37eeed73ce61e8ade6e56d685ef0a19e7d865ef01a2e60ced73caa6c6ddc4d7f

Analysis

max time kernel
150s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 02:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
Size 1.1MB
Sample260804-ddcrcs1arb
SHA256 37eeed73ce61e8ade6e56d685ef0a19e7d865ef01a2e60ced73caa6c6ddc4d7f
MD5 5ddb63abea0f0b620d38dfda5d50d18e
SHA1 1f7740d4d12384abedf7d746490314b3e46e2d87
SHA512 dceb5a092325a1519b80bb4a67f4fce7fd164ba9bf54c3f0b1d8cf7fd43e3f1ef17da563418c4190534de9a67db40b2b926fd0fdd518e510ff14779c26a70bcc
SSDEEP 24576:ALzcbti1sy8sOT6SOaSSpNnJvapyOwZKguSqAjrc5xaNIBaVdgh7e:AneWsy8sO+LaSSpNnJypJw4XSqAjrQah
TLSH
T1D3358D0A63A4419EFEA7F176D617C60BD7B1784A0376962F01A46B726F337711A2E330
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\X:	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\B:	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\E:	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\H:	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\I:	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\K:	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\P:	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\V:	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\G:	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\L:	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\M:	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\N:	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\O:	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\S:	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\T:	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Z:	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\A:	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\J:	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Q:	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\R:	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\W:	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Y:	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83765\javaws.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83765\javaw.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\setup_wm.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\wordpad.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83765\java.exe	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 20 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4840	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4840	2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_5ddb63abea0f0b620d38dfda5d50d18e_agent-tesla_amadey_icedid_njrat_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

64BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
Size 296KB
SHA256 edc6dddacccefbb26ead88853b9dbaf90db7692675e5e3a60728d5634bd3c94c
MD5 5c401bd6271ea55cdeea1e0e4c327961
SHA1 f08d38c954aba622514b2025a818339d59f84efb
SHA512 1ccff1fd2b27638b60dd5003924d726161eaa5a5890172b5b147133d041150d27a94e501b335da289e42f023a7b029255451d891f9182ab6312e05b2e4116f9a
SSDEEP 6144:hLzweHs9IT1RlqzLI/Bx70pcJtqQ1irFUBzWT5w:Nzns9y4ztcyvFUAK
TLSH
T145549D1A37D88CF5E457C27989524646E2B178954B34E3CB6324432EEF63AF0AD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83765\java.exe
Size 333KB
SHA256 9ae7f01480f80c1a13e228e737bb17fd3b138c49642fdacc2fb03de2ac86c00f
MD5 09a765cdcf9e3a4cd808cd0dd52872b4
SHA1 0ef50ea10d90d1bf53925ec069c12c88a1dd2c77
SHA512 f0567efe9aaaafdc5c456e7c290f65700a61e88acb84d6f0e0f01d8f2c49850167c4a1ade968837f0a689fc93762555df24023227e65ae2ae3792fb8420fd0bb
SSDEEP 6144:kxPEqms9Mj4AEijjNW5MuHf3aYV/Pvy+oQfeAi:kpEqms9MjZEiU/KcPvy+oQWt
TLSH
T16574BFA4B39018F4EC67423EC8558D15D6F27C5A0BA0CA5F13B4362A5F737A11C3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83765\javaw.exe
Size 333KB
SHA256 ffab43daf67c651aa2cc3fb3375f7fcd3b25815102b47114771d4485c57a0a63
MD5 07fcc8d26626665b17e7fddb002931fa
SHA1 d9e94fb7490f24fa8a10a2fe032c224d41225149
SHA512 08b6ca99c2e8b3a6a7270d0ed8b83e6f9e674731ad656b82fef229df0d4634d3515660ec70ce5a0840ef457fa850ac2d873276d97cf41a6e27192918cf403174
SSDEEP 6144:lg6Wcs9+sYUCfhFSosyaywoxzKYutYPDvhgEXhxtZl2AwJ:lnWcs9+sYUCZFSlpypzK4PDvhgEXhxtm
TLSH
T1B174BFA5B3501CF8EC67423ECC654906D6B27C5A0B60C65F13A8366B5F333911D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83765\javaws.exe
Size 540KB
SHA256 9eb2f1b865b1481635dc31c83241945f171db4bf74fd2010bd425f6575ffd0ed
MD5 b8ca386e148b7183e35f0a20896833fe
SHA1 11f3124e8cce3c3aab93a4f31a19045af3804bd2
SHA512 45cd95adfa60b4e0bbf72f04b15e025ba5c0706656f37e41208be8e67f22cb7f669d21d880a9cc0d79772fc1da04fa1e21b5c9e03e2f0c26071c9467beb8c73d
SSDEEP 12288:i2cNykns9vtsDig2RIn7o56/aLbbdIvWbBiw5Ecl:izasDi8n7o56/aZzZl
TLSH
T1C6C46C90F3E414E8F1B79A35CC769511DAB67C991B21DE8F02A4265A1F336D18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe
Size 596KB
SHA256 c129f271c8cfd8867dce13011e581b68d7fbe3eba677b67778a8d010925ede27
MD5 a634e6a61caf003511d18f66d48c43fa
SHA1 4901310401e9ae6d1f685fce0fb144278002826d
SHA512 9fc5bfca340d7f485c7c418f5e5f993a02f1e120f15519062c940cbf2e54768c9f03bc6a526d501175be3bcb4dc045174e315fa047fc23c5a799b97481ff247a
SSDEEP 12288:Es9qroCRSPaLe6PdUZrNSNGY+WDiqfJLrB5:iroCR7ePLYpDisj
TLSH
T1D3D4BF41B3D846E9E06AC534CE538642EA7278960F60E7DF02E482792F37BE55F3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe
Size 6.7MB
SHA256 cb0319f565e6c9c473a49db0b811a28ec5eb6823cb882c0ee5297bb712e9de97
MD5 b19250951251aea947b38f7cb458862d
SHA1 5a02cb461b372c1e68ca5209879247ae8bee96c3
SHA512 7523e8ae2c7293dd4cc356f534592948f490aad4d79769703ee2517f350bb0fad39a27eac5303dae76363f5e4e448289feeed247a03df79b4e3dfb83576d91f2
SSDEEP 98304:pl8YfTaJ1+WxwB2L4HrZtfPIieK5M0uR7F5e6tT:P8YfTazLCIiFUpI6tT
TLSH
T1D6666C47E3A600A8E46EC970CF2A5521DA353C8E57B493EF129476E91A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe
Size 1.9MB
SHA256 270104be91e4f74b697f02b3ffc78e475de61ed15a1d76c82d08ab76653e1940
MD5 0d90179223b4e4f774be0042d78968dc
SHA1 c2bff6e8bd7dc6efb246e421370927794605e8fe
SHA512 982f6c80e0154d4bdf61612a12d2487ebe157976089b4b578477cc4cd7e55fb492d8bdc039d5994eb4bfa78ae9b07e8dd6baec2a974340ce2d4d8a6159d7b2c0
SSDEEP 24576:ANdHIdKCvUVCXcYrrfb2kvEjL2NLb9Ld25PTOocJuJ/cIsY6Wfv2xUP1jYLj:QdodKyUKrrfbmvwpZeToMJsemxUd0Lj
TLSH
T1AC959C03F69941E9D06ED578C706953AEA72BC890B30B6DF0290B2992E77EE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe
Size 1.2MB
SHA256 484d2487e29416533560c4f3069b83283b2d94a4dd924601bfc2341f700e12c8
MD5 d38436f3fb99e6858ec6b4961f9a4bb5
SHA1 6a1b4857265d8dab0705c904884ec1c03ce3b2ac
SHA512 85eae941c73d0c857f45310442345bbb340244fd2bd8c4108850309bde47c87fe4f3591879ae5273aa7f3b2895075f11ee9f21148ddc37e8dfb5097bab3d3696
SSDEEP 24576:ryd7x4NK5vnhX7jbvFBq5kPdNJyryzIVprSIPj3Mh:ry5ONK5vRXvDWklTGzpGS0
TLSH
T1D745AE07B3D941E8D029D574CA568132EAB27C860B64A6DF06D0F25A1F7BEE86F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe
Size 3.9MB
SHA256 7cab0d46724760af970ef67b8996e52f9279f7b3ddfe0cc7c311fabdecc935bf
MD5 64a9644e1869ab0be7c142387c928d02
SHA1 d09697b86a742d8c9ed08992d55726ace764f313
SHA512 412c344852c5d36dbc474e0ab7ffe1debe2040ee06b2bd9fe3d48f47cf077ed49f70a78d45baa3b3ea4818bbc9a46f722d71549d122356573c3d029c7d136e30
SSDEEP 49152:/vIOW1MWrlv3RSe5cR3MjxW460GD0AGuuVEusJ6LNzOeL0GKVIeCjIp26If2y/Bv:yGzSuuVlcm7fwKAk+wyq7
TLSH
T11C165903F29940D8D159C074CE5A8132EB627C8D47F562EF3690B6EA2A73AD47B3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe
Size 1.2MB
SHA256 2be50306f1b8631b37a52d060693a7bd39f8bf624d5db4fe3f218e500306a5be
MD5 c575d312af00fb5272a071dd85622d56
SHA1 eeec28b8209f6980ef4961aebd6b8cdfd107c20e
SHA512 44fbfe6b4547fb74554a89375b9b03e3b8683129c96c2923e01b7f5ff0b5e02a113bee2cb9b27cc027d7cebc5228d16bab2aee8b8e423d59feb1c00160696162
SSDEEP 24576:ltTWQ/kTF27Xt1iITL7GL+8wfktwq08mghW+RAkh:ltTl/cFuiKLqqPstLNt/3h
TLSH
T1B845AE07B7D941E8D06ED5B8CA568532EAB27C420B24AADF06D0B3592F37EE45F39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 1.6MB
SHA256 fb79e75652bb8f94be654eb52495a1c5840c726ee963a93288a83a3ebca6999e
MD5 623ee58985bd91c931cf164f40f02d8d
SHA1 5291d171d52aae5662d254995f0e02861048213b
SHA512 3f6bca6c591295c9aeb7cf6082412bc4fb8b454304ed68bc7773525697462dc36d9c29a0a06607394bfa63ec24ebbcd4207124258e1daa4b8e02a4da5f54a925
SSDEEP 24576:OEdiDvxuKF+09RXa2WKbN+W2QncZYwTXQalhTlkkkkkkkl0T3gAQecc9q7:niDpuKA08Kx+wczTQahPQR7
TLSH
T1EB758C03F68A81E5D09DC2B8CE764B34EA717C655F2096EF0190BA253EB7AD44B393D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe
Size 3.4MB
SHA256 d6bade2c25a997ba13864428c8606ca409e3fc1e2ddb9bfbf0da8e6c49854d4a
MD5 13d467ca3ad832e4b9db3f72f13ede81
SHA1 4482e3ef90ac515cd44cfd635e492f2ed270834a
SHA512 ef31ac467df5e0c8eb9649102e6ed13f1068fefb4eb5f63f2b25f2eef234651716187a77d574d51fc614c9c57bf081e0c3f11310c2eb7b64cef762ce0e698c43
SSDEEP 49152:llq+5ws42IkY4UqFyYQabYsxDuUqMzAD6ulO7Udq+KqOuBk7bVnU7wF62JtYFklR:5Qiw6ul1EE4wsJx
TLSH
T118F54803E29900D9D199C078CE4A8632EB627C8D47F562EF3290B6D52E77EE47B39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 1.4MB
SHA256 8fa0c939fd6b566d2906e66ece42b06dca91956a7bfd541457261d1204130c77
MD5 a79f06f91b276b97b4868c02ec0ceed5
SHA1 4bf58d08f0e9f548f5ad9c049aaae864685366be
SHA512 8f82f80a7f5e7090d5041b36ef760fcb2eb47ccd21e6242960c4606c52cb3f42c31cd1ac855fe812ec27ae59c80954394babcd6dffff4112218be88708b5cb66
SSDEEP 24576:pA0CVctcTljNjF+XNbEqr1g8bUFn4IvVwIe1qRAb3Hfrxu:dCLTlpjuvrG8wn4IdwISbjxu
TLSH
T1E8659E03B2D941E8E06DD178CB568536EAB17C860B34A6DF0698B25A2E37FE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe
Size 1.2MB
SHA256 fa89702d3e17a39e599fc6b66ea40cc17ce6b95f214e1b0d1ccf6c33e6c52d4b
MD5 d6e928437ae461b807586ed50fb9c9b7
SHA1 b99cdc4435c3e1e82a7f2325dde245efb6e64e22
SHA512 4c08a44f55855ec25fb695ccd46444ab4483c40aae7d6fb0afc4bfe240532c9c66b4185f552a1c16a7a0e678b123ca9bfe12ce3bdd66c2df4a202f5294428331
SSDEEP 24576:uwpLqFgzoByX1BT5U4AVv/qE4bjHDZ4mHHB6:uwtAgzoMTu4AVnqE4PDWCY
TLSH
T13245AE0BF79940E9D069D578CA968532EEB27C460B34A6DF0690F2592F37EE85F39310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 248KB
SHA256 c21edd5d563378d1cfcfd358bd99c4c6d522c91d19527b513521249de4069ce9
MD5 fd02cbeb7cae570db15aef5289f7061c
SHA1 66ebebc1edd20d58a42cb325d117d984ea2878a3
SHA512 fdd0c6e71c0dbadf71da6a1d4a8584a28bc155ec15281fccf40a0936f41ce1e715559dd1c2de122446638c09fdd7ba1802a2c400057f29bba6c9c69061af96a4
SSDEEP 3072:6U39vHSQTzPnPaqLREgnbKIHe1qzKuR9CbOwWoY46TW8sgyhNCOVBDifbqb6tUJY:6s9vXv/iqLRRbtHxzR/Cuoh0aDv7bU
TLSH
T18C448E6966F810E7D03691B4CEE49503F334B87617108E7F4394426ADE63A50ADEBF3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 265KB
SHA256 58e0102d2307755cf8daf349ec312dc31915d663540b43a0a9f9f816a08bac29
MD5 ba36c9cf2b3e1b3c36e02a3a61f188e2
SHA1 9e5b9f5c26c5928e320951178a804193a97d1bc4
SHA512 52d9626988980ce5621ab22d9d8bbeae5f7baf80daff993a6ec9d61e315d1cf4f78585b47cf5a0c810625619d0022c0f6ef27291dadad63b62e47cc0f50455d6
SSDEEP 6144:Ds9FpjIpralpBWCxB0YWoht+uoZhJ9uT3NFWb:Ds9FpjL9/0Ho3SKTdFK
TLSH
T19D443B6929F814E7D175D1F48FD09903F234E8B2A3108EBF8291435A9E13A916D7BF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 610KB
SHA256 55d95815a01a64f8f477fa9d12dd9444053d2c514318ca723785777e62bf0cac
MD5 e1baa25897f7ec2e4a90f2da853263d3
SHA1 033cd67d7bb9b2dacfdc7d328edab695d7e5dd4d
SHA512 a7dbc50a6c19c9b2c100fc54d66254d2bef59f68857edd5f37d003aa0ee1a191b3a34b79eae28ab169861fcb8167f5ffcb26c47840219b7abdd7ad3010391681
SSDEEP 12288:jNs9DOJ1j1j25RHVlGTS6Zk9fUX15rvcMS5W9:jgOJ15u0Pk9f83fSS
TLSH
T187D4AF41F3E847E8E07BC534CA528646EAB178D60B60E6DF02A4527E2F376E55F3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
Size 7.2MB
SHA256 8ec4d648a1d5372b0d2c89abae32e3285baa86183eb8ca27366ed884a23cfef2
MD5 fdc1194cac86913e0ee34b0f9013d1bd
SHA1 706012cecb7bc488a18dc79360e8d4833b50358d
SHA512 bf867b5e1de52610a7cad3853d01701858eba85186975aac963c4f2530246a5425a63f6e02fbe20bbc73721a141f3755d6e54968cfbad156c5ff0c204efc931b
SSDEEP 98304:z6CZetahq+WZqGIwCsJB2++fGzOxRj2vJzRN+T6frGwm9cm:WCZetaf/GIG6xVqzRdDGwm9cm
TLSH
T15D766C07E3E600A8E46ED974CF2A9521DA353C8E47B492EF169476E41A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe
Size 3.9MB
SHA256 b4648d1c58321da882237924427141084c456182181869816c3f532bb94af95a
MD5 2a468378e2c6c7e897f9e594df2d676e
SHA1 0120431d360db4546076f5e59b1d8fdb08591916
SHA512 68b18c00cc5374e58a1c49c65374a24778431a55b2ab2aa3761b41755c5f7f4e39be00b6f9892114b3878d91aa77b5d8faa637da868d692eea7eece7855bd322
SSDEEP 49152:jEaKnPnsVrlsWUE0bmhLbKqm006NPpIupEHVu+e6NqcXToRzvUqIzYHBigdQB6pl:unEBiHEKmCCKNUhIUBbDT
TLSH
T1B1165A03F29900E8E05DD578C7568122EAB2BC854B35B2DF0650B7562E7BEE8AF3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.3MB
SHA256 3bef91dde702846b672c144b82da789101972d1bcd6d7e2f7dba72afdd773815
MD5 4fc87c4ad81f0dedbd0861cadf1d96ba
SHA1 0f1abb2293bd949013afe8d2f80727d7a7a0c131
SHA512 6037d0d0b4673775472e398c288016e9815412d86c24a0b443c303dcf47a534f8dbb19effb3d51652a355734d212e254623f7ab63302b62d703be5fe50b728ab
SSDEEP 49152:08nr/Pbnv4eQm5y1E61stBhuXjfS4LWxnT9ywM:b/PL8rjBc9E
TLSH
T105B57C03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 1.6MB
SHA256 86efad20cbf8ab5073838ef045df07b85c558f789ab8b81e0030d8fa7928580d
MD5 67d385653c7b2fcf24f7606f3a86dafc
SHA1 c9fde5abcc53196e879b303ff283a008f40b0f28
SHA512 89843862dd790f9058220252fed232881b4441b02abf8c394d43e1f51dc94c775399ee01394c60c762cf82631b468c08f44b167f7913776216374b15c9fab775
SSDEEP 49152:21T8mvYzTjB71bYN4SdITVfTlXrk9dBGE:uw/rhfOx
TLSH
T106759D03F39901E8D059D1B8CB568936EAB27C450B34A6EF0A90B6552F3BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.0MB
SHA256 48b3b76547cfa625f4805d168a564dd3a1194a7a2a3351312569ee283b6aac27
MD5 1b920ed8874b82d7909453ed700cfd22
SHA1 fbe4d2e424ab4e330e2edfc89a0bf5505bbc7d59
SHA512 433e46d14311940b2347fe0808ed8be58aa603afb93d0bdfa4258f4bfa062cc1fe375069ef9bfd53c2ba00f9249ce4b4cfdaa74ca6acad96630e40264dadc711
SSDEEP 24576:I1Y3oP16CjNJeWRnYuFVCtafhrJvls7CtW7KSdHBxmRkkkkkkklQXBysWAxMGfth:I1vP1HN5tVCtaflJNZrSdHBAVf3th
TLSH
T16A958D03F6DA80E5E05DC2B8CB768B35DAB17C554F20A6DF0680BA652E77AD04B3D394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 3.5MB
SHA256 9455fe150cbc18bf0f612dcf19bbb6dd443793339d7ce0c17aed1778ef4d514d
MD5 61e760560142ad7aa2143db3041d11c8
SHA1 1e0f0b5479abbccef7951392ee7a195711a36111
SHA512 1b6150e74d3f32eef0609266d54ec2998541cc9de5b7d936908f27c675a287f85fffa151a9a7e8994ef786b9a0d1122b0292e7da9916f2d5cc2b68a950df421b
SSDEEP 49152:6u2ekK5aqug0/HBf9/qtwT/0b6YErsz4AkOuaRoBISCaQZCLlrr5Kp:nUH9QIOnZYQ
TLSH
T1EC064903A29900D8D059D078CF4A9223EBA27C8D47F566EF3690B6D52A77EE47B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe
Size 1.7MB
SHA256 36833c9f4b4755972a7a1d0aa647d6d0110879357817d987ce7960784f986738
MD5 2da87037f59ab32230ed96ca686005ab
SHA1 33d54e38412cf5b189db3603a735395d33a068dd
SHA512 3bf2a324957216d71bbb87e5269d6203d91ea9d4c68251b97f6e9d8862c466105e3bdcbf9ea364963db2b74acd5e270bccf8a70d85b97827ab4668968aa120ea
SSDEEP 24576:xXMWzGk6zdBmsIO+MWqRusyGrsh+mGV5bb9VeQuJXlPnyF4mfHU9YawsN4z5q:+nke6psHrshdGV5XfeHX04mfHI4z5q
TLSH
T1CA858B03F2D841E8E06DD2B8C7469532EAB27C450B34A6DF0691B6562F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Size 4.1MB
SHA256 fbbeffec04870df0b3c4a49b89722bab9deda4006a9a2d18911e10a49c82ae93
MD5 a37f6cf543e7d21017ab877cfef0fbb3
SHA1 eaa00e6bb03bfd606037c2448e698d77df388d38
SHA512 15cfbbad92a05e29a3fd05d0fab885bc5fac2b81cbde12894319cc6efb6cdc822f28681405e7b6fe7f8ae2512c934d8a427540b930b9d46924e0700829616040
SSDEEP 49152:DuHthTnVgDHC+4RcqAFO6o+TjE4zExldDwUIDtaZHWRdpev2y/Ba/2au:OUoGyFd+RaA/2au
TLSH
T1F8165903B29940D8D049D074CE5AD232AB617C8D47F162EF3690B7EA2A73AD47B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
Size 1.6MB
SHA256 534cea3285d6aa956e9d32feb3a5b1565c87da053b8fbb57669c45c7c8653056
MD5 b5a6442f7e6a5c334a5c91ccacd6157c
SHA1 3af8eeec15bf6d7c847fe9e571f265e0848a3be0
SHA512 fed7baa7bde705a8f5fd9b81a14062c397adee5ac26cf326a4a6251c517a03d063d73895c63b882ab59ddf71d5f9d4e8932fb1aaffca4fa9286758373ce6db83
SSDEEP 24576:zdddUa6W57bNkNlPnEuC6YTv578AnykWgL1oaedpEukUoygGmq/SpcQN4Kf:zRUaL1bqrG6YTv98oy9gBo7EukU1Yc4f
TLSH
T1F6759D03F3D800E8E06AD1B8CB568536E9B17C454B24A6EF0A90B6552F7BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 1.5MB
SHA256 75f6516a48c3d086385f132bff733684842f0ed07f35f38e8ecbf130e1e2370b
MD5 f4f4e8247fe4eaa02f07e8f59efe5423
SHA1 4f6d82b6a1231b1babb9d8fdb1a037f8f4bc0807
SHA512 dad34e935f7d5dcc3fcbf772b50ae583a5fa9d40c124ebf6622f9fe53be0f37787d84473245274e54f959ea1bedb34a5938f82ea6a133c0a993577851927cd33
SSDEEP 24576:Y6CQM66h653AeSRTGuJAwS1uviKbcGsVa4i6h27d3WldDVjgGqacorb:zM6eebmzAwS1uvDYn+6h27dUZgGqdo/
TLSH
T1CF758D03F79900E8E05DD1B8C756893AEAB27C450B24A6EF0B90B6552F77EE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 329KB
SHA256 92e6920f0a341267588b2f21b7abf91f1748391ed347a7f2b0137fc8adc9c87a
MD5 f921bd2823bc326e56b61e106f863a6b
SHA1 5c8f542ebddb9c1952e55180b8f0c0437b4bdcaf
SHA512 6c9c4cb9029bf3b9313257b4333bab7ff72a2e4c9e1525a91559ab1b63b6eea83c6cea2e5dd2bef8b6f4aea182003fcb3ecb86e1d67bd1a825ab001091a73f09
SSDEEP 6144:M2Hs9dHNCsNX75EnDVT01dJj2lRZk8/iJPsfUrcAEj+KRiRc:xs9dHNCsNr5cJTk2lR52czAoT
TLSH
T1A374AF2577E008F9EDAB827DC8A18512EA7378510760E7DF02F4866A1F137D85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 672KB
SHA256 5d159b42670311a30ec3cc0cb5d01b6c7bc0d07193a55a412218c5c28cf5ee5f
MD5 ff83ea0be3e655d6a51d3365059ced61
SHA1 4c85aa50dc78f235eddb5765e917d78abb72721f
SHA512 6bdde3e9eca880ab56fcded5354fbdb7f1a6c0073d205a89fd074fb937282eaf7baac38cf2e24eae841cdcdb7233651b15168e80333058329e44a4fefca0e43a
SSDEEP 12288:561SEV240UWNkKkdE+ylHs9KrHskBmJeaau:g124LWNk4lvrMrJnD
TLSH
T160E43B16F6748331D073C0B9C5D2A69EE97130865B308ACB4296D77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.1MB
SHA256 f86b71829a69c76200c2d6efa27c3a4a150b97a672f3ef0a65590d16bb51c263
MD5 74b59ca9df4a2b633d71767ab134752a
SHA1 56c66c2d1a6d0737c3a55d24c68bdaea6d9a814a
SHA512 b3f4b7a641a7efde794a6b1a12118cd68b35d22f8d596c953c478b176aa8f83067d683bd5eee21f048e682658c815bd827835067a52fb2f22614fd34f1736d02
SSDEEP 12288:njvtdI1BrWFezSCavOoYcdK65b4L/ghpSy1TIP+s9wTmqCLwKzu/cSMdydAM:ztw4ezSCavnnYhL/grvWe6q8wyujMgAM
TLSH
T185351A15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 840KB
SHA256 44d0ed893c5e8600c2258829fba63dd71de7cca420039ba9b98f3e9a782b08a0
MD5 6443130a69af09bdddff66d36b543d4d
SHA1 c91df50735c0bfa909fa1f9c4205660e465cb66f
SHA512 20c95f92f63fc56b50c06d2e7f38974414a48335ac275cfb95827c2e96d44f03d87eded70af4076a8452c9a35335c10f49cfc2654cd0c4fd9d2a5e6de77a7501
SSDEEP 12288:2W/4BcK3v4NkhVKEXSlCwsE/1W/FNs9Nf0Im98FT9ppfyuTTp:2WCcG4uh0E/FKp9pRyuTV
TLSH
T15C054C66F6748331D073C0BAC5D2AA9AEE3234414B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 350KB
SHA256 f4dd5007dae22bc63529a79eeefbd1d5a03b1fb3c58c738fb20035d531897d97
MD5 b97257070c32f7c434848e17248a7cb3
SHA1 3b05ee94432dbe6a5512ff7291d617749229e37d
SHA512 458cb664771f961330bd8379ade6ded6682cac5d19865ccb950e32228ab735bc2e30a1f25b52751876352d6a180e6f9a2249025e9d46e2ca319f32622fdbe1bb
SSDEEP 6144:XOfs91BJ/GKWWBNU6ITLBi0qttclOKgU91BMwGsJJLXkjA76WyP:+s9weBNUbTVO86UW1jA76WyP
TLSH
T109743A3BEE38FCD2C27E5DB85A918600A77678304B61A3CBE175820EDE235E05E75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.3MB
SHA256 088cf0efb983ab103783d8eea77c6ad079dafc5b65b0b5377b842334281f009e
MD5 3efe5a302ec945b8dfeef0a2e4b8ab38
SHA1 53538cd6a51963a7b14b925ecfd1b4e931c38849
SHA512 b1d53791fc28cac0db79667016a40e99aba7e4b1aeff2689f1b805af537ab2b3a1d7d4a312144862f43236e7468676efced976563276d0eb01e9367bfdc2c26c
SSDEEP 49152:K1puIjiGtGUekDxin1hrUrO1/LpdZP0zL2vDB3geuLg4DzIMIhkcr0yP8NRV3THg:K1hthc1vhLOJ0ks0N5C3
TLSH
T1FB265B556BF880F5E0A7E178897AC6B2F7B678420D31EB4F0191C62F2F336905D29726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.3MB
SHA256 656c294161825808309cbff455d25604d479d0b97dbda6e47a41a1d075a36a0c
MD5 5ae11d0d5cf2f685f5e5f1fd12b280fe
SHA1 3c79bc3868d588ba02b7d31f50319fc4e9dc687f
SHA512 dd60d190fbb5a705d6c5c118467a216dc2482604c5874f0274cb971aea40a6da5cda836c51bfd7c487301e11fcaf466ab302df4235fbebb4cb97e17be0f81134
SSDEEP 49152:qnI4J+vLG2yL5zffFiV+XenmE3/zZXiTs:7IJaVjnmlTs
TLSH
T1B6B56C0976B8C1E4D1F6C77886A2CA47F37178154B30A7EF5266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.2MB
SHA256 6b62de2e0c77b811fa56ded9c1d3a329327aa123ce22c689a26fca4592996c7d
MD5 2108200f79f3a7bc34201b3a8124ca69
SHA1 b645a89e6e7cff72ea4814d35c5e4fe682d8610d
SHA512 04236eae616680016a4633c4cc1c2d72e91f0748be5904bb0d591ccfc3f02b394d2249f65319637294d7ff5e4da58c92edbb43cb2c1a25106c0e3cdf3ba07253
SSDEEP 49152:5jMpUjJLtAagep3DJf5SUYLoDpgLjSTYlQcGeWAaLSF259ruMHwpXMi4FqJLd23z:9NRQyi36YOcPKLvw2gAf+PN3+
TLSH
T133666B03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 693895a156f10027413ddd96006fbc78da566fa791a336f990cb12a97247d256
MD5 5b658a53f7fdb67fe7d31b983b8f9a2a
SHA1 2e5840425e0e4ddb4237f0d212833746d0381c75
SHA512 f2a055f4aa092d16de0e9170906ee637fe8c14802be468d37007418547bfc6fae22c43457fc88314c5ad4da1ef653541b28df6d349e5611b23294dfc005ea863
SSDEEP 24576:9Wv7oBH04QsrBmrDbowdgWNNn7DaHGTNHu7PNU3/5W/ohL0lgzxnw:CKHXQmeucVeWu7PNU3/zzxnw
TLSH
T176952733B2F600A9C44DE1769F4A872196D27C75CFE0D3DB8115721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 3.6MB
SHA256 8d4bda9798d8aaeb4364d40e3a7d91a751848ae3c86c83a297078b821ba31fa3
MD5 1dcf16faa05dfac2f2cf0cad63623edd
SHA1 ab0d8bf6dfc7f7c3f10ea528ab2d9d69c6fca300
SHA512 fb554e96eb93c76d460342b1e730599784b32eaf483bbeeb99d4bab4a1e2faf11d05edf2445e9e02e921805f4d57b7f9a51ab01bcec904894b5b88c22edc5535
SSDEEP 49152:zi1CIUg0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbeN3Oh6tznm2FQ/nho2qkrk+:py5112gYy5azzVvZ69nLKnhZ3l
TLSH
T105067B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.4MB
SHA256 1df5b89e17351613a4a4ff139d75a2d64795306ec4fe554289855178d927eaaf
MD5 78db663ab0b303c4d1fb8ca256e8db28
SHA1 5d1f899ebb21b4593a32326696ebeedb62157161
SHA512 c8102361320d81331e5f15774f096a83d99dc0566e648d21e46698040c18a89f63849a6ca1c6e94559d4db24c8fd9f75723ea5e7d1cdeef08f54704625ca3e69
SSDEEP 49152:87okbZFSEdJOBr4tEGs0bqx0z+n217aau1gl4wLcC:QSnJmOxd2dZcC
TLSH
T1F9C58D13F1D901E8D06ED578974A9233FA62BC490B34B6EF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 1.8MB
SHA256 3516e7fa55d106e9d3a8536d53fb1ea956ab9f26785c182cc4544a9a3e44b8e2
MD5 50f32e5c1e2884b09edcdc3f50f3de08
SHA1 c1220bf27896560c66dd5c107abb0cd5829480bd
SHA512 340b6f59b683a92c354f1679c615763b8ab2a362417c946e5ad9762924052325eaa1c7d6b3002a0acbbc7faa1e9d4744c877d1364886a72714c6104b22b3270a
SSDEEP 24576:/bv/5SkTHi6+oydcAzirAuCMysvAK+UQ1zNOgLLwH7ReaQXx3h/kYq:LMkTHiHoyZfsvA5U44CwH7R4x5kT
TLSH
T1A2859D13F2D801E8D05DD178875A9632EA72BC460B24B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.0MB
SHA256 924484ff22cf653002e5d863af6ba7393fd76605fa52df1a73f77ce8f0cc6b64
MD5 f9f5945576dc93aa6bcbf27e8bf06ec3
SHA1 361bcba6fe60fdf3a09d2fa9b05d17c0b1cedefe
SHA512 0dfe0dcc5780aa26b849f992663f6552a2e59df6597cb009b778fb3afa8c3b594085796480c3c7a8cd3954637c609ce8e9df71130e6f132be5b31930f64a3b91
SSDEEP 24576:RMI9Gv0sGnuKk49Q4y4lAnPmPa/OwZHWxBR04FxGgVG2Onks6xt4bSMHnqf6UXcL:R33KKkGQvT6wZ2jRVtOnks6NMHqf0J
TLSH
T1CDA59E13F2E940E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.2MB
SHA256 3b60056a982f2dc5f01d13d9b4ce5023bdbf8b42b9339bc74358864e988d1aa0
MD5 03188a50203b7c38ad0a37ab5083f029
SHA1 c280fbc7f0b1da05ee5ae8da05508879f642bb94
SHA512 d2bfdb00049849370cfa0b4f1276d4f2e7567588359ef82995baef309babbf4cee5097ad958f6d1d693e272669f975da46b85c6803a62d62e6f008654eb0e41b
SSDEEP 49152:sbzIeMFcIFRYBW3jLAE3dGGj8bfEGcjesaNkYQd0XNJKcvaAcPTY6Y5AjSL:HiWTvjCBDlZbL
TLSH
T1C8F59D13F2D940D9D059D078874A9232EA72BC494B3166DF0690BB562FBBFE06B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 1fc68c93b42946dd5b4e8b63f249522048ef5d670fa03b113fda34cd56cf9597
MD5 a2519e8fe99e90dc57dbc1b2062be1a0
SHA1 c98300bf43c55e6da338fff3b48191aeb8b4973c
SHA512 1cb7f94d7c017becdc57d6571f7f44b58a6a95444d07cb8fe7d5c9d6c2845c1632984e092419370fcbd1c1936461435f9bee979f31fcd72ee5091f4831d34210
SSDEEP 24576:wSlv1nGCRYE7tnYAZyUgwvzvui3iy9CTn0AP5+2QLJrxN:w8GsYE7l3vzmgiDn0AP5wxxN
TLSH
T19A75AE13F2D900E8D05ED178C7468632EA72BC160B35A6EF0A50B7562E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 333KB
SHA256 67707c16d09bf612c51530cecb123a252079e3b1ae58e8f68b0b94e5372488fa
MD5 066fa245753ecff943646aad9070348f
SHA1 930bb4a1512da0afd203e27d7ba352a3ca56894e
SHA512 a6cc2325d7ab59192fc49f9f5340bb7477f4d66dd3f049f39197298052debc331c795365fb37d32cc3311c93294a810825340a31ada7162f6648653d19658dc4
SSDEEP 6144:eVPXX+s9AE25sAjTVFmDx0w4lIYV/PvyzgUXZr6y5Os7:elXX+s9AEOsAl9ycPvyzgUXZr6yR
TLSH
T13874AE94B3900CF9EC67427DCC258905D6B27C690B60CA5F13E836665F733911D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 333KB
SHA256 55c538653f94e32131d0492123b09fcfa72a3945fcfd4a9bdce080fd20a5a177
MD5 5c587300f0160b6b84b2a4b2f927b344
SHA1 23627d44f1f217eaa5390214f495dbf68f3e93fb
SHA512 34f13aa0d473a079dbfc138501fd270424f47aa673e0a734d690adf3759e92986186f50ce3f11564df884f4aefe23e13c5d205dcee3c79caf7849e632634e6a2
SSDEEP 6144:cbj72cs9JA+oFQSIyx7szojWCPzeYutYPDvhCwVH0Uf/Qix:c372cs9JA+oFQvyxoEjrze4PDvhLVH0w
TLSH
T1E174AFA1B3501CF9ED77813ECC65491AD1B27C590B60C65F13A8366A5F333A01D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 540KB
SHA256 1ee419a8a65822ef26fa56437037fa0f1d0039959d4aa3229eea296c16f0b2b4
MD5 39afa6f6ba69ed6861bc73143ce2f73d
SHA1 2679a01dd92df3f69bcb6163cb94974c936b7313
SHA512 6656f9f4a5d319ca8775bfd80fde9497de51dbdd38e3587d66a3522da50f6ae50197a3c95d09b501c1ffb1f3872c4d9332910a2a63ba7d3a2f6caf716d8cb91e
SSDEEP 12288:3aB88Ls9W2BbG7x93v7505LbbdIvKHvRge:3iYBbe3v7505Z9HCe
TLSH
T12FC46B90F3E814E8F1B78A35CD758511DA767C5A1B21DE8F02A8661A1F33AD19D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
Size 333KB
SHA256 8b2e596e706459d759833d69bd0a69b705b3a2e508b0db3cbed52f5c7b090661
MD5 f1320545e84ac72edea4f3e548df442c
SHA1 b4e85a4050e59e2217a835c161060f5a3701170b
SHA512 a65df1ca4b0096b15a87fbd140557333cf4e94131253cda553fda41536a541a58ef9347ed946f93924e3352b46db4e6797c6f2dfa688df2181d8ef9df35e9df5
SSDEEP 6144:qwPzU7s9g/oe3rjLKHDFjZw1HYV/PvyNoIMeiveORD1LL:qMzU7s9g/73rYOJcPvy3tiveORt
TLSH
T1BA74AE65B3901CF9EC67813ECD558906D6B27C590BA0C65F03B836669F333A01D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
Size 142KB
SHA256 59e687ed060492315ada7f0c9e266115d7036ac4f14f214a9430d7dd01f6cdc0
MD5 21db22097eb7179992feb31ce1e5a758
SHA1 ad6e1b08b9f8baded55cff5dc913849680cb8473
SHA512 73f25c9569649dd08811a8565b65329d225cff9e65b8bc3e8f6492056c81c6020b9087ce311e6bd39602b1189dedeb2f7eab98c050fb3de6da59875677cf643c
SSDEEP 3072:2U39LjlXEo43udtjZqMNbjux8xkq9n66tMbVy3:2s9flw6vv11jt3
TLSH
T14DE38DA1E3DD2480F4378A7189B5DC2289F6BDAE8EB1DD1D5294310F09B27D1847CF2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
Size 333KB
SHA256 8bd74851dd26975e6b644107c1959dbe48cdbc2c8caac620ba62fe0858362ba4
MD5 636ab68ae5b572eddb66084643a2a376
SHA1 001c744820c61764a91d73caad2ebae69739b529
SHA512 dad59f1c65797ddff763bbb9d113d0cbb289173800dfceac078fcf1ac291c69debab3ad2dc1fa92b65fd99e6970690b490f58507cfabb049d142ec3e5f7e124b
SSDEEP 6144:DnoFAs98XO+ODsCRWDsaX0V42YzyYutYPDvhf5GqLR8cy:DoFAs98XO+O1RWwo0VCzy4PDvhNR8h
TLSH
T1CD74AFA4B3501CF8DC67427ECC658916D6B27C5A0BA0CA6F13E8366A5F333911C3EB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
Size 540KB
SHA256 948550aad7bc9a97ebec05fff843aeee93d294cb7ddf85d3d8cec9694ee7e560
MD5 b8e56c0d13c1b9df2060fbe5dd658c24
SHA1 0de4a3ef16862036858afbc87099720994785dc6
SHA512 03e1c16c17ae7b9d831c968565ae84d035170a58b639af8782f4919dabe8074e5902e73b7eca4fa21bf94f3428aa67225d37449ecf4a80e14ea8c3c63e2d14e9
SSDEEP 12288:+OhZzRs9YnS2Y/6wiLp4LCLbbdIvA44g6vz:+O/S2oiLp4LCZElA
TLSH
T18CC46B90F3E814E4F0B79A358D764512DA767C9A1B61CE8F12A4261A1F337D18E39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
Size 195KB
SHA256 94e2b9607b5e37c0743f7c511b66e7fd667218541296123f63d5baef65da246c
MD5 28238a2b755b202301860970618f796f
SHA1 b2e9ef1d4512637c60d74493d6555299d2e5deab
SHA512 8077d4d365094c6e4178f3c9e9263d96cbd29d2738b798203fcf755221d0d369cd4f6e5d037d32f83b7646fa4ecc764b691f1b18d7a7ded052c13b5d71653a81
SSDEEP 6144:O/RRbLs9D5DEmdggIn1UXFd2Nwab6wEClN:OZFLs9DBHdBd1Rat
TLSH
T173148C4073F910D5F47796798C714601EABABD561B22AFAF6394211E0F3A6D0AE3CE31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
Size 138KB
SHA256 d9973bc2df41542efcc9503e16b01c323cad58e7eb7b7c037b9be189e974de1d
MD5 dd21a1c8658d3e89b421aef491655ad3
SHA1 df46b4d37df0b4e83def2fa6a67308f2a4e3faa6
SHA512 88daa4496c3d1ea6b341b6426740fa3c53ed99e2cb013adff07fab572e6a1a76fb8910ec699b430521e15c92ba4cac469f906d318c777a27b92c03e837e1f2ee
SSDEEP 3072:01Qb8ZU39828vJEisdBziuxQymScPJBc2IIGU+:eQYZs958qdBRlcPJBcdlU+
TLSH
T10FD35B4253E914D8F0B78E75AD7048118F7EFDA26AA5FF5F0250910B0E79AA09E38F71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jre-1.8\bin\java.exe
Size 333KB
SHA256 4a75fc58d052be304cdea664f37458c9040af85ed3196491bd56a6f6598e65eb
MD5 26469add2f89a14766099f5e92d5d194
SHA1 c14b214fd0312faeaf128b1edb3bc24c5178c204
SHA512 fab1f4ce0ecab2cfed17a93be44ac7822143412c8099050f17d94b1ea66f3388ea81e29812ad678be3ae6c5b79c5a781f071c9099d4b614f59858a920516d263
SSDEEP 6144:hsP9/Xs998GOIByKjcBsG/e3iVLYV/PvyLacz0dZIO:hg9/Xs998WBD5SxcPvyGsoIO
TLSH
T18B74BE65B3901CF8EDB7423ECC699906D2B27C550BA0C65F13A4362A5F733911C3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
Size 142KB
SHA256 816ac2ee0191cc805ffdcd778dab46788236a0f1d170715d96f701d162e4c5d9
MD5 411a33c68c97c49538cc5d881ba58c20
SHA1 f59eb667da5802c6f30b667282c13c573d7a6b29
SHA512 daff351b800a061f006f4aa356e096c0c3c85f2ce1b1d92495e237c8db0570f914c379d992dac29bc5d030efb530e2644f4594b074a36a6d7850d42667f008fb
SSDEEP 3072:TU39LjlXEo43udtjZqMNbWwx2TNkHIw9DN/3:Ts9flw6vvWTNkHIw9Dh
TLSH
T1DCE38DA1A3F82484F6339F72A8B88C20597B7DBE4EB49E5D1254310D1AB77D54438F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
Size 333KB
SHA256 b40087ac1eb3b94b7d6a2d8c717d931a229121e6dbcbc52ba6496e8db7e841bc
MD5 cd75dbbeeaf6a00d336042c96b6d8fc2
SHA1 27efb8d157eeb2a1d9834d770abd7e4104ebd09b
SHA512 03cb2bc33c34a6631f08846373557c5456d42d78d646d95dd5c847f16b08429ff3b409269a311d87a79f5735e9c9918aaa3db6edb3b8dbbd4980af73b2995380
SSDEEP 6144:3lJafs9ex9RVgmRZ57gsC7Hd41zVYutYPDvhkH+Y52OWLtioHbx:3Hafs9ex9/gmr579MHOzV4PDvhkH4Hbx
TLSH
T13F74BFA5B39018F9EC67423ECC554916C6B27C5907A0C65F13B8366A5F333A01D3EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
Size 540KB
SHA256 b267ffd000f07e96d39c517bd194894b564a77aa81f4e7ad8e41bffc6a863082
MD5 a7cb2738d0ebecc4e1297f48b1d6fca7
SHA1 c6773bf96ac3a1beb83c89992c72498f99a81e16
SHA512 f5a83d0b283d28dc3722361deba0fad059c0269e34e77fe6e90988cd9b5df2b7b966f59a42762adf5f5b596b86f4bb9cfe57798151e7a34059c0764a84a15b02
SSDEEP 12288:PbxdVTs9c0QpTPS8wbYJlpLbbdIvWV+BFiv:PVoQpbwbYJlpZ2Fiv
TLSH
T1CFC47C90F3E814E8F1B3DA35CD769511CAB67C5A1B61CE8F02A8255A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
Size 195KB
SHA256 17379ab5fad228cc2069d74292ca11798798dde1db13206a483e4b2e91aedf11
MD5 bac74b8885207d7bcaf425cf9bdfa027
SHA1 ce8bd5ce448b063411121c1ffb38466b28f6ab9b
SHA512 df6d87d91796179885ad03773ed2a754338f86cc1d25e9c152a3d62046b8c1acb86dcc46e6962b8f00c8ea9fce29f80a3c812c8d1bae1a3c203a8df7dfd7fbf2
SSDEEP 6144:FWHvgKs9D5DEmdggIn1Un42Vrz3xi4SVZ:Fi4Ks9DBHdBdn4Cz3xpSf
TLSH
T143146C4133E805D8F473EA7999604501E7B6BD621B61DF9F9384311A4F3A6E1AE3CF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
Size 138KB
SHA256 b38147980a51694fb6a2c05e6f1beb109d0906d769465e7c52e6552d61197034
MD5 42f71020f80b9d151e4837f4d1a0322b
SHA1 75a997d72bb56e3e335f38fa1034780270e6eef0
SHA512 4a4b5abb00cb38b8389a532701756ab2447a5c52067ebd9043365dc1d7ad69a7a1faf51d298720a3aadcff95b48fd6f7be79bcf7905211a8683c268769f8d93a
SSDEEP 3072:iCQb8RU39828vJEisdBzYMsxtibUsLBwqpB:jQYRs958qdBplSq/
TLSH
T10ED36C9177F924A8F4739A39A9B440158B7BBD921E31EF4E6340420E0E35AD1DE39F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
Size 4.3MB
SHA256 a038faf583f61780661b126e1871a97a7a27f88be764ecaef98e2017f1c42a80
MD5 c8de58a018c42bcbb44e0a4a92bbd474
SHA1 1bee87ab5a1ddaeeb2f065a35a35c1db1aba9e97
SHA512 56c1845f938aaf539b4a921ce5c2262d811cd712a8961e4bfc680b76d497462e30d01a8b2607207d4270239e7a6fdc689db55d5f8e5cfddb4240e1f715c6fab3
SSDEEP 49152:qEOtqlBW4j3w6MlRTljsvy1fA5LtdxmLm7ZEoRW31euZlk8KBSD6dPI4UV8NRV3J:qEu4GZjzCLqUddg495Cu2Q7
TLSH
T141265C556BF880F5E0A7E178897ACAB2F7B678420D31EB5F0191C62F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeClickToRun.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
Size 4.3MB
SHA256 af40762e1507052d00dc3eee73e8f2d0101b00ba22f75369aeb018afffce377d
MD5 1f40cc80aa941e2579a85b9566263971
SHA1 306c32fb9880752715edf0d0e4381e5a362c1cd0
SHA512 1a51d0ba749959cd7e76fb1ec7e2cb35e3165e8f53c5c4700691554039178bafa3a1b0173081e5e1d84d53548c9f45d9c7408d3ac96bf26cde40767cc8560dc4
SSDEEP 49152:xrzOH4wvZa9qnkmYVXbbfaoTbLHdASnj6Y/B/3meu7mgsWMuSjyHki1M8NRV3THS:xryZ1EX7PLbIiyEid5ClTquIC
TLSH
T155265B556BF880F5E0A7E178897ACAB2F7B678420D31EB4F0191C62F2F336905D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVDllSurrogate64.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe
Size 275KB
SHA256 e9eaaac400b6af19d78c01fd590df2f0e63dc1a42ec1213c2355b872ae2542f8
MD5 dc85579d8bea88d0510405908e93cafb
SHA1 2c17be85ac13ada9bb717539de263e813307526d
SHA512 90a0d8cfa98bb9b7409360406392308fbba44089216326b1286e4dd7b01051d17c883c674d2958c436f9a2804d7d623dfda745b382fd75ecfb0e66c28e42e715
SSDEEP 6144:3497JUs9IWGNTNYdMzATVkQNUO7q596i+c8n6YwaHEX:oxas91GNTCWsTGQ4Wpn6Y0
TLSH
T19154287BDD38F8D1C37E9CB867A1C700AB3171715B42228BE179C26D8D127E15EA9C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVLP.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
Size 588KB
SHA256 0ab293790a0e8664a16c0e7b7c1520e57cef6662c102d252c57b8c40429b30ec
MD5 ac7d7bb6ff1f41190f89b7d451b1beb2
SHA1 98d9d993dc73b974530e5550dd53af8b1b36ad8e
SHA512 38d9e2562cd8266e53e90b7c28801d43646cc609d491cb60f906a57074fa9fd545411b10974c1d290267429e69f9ba085504e7fc9591dc5321bd44f59b9e8d56
SSDEEP 12288:+EAkWt+Ys9eVluzvNU4TEYicToc3CYvE/:wkWQ5q/csc3Cy4
TLSH
T1C1D48E7AEE28D8F1C17B897886968601E6727C110B61D7CBF16CD27E1E236D05E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Integrator.exe

Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
Size 6.8MB
SHA256 c3899bb37f14925bcdbe5ad87a4c69b80419d07743222389988dcf503b67b31f
MD5 c80dee07557c691491004142c0873e54
SHA1 160389b32e140a912d97a4a468a3b654187f30b5
SHA512 c678e5f4a77b42e6ca01fcf340557ffc664685c0d4a2b176944eea20a067ead047f5d036c91c77acdd1851eb18ec48db8ed5402846988f32ac44daf9fdd0d03c
SSDEEP 49152:QsrBADQSWcYVHGFLbPSGGgtM+IzxMi03gcui21nZE9FSA+pnFYCRQ9zOB17/xYtx:QxkTVmdIxhXFTFB1GWphrrmqJjeb2O
TLSH
T19C6629596AB481ECE0AFD1788D778772F67278429E33661B0261C61F2F33E588D19732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Mashup.Container.Loader.exe

Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe
Size 100KB
SHA256 8483a2e1255e67580da91c70a1c23dfbed3dcbedb45b6af2e60909a9500dec96
MD5 c8a6a2c15714768f49fc64ee29c97d5e
SHA1 98d0d71d1c9f53bb87ec5f754e3d12b7abf53683
SHA512 d9517b54714f79a80da554be556068e683514fcf73c68f2fff97c6a2e29d06c3c322fb35bdac948fe09c88490986ebf00d381196bd02da54975955c914a84d83
SSDEEP 3072:0SMU397eAcIPNHF9oZeoS/AZ6qRqUCJT3SI:0SMs99PNl9oZeoS/AZ6qRqUCJT3SI
TLSH
T1E2A3D049AB5E1AD9C6630BF04061420AB7F77D122B65D38F916BD24E1D277C0ED3BA83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IEContentService.exe

Path C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe
Size 449KB
SHA256 ec8aa12d47ce682f4bb4b2f9aec67ee351a3282b39ea6194c7f6043c747c9a21
MD5 6d0251ae21dcd3b2c6fbb8bc1cefc7b3
SHA1 d8799f3d47d0fff0b287d6a7cee0d5c4eb6e9a3b
SHA512 90ed4b13c1162f7775ada1236c4e1543eebf1c9d0fa5e4f19a18bf270b6b4bc0fe548e3287ba64811f9329d5adf841611ff84014b5bf2eedf1d67bf4a4f4d1da
SSDEEP 6144:xNYsncZAwk2qugcOYdflee+S5fSQs98eoF5jfcbvnmwVFwelwG/MNJ:vYsLwk2Pgre+u6Qs9+RfM32jj
TLSH
T181A48D8AEBA484F5D657A138C57BC671F7B2B8C90E20674B1665C26F3F33A606D2C710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerfBoost.exe

Path C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe
Size 877KB
SHA256 2a10cbb06e395b18bc276fa6de3b21b7a856069ac9fd5d39a164e445e9a5b3b1
MD5 ef110ed67caa9cc6726319fb6ed009c8
SHA1 f59ade513373b52f7ec30da5d7f39a8d1e9be038
SHA512 7ba2050e3efb840ef68ccf9492b448f003d347b55ab03584bcd6bb120b2ae9099fec8c415a2caabce7e0614e6f21bfd82d4ff2b3a1bd8d96ae14f9e23e27db7e
SSDEEP 12288:6GHLjGIcPbIOLVs9ppIlaOL6EsM3p4vpEeZob4UnV5BMw9dTbORTz:vHLjGIcPbIO9aIrn3upEKdUnHBt99mTz
TLSH
T1C9153995ABF944E9F1B3A67499B68571FAB2BC621D30D31F0160C25F1F37A808D25B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDXHelper.exe

Path C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe
Size 189KB
SHA256 cc633eb156f0529b8273d556373e1f9b0ac606ed94ba43daeb8001da301d65a8
MD5 25e912c847c37b7a5003f16ae2b4de49
SHA1 e97856927b100055759ccf6e7f2ccee6251c7df2
SHA512 73288074d6ee923786d281aecd3957a62b16cccb8ea9cf2bb6f17336e909a1db68b40dc64a0bc131119a35c57036464c121e2993ad761ef915d40efb224b95fc
SSDEEP 3072:toZSCTpxNq/D+U398m1Q2+zT6lZdAh3SJxfFrgrwHDWl5C86fns:eS4nNq/D+s98felZdGaFkrll4JE
TLSH
T18A149E1E7BA0A0FAE40291B4C568EAB5E7B2F5F15D22635F5351C28F0F737816E28760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoadfsb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe
Size 2.0MB
SHA256 6eddb86a421aa543d3ebc8d64d9ddd62903128a7a853cfa08fb1b3c699eecdc5
MD5 070ec66054434d3f313e5b4f50b4b6b4
SHA1 931fc06e8662ba1fd97ef4e5cff9c632793c6eae
SHA512 e532d551a50f455ef66948a75b9c7ff5df1fbec86de85e96e19e5d98654f3fefef6f4bdaaa980597bc08aa99d1721a7e1b12deddc2fd0d3f9ca2424d10d92277
SSDEEP 49152:m0j0RVehroJkAYr/Nwd2A01GFT7bhl3rX:90y+NJX
TLSH
T1D5A52946ABE8C4E5E2AAE2789975C9B5F6F2BC414D31974F2156C70F1F336604E38322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoasb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoasb.exe
Size 341KB
SHA256 3b20c9b86aad9bfe9e6fd1013fbd0ca923080349af95480637946c99c090a1a2
MD5 2dadc2926df30c7a2e247be477be54d2
SHA1 357f8e67c4cab5354058bc29c709d80835f092e4
SHA512 0314fba1f46fe5f17c8c2b03b87f90cbfe29e0ba8f2c23a13acd966832e7332aaa18d51328fe70b79f3bb4d038d87c2ef9781e19c83de96943fe107094d19af9
SSDEEP 6144:/1Ncs9kusU2jPRZ/85vaspBynton9bhvRx9EiOwZexhwfdJ:/ss9y3jPRZE5vasp6on9bhvTmw4w1J
TLSH
T12D745B277B688CE1D91391788986D6B6F7B3F8505F20D30F2992C36F1E37161AD28B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoia.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoia.exe
Size 6.0MB
SHA256 e964544c5bb34cea9a5f48be96a59545c3e57c4b68c6dbce74f88fa4dcc0f2b5
MD5 c529e92ff8033ba52731bb668622d160
SHA1 412c9c4a718321f1ab9c5358826b0e07eb653e19
SHA512 faedd75bb2a452485e2617c6249f16e59f549843b2ab2d67d48c981f29089d71bef7fe547694f1a3284f34a93576a3149da830bd21f8e8ff259ee5e1d97701bb
SSDEEP 49152:ic6MHc6TKP6kavRpdzQzz5h44m8hSET2bt2I24pEG8htsoxK293+XQK+P5jGSUAo:iXIzuV8h6x5KZCLw21ma6r
TLSH
T156564A557BF982E5E1BBD134CAB286B6F6B2B8555D31A74F0451C30E1F33A909E28332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

officeappguardwin32.exe

Path C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe
Size 596KB
SHA256 4a4c4aeaed0c29d21a4852e5d29293821b8c00e6333819694827e3a37fa8d683
MD5 366732b90a08092ef9c9eba4d9a147c1
SHA1 5a54c12ba113f330bc3ec11e732da1329e5edbac
SHA512 c1c40b7d7208c5bb87847da6dcba3a14ab6aab70b0a18c9adae43724fd3740954862441592e2001656405e69b35448cec3aab94687482c9d050d364c6224925e
SSDEEP 12288:+kQlQfJngcpvtLgMbX1s97cIPr0lypFpfdH:+kQqfJdVbXFcAlcrN
TLSH
T154D43941F7A881E2E166A1348A66C571FA7BBC130F70D70B7559F22E2F33640AD29B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocolhandler.exe

Path C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe
Size 6.4MB
SHA256 523a38aad4284ec92ffe06e6b2212ccdd6cbf3e599c966bfe31e25e1d4a0a1a1
MD5 b4868c889a91ac2237448682bdddc675
SHA1 caa89dc99452b8b17214357b12d5cc38a7639c12
SHA512 4ca83fc7c120ef919e9255f976f520db3595347cfc6e09b9b7308172b512070c9699a1492c9a05f6c8445522072090d58ab28be84a01a2f2948bd3c584023508
SSDEEP 49152:AcPWkfGQPztYm5KBj5rsjGum19kNPsQiV4CESWBVp0V7mu1frS/arRYFpgU34VD2:kE+YSJmJmRccA6BzHjGp
TLSH
T17E666B417BF880F4E1B7E2788A3A9675FAB278425E31AB4F0151CA1F6F776508D29331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OLicenseHeartbeat.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe
Size 2.0MB
SHA256 d58dc333e4eb6b0d89e4caf35594f1450175617534a39af069ce3309d38b886a
MD5 617d2f29ff0f870db052486ab1b53aab
SHA1 bbc209675d7b5ca548d3d4e8df24f475befbcb78
SHA512 86b8a117f3eb5e3df21b0c06186dc00fa528dd6e7404a2fc9a7b4b546fdc8fa1df50403199a921d418d7d27163982352b0edac9fd25ee435feae98e6609931c8
SSDEEP 49152:7UE2Grf4Zo3NG34EAorrDhjUYrU98xjqrACP:xbJT
TLSH
T118A528416BE881E5F5BBE7B88AB68979F9727C521C70E61F0156C60E1E33B408D39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLDumper.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe
Size 222KB
SHA256 323ee39e8646b4bdca1fea94182679bfe13f58a6045e62cd2f68ad69cdcb3583
MD5 3bbb8f003862ffaa2be0deae636c43a1
SHA1 8717f3986b9dd628b554c222f3912b1df6f40f8b
SHA512 0d7f850e2842b31f1b961d7c5685e2500f9619ea4fad75c97f8a225827ab9f41a971a1431a94130c3a5c08a319d6ff3569d23bc5993a82b29e36947b0eb24b15
SSDEEP 3072:XD6RUj583tyU39Haj4+qrSVzN2Bmt+hl9lhpxAORk9QffiqkxsC:XD6R+5AUs9Haj4dizabNRk87C
TLSH
T18924590077F92058F5B3A6B0AEB581576A77B8A52B31D7DF4148C26A2F33BD09D34722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohub32.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe
Size 2.0MB
SHA256 4b2f5e6fc4e72b246abc60b44f44ea0ffe703d60602c5d02ffc1e975d3231ac3
MD5 410b46f89f3c2e6a5d29d667f5ada208
SHA1 85f4b93b2d483355850b8c535a52f2b2fbb5e0ea
SHA512 49c80067f47cc48bed54a0e6c400d74501f5f62ca42b150b7ab462972da4d03d424090fc5c4892c91632609daac9a018cf4ecf38215473cf30bd1c79b72ece5a
SSDEEP 24576:k7oKl4F8bYGgRoassnOWh7AaDM52A2NBH3NRLOD/1FVwQPDFVEYhb4FgwPqe0PjZ:k7oKl4CWF2D4ULOH+MYu8m1/p9Q7
TLSH
T193A56985BBA484B0D52691B18AB6867CF772788289334F47318DDEDEBFE36604D59330
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreporter.exe

Path C:\Program Files\Mozilla Firefox\crashreporter.exe
Size 3.5MB
SHA256 ca2f85071ae024ab6a3ba6e1713e011d047dad862d700d8324d28c4ee646479e
MD5 c059ec7fdc1946d3f1ff4af62bd954de
SHA1 9a018ac9f01bd2f395989d78b5a657622a896088
SHA512 c3d73aa5377b7da2878846c19ee50dc26409cb68a51b3a6c04b8a57c7c8c4a72fd096a534d43f6d1c96c19296c2b4cc36e0c38b1257997bebd9af0f598eeca94
SSDEEP 49152:dUZADn2/JWa45pk9HO28wsz3iDT4JmeDNB05FQz/MTmXLhm6kV9sWlZJ:dUCyJWLGE2Jg9f05Fy+aLhm64R
TLSH
T163061842EB611DDAC025C0B482266723B761FDBD073036F74A906735AD68EE01FF9B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox.exe

Path C:\Program Files\Mozilla Firefox\firefox.exe
Size 777KB
SHA256 ee74ad7dd06f1b9b7832a0c7c4e6f75b4c6f290cf1d2dcf4f54cbbd130874180
MD5 6c7690104b7542bd4e537bde9729982a
SHA1 6a610ea7090f2ff7ad27a94c9c0a00c171b57b89
SHA512 9ff05885609bcf4f82044f88b64252fb6e0b25830c03b6a52cf27f8a632cb2def8a5ea779f3a5ccab297aaa8d9d90cfbbeb535ce8d9cb4be025e47e39d60b414
SSDEEP 24576:ls/VdinkW2/ghdm4SwpemIwpelzEtyEw/z:S/VdikW2/ghdm4ZpeapelH7
TLSH
T1D005BF03F38516F8E48AD5789A52D633A5723C840B51A1DB1BF93F2A3D71AD12B7872C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
Size 329KB
SHA256 ff70dfb933fc6e1084d3f3e05e703ecde75b07992b3713f2af2111e0151966c2
MD5 d5e3a4614381d5b1ac25f0f06703db66
SHA1 8313cd059b738e3febeb859edefa65b6f9a416d6
SHA512 921f22fd27265ee6fa90b550ffff62b77987963860d39e92b1f57b98aadd2cd891358c3dbfcbdcf7833d33293ef6db43be87fed862567b5826fd90f2fbd4ad85
SSDEEP 6144:WXs9bd60urYg5Ft2S5n1vSg2lREDK/iJPsfUrcATpIbqM2ybL1Bj/vUC0:Ss9bd60urz5XJ5/2lRt2czATem+e
TLSH
T1A674BF6477E008F5EDAB827CCCA18916DA73BC514760E78B03B48A255F237D81E3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nmhproxy.exe

Path C:\Program Files\Mozilla Firefox\nmhproxy.exe
Size 654KB
SHA256 4f39077a8c2a849e807540b4a6f21b79c1fa81a9ed3eee7814d19df9b846e9c4
MD5 3a652719e9414410fc42829fa39e7670
SHA1 e7b69f41adc0773eaf6efdeccdd3d809f30f6b48
SHA512 33616b3e8472835b66ec6e127ffb2b709cb20433df53ccd37d4ede9c59272afd8c7f2d05f923009da53acb2e9552a80baf97804b10990daec2caf4291a9d1ddd
SSDEEP 12288:MSzIBn7jlf7/qpYwWjyo1s93Pc/waheNdtISpOMRM:3zIBXl7qOf/yvO
TLSH
T178E47E02FA97D4ADD51EC478864785327933B4CD0B30AAFB32985A393E59AE12F3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pingsender.exe

Path C:\Program Files\Mozilla Firefox\pingsender.exe
Size 126KB
SHA256 645eea1dcf14446a6955465ac1a7ef345e586687f142bf08909228cc13118146
MD5 0cbb563dd3f9783c589e94ed08c7e851
SHA1 04530209f1f9689ad8da0329afd7580941316e9b
SHA512 177a16240ec96a09950ea51351e085aee15961629ac80d10da7d8a6d61d355752661def6897878dc6007cefc20074562851d559f18567373388b7b2dbda0c5b3
SSDEEP 3072:MXgrljFU392tSh2SdWA28NLRMk5JwHj1ov:DljFs92oFdYwRMk5JwZov
TLSH
T158C3CF43571A58BAC501CBF0E0EB962393A639459B762BDF6368C2512F45BC06FBC3D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plugin-container.exe

Path C:\Program Files\Mozilla Firefox\plugin-container.exe
Size 202KB
SHA256 df3c17c06030bab4b56515f2ce2406c1142e2292c9f07bfb1bc5f763406b881b
MD5 f4fd4cb80f2e923f97d1495f66921b36
SHA1 c0d6d927dcecef4134aa1f8b580d422de9079196
SHA512 fac0ac52abde2bf2920f6d651af3357a70a31b7a0a9ee9126ce997050cc90cb24fe000cf051c14abfe7fa8ba76722055e34fead19e211b638f98ac75277a9643
SSDEEP 6144:mIkKqVkYs9I8Wzy0EuDV8fsvIN6mPZqcoyUeH5:SRVLs9EWMisvaZ
TLSH
T1CA14BE23F68801F6E499D17467D15322ABB1B9C60B25A7DF368820213F56FD87E3D3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.exe

Path C:\Program Files\Mozilla Firefox\updater.exe
Size 523KB
SHA256 76111164417fd8eb9c688044a188aa84ec159fc9a38b8cf0ccebc6f206dbf144
MD5 59e3346f41d231c0a6ee17c1dd5a52f1
SHA1 bd1cd714213216f419700196e406acae9d6fe62f
SHA512 14297ed113d9bf667a53050ebdb18d7d378d4d6a61d98c464fb612ac92b74f325fba5b04d81aec0287cb997e7178d420b7432b4c15516570113db7df86fb7040
SSDEEP 12288:4dTnxs9Zjb9KAp/Nbk/+Q2ZeGSSOJAdGyq+MpAyeNKpy/:+Tnijb9JOmyJ+RvMpAyTpy/
TLSH
T1EBB4BF29F3500DF8F42BA278C9A28511E672FC650760A6DB62E4D6163F332D85B3FB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 188KB
SHA256 6b54411a341a3c6c644ba9dcd60b9eae948ba7024f76822bcf7bc5f322f10402
MD5 757abdb5ac36b5828b0986835bba8e3a
SHA1 bf8f52e5091a0828665aaf3b91ed5c114e362982
SHA512 f2e12da30761d24bc8b7e4f356bdf0e8cf0c689aa8db73b6b07c6444424696d3d1600759f771f2e1cd5604d74441234b381e166bcab2053daef3ce5060cadb13
SSDEEP 3072:GHHwPLlOU39UOgV8pQFq4XKF3QP8pPahxh0nbtI6ZfG+leTqhsV/Ukrh0hlFjsjj:GnwPLlOs9FgsQFqT3Qway3E
TLSH
T1CB14691AE29802C4C0BE5674C7515692B3373C6197E2D3CB62E0F53E1F3A6C09EE9667
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4840-2-0x000002AF54130000-0x000002AF54135000-memory.dmp

Download

memory/4840-6-0x000002AF54130000-0x000002AF54135000-memory.dmp

Download

memory/4840-4-0x000002AF54130000-0x000002AF54135000-memory.dmp

Download

memory/4840-0-0x00007FF780DC0000-0x00007FF780ECB000-memory.dmp

Download

memory/4840-1-0x000002AF52910000-0x000002AF52917000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads