a8b2928181b5db0de38e8afffeba5ffb7c63b295d6d4101d4009bc3e71e169b4

Analysis

max time kernel
150s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 05:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
Size 1.1MB
Sample260804-gnxq3aea39
SHA256 a8b2928181b5db0de38e8afffeba5ffb7c63b295d6d4101d4009bc3e71e169b4
MD5 a8d4e9bd17b18803f739ebd7e53563ed
SHA1 4297432126969aea64728783481ee92c30157e35
SHA512 661e1f13ca610bb4b6ce9e8f4f1a5673a2830ebb169c97dd023f8d6908170adc6fbd6cec708e9865eeb2199e7e51fdc622dc2a4a4a00cae080c03e832c5c3c26
SSDEEP 24576:UBj2bbZ1qykNc8h/iSCpEOAVupyO2aKFxSqvjrc5xaNIBVv:UZurqykNc+/iSCpEOAkpJ2LrSqvjrQaq
TLSH
T1AD358D0A63A4419EFEA7F176D617C60BD7B1784A0376962F01A46B726F337711A2E330
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\N:	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\P:	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\U:	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\B:	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\E:	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\G:	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\I:	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\J:	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\X:	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Y:	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\K:	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\M:	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Q:	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\S:	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\V:	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Z:	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\L:	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\O:	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\R:	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\T:	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\W:	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\A:	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86734\java.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4112	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4112	2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_a8d4e9bd17b18803f739ebd7e53563ed_agent-tesla_amadey_icedid_njrat_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

64BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
Size 296KB
SHA256 6351afcbac04bb3bf9d45675aad160e27322bb6d73ac468a69dd721f5cadf486
MD5 0701bd736023e80467f2f14a873ed23f
SHA1 e82f5812801a3cab73d0d00a4b4f8c899486e257
SHA512 9c997b701a076ff20f739fc4b6ad875922845d2c8b5bbbcc7fceffc11b4b923d4c165ac4f683f5e689f8328b61c4369ee2ea57c3cc8c12d0dbb76e3cfd840eb9
SSDEEP 6144:hdYs9fMNs9yLTaSdcCHp/TxnRdcJtqQ1NhaUhRgxfxBgCbSQKU:TYxs9G2C3cy4vQKU
TLSH
T1E7548D1A33D84CF5E457C27989929642E6B178950B24E7CF5364432BEF636E0AE3DB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86734\java.exe
Size 333KB
SHA256 ba3dfc2d6807a0fcc9cdf4d1c54fbee3cc72222135625bee909b43120636e7c7
MD5 bba6e9e159ecbb26f48299922dc833a7
SHA1 330d8fc4fdde75f618807b2aaea66ab53aca57dc
SHA512 b309e7acb9214b20b16721478258aab652ba22ed408263a18a2c04c005a0949bfeed71e34d93efc1e2f2f4a0bb6d616410a87a8c3ca35d75db9b53829e9c861f
SSDEEP 6144:CAPF2fs9yXPAA5ZjaqiS33gRJdYV/PvyJwi7Xd:CcF2fs9UPd5ZfMncPvy2i7t
TLSH
T11F74BEA6B3901CF4EC67813EC8558905D6B27C590BA0C65F13B8366B5F733901D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86734\javaw.exe
Size 333KB
SHA256 e5e55b25dfff0c168586cef817fdcb622194846682d260d84328b6a12c745da7
MD5 e997289e56639d350a786385387a6d9e
SHA1 91b16980210e5fdd993d3242907b9e5d6729291d
SHA512 7c031349bf2d3ac5d172cd30592c0e325506234b7518acaed217b097bd1a5d6283af8bd908172cb318713c9ff7226689fddc2fe1ca6c4a55759b806a6fbce767
SSDEEP 6144:ZW8YRs9y1ovykz6+gazsD/WmKpzdYutYPDvhXxJBTr:ZnYRs9sovykztgagLWBzd4PDvhLBTr
TLSH
T11674AEA4B3601CF8EC67863EC9558906C6B27C590B60CA5F03F436265F733A15D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86734\javaws.exe
Size 540KB
SHA256 68e34ad43b114bc0d7590bfd17502a5f50bd910f176adff12da352279570a405
MD5 6f0b91d5cd434b9cdbf4c05ef41ede96
SHA1 53769a0fe5e709549608a9c717aa49ea3a7622a4
SHA512 5a5b7a119cf6ca0d99c3f61de44b10eae98fc45603d38b9e139720ec376cc88b2f5c677a3eefa5b217e618bcfec44fb8acdf4c7d7abe30e55785a62685c1e438
SSDEEP 12288:a0NBeFs95PmcXBS/rsniyXnLbbdIvWZX0og:agFmcgsniyXnZF7g
TLSH
T163C46C90F3E814E8F1B79A358D768511DAB67C9A1B60DE8F12A821191F337D18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe
Size 596KB
SHA256 571f5487a743a0d613f3c2eeda8abb6ed2c15ae5e44ee5e56f0c614196e5c711
MD5 d04ec0c2f24d8b08d8282e98868d98d9
SHA1 5182e778a772ecc680f3ef53a1efc1f8f237af97
SHA512 1ba8f2051045e8057d070a81d16797656088dc555a394ebe05311f53b96f0c75548bbd0bf0328491061474057002986db6d33096d79219b2e6d370a691eddf9b
SSDEEP 12288:MCs9FtkBVeR05/QdrAArNSwhkH81ad4zU+WDiXj/ynW:stkBVJ/FOUpDiXWnW
TLSH
T100D4BF41B3D846E9E06AC174CA538642DA7378560F24E7CF02E092792F37BE95F7A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe
Size 6.7MB
SHA256 959b9c4efa7b8f8cdddb41b656b55d3deb766641e44781770f830f705b765103
MD5 abf91dbfe1199e4e90054e55c0ab3519
SHA1 231c70ca02424b7891ad0234c47e765c75e746d0
SHA512 7aff508f7f157c921f7e3378a38d9b7b06ad4171f69e1946626401b8a445fad21eb50e0b0239c5e96b2b49ddf0dc97f0d005332204b091dae7ee221178dc8b5b
SSDEEP 98304:9l8YfTaJ1+WBuB2L4HrZtYPIieK5M0uR7F5eaG/:D8YfTahL7IiFUpIaq
TLSH
T10C666B47E3A600A8E46ED970CF3A5521DA253C8E57B493EF129476E81A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe
Size 1.9MB
SHA256 81b0dc464844b0b67b1a497b038f4b89f6a3e9055761309a56d119cfe516115c
MD5 d7c3fded5ec1e8af6d672195b34c95e3
SHA1 fda3c07c229dca23991035d8dc1a2bb282bd05fb
SHA512 c63115b11e3e9afd0f743828a6ce58bdc227a0226bba918900c967521a4c9062ca04f1fea6a68bf7cc5a639f89de53daeb9c3b8694e6c3676ac29a7ba7c4db6f
SSDEEP 24576:qhev37Sm7U2nXWVX9KU+QMLZL2NLb9Ld25PTOocJuJ/cIsY6WfvwKcGmapR:Cef7S+UTX9KUCxwpZeToMJseCRaX
TLSH
T167959D03F69941E9E06ED578C7069536E9727C890B30B6DF0290B2992E77EE49F3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe
Size 1.2MB
SHA256 7c27bb3b3260af328948c4b5037879cbc57771f6495057a5e7b5a0a8aa889fa1
MD5 3f62207b8eae080f7c6f0d7b59785e51
SHA1 b15df8a3d512a7b3ea2bdb26007909d8fb16213f
SHA512 833c12a15f4d02180ea15411a62c3b45f25f7bccd490f3b7ce6cc088876a3bc5f3e319c550d315e4e593c70f66f7dbb814c319afe92e169eba8c385f3e4c858e
SSDEEP 24576:i0rETIzLs9XvNmXT3rKXzlZ3Puwj/PNZ5IVprSwfE/rFn:i0rEkHs9XvUbKDD3GG/VypGKE
TLSH
T1D745AE07B7D841D8D029D5B8CA568132EAB27C860B64A6DF06D0F25A1F7BEE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe
Size 3.9MB
SHA256 d8f67bb80ffbab2d25389c6aa7a103d5cdd4dc4bc58330308ff85843d06ec180
MD5 72d447c51dcacd32c349bb392a8c4aa4
SHA1 e9fa88e1df4548925278efa1a00b9fcfcc9e723e
SHA512 cfd090aeeb7b7b340a49501779c04a511b0921d682e2a19f32d0bc1232c1a1ffbd6d48b4403300ad3fdb3e17ce63291b103f035ca92c90c77852239782106280
SSDEEP 49152:hYy+mzvJ3LMoc1S7/UMqbYqW4jvH0GD0AGjuVEusJ6LNzOeL0GKVIeCjIp26If2a:tEFSjuVlcm7fwKA70H
TLSH
T154165903F29940D8D159C074CE5A8132EB627C8D47F562EF3690B6EA2A73AD47B3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe
Size 1.2MB
SHA256 b1e1e1ec548373176436ba841d5febd05a8b4d4b7ee3789867a54819a6b0e51e
MD5 50410fe92773f6900039b92bbb4539e4
SHA1 6a713028ac9803453284baf9d53f9dbb1697e546
SHA512 3992350bfc72f0e89a213e6fb70751512c38f66deb9bc7e8c43d639723a526c2a513901b6bcfd5b5003a99488b06f77973d1c2d518a44dc46437848a7138bf39
SSDEEP 24576:Wrn7KEeumFUMXjDbgc+J90xq4IvJt208m15EW:WrnmEerF/bt+DMx6JcNg5x
TLSH
T14E45AE07B79841E8D02ED5B4CB568536EA727C420B64AADF06D0B36A2F37EE45F39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 1.6MB
SHA256 414efd3faa072003b92d81077c27c1d85be75f515bf97091df525a1119f6a472
MD5 a2e0db02e8b5253dc8ddb47dfd112a3f
SHA1 ad67647720c5e809c96163533d87c2c35a3dc4fb
SHA512 771a517542491ee2598b5d4351afe4bf71a5e82394fb3836f01d3bf1bdeb574ee162d593ce6b94c85a3b2424e4deabf10825ede1bb27d5668fd1de6e5212a58b
SSDEEP 24576:7XXhpX4hBSK03sXKQSL1woDVGFinwDqPpxZflkkkkkkkl0T3gAQsS1ZFn:jhpohBH0xL2oOiOu35PQ51ZFn
TLSH
T1AB759C03F68A81E5D09DC2B8CE764B31EA717C655F2096EF0190BA253EB7AD04B397D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe
Size 3.4MB
SHA256 0d16446f599fc79268ad24de44c24aeb4f9ca0b31d789320ee74f6cb7540eeb0
MD5 585e1f0b06e2183515a8fd28fe3023d8
SHA1 db901ea94182eaf42ac1e365c246f8222d80d198
SHA512 23f3cbcad2ec7c39cd5ee90879dbace48eefbcf3e47c130b0e29504af385c7a5857c1865540d4cbcbfd9ecff098a4041e6d746a3f5b19eeadb660edcea055682
SSDEEP 49152:jP4TU7fVjLg03Y4qGLJeXKHugI8UqMzAD9ulO7Udq+KqOuBk7bVnU7wF62JtYV3o:obVw9ul1EE4wsS4zB/
TLSH
T1E9F55803E29900D9D199C078CE4A9632EB627C8D47F562EF3290B6D52E77EE47B39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 1.4MB
SHA256 25e9325287e86f3c4ea6ae25f8e7ec93caa472eb4dbb8cf908e453a3de27543b
MD5 b30e7a560844054749dc03c4ac79d9e0
SHA1 ab8cd168266d88d78688eeebe47c70040036ee63
SHA512 344ac23b0717f0d07b90bd19e7829f53536e0bf5a85a7b5318af8acd3e4e981ea01f7631aca4da4f123147efca2e666638dce0e8bbf99170258f89d7fbc10864
SSDEEP 24576:TYnAcfZAegjHQXrEO1CoM41FqGRzbXrse1qRABmcv4YYXrZ25:0nFA1j0DCZSsGRz7rsS9ghbw
TLSH
T171659D03B29D41E8D06DD578CB564536EAB27C860B34A6DF0698B2462E37FE85F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe
Size 1.2MB
SHA256 d0a9a4be9245155048524337f738cbe74974aa02275f1c68899de630f263efa4
MD5 1c9b16633c7f8ebf5e5961de0fb1c347
SHA1 17d2a6b38f1e5aa2d5ec724e8a24feba4c0d4c2d
SHA512 7df8f820d73e0ace1d284c52ff38fae0cea572db088d30f10ad667f0052ab7f03d425fa9286daae2595fea265bfdf769cc38a860a75499ece8cece2444a64a22
SSDEEP 24576:iAcKHKKYoJPXj5MuwatVXU/AVY2HiONzSkgS:iA9qKYoHMvatVk/AVxiONz3
TLSH
T12F45AE0BF79840E5D06AD578CA568531EAB27C460B64A6DF06D0F25A2F37EE85F3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 248KB
SHA256 6579f1ee354dbce3343db5bb509f6dab3e3ac9875ec33890e85d0a9c91f7ab35
MD5 b2a0c8a65be25681d1a3a19fcdfbe582
SHA1 1fef4d217d43a8521c85af9b37577cbdd7d8b2a9
SHA512 4719653a55e6d8f4f86554141bb96c2e973a7802eb87dbcbc694810729a4afa73805b8615767033b83c7a3226c5445db01501c8d577ff2eeb23384fe892e2596
SSDEEP 3072:6U39yaO+QTw3D4HPA3gnbC/4e1hDKuR9CbOwWoY46TW8sgyhNCOVervurvdbaBw3:6s9ya80T4HPAGbi4KDR/Cuoh0fWbk23
TLSH
T190447D6976F910E7E03691B4CED19503F334B87627208E7F4390422ADE63661ADEBE35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 265KB
SHA256 836e0ed5812be9268099aed3cebdaef43a7370f153eca209795f2f7efb39dc03
MD5 69cd9386e763b649f8bb66a9e7faab4c
SHA1 9bf6f3f7e491603fb1d632fc8692e65ff3cd0922
SHA512 d47c5bf69fd531f1d80ab30c80ea98a05e8fb8f16411c26bf4c4385a47166ed54b0afe542d756d1de4480c99fc44248c0c35410b8799741c2f9c49fbbbe3bcdc
SSDEEP 6144:Xs9yCzYQfraqpBKyWfbYWoht+uoZaxd9FIU7:Xs99zYp4MbHo3jbQU7
TLSH
T1C5445C6925F810F7D176D5B48BD09903F274E87263108EBF8291835A8E13AA16D7BF3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 610KB
SHA256 afae4a08eb6b1f21b4b3aa02bea8bc4204eab28850b494d74a27c77c99f6aa18
MD5 7f02f0ae8e7b877531db3f5ec755d880
SHA1 716d46767a8afb97debb75a70854902fd5841664
SHA512 5bba4e3260c99e6ca964f8de7e40f06d7f669109d4a0dc7305272bbfe19ea03dcddcf2323fa0ad23a2e0797fcbb13fdf07b830619e52e98518fb7ee3d6b4912f
SSDEEP 12288:3s9yF2VW87/UzHVlLySWj69eeT15rEJQSAZrMrmWv:HF2V3w/q69eW3aQSAxI1
TLSH
T141D4AF41F3D857E9E07AC534CA528546EAB278960F60E6DF02A0527A2F376E54F3F324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
Size 7.2MB
SHA256 941e196d58d8d9b564c6d7df56c80a8d4ca01ce6fddf85cac5035def95374ede
MD5 9508257341a68670e2837e62319d03af
SHA1 50bce53b188271d5afbcac899ad33e923b162f16
SHA512 029a4c6223806efe4668e7ad87c4ac8c008e17849cad5805f546c4355b5343d5f5b409e495309b1d6bed074e80b897c77d053e257c9199b1ac64c9dfce4d212a
SSDEEP 98304:86CZetahq+WZrnuwCsJB2++fG+OxRj2vJzRN+T6frXKPP:fCZetaOuGIGJxVqzRdDIP
TLSH
T1FE766C07E3E600A8E46ED974CF2A9521DA353C8E47B492EF169476E41A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe
Size 3.9MB
SHA256 3a9eb6a9354b25a2cc6474289ce53fa111bad1774c539381abc6eae28123637e
MD5 a1eef4057a22b33e76521b17bbcef390
SHA1 71d531bb87a9951583d5891a98499847c4010b1f
SHA512 9e9a525641fa1775d45af82f5f4b7d2066d313844059837b0b2b868ab2e38886313b5ab78dc00a620d1c2a1198b9d1b4c4d5d2e65d5b6848898ecb058e9e0a36
SSDEEP 49152:yljpEW3Ei08fpJjm0sbmhLbKqm006NPpIupEaVu+e6NqcXToRzvUqIzYHBigdQBk:aEP2RQ0SmCCPNUhIUBbwHe
TLSH
T105165903F29900E8E05DD5B8C7568122EAB2BC854B35B2DF0650B7562E7BEE4AF3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.3MB
SHA256 8a2c138ed77aec40503ea855d6f7008fdbce803ef7d9053e82dcf3975e4f6290
MD5 a7bd1fe268c267c3face70d22aa9250a
SHA1 6adf008a0280eccf82a36267086547ecc0a4ad32
SHA512 f745c0d58c6daef964ec1e783557a2124c2432d78d0fbd76090251cec60930a3992c1235e06330b78ec1fad57865c4074012639642715dcba7d30d107b213bb5
SSDEEP 49152:6FkW0jRi2M4+oZ5E6EstBhuXjfS4LWxnS5F:U09V4jBX5F
TLSH
T1F4B57C03F2D900E8E06AD178D7469533E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 1.6MB
SHA256 9e050f36b7eecc78f51bf001fb09afe4e911e6a6cdba1388f2816e654da79100
MD5 7916fd60c13f6fcbb5f3a7c31f0a91ad
SHA1 fd33e574fe803c8c8b096be7ad9f4cf7383c0f8e
SHA512 1081f323c207943ae11495a428807efc2494769c23fb87151e74a90e44cdb238159115a8128cd0b727b79ce19bf8fd0c2a1d591ab9104b41f6517c59793b7db7
SSDEEP 49152:qvmeJQBqOAFTjTZzVLvJe8TWkwTlXrk9dB2cnHZ9O:YSBqXtwOKcnHHO
TLSH
T130759D03F39900E9E05AD1B8C7568536EAB27C450B34A6EF0B90B6552E3BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.0MB
SHA256 6c641bad0de375d76a83e11278fd37f0f5d371314b39eeca24e5c5284d0ae6ce
MD5 fa2ad9fbb1c9dad065211f9f71d48b32
SHA1 94bedf1c5fdf1ccc2c7540fc478314a2cde642d0
SHA512 90e57b80deb90417660bd5672f61c355224750ab39dff472c91081b75dffeef9b6666232167ecad4f4b7bb809c18bf50caae5cde2c68435e14947192825c0792
SSDEEP 49152:n8XzufL5iBnVE5ez0ZrSdHBAVfw9owmw1:8KfmkwA1w9oE
TLSH
T163959D03F69A81E5E05DC2B8CB768B35DAB17C554F20A6DF0680BA652E77ED04B3D390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 3.5MB
SHA256 a48960fccabd940aeb05882ead83f20007e5ea7bf08a1a0c4b38ce45c1f3b4fc
MD5 30fa790253d0f5d6c3ea3826f43cb49d
SHA1 173a309502a3834765441b0b792c84ff89931af9
SHA512 ce03c21ceb5a81d21b111d15f1ddf1ac0a5587617129773594dec01126fbcc2225f2e8a16db27d3bd58f72788e7e549cde7899112722a3db8c9996fccb68a539
SSDEEP 49152:6u1xR+MPV9ExG6Ul4JIkXAib6YErkz4AkOuaRoBISCaQZCLlrrpHb7E:/q82XUOnZgHbw
TLSH
T12F064903A29900D8D059D078CF4A9223EBA27C8D47F566EF3690B6D52A77EE47B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe
Size 1.7MB
SHA256 fa025ed9f8d128ed303858337035091148f695fa207a534c8f9d09d4e0bf9c10
MD5 876908b307683ba68cc8639f5d526f9f
SHA1 fcbebabaf36d327bb2ae4ef00bbbc1d90bd10e8b
SHA512 f75ceae1b455e66b5139794acf8242d68a7aa13db3198f03cb20953f7556fd8c97e45f550bf1b96fb900ffa8bf5ed72278090fe5180aec26d9e6dd67fad46746
SSDEEP 24576:8T65uD6hw5vAkblj2usvjKxE3N5tFTxb9peQuJXlPnyF4mfHU9YawsNC7LvY2m:kDQQOvOxE3LtFTh/eHX04mfHIEL8
TLSH
T1E8858B03F6D801E8D06ED2B8C7469532EAB27C450B34A6DF0691B6562F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Size 4.1MB
SHA256 5003e85c12c9cb9bb63b913d1ee99a4ab0d37474fa875e06f2375ec6aea088f5
MD5 71da4fe8f2e8318a87e5c58ff79f3b52
SHA1 8012424da893fc84661809750edc8bcf2b07c63f
SHA512 765144ba536f028e5ba9d3950077e1f103fc8e63dc185fd4080664b8b270ae511e0d692ed60461cac3bbdc52c7074378f4e2f1b4126371d5e39566ca0287aeb3
SSDEEP 49152:DupOF3/+h39g8eGOf+0A/M+TjEKzExldDwUIDtaZHWRdpev2y/Ba7Hg1GFzY:3wZEvjd+RaA7Hg1GFY
TLSH
T160165903B29940D8D049D074CE5AD232AB617C8D47F162EF3690B7EA2A73AD47B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
Size 1.6MB
SHA256 09b666ca9c56866a6cb90fd44467fd902a3c56d290414cb6f555553faa36fe45
MD5 17fe39e3c31a1153aa36dd24acb33bc4
SHA1 389d4bd965f3cb5fdaf4ea3399873c3953f6510c
SHA512 78ebfe418bfa1695f65fce46a7af780de3049cd55e9af8ee22b82d789dbad5fa404929dc9744ec19454980c4dd8f41fbec37fa3402e8a8cfddb6e119cc084c65
SSDEEP 24576:Slpy3N6hjlMb0NBBiDuOqMCnfISBWkWQL1oaedpEukUoygGmq/S5eXG:Sm3NopMgVoqMCfIQW9QBo7EukU1jXG
TLSH
T145759D03F3D801E8E06AD1B8C7468536E9B27C454B24A6EF0A90B6552E7BFE45F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 1.5MB
SHA256 6da4abb1d37c8e4393861ff703e84285acf732299bb399fb280ac618286a99a9
MD5 9967c536f8375a1a8d13d6657a23e4a2
SHA1 c4b7d13ca145fa484f5af1c8cae65b4f0fef45ec
SHA512 2bd06cdea9735caaee065a9e856845adc2450d980c4ad4c9249b4a14d67585bf7923f6b8b8ce3255f61413caa8d689717b41336a5ec66d4d4dd42c0f55418af2
SSDEEP 24576:eppFy6mHtKBMioPMu4lxaVYXwQsjGsVa4i6h27d3WlVJU/PJ4I:SFy5NN3klxaVYXvwn+6h27dGJUSI
TLSH
T111759D03F39940E8E05DD1B8CB56853AEAB27C450B24A6EF0B90B6552F77EE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 329KB
SHA256 a9fe3e98ba496ddb4d08a02dd7d6f033a8a68843105d67558350e452df88eab2
MD5 800dcbbc8777a5898e420120f5a913ce
SHA1 1655756d4e43d3084bb3b7f99c198523387b5a7a
SHA512 5b0d7c42ac3d7981b290dc381ed6bed9f63935ed0d492a6550a9154e6c132aac46f19b7fde1c90087d2ad122e253ab9106ceb31e3f9d7f45f137a849507002e3
SSDEEP 6144:ods9yNRq+O7Zvt5/heUy311fZ2lRK+x/iJPsfUrcAb0Nb3bLJB:ms9wRqR7Z155ryF2lRd2czAY
TLSH
T1A774AE6577D408F9ED6B423DC8A18406EA73BC5547A0EB8B03E4C6691F233D85E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 672KB
SHA256 35834b05213d4d20e9aa3cc5879e2187bf6a046e84b39688c0a7e968b6ebd837
MD5 1db196c2c86f94102ccc19cf119d816c
SHA1 5411344b8806cd6c6413025634408a5d794a33c7
SHA512 286a3d08655b2718b4aafdcf2deca7edd13e5c0dc835c05a4a93cf20183a02092462d74b8e069d99822ec53db1f221ecfd46507c5d0fbbc89d3ceb7a3a62f4cc
SSDEEP 12288:es9BrVAExUp55Q//cqMAUs9OrHsk3t/3xGGikB:DnAE+p55xA2rMk5xGbO
TLSH
T11BE44A16F6748731D073C0B9C5D2A69EED7230825B308ACB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.1MB
SHA256 a36eab101ce42cd7408bc6aecbe9f3140e3ad024f786e6828228e3a9a9823ac3
MD5 134208e2119d51c258732b3d02f4c0ea
SHA1 948bbb2d86c5c3c888aecca572777d626e36c5a9
SHA512 3e323d76bf45ee8949fa4d7288c528d5b7b2e2d7c82438a409cdb6db42065a9549379aea435ba19d214233e6567ac58f99ae8ec40b25e40fdc0fd98bbe72b365
SSDEEP 24576:ebLpezSCYvno5jRNgrvWk6q8wyusZwoRY/UEg:0pezSCYvngUvBHjyX6UEg
TLSH
T15E351A25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 840KB
SHA256 70ab9e226887c2dbec8dba14f5335f7daa13daec1d966d7f7be775df04270eed
MD5 6d5556fa6893c392ab4f427c8462e8a8
SHA1 759c3aeaec7b909063a24441851cc5426b6e6c17
SHA512 b64e50dadde0428b670cf208a41776d7cd408842638061359286c903ffcbb3b0a02267a8e359d5c7b932253915e13316e3f0d2aceca8199b583948a49eb133f4
SSDEEP 12288:LjLeBHU3v8cx12Iuf5S7wsEZaWeVjs9Bf0Im98MZt6oQRbipFq:Lj4HM8Q1SBeVYMZkHRT
TLSH
T134055B66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 350KB
SHA256 924a1c01bf585dd348a246eee05cf1815b201c2070d9154b8486a1c8b68e20b9
MD5 41d9d82632acc37a1715420cb2dcda5a
SHA1 63e6c3baee8cea574143a2e56a4461f6a64fc7e7
SHA512 296ebb2ff704de213d71722fd0cad4a88f2cab12544d883001eb96f7f9fb961ecfb954b86183b1eb9c1d4fbf04e06e840802de55565d12d08e9ca67d41f227e5
SSDEEP 6144:yOts9y7BJ/GKWWBNU6ITLBi0qttclOKgU91B0yZFv8QQVkB4aAF3uyau:3s9NeBNUbTVO86UZEfKyF7au
TLSH
T135743A7BEE28FCD2C27E4DB856918640A77278704F51A3CBD179820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.3MB
SHA256 3c2d9dec4b626b409f6ba1bed2a10e933a8715f278122f27e1f8291536bc8635
MD5 245b0c1f08838d0d71dcc6a522ac3fb9
SHA1 4b75d6dae09ddabbb53611cacd40a6a47c0d40b3
SHA512 7c212ca4a96815fe03a8b3db069ff69b0ddc71a2cb5cc45f940240eb37ad50903feab3ad1b16c66bccc1c23a2260a21d1c1fb8e60289b9193e3a4b73fe90d60a
SSDEEP 49152:VqBfgzMOTgpmCEV/p3LeRtvShj9LHdMuWGFL3nc3Xeu6jl/yX375OlVLnH8NRV3V:VEigw7L3vLSQgOvLc5Cdg
TLSH
T129265B656BF880F5E0A7E178897AC6B2F7B678420D31EB4F0191C62F2F336905D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.3MB
SHA256 ce6ddd2b3899fa39ab5c3c68f2a77dc07edaefb9371bc3c1f405bf5c786c317c
MD5 60ada727e3479d6fc7ced4ed99b9c9e5
SHA1 2bb4ddba34c80b40e93c4f9064b2e2e5d3459284
SHA512 0a2b72a77f0ac9e3783309da10b5352ceaf818910ccefc646fd65fbb42d773ca9c58a566c48d7f19527cb675981a208a0fa6735e0b4924d9ae524e6d75f13448
SSDEEP 49152:v6lwEcxtz2yL5z+fFiV+XenmE3/zDt4Ni:CZ2HVjnmO
TLSH
T143B56C0976B8C2E4D1F6C77886A2C647F37178154B34ABEF4265461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.2MB
SHA256 d1785e4d2d3c4c2563f5d7a41d689eaf740bea8b23fe55dfa56871a49eb92a97
MD5 d93f102fa761f884498afe01b2a08cf5
SHA1 9712b12eccef340c48cb23dbc3dead451cbd41a5
SHA512 269511bbb75453a99f41a8c2ad9d09a03aebe6edd0546e430100d3ea92c56198b914063eef22885219fb55c6111e438834314e6abdf4684f13e0585871896d5b
SSDEEP 49152:/jWi3/t5sxd6p3DJf5SUYLoDpgLjSTYlQcGePAaLSF259ruMHwpXMi4FqJLd23Ui:PDRQyi36YOcPnLvw2gAf+PN3Jo
TLSH
T17B666B13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 e7503421cd794f5b5aa00f44aecddb9e740afc45ee99ec0c31328b1362528e5f
MD5 f3e3f1a4dfda46a8e54e39cee231e66b
SHA1 80fa9e0bbf7bdb3cc1dde389c855d96114f5dce7
SHA512 dd6e9d40f09714347f2e562626701682d910cf0247fbe77203673c401c20cb4d66a131732500bad74d6f472f1d05ed4404c6a8c7f1e1c70f43007b64efe388da
SSDEEP 24576:xpvpQVmpQ93rTFhDboI67RA/7DaHGTNHu7PNU3/5W/ohL0W2Leuz4Ph:GVYQ97jcR+eWu7PNU3/D2Lz4Z
TLSH
T199952733B2F600A9D04DE1769F4A873196D27C718FE0D3DB8115721A1BB6AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 3.6MB
SHA256 975d7ab626eeb059a4ac57f8f4b0d122ab4db76c8c2f418d25288c756f5e7b54
MD5 c95dc624026022951e7ff2a8874c783e
SHA1 6ffb50fff06c7ab750d8a66a11d116907262f1ae
SHA512 7e708a32a9ac8c90b59033941a740534a510a1d818f548d0a24c8205cca42f3fb4932b8935ec7846df6823eecde0d4ab50914afed870926752b0fa768bf4591b
SSDEEP 49152:LcEu80pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbPN3Oh6tznm2FQ/nho2qkrk99m:yy5112gYy5azzVvc69nLKnhZI0
TLSH
T15E067B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.4MB
SHA256 f63be402a1044cdab9679954420525bd594e3880bab565c66539fb7d3ac8c6e2
MD5 f12c83171ab2c3804fb96dbfe065206e
SHA1 f8a058c542fde9423675fe014b50637398012af2
SHA512 d3fa3775f1b12cc5bd0e858d63854c43cbf5ca7aec7904c3b75b032a15bf990f9127b7b989d6072d68f0c18adbeb154f3f26a9538a7009fadc673816b8189199
SSDEEP 49152:GPyvqZZFHdeOBr4tEGf0bqx0z+n217aau1glRhV:eFbJmRxd2dRhV
TLSH
T1E7C58C13F1DA01E8D05ED478974A9233FA62BC490B34B6EF0A9072562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 1.8MB
SHA256 1ce788336bbaa458af8ed161ef27f5044b5661b415739feecde89321275f7884
MD5 c7f8730230366ac9db946cbe84fc425c
SHA1 e13a67a0f3d7c12c88d13673f643ea2659c89dfa
SHA512 730b9749e3e6e5903c98971be89fdae78ae0f3b2b1c822c0bc90670ae2569848f55f3d089b77e080a932d3545d76105736c4384e637f1d7e3164046ca0aaf85c
SSDEEP 24576:Y0vySL5Cih+ou3/zG6tuCMJvxAF8UQ1zNOgLLwH7ReaQXx3xL1kemQ:9L5CisoGcvxAaU44CwH7R4xHmQ
TLSH
T11285AD13F2D901E8D06ED17887569232EA72BC460B24A6DF0A90B7961F7BBE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.0MB
SHA256 71a982c34b335cef8ced63242f312534b8b2c501748b66dcce8b5fb1b36b6924
MD5 7c073ad2956bcc15ab02deb6cacbaf1f
SHA1 8abee3e11739951b5613162947f811523f1d5cbb
SHA512 d097bd2c08656a1c8820fa2eb2ba41306396f5c1a01a3905489868a08a92d71a7464c15169a4fcb21eceb17d11ae0fc4529028789e3b8843b5e5d7ffcc5cb44c
SSDEEP 24576:kpLvzmcfFRbQIvGbAk4LPa/9/JHWxuR04FxGgVG2Onks6xt4bSMHnqEWXfyp:UrFJQ+Tk/J2ARVtOnks6NMHqjvyp
TLSH
T1AAA59E03F2E941E8E0BED6748B669236EA72BC464B34A6DF064072551E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.2MB
SHA256 bd8e4a43daa31bd85f45e32514fc51b38ff3340392e6db095da17a051e28073a
MD5 e74c95ba4cd4a5b401db8306b9288052
SHA1 2276f33b966ca003d161b0c3f41767ce00a1edc6
SHA512 d70ab8efcf3cac346ac5ba43606d4326af15b90e35ee78096b89c2c2e0b2181991adbed5acb9ef0396f86fee46bdccaa871b85b93be23367e42e821bbac51566
SSDEEP 49152:K8w6KVgKVlEjLAE3dGGj8bXEGcjesaNkYQd0XNJKcvaAcPTY6Y5AAhwR:AnavjCBDlZnA
TLSH
T1A6F59D13F2D940D9D059D078874A9232EA72BC494B3166DF0690BB562FBBFE06B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 d50f9304abe9d61d4941b672ac1485204496802d8ab7f47a89b92b745faf2bef
MD5 2f532ad0882e567fa3b39730c95a82dd
SHA1 aafa86e21abd91d80b7680eedb0b6dd65b4069d3
SHA512 6372d79aff7722f9725939c5d62c51d52c6a082f944da87656556d8ac5133b8e6ed53d81477a7b19d7e74edac6def5ce794906afc72630daecd89a59fe50123c
SSDEEP 24576:nd/vZOTZqTEmJnTDayUgzw3Mxi3iy9CTn0AP5+2QLc/WPVxbr1:n+TQTEmBxw3EgiDn0AP5wrt
TLSH
T1E175AE13F2D901E8D06ED178C7468632EA72BC150B29A6EF0A50B6552F7BBE45F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 333KB
SHA256 099a992df55df8bbfbe9601715d980aed842ed364847af5bfdcf8d482ca220e4
MD5 25223530888da1bbbed1fd11e05747c2
SHA1 6077293ae4fb5225808645330b1157a7df561b64
SHA512 fe0d53a7bb3f0d762c0ca7db1df0cf4a0376f67bf155ec532971b2595cb0a6934831a06eae12f8cbd135eb48ec38532325131dd1f7e9fdd4fceebfe8799ac029
SSDEEP 6144:GYPy3ts9y1oAcjujFvxg8xcqw5YV/PvyeaEWVY9kIdnK:GEy3ts9OoZjuvn0cPvyLEWVY9kIdK
TLSH
T1CB74BFA5B39018F4EC67823ECC559955D6F27C9A0B60C65F13B4322A5F333911C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 333KB
SHA256 d0316a267a38e3a640fc4fcb8498e63ddd6e6cf249e588456148d8206cb717e7
MD5 acf4111055eed15a311e444fce19b49b
SHA1 75bac27f39fb1c567b951ae47332f26d61b89bd3
SHA512 11ffbdfd5abe86d0d6a1338cdffae2ef8c82cfdd257a1ee3393b89bd6f3bc462ad5772e4e2c6016a9f0083c7c74e2be9e77b5044e13899f8019fd4ecaae1d601
SSDEEP 6144:XwV5As9yl8oNv946tG5sudbefVz2YutYPDvhfVoi/QT95r:XU5As9o8oNvC6tG66b6z24PDvhGi/QTr
TLSH
T18474BFA5B3A01CF8EC27823EC9555906D6F27C5A0760C65F13A4322B5F733911D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 540KB
SHA256 6d1e28497174e122cfd67ab614f2cb32c5c072aa3ad44e041dcf5833197f0621
MD5 343db7dc67e01be98e8df57aae3bbb6a
SHA1 4c44e4aba2e886d2e24c355f5bd15d4d8b3698c0
SHA512 aaa3458e333f6878adbe55e2b4c35157a88744a8780708140d75ad5d50b3151a81526ed972258584789378de1f3a6de8cebf62a8afd9f3e90340f937c01d3247
SSDEEP 12288:4cmLKBs9vW7c3FX7+/PDS2LbbdIvtaKu853i:4/U7cp+/PDS2ZH8Zi
TLSH
T1ECC46C90F3E414E8F1B78A758D764511DA767C9A1B61DE8F02A8222A1F337D18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
Size 333KB
SHA256 8fbb2cf2d0d4ebcfba1956ebaa8d25b9bf0546635e1130caf246d9b066ea6449
MD5 87adb915e2d28cb122dcc61aede4fbb1
SHA1 618cdb9c195c3db2458d312ab86a384eb5823040
SHA512 869dbc67acf42d6e0555e4ffcc2a2b417bad9fc6e43a735e0edc089a7a42d4a57043088494387ba04b1f0628649907e5ff696e35887f19aa08dd41e96c92a635
SSDEEP 6144:/tPs9Cs9ysWwCLhjj9M6u1W/30kYV/Pvyy//CB5I:/ts9Cs9/WwchjPvRcPvyy/qB5I
TLSH
T1F674AEA5B3901CF8EC67413DC8658915D6B2BC5A0BA0C65F13E4362B5F333A11D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
Size 142KB
SHA256 fbeb58aed40d8eaef315be3cc6fea76833f978dca9a26ab202dd1c0a60e19059
MD5 8b4d8596a3e3c2fd347a0e0f24790c43
SHA1 3fe407f5e806eb23c2cab8ef7ec01729fe1638f9
SHA512 54e3641e3fa2be488f2bd8ccedfca350e1038aafd7b6f55f4f87796d2edddb704c215ee29fc8235cd47b716a6a2d804c0e7891046b58ee71b7ef2cd908200a93
SSDEEP 3072:NU39yUjlXEo43udtjZqMNbjuxJ5Rxb22zi+re28FGb:Ns9yMlw6vvUR22zi5F6
TLSH
T1F6E36C61B3E86488E57B8E719CB9CC21597B7DED49E08E0E1294721E09773D09839F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
Size 333KB
SHA256 b741a35ae5d3a798a27b7ac8e7ac99674c18459104209d99e982ed91db797036
MD5 4f0aa54835e2e1cb0fa05b2a49a8ad4a
SHA1 9efc9ded70cbbc5e6cc05aea53f7e844ad171108
SHA512 9cbdff05bb18bd6149e9d9ea7386d13dbc8f10068b875083f2d84173abf7ccb6d8dc82986c4a142abd0c5578d311c49f54c063633234236621570a8ae1a995ab
SSDEEP 6144:oOoN9s9yosUoSOTnexEsAOwH8zzHYutYPDvhfSOFVTgL6GmEM:o3N9s9xsUoSEnex5jw6zH4PDvhaE8AEM
TLSH
T1AE74BFA5B35018F8DC67823EC8658905D6B27C5A0BA0CA5F13B4366B5F733911C3EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
Size 540KB
SHA256 750a2e4b179fc6ee06bf9b0d1d8d360eaab0290bf616cccc0023a3fa727914f3
MD5 e38b95a159a358b2c126e7c52cf2759b
SHA1 deccec9cc28da94c87957f4d716e956a4df534e2
SHA512 856b2731f1ee28f1b3e36dce6b4cf2223dbacee701ab3b92a886847644faba7b35e3cbb2f65fb69b4e0d218b8e1bf1478bbfd7eb9306cc806c49a727e04f8354
SSDEEP 12288:z4xfxWs9d8wWkxdws7aRu46LbbdIvGDrkKlr:zYiwWcT7aRu46ZJD4Klr
TLSH
T134C47C90F3E414E8F1B78A358D768511CA767C9A1B61DE8F02A8265A1F337D18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
Size 195KB
SHA256 6d06770366c28169a72bfa27ec08d885a0657c31576ef035b29f82c67c4753d5
MD5 562ceb3883c0e153fd5384006c3e4c39
SHA1 8d9c01e4ca9e4fd618e4d1e2a44a01f3ab48df0f
SHA512 1af32afa0be5416fc335c7be06ffbf7158521c059e6244f3485416f1839ef305f069e4e4b7d94a6cb81b6cb23a8bf30c0ec7b5e47027611128a9de3225fc2952
SSDEEP 6144:POP170s9yw5DEmdggIn1UoRDTPvW5kjFEX:PGt0s9HBHdBdoRDTPvW5kjmX
TLSH
T118147D4033E904A4E4B7993985A08501F7B6BE621761EFEF5384715A0F3A6E1AE3CF35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
Size 138KB
SHA256 a1bdad7e7f3f0a3581b9b6ee607a6ebdfafda9a21d2fc53a784c66938b410e3a
MD5 e6c80cba120b8009ac20605a2e1a7c27
SHA1 992ca54b4524e627dcade99b9914636b5a5af004
SHA512 1333b177a5bfb430240a964aa9667131e3a063731e23878337b73cc0f197f7c5463d83c1db3cf42975206a44b3b28a4bbb0ddb8cd6c27d578037f4e0a4eef1e4
SSDEEP 1536:YVJQb8FIvXuhi3ugyjXjb28W1VLs8h8Us8h8Zs8h8ise8MJ2zf67NYPxfjjDAsFq:YDQb81U39yD28vJEisdBziux/nyn
TLSH
T1CBD36B4163F91888F577AB75ADB04115CF3AFDA29A11EF5E4290410E1FBAAD09E38F31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jre-1.8\bin\java.exe
Size 333KB
SHA256 0375cb2a21f5f0bfb5c0a40430b7ff05aa935d5fcaafc1a3f674de3ef10436c2
MD5 0d09378988a5cd446cd1cb6bc1f63b36
SHA1 22d240627af85258dbe25c48e037819098341bc2
SHA512 24128fc3915e6cbe5c0a8736cc8eef0943cc2758879e0048e345291d7f2905c80d854c9b34db7729331e6ec919bd4a9629d126aeeaf2ffff1fb6f32e803e4c90
SSDEEP 6144:sTPPWes9yBTmCZBjQlMHg5h0+7YV/PvyQn9gTV:sTPWes9OTVZBaSQcPvyQn+TV
TLSH
T11D74AFA5B3A018F4EC67423ECC555906D6B27C6A07A0C65F03B4362A5F333911D7EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
Size 142KB
SHA256 e77d56ae9c1972e9303148512dc281472a8f088f56bb64e53899e178d708ebc7
MD5 c4df3ba29dee5ba127a07abec8fb38b6
SHA1 d383aa0f2700c6621bdabe865c29e85b1642ed24
SHA512 b8764663e7e5f85da7334d99f6df4ac92d805b8440436fc3cf1f414749f162f7d2a2126b1e73b755be30906fffeb2d8575c1f7044d202b778658586d9a5c4f58
SSDEEP 3072:cU39yUjlXEo43udtjZqMNbWwx2p1o2KgBiEJac663V:cs9yMlw6vvWpW2KgBiEJac66F
TLSH
T1F8E37DA1A3D86888F6738F71AC748C2098767DE95E60CE1E5195724A0E773E1843CF3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
Size 333KB
SHA256 6c0c34a813b0380d8a0dea3eee441754a5725daa747ace2142836c167521e4a2
MD5 d166d32d20797b116af10bb3e3743519
SHA1 4779fb777bc2f27c2eb0b7607253cfb6da32d785
SHA512 b41993a611d97eb7b77fc7760d05dab574fc15ed999a92dbdb02ae218a1699b63232c1ff615fb8511fae93861dd0414bf0ae08e49fece941d98eaf5e07701dca
SSDEEP 6144:jtgH8s9yqmg0Zgw8crsF7/uJgz9YutYPDvh+qFi:jOH8s9rmg0Zt8cYF/Fz94PDvh+qFi
TLSH
T1C674BFA5B3505CF8DC67823ECC654916D6B27C5A0B60C65F03A8326B5F333905D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
Size 540KB
SHA256 7c23a720c3704ec95f160605164e553efeff9b2e96de54aa25350617a6e4db96
MD5 143ce471f1d02215fc050fff8e1e9810
SHA1 b465718c596aaca5aeebd416ab38245d0ff61383
SHA512 9b89929a670bde4378d68b91af6be6cfad703fbae1fe8391b1a8a3863524b5573e69e3b461703eae2ade17cce9b7e7b05b635c298127cfc307b9576ff9534fea
SSDEEP 12288:BsUr8Os9nSmu8v0cMwYtwiLbbdIvWCdETZ7ne:BJTmuyMwYtwiZb1e
TLSH
T147C47C91F3E414E8F1B78A358C764511DA767C9A1B61CE8F02A8265A2F337D18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
Size 195KB
SHA256 c3c70a5a2f3137ec8c15c4791dd95ff6d5f0eebcea4aca6d72a08f2260247f47
MD5 f5584294df565201229a46a9941afeda
SHA1 b4110e14e3f7a888e64c0e2456c92c6e0b0ef531
SHA512 7db8a513fa3713e8d26fa8eb3266033af6a785957a779ce9f42a7f32148ff2e7d2441208055d33d442b7dab530276d4f56e36108081525284224cbd01acd53dd
SSDEEP 3072:TjrgxWtOvVdTrU39y/Y5DEmd/MjgvhagI/f1OFOCJGxuFKHa/:T9Ot1rs9yw5DEmdggIn1UnDh
TLSH
T1B9148D4037E500E8E473DA3898A14545EBB67E511F61AFEF5350312A0E3ABE19E3DE31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
Size 138KB
SHA256 5cecc3a2b44c3c45f54d511df91fbacee55757bec53b89c99f572bbd2e367352
MD5 b489c9e548bdd67c001bea4c96280b99
SHA1 9863ba2ff4763a86fcc524a84612a2a9bbef7daa
SHA512 be346ffe2744d5b83bef324094050e87690a87398d42e23de3bb1213b5b2af8d3061d294b7445bbf0056357b76603e49e583d6edcf5586f26ab05c2762cb310c
SSDEEP 3072:cuQb8YU39yD28vJEisdBzYMsxEozpWaIOkA4KEkF6i:NQYYs9yK8qdBpOTCkj
TLSH
T16ED38B4163F92499F0B39F35A9B445108F7ABC621A65EF2E9380510E0EB9ED1DE39F34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
Size 4.3MB
SHA256 454c0855e25d825908c75061de6b4db7b89b71706fea26cc6e781d28fa76a2e6
MD5 63854f7abde59fb003d503f6cb530eab
SHA1 de7f6c4c9f953f233203ac70eb4ec9885c7896f7
SHA512 7b3846cb1f376bf42457980af0abf87437cd6c8194e818057967db29c62f72cc791dd2799067d562e3825d29163773f5940ce276a4c9de7188b482c1f9cc46a6
SSDEEP 49152:6pMWbFr7+FAgOTltV+GdZwqgIJ5ixNZLydPbLQjNJEyb3leuBfSJ98Qlw6Ix83BK:6t1TMRqS3LWvLIm3N5Chwm
TLSH
T1D0265B556BF880F5E0B7E178897A8AB2F7B678420D31EB4F0191C62F2F336905D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeClickToRun.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
Size 4.3MB
SHA256 7c6a6e62e7be1a5aca7f4edee1f51855927d601565cceb40cf8a7e5c0b168897
MD5 e061c691142250c3ffd353002c3c957a
SHA1 86787f804c78b6977659ef1080c7432167da1d4e
SHA512 be3506e940c8d87289e86639eaa148bbcc18133ea3bdbaece963653e5eaf5ab194921f65ab55a4313db6a20de3487bea88d96ac49f81c6f862ed512b98e30de8
SSDEEP 49152:qlWAOvliOhYeNT83qpiNth0MWm/LALBdCvdmOrkdo3zeug/YrB9H4aqsyxoI8NRQ:ql0h50hJsL6VlqhxA5CLsa
TLSH
T13F265C556BF880F5E0A7E178897AC6B2F7B678420D31EB4F0191C62F2F336905D29726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVDllSurrogate64.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe
Size 275KB
SHA256 d7ddb943ee7c6a49d05cc4ef1163ebbed1f035b4ca155901b9c970fa15010845
MD5 da7799d7e8db039beb8f29a6793ce46a
SHA1 6835fb901993ba6eb32bed7ef6424b70c23a3c38
SHA512 7da3dd3503e88c9dc50c927dce49fe64ceaa215a2428a0297c837760728fa7450125f42ad9e809dc3982e3d7c4208f76555a2251c39dbb4ad5ab45bed5c3ab02
SSDEEP 6144:3H970Js9ycWGNTNYdMzATVkQNUO7q5/nnDNDIwXp1GEJ:XxAs9AGNTCWsTGQ4NVHGEJ
TLSH
T13054497BDD38F8D2C27E5CB85B90C700AB7160714B52639BE179C26DCD132E15EAAC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVLP.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
Size 588KB
SHA256 d541300f186ae2c577260431aa0774fac4633ac4c8b3997da7686084634d7ab3
MD5 8c8a9038645e04ae039bb2ba1be825fc
SHA1 354d6b558c649a27b98b4d8eeacf2c7a24722fa3
SHA512 7accdd749dfe298facd17086f7ccb61032ed480bec86a58624fa29afc9b23dc3206852915deae7f3f7db30dce6389e74a2590edb0ba8eee6d60b9bd3633f1119
SSDEEP 6144:XH6XPUwI4STIlTwj7Kfjvgs9yApT6C7Jr/UbRo4Wp4hzvNUXITiXt9Z+M47iUlf3:XaXmIl6Ugs9AkluzvNU4TEYicomhv
TLSH
T11AD48D66EE28D8E1C27B89789696C600E6727C110B61D7CBF17CD27E1E236D05E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Integrator.exe

Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
Size 6.8MB
SHA256 f36a989e0855d3fd192f1906d4054d00d1427f4134517ceebb79edcd20a25fb3
MD5 a3ec2568910152f53718f55921a5d3c0
SHA1 368da121cf45cc87fa39d86ac3d46ce97e75256c
SHA512 2c50f1789a37ef653a27ba06c60a4ff735425cbd5c85666f1d93cc456628eb69efe0fae2635b2c575fe8978bdbe7141435fbf31bde352502db0deafa169b2741
SSDEEP 98304:NdYbQfbd86ijEo3FB1GWYhrrmqJjeb2KRnyT:NdcQzTijEoLUWY5SzrRQ
TLSH
T14A6628596AB481ECE0ABD1748D778772F67678428E33661B0271CA1F2F33E588D19732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Mashup.Container.Loader.exe

Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe
Size 100KB
SHA256 c33e652629e7a97e75ad4e9c1edf295a7ea0f951d983c7190fd65a12280348fd
MD5 a7d76f1cf6ef188637b831e01c7b8c21
SHA1 fd7e4bd3788ac7f7bef86cf0f876967c502ce853
SHA512 9e07133785fe7a7fedbde073c119e4b84ae5de26f61cd962c920d17691bea7fdf7a03f3defef6a2234d20527078eca727f228ea131a35a5c8f70687dc8955c03
SSDEEP 3072:0GtU39ymeAcI2mG3tT0MY6gmXFIxmumkeO3:0Gts9y42RQKL6
TLSH
T11EA3D042778884C9CB4303B8819195A7E2F2BDA25F11DB8F5275C25E1E777C8ED36B05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IEContentService.exe

Path C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe
Size 449KB
SHA256 156bc9e4d727451155c5bd08b7539850cfc0592fbab56446bad66b4135bce0af
MD5 9403106da4243edd2384eab599d3e9ea
SHA1 43a217dd1353fe7fe1c67add1bc27d258ff8c189
SHA512 4105833f99d5405a894d33f3a1a8f6f5d9b086c3c9e319939f0fa07bb15d75e5676db85e052dfae04b417cfda6a975a46528d13fe75de0aad123e71ce669bbee
SSDEEP 6144:z+6xHHW7Il//ugkv1I2due++5leAs9yJtog5jfcbvnmwVFwelDG:y6xYIl/WgTe+OcAs96RfM3o
TLSH
T110A48D4AEBA084F5D257A278C577C572F7B2B4891A60674B42A5C36F3F37B606D2C320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerfBoost.exe

Path C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe
Size 877KB
SHA256 983c8000b1cbfc9abe603dbf3e8ea695a6d0a399462781f8a8a179cb5dcb3173
MD5 8c7f48579e3ed48f7fbdb43008a7a611
SHA1 c968752f778795d798330f66f56d9eb75bd15abf
SHA512 1a1470e7b67842884e53fe0da2647b9dda00b8004cbb032de41f646f8cc7af6025297d483bb16174f6dfedbe5c501f51ef295b2cc9f8a17914628e0f0910eb2d
SSDEEP 24576:6qdlN7tyl1N1NmfyrzLpEKdUnHBt9NMpKml:f8N1Ng6z1DUn6Ll
TLSH
T1F9153995ABF845E9F1B3A67499768571FAB2BC521D30D31F02A0C25F1F37A808D26732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDXHelper.exe

Path C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe
Size 189KB
SHA256 c241590021cb1fc6c2d14a582e45ed6a7f962e9eb0d182955a021a84e6b7bd91
MD5 e2f8e8681f22221e6ddf84b1019b3daf
SHA1 7ab9b4946f05aed5236822a7f9f9546e7d62eaf7
SHA512 0241b5d56118314f2757c03080ec7300579bcb545b5501ad2a77bcec496d3a1d0e30af45fabccbd2583b770357b167f205e541de92d41cd310603539a766ac70
SSDEEP 3072:Z0pSCKp9Nq/DQU39yJa1Q2+zT6lZdAh3SJxfFrgrwHHStV9B:2SJjNq/DQs9yJ7elZdGaFkr9bB
TLSH
T168148D177BE4A1EAE413C174DAA9EA75F3B7B1B15D20631F6261C21E0F336817E24B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoadfsb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe
Size 2.0MB
SHA256 9955ffdda8859abbaad923dc4d2c4779979aed7663053c5a58a14b2d98b94fde
MD5 c685f94815bfe45a24cf226d731554d2
SHA1 0b80795eb0f498c570cb0c7100c2458fe7b03a18
SHA512 2d4b62f371f5d2e55e6e944ba2834ddaecb0a077e83a66a28784728efe7a7a2c132d0ee8b91cf7892db7579af6ff9264b175c6cc7ead8eed5d5d23d67c19b83d
SSDEEP 24576:xVDP4A09FWJ5LMGRKyCt2ym4YL/yYcpPfJb4q1N0aR010dFT7bK7+6mlvKpJxX:x56QJ1MtyCt2y7s/0j1N501GFT7bhlMX
TLSH
T165A52946ABE8C4E5E2ABE2789975CAB5F6F2B8510D31974F2156C70F1F336604E38321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoasb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoasb.exe
Size 341KB
SHA256 2ba84eaafea47ffbc27276d4b265c7bae84ac1168c361515b99a47f32cccbee5
MD5 d53445d12ed7e38cce34790e75a2862b
SHA1 c70009cdfb5aff7c460b20cb85b59851e200f217
SHA512 bdf0c1a348593abcf74c48fd4436b66488c3c7f1d427bf01ec4d8bc1ab83837114e0e92a17931341dd8f45e70781c82a510e0a5a64a2e26ffb0a4da9d79fd69d
SSDEEP 6144:7pN2s9ysMVU/UPRZW8pXaspXa6B7o9bhvRx9EiOwZexhOUkK0z:7qs9QqUPRZ3pXaspJ7o9bhvTmw4OUQ
TLSH
T11C744A577B788CE1D907A178898692B5FBB3F8215F21C30F6952C35E2F37261AD18B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoia.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoia.exe
Size 6.0MB
SHA256 18524f60a11cf885677e83ec4db1ede44420e04bb8388d2346d359c7ae1ab3da
MD5 aba51c0f6626327b9e5572caa0f1c387
SHA1 bb5769f0538875af96ff7cff715e89343b5744e3
SHA512 34029a9517ce8958524c71c756469ddfbf4d4236c2df5cb866f9c175c3411e3594849b429dbeec4974bf856f52675cd2ad1b0d8de59f12dbfe96bd821d9c7af4
SSDEEP 49152:NMKW4irnNXB7xr231W7Q5pOL1u4A+BOKfOGfZAcpE7F2tl8EK293+XQK+P5jGSUj:N4usmhPOyE5KZCLw21maM
TLSH
T146564A45BBF982E4E1B7D134CAB286B6F6B2B8555D31A74F0551C31E1F33A909E28332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

officeappguardwin32.exe

Path C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe
Size 596KB
SHA256 12b892669146846d71ea48f9e2cc1442e35eb241877a7343f1f194a654e93d07
MD5 6beb735fb91e9fb9ffe698e76d225318
SHA1 723a98a1e21279d98d54328428212409d597ffd5
SHA512 d2b1c1b71fe6178ebbb85060cae0174ede3070981372456c418ef1b5a50270985e23dd76ebdec2c9c9660766dde15b2810eb9816d8c18692f57da68423e63275
SSDEEP 12288:IHSo1J0u1gxevtgghgBs9NcIPr0lypFpa6fXhdJ:IHSoD0u/BgfcAlceW
TLSH
T1EAD44A41F7A881E2E566A5348A668571FA7BBC170F30D70B3559F32E2F33640AD29B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocolhandler.exe

Path C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe
Size 6.4MB
SHA256 4eab8a419e8b1662c35fe050d097a2aa43d5e1bc5a1b307dadeedc5a77ebce5f
MD5 48ac825a7cf1541988c2c89b85180b61
SHA1 67966ae5728b4a3619dfa50205e8b4417e2b491f
SHA512 a554718919ecbeeae8ad5f4872ca315d155670614ff769808a3bd7cf831367bd4afd3a84a4ca382cfc010d91f951207e518fb767d977bc2e6d671b2830d31a02
SSDEEP 49152:Ke1N0oGQEGydbIKBgvh8jz6gZqeKfr0l4JEuBsBPuyNy03+8JIaeAqlFvyaTqhYM:/Fo3uQytPAUOhrrzHj4q
TLSH
T1EF666A417BF880F4E1B7E2788A3A9675FAB2B8425E31AB4F0151CA1F6F776504D29331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OLicenseHeartbeat.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe
Size 2.0MB
SHA256 125b38483551091045e912a3ca7b91b54eeb42203b200dce120e69a6e5f776fc
MD5 a919840463347501b45bd7e0faa89018
SHA1 5c4ab93918bcfeb175ee36e2789f2d9bd8391350
SHA512 f0c56ed590ba643fa3330aa63facdff84fd04f094878d1c2193ccd9c44d4db83e9cb504a046041e8f35252ce3393e549352c0845dd3a1272a8249b82cf9c1c74
SSDEEP 49152:3khoGUgiiT7XvVZ/RR/jqdc/YrU98xjqrA31:6hn+
TLSH
T13DA528406BE881E5F5BBE7B89AB68979F9727C521C70E60F0156C60E1E73B408D39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLDumper.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe
Size 222KB
SHA256 b3243ae2829ea265f905d6d0f6c30918049ccc4d7359732ba206de8f6665fd77
MD5 f4e1ab416e3184bc53b0525c2dd68fec
SHA1 426448f5144bc9551d201ee67212205b9b461254
SHA512 c6192d73fccd9b93840246e142854e5be73bbee356d5e00c08f5ed7260a8606fd88420749f4200424f592cbb1252b6899a2690f5081071dc42c7fadd85661763
SSDEEP 3072:X0AREd7a/tHU39yKaj4+qrSVzN2Bmt+hlaTxcFvtYPRIQ992KFmPdJ:X0ARM7KBs9yKaj4dizB2dt+92ZPdJ
TLSH
T19F245B1077F92058F4B3AA709EB592526A77B8952B31D7EF4118C26A2F73BD08D34723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohub32.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe
Size 2.0MB
SHA256 c97d4f7796c63d9003940578cc18e93f92e208207491789a79d2d6767d4d145c
MD5 157d0fefcb93506ba24f80b28b372fbc
SHA1 70e7807f38836212c3585587193da6d6bfe2d055
SHA512 b282532acfe9767b248f058f205d45eb43b4e84f511551947d5a7adb91cb8666b870d5c80ecb79fe6cae5d59e22dab0ffceeb1f78c31f4ded3f045bb20cb9fb9
SSDEEP 24576:UGII3sFq4YGgReassWUG1BCDDM52A2NBH3NRLO97YFVwQPrt2knmb4FgwPqe0Pjz:UGII3soGDj34ULOH+MYu8m1/p97Bm
TLSH
T19BA55985BBA484B0D526A1B189A6867CF772788289334F07318DDFDEBFE36604D59331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreporter.exe

Path C:\Program Files\Mozilla Firefox\crashreporter.exe
Size 3.5MB
SHA256 a4fe2300ec941f787627b38c709a9b5110ee8faa3671928bf5b68202375fc694
MD5 18f70b877c43f7e6657c78f53e8dfbfe
SHA1 4657ee9a3ee71c8343d904cb0c9c1d46a4140ed1
SHA512 5439acbcb7dba2efd49fff33f6cd42446d9e780346b240ec65a437928b4786609c0842b36b8870d7425f4ea38570520d10679227cd2aceb0c71936c04356377c
SSDEEP 49152:KDQpzASyyXwJRplO28wsz3iDT4JmeDNB05FQz/jTmXLhm6kV96YoMa:KDeSygra2Jg9f05FyvaLhm6DF
TLSH
T1AE061842EB611DDAC025C0B483266723B760FDBD073036F74A906735AD68EE05FF9A99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox.exe

Path C:\Program Files\Mozilla Firefox\firefox.exe
Size 777KB
SHA256 4aac1dbb6edd3cb4c1fb8a0f789f0931008e257a539c72e69322af8325cbea99
MD5 f87a9a2b97fcd71f5d5ea05f52b6f983
SHA1 d87afc5408ea97b0c984c3b5699fab48d1e0c8ed
SHA512 4da35628dc09572f2dd0d8a1e6bf88e8344b2056f30f918428afe161c6ef80aaad01309bd3c6535aff352f44ab969f264f2140a863fc4bd71adc63b6a526f7cf
SSDEEP 24576:L17wLGMYlXDUwZ04SwpemIwpelzEO6UANsX:J7wLGplXDUwZ04ZpeapelD3ANsX
TLSH
T14805BF03F38516F8E48AD5B89A46D233A5723C840B51A1DB1BF93F2A3D71AD11B7872D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
Size 329KB
SHA256 74593d9fcb067170d2056bed8b9b7032f931759181dd6e5cd6b6cfad72d04ef9
MD5 19923d2000128015983c63c2963ed407
SHA1 ab0de3c96d767127f6fb848741347c43bb65dd9a
SHA512 38b366611263691b8f847fad8fa1681707efb89282565f3a80a42b95c591920bc9eb2ad18d5f88b5f01905b8fa1fbecdcbe750ed8b43d37ab97951d073610eb9
SSDEEP 6144:aus9y/zGVZp815JN7V1H1DCy2lRT8m/iJPsfUrcAp58qfomJ:rs9OzGVZpy5zR1V2lRF2czAp5Nb
TLSH
T18674BF14B7E408F9EDA7827DC8B18415EA73BC614760E78B03E486665F233D85E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nmhproxy.exe

Path C:\Program Files\Mozilla Firefox\nmhproxy.exe
Size 654KB
SHA256 10f6b8be33f36310b3439363e6d33ef7117c521e7e08e834301752c93f185527
MD5 6fff5cde5efb94c1e7aa132590835319
SHA1 ed160c9295c285e260370f3301e8b6e2f4143d25
SHA512 ae1eee72a3a41f59f4cef3c07ff9d3ae818857095fead68858e2b0c77f16f142d53961831c820fbcc287dacc8f73d11ddadaea1dbc216877a30b8119e33c552a
SSDEEP 12288:tvL2POVeZRV1EaXe0wIXyWqs9Lcc/waheNj+F:tL2gCDJXL1pcw
TLSH
T15EE47D02FA97D8ADD51EC078864786327933B4CD0B31AAFB22D85A353D59AE12F3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pingsender.exe

Path C:\Program Files\Mozilla Firefox\pingsender.exe
Size 126KB
SHA256 7fbc4f0d6b4b2b8e6ca42ad5c505a8a3ca37a4deeb3c35cc1d8b5cec212960d7
MD5 25770306ed775d9f389c322842964e50
SHA1 c6b59882044e779788e6dfc917c54ebdd76e2498
SHA512 835b1373ba90ab0b8b34ee89b8f8631f603cf46d89cf052b4c2e2db61d83a2cebe20ac3ab14a7794023ae838c079e34e5e2f447c893781cf394cab0213849ddf
SSDEEP 1536:SXEfSc7hSujvvXuhi3ugyjXjGUiLBSRn6dhSdWA7gX30vRTroFal3sqcGx:SXKSduj+U39yOJSh2SdWAqe5MFal3s3O
TLSH
T12EC39E03560874F9C5AC42F0A4D7661B976AB6244F79E7CFE26083202F622D4AF793DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plugin-container.exe

Path C:\Program Files\Mozilla Firefox\plugin-container.exe
Size 202KB
SHA256 de19597c7bc6b5dbdfcf5fa8dcc775b340f792e62921006368c0cce69b1541ad
MD5 0307322c3188212c45216ae08b9d1377
SHA1 3bf21bb3a0f30befe19ede2ba579ed1066bc7b91
SHA512 6770af5d836b54043671a88f391d7fb7bc50e9d931b7deff7abd612e9775bc3af471cbecb2dc363ca0d19204c778b1dd993f6cb9e19be9e1c9bc62eefb5d3889
SSDEEP 3072:/O8kqqFPkU39yNskiWSVfX2UwaPu06j9WhWqBCwtcX+LxNnZYVlxUUph8SFVU:/O8kqqFPks9ya1WSAvEuDBW8J2MVHP6
TLSH
T1E014BE03F78C10E4E889C579678256319BB1B58A0F20A7EF275846213F69FE47F3D296
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.exe

Path C:\Program Files\Mozilla Firefox\updater.exe
Size 523KB
SHA256 b54d1d674024f7004b4b71cc3af4354c038a56e4e77c5a73e25f21f1d0dc973d
MD5 efcb11a4f2f754d04bf6f5533b6f8050
SHA1 cc61ab921f693d6f94e64c36b180edd8602a32bd
SHA512 5806662b8e7f04ce477eb79b97e2be4f446b28ae5156d3d5f318e6f2656a1fde9233a924f996904d07c320d2fbcb6ee22e6db136fc3a77fdc2d7f74cfe37ea00
SSDEEP 12288:qa4wms94JCWEd1T+by7a42ZexmSOJAdGyloV3q:r4w6JCWql+PJ+RlWq
TLSH
T16DB4BF19F3A00DF9F427A278C8A24512E673FC55472096EB22A8D6663F333D45A3FB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 188KB
SHA256 bc4bab8565948ca126ed7239a580f00172d967f458916a417e8cda7787797724
MD5 f3105996a5e2c4ea5253f69957f95eb1
SHA1 c7278a0da28ab1771814c2d56d6d9928f6cd06e2
SHA512 3366e5ade93a747b62d2c59032591e78736e2918e313cb91cbe74fb7fda7e536238d88c8308f2af90fb7244e3a39decaa89f24b4716cb4263869bfe631dafe1f
SSDEEP 3072:a/1x+RSRU39y2PpV8pQFq4XKF3QPi2eoXUso+Tp8TAVBUy22HI:atx+RSRs9yypsQFqT3QqGNHI
TLSH
T148148D19E26812C5D16E6235CB565642B7333C6193E2D3CBA2D0F63E2F3A2C46EE5713
MD5 SHA1 SHA512 SSDEEP TLSH

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads