heBNUbTVO86UBE4Ed
TLSH
T1C574287BEE28FCE2C67E4DB85A918600A77274704F52A3CBD175820EDE235D05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.3MB
SHA256 f62fc653c79e5c72dfd1d86c038b479629a3ed9b904e122fa68ede3d1ec579e0
MD5 3e96833b72325c2162a05ea2bfc6f9ee
SHA1 5a367b74518e7ec16f8314b25dc69b4c844e4f8b
SHA512 25aa33e05dc2b7359688ca78d75b682cfbd9004084daa5d30bb91d8a475cfd983fb95c462df3dce89d5d286b453bf018474f375b7220af4ebedf61d10df2235c
SSDEEP 49152:pM0d9i6A3vr7mxss/XpjUNR3yLxdekwzd1KE7k3NeuPcicBi0eVozCYQZK8NRV3l:pMj3WlXuiLauczxQ35Cntw
TLSH
T1EE265B656BF880F5E0A7E138897AC6B2F7B678520D31EB4F0191C62F2F336905D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.3MB
SHA256 944dcd2480afac9a89c4e31e070c04f9bcd384c28c7b374f1d21784799d78cb6
MD5 ce16ce6ca366cce06efa80e788ac0142
SHA1 cc5904a9175e31c98cb6b1acadc325ed3b47a540
SHA512 0ae5796132c00d46a4090203ada394328ae2f41f266598c8f502546c6999fb9fb6ad72193d9606c867f87fb5f47f93a0e91c4e071bd0c643a0c25266a41e8d49
SSDEEP 24576:F33KS3i3r2z+L5WqTrHCYRFiV+XenmE3Pnzc3446mH8:F33KS3i3r2yL5zTfFiV+XenmE3/zp+8
TLSH
T1E9B56C0976B8C1E4D1F6C77886A2C647F37178154B34ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.2MB
SHA256 17a3b1acad5f9bf00ba8cb44c399875cb9f020946f577f52c5bde829eab65a76
MD5 d82cb6add4ecba7299df415b02c81eb3
SHA1 dc15ed4a81b005e8bdc87faf3969263eaf77c57d
SHA512 5c9abaca3039c7e9df4434b9b65054abd7bbb217f21ee4b98a4f6a82e95b1fc59c91d341dbb8aed6752cb6138f58377faa3dcc6c138ce0ff32e8159087e64aa1
SSDEEP 49152:5jpmooLWjvXTWp3DJf5SUYLoDpgLjSTYlQcGeRAaLSF259ruMHwpXMi4FqJLd234:a1RQyi36YOcPBLvw2gAf+PN3ALK
TLSH
T1AE666B03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 f51e4267cf8a5106d0fc088b50dc674c635df08c13140b40b97035c2d1c9a6d3
MD5 60911e4cb97224eaf8b06cb28f554761
SHA1 e4258645f29b80dd69a771cc14bfad37ee08c5d3
SHA512 e93e7168ec9fe535d69f1a203bff27f2a75ab3f4f1295e47dc9960981f3543fef59a9a70e5115eca1c7dbf9f6fde70b053e18aa3b1f2b2a0735ab2444e326e6e
SSDEEP 24576:oSvtx+eznQIrHpdDboBBdbwE7DaHGTNHu7PNU3/5W/ohL0mXa3V:6erQ6eDbteWu7PNU3/ZKl
TLSH
T173952733B2F600A9D44DE1769F4A873296D27C718FE0D3DB815172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 3.6MB
SHA256 0972d375eec8b888a05b3a3b60953ee5ce38e3f08180a6b28dd616afd075377f
MD5 9708b33cd37838cf057bf2715fdc5999
SHA1 2fb3b787e0e969cb2556326b3d1468b4f99e1a1f
SHA512 b4d0ba6840a9ff88c85742f3d4dfff016a38bfd85b2f6918879f4c58702933237fb79f3920c2d4fd9d6086c759e5410afb070cbeb0d344263b899f2fb0a657e8
SSDEEP 49152:yh9LWeDS0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbIN3Oh6tznm2FQ/nho2qkrk:ay5112gYy5azzVvH69nLKnhZbd4H
TLSH
T13D067B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.4MB
SHA256 039f79138b9cbb598f0e745100b00c3602919b2648d9f7011a9c553bcffb4ed5
MD5 a9788d86ddfba0451cfef3fa4b1bac9f
SHA1 f03c065e9f65741722cfd9b59b6eb9bb87bde0f1
SHA512 48ee201bc46732d5bcd27d71cbb391262341b0e64a629463070ffe727d03249bdf6998fe0606ea7f6bbbddea3354b581e9952c00411152befcf19ab17a25ffac
SSDEEP 49152:RItG3ZZFecmyOBr4tEGq0bqx0z+n217aau1glftd:+cejJmsxd2dld
TLSH
T1C1C58D13F1DA01E8D05ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 1.8MB
SHA256 86429267dad4d30ce01ab1ceafb722516a4d10d9d1d40f98f0507eb3348fa997
MD5 b1340f67111c4f8ac24a5611a7985355
SHA1 8f7a481c2a4229fd65c20fbafe5313312cb507fb
SHA512 528f9e9a411f568e44f32d4c02d5bf74e0755d4e15b263dd4eedad6d9569acad11425d10aa104c0a2199f2ec7ab31dd6dd2ee45c2c64dff009bb190f90fa76a0
SSDEEP 49152:CYShVa1PoLGPbVAKU44CwH7R4xXM2vLMvL:a0TZuRoMz
TLSH
T14D859D13F2D901E8D05ED17887569232EA72BC460B24B6DF0A90B7961F7BBE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.0MB
SHA256 b6ade98771dd437fdc69f6cb7c2c781c8823d31a253a4c25e7fdc8298bfdc1e5
MD5 9712d3052b3c9cb657c65b6abe2c8cf7
SHA1 293ffad1529b7a401ca6780579692b7b55338ef3
SHA512 a3f4e85f4db041114719b75a81bbc5fde0ef4822c8ccee1a77953d219a7fe9916b32812d20537b9adfb124af87a83d3279082fb64d691e79e99026713cd6962d
SSDEEP 24576:VeavQu4zpbbQTluhAc51Pa/RiQHWx9R04FxGgVG2Onks6xt4bSMHnq1wf/+zBY7:kDpvQ5NHiQ2PRVtOnks6NMHqOf/+lY7
TLSH
T1B9A59D03F2E940E8E0BED67887669632EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.2MB
SHA256 c35c57e4d7867f25b8f691d49bff0f5a46fff0ae259bb9e485d62cead378a612
MD5 fff00040f5b966e4716bb9c2cadc8dc6
SHA1 81125438ff0b446e7dd9c5fd18bbf08ffb968ded
SHA512 0881d6191379da2a357afce7d2b902e17638e19699f06c5edfca757091c183e8fa311e50c86034d7bb6c3fda0f7e1f0cef380b018fc3c9b23064726842f76cdf
SSDEEP 49152:k3Q+J3Z38K8jPjLAE3dGGj8b3EGcjesaNkYQd0XNJKcvaAcPTY6Y5AYL8za:eRkbvjCBDlZJ8za
TLSH
T1AAF59D13F2D940D9D059D078874A9232EA72BC494B3166DF0690BB562F7BFE06B3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 5279e9c3f325b75d6a6ee3ebc9394a98eda6b976e7922d2994ffe2f6d202f05b
MD5 91f74e26beb2b6466aab2c0078a22613
SHA1 79f1f5dd73e0d590be92835fc98a740aa4a91742
SHA512 ae8ef6101e7803cfd8fc37d49e6b16fdb702d8d71dc8f2eacf2277831f35bbee25d0d04a9ef898de7bb81ff59e816641a35704c06611b9f4fcb3d67051d994cb
SSDEEP 24576:B/ovjjUeypEv1nh7+yUgF1pOoi3iy9CTn0AP5+2QLNDIWe5jCMg:BgUjpEvNV1p/giDn0AP5w5DL
TLSH
T1F9759E13F2D901E8D05ED175C7468A32EA72BC160B34A6EF0A50B7561E7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 333KB
SHA256 a233b366ca96b5028eef29349f6ff2327949f5b204ad238c5c4ee92e811858bc
MD5 95d1fc56d5dc1fa25d3dfed6362cad53
SHA1 82e773b6b35d99528888dc28d923113d5770753e
SHA512 fc652eaec106c7a5e4b7ae7da8168e30fa7312082f0a77853518ed153e20dd5355d6549f3547100960b57275d66d39f9ed2d26d9510d67e077c16b8e32cf9bd3
SSDEEP 6144:JAPdjTs97JVmw+jw+Tiw7LyuYYV/PvynwRHIFTBn:JcdjTs97Jow+jOjcPvynoHcTBn
TLSH
T12274AEA5B3901CF8DC67423DCD659916D6B2BC590B60C65F13A8362B5F333A01C3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 333KB
SHA256 4a17138660b38068ed101dd0f16b17a7ec81a5132dbbac82809b324dfa037e87
MD5 3e46ccbe8b4c3cd13df422dd29c2fda5
SHA1 a436ab6cbc746bedbc1a32dc995a8855764d4138
SHA512 b8bc90a449944f4bce4404b02e9617b69db179d281ecf349ae93a05d0b5ac31cda5f8841ec49a68c536e02d0d1209edf8fa2e16206ab84e173464386a2d92c40
SSDEEP 6144:KrU2as9QuvD3Qej2FsZ5nAvgzVYutYPDvhUsFgxCFVm:KQ2as9QuvD37j2uznRzV4PDvhB+Yzm
TLSH
T1B174BFA5B3901CF4EC67417EC8698916D2B27C560B60CA5F03B836675F333A11D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 540KB
SHA256 34b65b225c1ca2b9e4a6921263e39078459b4f4aab7ccb05c829ba73f2a1219e
MD5 69169011790f9ae6a203e3efcdc0e66d
SHA1 515f3a7281d928c0255075482aba07daf69995f2
SHA512 a029023f59aec5173f38f83fb88d413ce034824b28c9ba96b4ef948d71ed2c19683be658c95cbce42a89fe4d05dd5b01aba4ea3684e5c3b2362dfa69edda5116
SSDEEP 12288:xWknIQs9d+nYyl6o8fHD1qLbbdIvzhwD0hdV:xfvnYs8fHD1qZf0nV
TLSH
T18FC46B90F3E414E4F1B78A359D764511CAB67C9A1B61CE8F02A8255A1F33BD18E39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
Size 333KB
SHA256 20544f83c65b1a64af413104c43384b85ecb41195ea1d43446a3408a44d09d38
MD5 e45b61756786fa6fa455d029b6bef5f5
SHA1 5b44ba753d16c6bb2ed4ef4e5249a2338660b3fd
SHA512 02d9c6fc76a0699cd6c5ab7b511926cba4af8f1dff27b6846018979a4733ce167120ac7f945d68d92508fb9102ff048bdeafe1caea70fe98d57af82d77bf9467
SSDEEP 6144:NeP6WSs9L067ifjc9IMai8wRgYV/PvyJBDjrSQ207:Na6WSs9L0Mifc1GcPvyrDjrSQ7
TLSH
T14D74BFA5B3A018F8EC7B423ECD554906D6B27C560BA0C55F03A8372A5F377A10D3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
Size 142KB
SHA256 0d1354e6c7344830f652eeea012bb1e6ea7250cf8053bc5a5806f245ce670a0b
MD5 fa6321e9297456e75d8ec364ad75ee8b
SHA1 fc157cef8be08436b5e96b541fb11064be53e9e6
SHA512 ebd6bef728a595240de06accd285a3fba8ffda6ae6c3c6e6f4d488f1017719f9eb11f844c7d414bf795c8d611d6a308c5983a51a611d65ddb70aa1ac98eda909
SSDEEP 3072:qU39ljlXEo43udtjZqMNbjuxtCoxs6NvAuOHUWVE:qs99lw6vvMAuO5E
TLSH
T1BDE39D61B3E82884F6738E32ACB58C3159BB7DAD5EA0CD0E52A5310E19737D04479F7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
Size 333KB
SHA256 a1f302b6792942d9f2518596296d2542a00fdf3c11ca8226722cd5a8263732d7
MD5 487fcc757db8c43f19335007829d5165
SHA1 0b31bbee307d5cbdec43d745fd618c7cabcc7698
SHA512 724e3abe3247fbdff64269eb1d38695420d5d5a485c7fc16bda7b739b4f7cc6e7618d04a6fe960e6f37d3afcc20a482e0ca5ae8a84e0a083fb2bc53abb01363e
SSDEEP 6144:apuCbs9tcM98D94ujVskoYWqHzhYutYPDvhfKVCE+bP6W+r2dw0d:a8Cbs9tcMyDmuj+NYPzh4PDvhJhd
TLSH
T15574BEA5B3901CF8ED67417ECC555906D6B2BC5A0B70C65F03A8322A5F333A11C7EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
Size 540KB
SHA256 587c8e6510b42c17f20ab59773477c25d40044f814d98fd0a0f40d62c24e7306
MD5 8f045e77014c88c6a1deac35e8b4d0bf
SHA1 b2682bb5b054bd76f72632141f51e314c522850a
SHA512 950641dd20f7d3bb4da30c1f34499fb35ba9c4d12ffb0e0d174560e521b478a9fc9bf7a270be06cf611832ee605842e30d163f3c85f290f3fbc44db606ec99f8
SSDEEP 12288:Nd+K1uCs95V6ONgMBcYXPkyLbbdIvnA025:vVu6OVcYXPkyZ5j
TLSH
T189C47C90F3E414E5F0B78A358D764511DAB77C9A1B61CE8F02A8265A1F336D18E39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
Size 195KB
SHA256 326e3e09715b19bf63b0230ce64ed9aff417119ce2292fff3175cf23fc68c987
MD5 4711f2f88c185252709752a143e027ac
SHA1 95e93f480f92c3a085302b31260856f1aebdb5da
SHA512 77db7da403d188d6746c4d1f15e48526add8e42b78f53adea4498d5848abce3f4878e0bf5deb6984463d0909e69c3633ad1691cf20c1f0a3eec7b6968d714f95
SSDEEP 3072:pRKExJtlYee4sU396Y5DEmd/MjgvhagI/f1OFOPqxqlXc10BnXCc:pzl5Tss9p5DEmdggIn1U05c10t
TLSH
T11D148C4033E910D8E473DA7998604901E6BABD651B61EFAF9384305A0E367E1EE3CF75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
Size 138KB
SHA256 443d27428dcc4d4cc535e5cf6c97f0d9fa2244158efa04593adc46946729ad41
MD5 1c611c5332677e2e5baa24eb697abf97
SHA1 98d0446bfa4d7f76d7dba18cb27cb9acfb45d9e6
SHA512 433bd32e426638c1100476548f2a743bb8045596a04bbf5c5bf55be9d0b39afbeb4fd65094cd251b0b1bfa694eb6a492774ef7d0e4261ea4df3d665dda7476d7
SSDEEP 1536:MbXQb8FVvXuhi3ug8Xjb28W1VLs8h8Us8h8Zs8h8ise8MJ2zf67NYPxjxxQZTGGk:MbQb8CU39K28vJEisdBziuxFxtGYbt5
TLSH
T1C4D35B0163F904D8F5B39F71AAB081558F3ABDA15921EF6E5350820E0E76E91DE38F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jre-1.8\bin\java.exe
Size 333KB
SHA256 66a5570bff386471b6722c5fac490548c229b35f369b7d6863ce08f3bb9c51bf
MD5 485a3386e93ab8bfc4f5b252b66aa91e
SHA1 1e9134359c4a88b5d8a7928033801d977ca240ba
SHA512 bd4f24a2ff4886ec2cb3afc588f7bf4a832084b3a2e7ebd6666f04bf09aff5ad1df8aa33310a89a0e4f6706809ddb80bb9669dc703657b4f728270347ccb5164
SSDEEP 6144:TlPqU3s9lP0ZCujo8cIjmg2tUYV/PvyR7Kecf9:T1qU3s9lPkCu2XKcPvyF/cF
TLSH
T1DF74BFA5B3901CF8EC67823ECD658906D6B27C5907A0C61F13E836665F733910D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
Size 142KB
SHA256 6b6e5867a4eb10dff2ce9596d0c37650dd858c49a46634ebc94e2a8ceb9a2ec2
MD5 1c5c07e206ce6fd315672d3f1b117db3
SHA1 bc9429a895c7e66174a2ed44b7e88a4f87dcdae6
SHA512 a31cce9c57f7abb4ec82554d81b0825e0a41d7b3255155c0a602f2f6c4afb71597dd7ea1c54611fe4570710adcc86f8303645772d7e9ee25689753ce2a3fa208
SSDEEP 3072:oU39ljlXEo43udtjZqMNbWwx2NwxNy/KwKQ6DPwvle3ljlX:os99lw6vvWm7OKwl2INODX
TLSH
T1F9E38DA1B3E864C0E5739E729C79882149B77D9E4EB0CE1D6295320E0DB37C19439F7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
Size 333KB
SHA256 b8f3a12b7407375cb7adcd8b3c48610623c40b41a8e1500935a1b3e1c5a71f56
MD5 d30151d99d16d52d5e065c586197aa66
SHA1 bf4ea09779353cbc7e416b8ac2007ea5a0538d4c
SHA512 eb1c94b1751ffe5913fdaee7b83b55f39e354447f2778521462249ba616fd52922acdf9cf7ba85f0e4f605938022781a86ea5b1600910e527b9b401d91bb952c
SSDEEP 6144:3NODns99JyvUPZRBBsYeMgilz2YutYPDvhwX+2hmyL7ojOg:3oDns99JyvURRBCrMHz24PDvhwu2hmy8
TLSH
T1A574BFA5B3900CF9DD6B413EC8654906D2B27C5A0B60CA5F53F8326A5F733911C3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
Size 540KB
SHA256 c5406e86fc4b1aa2a10fb9c4e2595b87c375055187ae43f8ab3d4b6926d328d5
MD5 32dc85d11f62a0414803a7bb7b7be1ad
SHA1 efc69ac82bc74fcdb590e9dbfaaf1db7264cc750
SHA512 d4fca48940bd7e8f21b27e8a68b41f77397bbb660c8008a1e78d942e64ac9dfb38994ee1f83336a0b433ccbd213c015cf8fd9712aa098faee03097299a5f31db
SSDEEP 12288:H0/E3ws9IcIiLw/o86Xu98LbbdIvWAn80b:Hi2Iin86Xu98Ziv
TLSH
T19EC46C90F3E414E8F1B79A358D769511DAB67C991B21CE8F02A4226A1F337D18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
Size 195KB
SHA256 74d82d6dc389e0640a8202e8830b0618beafd9dc559ed60b266cde791c853fda
MD5 5cb31efa3959afb06bd4242157f682ad
SHA1 4c9783dd92c97253a47b881d3f33521077133e8e
SHA512 0e6ce4d2031e6488ed1f1ed6a209a99d4ad8068ba0360efa9df03d65b9a2598772bd12c98ee1c3feea50cfb4f685a34fcd64de82bcbacc43fc6fd75d71b5a1eb
SSDEEP 3072:GFb1x3t3jjPvZU396Y5DEmd/MjgvhagI/f1OFOCJGxUIpIljUERZB:G333nZs9p5DEmdggIn1UntITEPB
TLSH
T180148D4133E81098E477DA3998A04641E6B6BD621B61EFEF9355315A0F3A7E09E3CF31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
Size 138KB
SHA256 3bdcf5e2410958a8ef85ff9d98e06c157fa71133bf985cc681a0926fd1e4b72e
MD5 ea9a3914e3cdd5ace0b833ea960aa471
SHA1 f12190bf509254cbd31671d9373f0416165fa36c
SHA512 c74aeb6d333c472154989d441ae3884760bc78a8ce962bcdece54a5d03cfe9e01d31ad1cc8c170fa0d789ea8ecb6768fc55629e040920868cbcdcf08f0097cd3
SSDEEP 3072:a0Qb8XU39K28vJEisdBzYMsxYN1K0KzGIjsF9SjEr+L9f:1QYXs9P8qdBpvN1rAGIjsF9SjEr+L9f
TLSH
T160D36B9173E80498F1778F75A9B085598B3ABDA26E21EF5E5380500F0F39AD19E38F31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
Size 4.3MB
SHA256 6464c4f36c0ab602b18e5ba2b9effa2e3a15940ee8332d857b73f23d283da5c5
MD5 886e002ec42d4ed4156e51124a23a73d
SHA1 3dfe643f56bd998a3343874e6a47f7b269fb36a3
SHA512 dd804593d422406100b7474c2ec770f49d411b5666d75c1a0ac80d6d7ec702fea0f5bb3e272a53df15ae2e4f46cfd6fdcc7c274b2fa1a77089d60f3b59b99586
SSDEEP 49152:NGdZCNzdt1A2K2fu02O8C45wyLKdWVik3fUqb3YeuRs2cuFgM3MNSWoe8NRV3THb:NGkto82HhLejRMMWC5CBxU
TLSH
T1F0265B656BF880F5E0A7E178897AC6B2F7B678420D31EB4F0191C62F2F336905D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeClickToRun.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
Size 4.3MB
SHA256 06aca2afbe17c9addc92e71df063a0f799c7f1f518bd849048002500f757d8ab
MD5 eb16eb38a45bae45a16b3dcf0630571b
SHA1 4ab3a1da908a19956b5b33f9a742db1edd1f7fc3
SHA512 8f0fc54000f9e6eae42051c16b99787234287b0af38ef6ab3936371c0bb45c02af966488dd64a0734fbd84252cee92b8e244fa84126bc47bd55beca04a587c10
SSDEEP 49152:rzF8khPc76vEmtA9fu8vMXk9seLYdb+kU6zdWn3ZeuEskFxdb2b4AZgTo8NRV3TH:rzw6ZL8LdLYVM4igj5CU
TLSH
T1D4265B656BF880F5E0A7E178897AC6B2F7B678420D31EB4F0191C62F2F336905D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVDllSurrogate64.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe
Size 275KB
SHA256 3c0c0ecc42177d38c3a6fcf0d6624401b6a1b96b45fed747435d09b81980d968
MD5 53b8f90fdfdb45f2db9843e94c2d6980
SHA1 09a2645354c02caf54b668b4d83a9d2c2c0bcfd8
SHA512 5f752770512edfc7fc9b0c43427fb0fe312ac6061fa4dfdde8b3a58705e5d6e32a3f3e0d82d4115aeed0c9b4edd857db6d7969a5f59d077b134734420aaf6a6c
SSDEEP 6144:3V97oXds9yWGNTNYdMzATVkQNUO7q5nTSVR9X0O9c:lxQs9zGNTCWsTGQ45WNpc
TLSH
T10654387BDD38F8D1C37E5CB4A790C700AB72A1714B42638BE175C26E8D136E15E6AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVLP.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
Size 588KB
SHA256 9e1d8623aa37c086500abfda31e2dbf8ca261fc11da70180fdb4b2df4ded4525
MD5 1dea4e25c9ae2efabb4e43d208a76e63
SHA1 f68049c6444f7fed014fbc6a3eb5df7c8f82e19a
SHA512 dd5105f965cc250cf6896daf05d465c7112f01b9a547bddcd5116397cd6168e59d078f3d97fe96a66d33814af6cdfec1539a856c7f7395dcb4d7096bc7508d37
SSDEEP 12288:Qyh+gOxFs96mluzvNU4TEYicijoXEfxExWE+eTMgz:J+gerq/cqoUfqxR+yFz
TLSH
T166D47D76EE28D8E1C27B897897928600E6727C114B61D7CBF16CD27E1E236D05E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Integrator.exe

Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
Size 6.8MB
SHA256 138ff1a002f7468136fb98a41c7e565d45e1602c535ff091fb88e301e0a1601b
MD5 3e5e1d9a3924c30f7953979b2dcea99b
SHA1 60d402c477c1f8cf4c14d38694f212a3498b5de2
SHA512 07ce3bbce1cbe4966d2ddc2a16043b829cc800b6dbb1a0f6939a9f10e1e0ac5b098b40b206d23ec40bf40741703107a83c00b784eb4559ed3e4786ceddfc57af
SSDEEP 98304:+ieqICNeewUybFB1GWlhrrmqJjeb2p8o97:+iDIGuUyXUWl5SzTM7
TLSH
T1356629596AB481ECE0AFD1788D778772F67678428E33661B0261C61F2F33E588D19732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Mashup.Container.Loader.exe

Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe
Size 100KB
SHA256 7bd4a46c053cd5ecf6c7064fab32611ee7428d06a85e92d64cc04f9983d99c3a
MD5 4b5074537f071282e7b90a0377c2a9a6
SHA1 dd5a29519b016472de0c99b809b239fd364f9a76
SHA512 2094987c394883f85b890d816589f56604852f9b9a5c66bf6a3a6937488720e16bf7b4b2ea5476e5253895ee59ae46a0c8ca22854045c2f43aa91ef3f6a31481
SSDEEP 1536:0KosvXuhi3ug8Xjd/eAMpldERVkwnLVIfRJHY9RCVMu9D0JdzzEWMqlGTLN:0JbU39ieAcILnLmTHKmviVtblK
TLSH
T159A3BF57678D40C2C11147B89892DA59DAB6FE420F3197DFA12BC21E2E233C8BF79B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IEContentService.exe

Path C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe
Size 449KB
SHA256 3c24ca82dd396de73704d40d967f97d303b7d248c86fa5810f8b99c09a99d7b3
MD5 0bf47d1c35b3046045c4bc2350f483f6
SHA1 7a02226764ddc1168a5cd3828e36fac571654f25
SHA512 d755225fb2845325d534c4dd5dbe5535d031c0ff368e518c85814934d024501bb4b5d46e1bdc02bc37f6ed7fc26d1b1f007aa2ad43534430e5067803ac93132b
SSDEEP 6144:JahELbZcwQTXHugTbnEtWHe+mq7cYs9Gvou5jfcbvnmwVFwelJtY/:whEOwQzOgPe+NAYs9sRfM3/tm
TLSH
T101A49E8AEBA484F5D657E238C577C671F7B2B8890E20574B56A5C26F3F33A506D2C320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerfBoost.exe

Path C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe
Size 877KB
SHA256 a2bf39f4e1957ca73afdc42e76763c780b29ce269433c6c51c89c65e8077d033
MD5 8dd4dd2e0fce01cba23a87bf00ad6b67
SHA1 e821962b05fbafe72241fef8a899d78a80228f67
SHA512 4af04366930de06a67b0bb753d98b1be94868b4a10878f3ae05abfcf6e788467527d5f32d1498ce5463e65a47c06207e8eb0b1a3cadc5691962ff9c3ca71dda1
SSDEEP 12288:qFmiJfir8ofEh5s99gP1MQLzvfmRyDvpEeZob4UnV5BMw9duj0wZA:YmiJfir8ofE3MurORSpEKdUnHBt9H
TLSH
T16A153995ABF845F9F1B3A67499B68572FAB2BC521D30D31F0160C25F1E37A808D25B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDXHelper.exe

Path C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe
Size 189KB
SHA256 1e2ea80496c573cbd3be6183c1a8ba0b921135ef8d6255e6e9b1804f9fca0b51
MD5 2a3f498758d5c81b02c4629d49638af2
SHA1 ac708d36b36a85d19edbfd966438aea3a4406963
SHA512 f7b311d31dea3dc16dda3a702b49ffd8861c6a5a57010528adba3e32b8dc02d20ab79749f759885e34bfdd6933192d4b4f6649965df2ddff087d84a87de3ee76
SSDEEP 3072:SsESCTptNq/D3U39GH1Q2+zT6lZdAh3SJxfFrgrwHKhEx94NnIbMWQ2RUpKF:+SA3Nq/D3s9GWelZdGaFkrNNIbjQiU8F
TLSH
T1E2148D567BE4A1FAE413D238C969EAB1F772F2715D20635F53A5D20E0E33281BE18B14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoadfsb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe
Size 2.0MB
SHA256 ca985c99cd6ee31799bbead8f5e39e3a303b225461a0b97864bd206d17341e75
MD5 67471c7d3502a61842425ee330d46946
SHA1 15b611e86d1676c6d26abeeca5bf6969d3c88ed3
SHA512 126b8aecf10ee93930a706072fb6eb523201902b122d58bb9c5532392328b73caab9c9c92ccfb8da2a98bfbbaa97dee5e4dcf1eb5f16292f8e453f45e8b0b980
SSDEEP 24576:tpZP4LQZSSjBHX1IKKmmVGFO7u/Rd7TBfdWDeb4XaR010dFT7bK7+6mlvKp0a:tnPpjlXPKmmVG4i/T3b4201GFT7bhlpa
TLSH
T189A53946ABE8C4E5E2ABE2789975C9B5F6F2B8414D31974F2156C70F1F336604E38322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoasb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoasb.exe
Size 341KB
SHA256 a3fa3764b1b70833ba34a80857dde7d558097ffe495a70a3267c9f49fb0fff7c
MD5 9fc7ccd9746bc0326d56c6b785bace9f
SHA1 46036fca0c83071b752375fc3d0f85916e2f94f0
SHA512 18412e1498b0ee27404fe7ddfd5e2c533dff71fad675e3906809d2585a5039adb3112df6cf411359f8532a44a3ed48194ea54e4c6daadf6ed183b361dc553ddb
SSDEEP 6144:UUNFs95/QUp0PRZS83hdaspLQLUMb9bhvRx9EiOwZexhA0ofEsZ:Ucs96w0PRZb3hdaspzMb9bhvTmw4XoZZ
TLSH
T1517428577BB88CE1D807A1788986D6B5FBB3F8514F21C30F6992C35E2E37261AE18711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoia.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoia.exe
Size 6.0MB
SHA256 f47e48a0f0a633541c1a121cfc293c4a11e381c5b7d18f1d2b407def388f1086
MD5 9f5e3fd17452bcbf39252feff3366826
SHA1 5a2b6726a4bfce9eb527ccbdc289951ed55769c9
SHA512 5cbe05ad8975a19ad431fe88316b5832f45d1d1a8ac57ed8cb19f965cc0ddabba26712b49c1c74806ab59bd02910faf9fc108b7dcaee8b9c521b43c14d1470ca
SSDEEP 49152:uYoGkMua+u9ZdcoAs8CQOCi3L3hr67vzM8x68VeAEZYztbbAK293+XQK+P5jGSUN:uQ+Xv7xu4A5KZCLw21matLUl
TLSH
T191564A55BBF982E4E1BBD134CA7285B6F6B2B8555D31A74F0461C31E1F33A909E28332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

officeappguardwin32.exe

Path C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe
Size 596KB
SHA256 0613e5b57e63968b338f92fcdc461c534f1d8d0c1d06976295c87c3b59470a57
MD5 49c8a6977636d7b66a1d5f736357ccb5
SHA1 768e93e3e45f6223ec5e34b60eaeeef8c8ffc88b
SHA512 5bdadd9038fd03d41ac6ba8944b91c568ea8b94e7839369fdeb7ee4d3257f9cf303fca7c3865d0897f040e749f51cfa7cceeb985e8bdc7d93430f3c95f1576df
SSDEEP 12288:rxfyHhgypglavtmgZ79s9xcIPr0lypFpKCKaXjyqwyM:rxfyBgyz77vcAlc2CKaXjyqwd
TLSH
T1FCD43A41F7A881E2E566A5388A66C5B1FA777C130F70D60B7159F32E2F33640AD29B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocolhandler.exe

Path C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe
Size 6.4MB
SHA256 58f93573f57ee8dd895bc03d7366501ec84698629e598527f8ce7b70b26f692b
MD5 d3e81e768988e4d8c599015560358501
SHA1 f9a32aa303d7eff8e74c29a76c04c2cc0d5f2e60
SHA512 2a7f9fe5f69518aa80708c3ee0b33b470fa1fc2cecf33d2aec04708a6aa6e18f8edfac96af5a02c713e4177f1803e1caa29830a9564cd0b875c8fb98f35d6887
SSDEEP 49152:WAQ8CLGQAIQt71KBAm56NjaQCxlhlzGOe43K7IFRFiC46re0+Npa7SqFC/+/rEBt:kj1m7L6WuS+2nNmzHjSb
TLSH
T1B2666B417BF880F4E1B7E2788A3A9675FAB278425E31AB4F0151CA1F6F776508D29331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OLicenseHeartbeat.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe
Size 2.0MB
SHA256 7eaa9cff09b6c1bc1979b9c4d87365fc0a8b442e1afa5fc03e57998095c2fbb3
MD5 21a951374ed03c9da24665281219aab5
SHA1 61205e79a305310fd081964f563d6d634fcd48ff
SHA512 89033d07a52c4a0d072d567ed87204777d8c5d4db04acd22cc708817a2a7744cc2a5e3fb45d8e3a1ddf99e4432a75804ca90ec9fc12af1e6a9f7dbd67fd937fc
SSDEEP 49152:OjMwGa8hEzi6Yx/3jgUS5n9QYrU98xjqrAcdHs3:o8FJdH+
TLSH
T10CA528416BE881E5F5BBE7B89AB68979F9727C521C70E61F0146C60E1E33B408D39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLDumper.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe
Size 222KB
SHA256 3e31603750cbcb06502ce0eee45765c6f205bc6022fb5c2e96f8750d1a1cdd47
MD5 44412f87bd9e0625c85fc30a587e3783
SHA1 34d09cc131527171f830cf942e2b5e09bacbe785
SHA512 b75f98a3a81a670f774b907ad64b1c4c7b0ab5b1ac5df452858dbcd737263c2faeb9a2b315ccab24f472564ba873b1ccab80e88934fc5cfbf91a981ed1bad570
SSDEEP 3072:XdaRwDtnftsU39Zaj4+qrSVzN2Bmt+hlEWVF1WiKYYUDiWiI44AI:XdaRKtfSs9Zaj4diz8XpeWiF4X
TLSH
T105244A117BF91058F4B3AAB0AEB582126A7778955B31E7EF051882A91F73BD0CD34723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohub32.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe
Size 2.0MB
SHA256 75046f46a2387ef3382827d464e3803ce5a5487d153b39ad8b0d06f63c6e5f75
MD5 e6bc9f2462ffd155145252d352d91a46
SHA1 427166f8d5fa0d50b00c55560ec0ee71ebb6d0fd
SHA512 c5bc77eebae39a6bd066b632ea4a11a87f6a01ce633e92ce9900f9a80730798be2c4fc16af6c03826c3f7ce977698d920c21a4caf87a6a1a45c6f275f3c5ef3a
SSDEEP 24576:e16zBLF0RYGgRlassbvh6Y3UgDM52A2NBH3NRLO5tCrFVwQPHW51QUb4FgwPqe0c:e16zBLOhPkdth4ULOH+MYu8m1/p9X
TLSH
T1FCA56985BBA484B0D526A17189A6867CF7727882C9334F47318DDEDEBFE32604D59331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreporter.exe

Path C:\Program Files\Mozilla Firefox\crashreporter.exe
Size 3.5MB
SHA256 65f9bf20fb3279ce515a23b6c586282a37fdd26b314b3233e6b5713b777b110d
MD5 2c98dff144acb7a4c9965933f51dd2ce
SHA1 a91e4208ae0f719cdec8e0b2932697b25971dbb6
SHA512 aeda037cfa5fbf0cc605868ffb24ecc3a28917fde81e83d25aa3588e235e872d96da80593bced7c7f269461908a86a30482ff9c8d52fd46c61d99ba1287d631e
SSDEEP 49152:5tf3ds1oRkhpQyPmO28wsz3iDT4JmeDNB05FQz/9TmXLhm6kV9BT7i4:5tPpkhSyj2Jg9f05Fy1aLhm6uT
TLSH
T10B061842EB611DDAC025C0B482266723B760FDBD073036F74A906735AD68EE05FF9B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox.exe

Path C:\Program Files\Mozilla Firefox\firefox.exe
Size 777KB
SHA256 c5b4bfdccc51607506e86a479484887d59c884c6cccc767d738babedb1ee7d90
MD5 7607327c8700f58e45b6ca4e02c39f9a
SHA1 2d34f5bae3a3cf729e23773dfd25b1d7463bfceb
SHA512 4a524a25c74e94000cc102ba438fe895f00d77cebe8aac7c7432b3efe9fed62791ae6130b2b7e6b79f997db28516202b5096ca2f210454d9d496d09b9b226eb0
SSDEEP 24576:MUIIoM5EbjDcVEE4SwpemIwpelzEi1kRi6V+:vIIoMKbjDcVEE4Zpeapelz1kRf+
TLSH
T16105B003F38516F8E08AD5789A42D233A5723C840B51A1DB1BF93F2A3D71AD12B7976D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
Size 329KB
SHA256 84fc6dd593cc6fde4b774d672f00b34ebb1cdf996fae9a2375bb54fa9796d110
MD5 bfbb6f239f82a842cca3e2c7317e3f17
SHA1 0210dcf0bfed7cced9e10adff946e789e2dd0bcb
SHA512 283aec6e3392cb67b1a37a1fcbe262a40f806a0690c461218aa5fc760f91f86881f659b1524013396d1c518aadba6f25ab45ff27915a1c478f68463a5fed95e6
SSDEEP 6144:clrs9pDbJVtrn5qlJSMb1gvY2lRSxJ/iJPsfUrcAZyxyam0nV:+s9pDbJVtr58QMz2lRK2czA4xyam0V
TLSH
T14374AE2573E008F9ED67827DC8A28511EB73BC550760E7DB02B4866A1F233C85E7EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nmhproxy.exe

Path C:\Program Files\Mozilla Firefox\nmhproxy.exe
Size 654KB
SHA256 0eb7009df9667fd872bb5f5fa906bc758b81d08a6cea21c5ccc5a2e9842ef5f4
MD5 2a3fbc9ddd0ba9eab7a3384c0e737b09
SHA1 593c8740a38e60963d3b9a1c058e79c64c13f2b0
SHA512 83b321e02b346cc62c66e84670d1123e584fb2d8719bb0de1609adf35a2eeaf66c9a1e9c8261f055b66d17ef97a3dc78ef3617948863498185ddeddd0156d18c
SSDEEP 12288:ICqQR7BpVP5yVrWSwThywJs9x3c/waheNd8gbK:nqQRlbPcrV0bkd8GK
TLSH
T147E47D02FA97D4ADD51EC478864785327933B4CD0B30AAFB63985A353E5AAE12F3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pingsender.exe

Path C:\Program Files\Mozilla Firefox\pingsender.exe
Size 126KB
SHA256 629ea9aa0d0a65124671ef8ae127d4ef67943d99436d2df12cde43e58c0fc93c
MD5 8070d6095933bfdc2e270e785fcc13bb
SHA1 b9794c27bf5e5f46e1f235a5e9c3fff01911f7d9
SHA512 efb42d78a829d287b9a78ea1b4e5277e8a607668eba86ca6971f2f953b58dd49d88d3f3754295391b6c09661c8bb9d22e5ef8d58d0ad6775dcc2b6d318f05aff
SSDEEP 3072:McXm1wjpU39PDSh2SdWAu9MHS+F0FKAlp:Mfwjps9PuFdE0AT
TLSH
T116C3AE6241200AB5CD1083B0E9D79D62F7A23985077F37EFAA16C1823F457E86F792E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plugin-container.exe

Path C:\Program Files\Mozilla Firefox\plugin-container.exe
Size 202KB
SHA256 22a9639b8605095cbee5c50803ac860498747b0b87a5a77b1770f2bbd83c2e08
MD5 f86bd9dcf6abcb90f120578aaf749319
SHA1 21656bd626d54733355129f3ede648c5c14f14f4
SHA512 2f972025889d8c019020f2bc5d321b10fd9f39a01d86932aee621e38e88d056e95303ffe7cfb4955684326653aca5a4eeb1ed8918575c9d56ab76ea85394cd33
SSDEEP 6144:8rkLqphIs9tEWDAlEuDmIvtcpWwkz6+By:DupWs9/0RmV3+By
TLSH
T19214BF13BA4811D5D4D5C2B42BC35231EBF6F7860B21A7EF169859202F52EE4EE3D3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.exe

Path C:\Program Files\Mozilla Firefox\updater.exe
Size 523KB
SHA256 e0a8fc3654282f268e1edd8d75b3d8f863236c63afa9fbb61ac6370c4e1706ec
MD5 6b0dc00d344399b26e66ef43605cd474
SHA1 da0de871adc89b1c2ee4d3bbb21a0a13334be322
SHA512 90dec6bbdc7841a0cecb5487e2440ce0e9b4e3ceb51fa2d340acb86d400404aca1ac5e57b1bad51f9cf92564058a5047f5ed39f0803b42395b2dfbd894c0c982
SSDEEP 12288:lJOX+s9C2FA2Pd8PbD6Wo2Zel+SOJAdGya8s:3OX42FApPNHJ+Rns
TLSH
T1ADB4BF5AF3500CF9F82BA678C8928511A673FC64475096EB23A496663F333D41B3FB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 188KB
SHA256 5da854ae28ed79ee0c50e5dba62818d4f92ff576d1907cc56e3e1a3c9b872548
MD5 56f445bc7574379dd2edfdc10b750b30
SHA1 86b8f7d3017d355f5bddc75265f4db064cc61048
SHA512 e4b28ad86ac8600555209b74342ea1643a54bd6fc5133c951df8d165743ec1e11ce6f21c6c29368fb0740421ad20469c6b0a8e90f72be9f00fca4d9d70d15911
SSDEEP 3072:6Dl/gaC7GUU395ILV8pQFq4XKF3QPh/iWdYIgISP7ZMAhyrDI:6R/gaC7GUs9qLsQFqT3QXD9wuI
TLSH
T184148C49D29852D4D1AE2171C7A58A41B3333D2187E2D3CBA6D0F17E1F3A6D06EE9B43
MD5 SHA1 SHA512 SSDEEP TLSH

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads