d5d62f88f4cbdbc4d2e11934ed159d6bf3ed84ca26704a7ebbc4ea8c3f900ff9

Analysis

max time kernel
149s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 12:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
Size 1.1MB
Sample260804-pxwjcs1bnb
SHA256 d5d62f88f4cbdbc4d2e11934ed159d6bf3ed84ca26704a7ebbc4ea8c3f900ff9
MD5 283f771dcd4d6f5bb161626b5bba432f
SHA1 2d1cc6d04236f3045471b7572b7291dae92393ed
SHA512 dde5c0e9835a0b3fc12f29b0567e12b97b66aeecad608f26d006bc3925876ac54a9e4a437bec0f57eb8191b842da415932ce3faadc35d85542166e74fa120c11
SSDEEP 24576:3ZCKb3z1YydoSSQzhSqp+WYVWpyOA4KnhSq/jrc5xaNIBSYQkT:3Q6xYydoStzhSqp+WYMpJAFhSq/jrQao
TLSH
T1E0357D4A63A4419EFEA7F076D617C60BD6B1784A0376962F01A46B726F337711A2E330
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\E:	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\N:	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\P:	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Q:	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\U:	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\G:	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\H:	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\J:	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\L:	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\R:	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\T:	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Y:	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Z:	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\M:	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\O:	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\V:	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\W:	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\A:	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\I:	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\K:	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\S:	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\X:	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86921\java.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 20 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4480	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4480	2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_283f771dcd4d6f5bb161626b5bba432f_agent-tesla_amadey_icedid_njrat_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

64BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
Size 296KB
SHA256 8992751f3248549b63707d04115a830f0dc706b388125f755035e8661a82a0b2
MD5 51aae7586613ceef2035498bbcda35ca
SHA1 4c448f4b64f54d7b117cdaa69e5294bf3bb01899
SHA512 0b0fcb2abf590b8a1f0c6f525c14ee2bf2fe543a679152592e4b96d354a0c4865ce4f8cd0ef20ce8d97363d6f11e21cdc06294bf18f5cb441c46c5f37bfe8af4
SSDEEP 6144:h9pfLkks9ITjqjS/VN/5xC3UcJtqQ1stxTuG0muDEErPE:bpAks9nW/XcyruGb2E
TLSH
T1D4549D1A77D84CE1E467C23ACA528542E3B138954B74D7CB2364432AEF637E0AD3DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86921\java.exe
Size 333KB
SHA256 af27eeafd7df9dc77275ca79da216afe57669f824089dc24b59ee4c992c0e45c
MD5 256b53724d8cc42da678e856a32bb357
SHA1 4f150cb2c1dbc10b2b96f5814df02ee1c94bbe59
SHA512 f523176f9179eba1055c6dbf448be94e3ae42b6ea42fd45525f93fb1a618573c30da03312e8b6f45dfe1eb278b3113b2ac2afa2b5361d2fffd725c739cbd1c29
SSDEEP 6144:YvP7bZs95US2k5j3OoMkbL2nqYV/PvyolBM:YH7bZs95UZk5BiqcPvyZ
TLSH
T1DE74BFA5B3901CF8EC27823ECD655906D6B27C590760C65F13A8362A5F333A11D3EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86921\javaw.exe
Size 333KB
SHA256 7f187da108cbccf79e1f1b2297c396f093ad804832c2a59a92a28fd29cc0a256
MD5 0845f56b91bf49965c4f360cc7c9b027
SHA1 4c2cee874cc831cfc804be1e86f707996df5a61f
SHA512 1b7441b5608dc0f5d78a043236168fd807e61a8cba897610fd7b192981a92b225f18912018e7bc2e4d5485aacd48140b96ac00ac1007d6476ebf334af9615603
SSDEEP 6144:qs2T8s9FQaxPf0OkLsHJtBYSzoYutYPDvhqncfq4697Dl4q:qHT8s9FQaxPcOk4ptlzo4PDvhqncfq4I
TLSH
T17F74BFA5B3901CF8EC67813ECC554906D2F27C5A1BA0C61F13E8366A5F333A11D6EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86921\javaws.exe
Size 540KB
SHA256 ffbe4e5bcaa95ee0e38c6f75c5b312b78ebf750516dd2b524eb2d3af57bbb9a7
MD5 48eb7ee06a5cb4fb0c6091c917e31cd7
SHA1 686c1581a2a54b138dc5f89fcddb68860547d7da
SHA512 fa57b2980d2f63bff96fe7dbb82de379ea2ae8278845d82ce6abbd6bec2e26b1adb3792219f2735e707b5df03074ff8bc5f3a2c44af1a0ebf760c8242ae64610
SSDEEP 12288:mjaGfZs9G1K2itI2hEsk+o/LbbdIvWoqW2dZWc:m2iK2i3Esk+o/Z3Wc
TLSH
T1F5C46B90F3E414E9F1B78A75CD764511DA767C9A1B21CE8F02A8265A1F33AD18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe
Size 596KB
SHA256 76b61381c86505c09b2ae484376cd615af5e35e1f4966461b3a5008d693da496
MD5 b27d4e070022b5120790f5baab39d852
SHA1 4cb25431faf99a1c7ea3245da8343267bdb5743e
SHA512 b763c9cf25f20ec6c353633f6ebb8e13ce85f05496d6c673a5b8ccc637b1455c87d959c11e4470228f03246dba3d568534bf998fe9f5b6df43fdd330ff6fe03b
SSDEEP 12288:Is9wNXcBZrlFCK7d9jrNSU9R+WDil4IxbTzHO:cNXcBNC6VRpDil4IxDu
TLSH
T1B2D4BF41B3E846E9E06AC534CA438642EA7378960B34E7DF01E092792F37BE55F7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe
Size 6.7MB
SHA256 7531de3dafec9cab856ca924cf3dc4e8f0f4ea2ed8416e32a588dfbabdeceeb8
MD5 64b586b51c221c8639dab6fa9de5ec43
SHA1 02ae665ebd105b0a9d7e41ce04db4276f865b144
SHA512 5a87ddac3d8805550ddbff206b48a8c54c30c6742a780c4b2420e6682dce7886759326bea7c218be1f390ca77de4c0f7466b8834db07a18271482afc1ff61d46
SSDEEP 98304:fl8YfTaJ1+W6fjB2L4HrZtJPIieK5M0uR7F5eSJ:N8YfTa9L4IiFUpISJ
TLSH
T12C666C47E3A600A8E46ED970CF3A5521DA253C8E57B493EF129476E81A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe
Size 1.9MB
SHA256 b83c0262a4189e4d48dac00ddb398196fd55106d5ca67765cf47bcda7e0cb433
MD5 cd2fad1337674ec9647b2f7401c11aeb
SHA1 016ad2ab12778e0b073c98dbd3831cd212d3ca00
SHA512 75b10dbe873c8819503d7c086ee28723d234ddaf5a8d0c8eb641652e781b2e90b0118f4cbf87599427b3e850131a06542d13a775a192b489ffc437582d77d914
SSDEEP 24576:sHpolepl8UIrXf/YMWKDaxCHeL2NLb9Ld25PTOocJuJ/cIsY6Wfvtdjz2NIXDfj:WpKep+U0YMWunMwpZeToMJse9F7Tj
TLSH
T1BB959C03F2D941E9E06ED578C7469136E972BC890B24B6DF0290B2992E77EE85F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe
Size 1.2MB
SHA256 196ab66e584dde600ef650b0807d790a90276d8a5a889e09cd0af1d6b487d1d6
MD5 d7e54810eb3ab5cbc199a708f2ca50aa
SHA1 2ea1153584160f7d0f1b5c64716e562107cd2e02
SHA512 7fe47c90203b23bb7f756b3f6ee4d4818b53c9d0b4e2626ea2c9f99d67ea4edb1bdd5d140999fc2ba0b1a52e81cd89800d1c0bfb5e346bd8434d712a1be127c1
SSDEEP 24576:XmCUqma95kvj1XXfH96r8ATht3IfCIbXCIVprSiEcQFhB:XmCdp95kvp/96r5Vt4qg3pGJcQh
TLSH
T14545AE07B6D901E8D029D574CB568132EAB27C920B24A6DF06D1F25A1F7BEE86F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe
Size 3.9MB
SHA256 65c8ac0fec11162e7054ef942f209d505456b880b9745e29651f3344856b3b12
MD5 20d522b8b7f0bdcf08cdf0996f27fa31
SHA1 8d52a52408c44b388f20e554e1c7fcb1a60fd671
SHA512 0f163487bfe204a3db581097c4ee6bd9d3266fd6c47d3017c1338f851c9bc496978ac5c14c43aa1fc91b0d7379dfc810ae88787644273bbfebe5b36e91c01131
SSDEEP 49152:gek6Svk7ea6kaoSub5eWOv59oGf40GD0AGcuVEusJ6LNzOeL0GKVIeCjIp26If2E:0K5ScuVlcm7fwKAfAl
TLSH
T182165903F29940D8D059C074CE5A8132EB627C8D47F562EF3694B6EA2A73AD47B3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe
Size 1.2MB
SHA256 60e50cff802bfb67808e6a10f40f4e35e948a76c387f815310b409646f0f8dfc
MD5 96b7b3d14b167006075479360c5f2c78
SHA1 1d1d83b5ead6fe57b568abfca18ed93884eebb1e
SHA512 f724dd2bd134c66d3963feb44896384d45356d1741442135669c33912e3384788df96282d906ae4e3c1c70049e920a277508f1795a1214fd2e0be8b164de1c33
SSDEEP 24576:FzF685bSFvBXUT7yhZmDshUrYS0Eb08mDFNQN:FzFN5OFw76ZQME/06NA2N
TLSH
T17045AE07B7D941E8D029D5B4CB568532EAB27C860B24AADF06D0B3692F37EE45F39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 1.6MB
SHA256 7af3ea860f00984973066bd49f3eb8a19caf58b96389290047c4746859593739
MD5 9ecc39060b06142e7057116552bacc6c
SHA1 3f2bf5be79805b4a824cd06855a2badb3ed63daa
SHA512 da0eab353612f713b6c554b2df4dd2c04c67905214e7aa447a91d20ec7713f8640dbeebe29666cf7244b76c24e51f1915cb81a408f7a4382464b24c611f27fea
SSDEEP 24576:ZchHRWX2R/60QHXqxMpJD4GT5Q+lUlPMzhbwTlkkkkkkkl0T3gAQy5ynn2K7:2HRa2Ri0DIJ0G3lcA9gPQr2K7
TLSH
T15B759C03F68A81E5D09DC2B8CE764B31EA717C655F2096DF0290BA253EB7AD04B397D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe
Size 3.4MB
SHA256 5193c0f54dfa45b04e605ff91144942ae3500afa69a0031191ea2a6de365944d
MD5 6d4b49e6797de5826845f598d7d86045
SHA1 a24915cbc4ea906895126d5048076fa93b1cb25a
SHA512 7706ab8a9b3cc7c310ccdb90cf79f594239ccf3485d1f87ffb879d8b71a63ae842a1baf0c5f01afefd8480a00337dd7b0c1492f1cde713b2fd9ceccbde283d27
SSDEEP 49152:PsR3cMlp0qAjQqJHKqVn+J1T/UqMzADXulO7Udq+KqOuBk7bVnU7wF62JtYi/uB:NrPwXul1EE4ws/U
TLSH
T101F54903E29900D9D099C478CE5A8632EB627C8D47F562EF3290B6D52E77EE47B39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 1.4MB
SHA256 c9562e236ee4ec36ea832e68ad68b2185d9e29f537a6f79da8060a90002dfa49
MD5 b9c6bc50b113c5f7dcd26fb86b667dac
SHA1 4199bc3cf3f5f918a60eafa4579dcc678cf3c201
SHA512 66c2c73960f5a97a11361558bea3dc19d21330bd7fb22ae717e8809410b08a4532272b4026b2ba0afbdf9eb640109671c8de0f5d1678df956b8305af2b91c0af
SSDEEP 24576:/jjqcEwq75jyhXBEpnjyshsaWj013EkAte1qRA5OT3xNmrL5:rjBqNj+GyUVM0139AtS58bI
TLSH
T1B465AE03B29D41E8E06DD178CB564536EAB17C860B34A6DF0698B25A2E37FE85F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe
Size 1.2MB
SHA256 899e733ba6679541ecc3c816ad547eaf6171ff435601f56ea44bafd1bb73b094
MD5 12fd1d14102c9c6f35a2a2cf6e29d0d5
SHA1 a26497945d490432c84d0453da3681499bd7d37e
SHA512 40fe9bec2a93db36aa18e2a6a295e23ac390ce74ba907c936aef11d55996265551fd87db9c9fa627391c2945e0de0d018fb4cdd0719e6a948e5cdc0b952c017c
SSDEEP 24576:4qgu/Z8boGbXTXSEAFOoVtCoR8/GZHbW/a:4qxB8bokCE4OoVYoR8/66y
TLSH
T18245AE0BB7D840E9D06AD578CB568532EAB27C420B64A6DF06D0F2592F37EE85F39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 248KB
SHA256 2a8d993658464ef5954735df659fbcd54779a70ad3d56c02aa543ff320aa55ed
MD5 4e04446e7aa3151ce710b7cd8db290d4
SHA1 6c14815aedbee0cf219a05d2d45581694f708bb0
SHA512 5bf551ea4c04e9419355ea4352cf2e5399a321355485b618eed923fbe29dc7e2fe9012e3805738d8958d2938a70718e414b8df68812cb99f9d3332e21c6c7fd4
SSDEEP 6144:2s9nhdM74c/Ub2O/VR/Cuoh0UcEOepXdmkz:2s9hdRYuVRoZd3
TLSH
T1EC448E6936F810E7E076C1B48ED59503B331B87617218E7F4390426ADE63690ADEBF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 265KB
SHA256 b830426b998098ed7620dfced0e6122bfc16ae38db4da8990cf4f2e5cc44586d
MD5 4f4ade581e28a87e7804bed3ff1189e2
SHA1 4cfc4204b23e8334994e65b0324a17fd21407a15
SHA512 425948dedf2bb4a52e70d134462780a98b2f0b01a6f8bcf1660332b207324b443e18395c714386ac97e80d6848c4affd9f9f397eafa424ce50cdf36ecf14d8ee
SSDEEP 6144:Es9N7JvkraQpBAj9YUYWoht+uoZySLytnQudwI05:Es9N7Jh2LUHo3J05
TLSH
T1DA445C6A25F900F6D576C1F48FD09903E274F8B663108DBB82D1435A9E23A916DB7E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 610KB
SHA256 bb104479ecce4a14dfa5bb5f68411b19213555ca27e7a920d547414419ff1869
MD5 eb851c4a0d2c5f66cf894694782c1002
SHA1 2397a0259fbf10f61014f9f23f2814377c88069d
SHA512 1bef1c197bd0de2631147889d1806b352da7884a9344258fdd4f3d824cc9a2ba99197a7aaa8294b6a5d5226f83c8627e6c245d5c81c500ba63d9c47bb246e6d7
SSDEEP 12288:Ls9q/lZAy43JTHVlVpSAao9/Yto15r9ycxnW8hjw:7/lZXmBoo9/739ycY8Bw
TLSH
T15CD4BF81F3D857E8E07AD534CA528546EA727C960F60E6DF02A0427A2F37AE55F3E314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
Size 7.2MB
SHA256 702c58baafedc741026098cde6828c9d779426a1ccc837fdffb934fad8aebac1
MD5 3041de3049e7aa54f1065c3baa59bfce
SHA1 dd6a3f6368ad07547199111078ccba2047de345b
SHA512 31d9de59e32329e34492b995fad6ad80bd4395818886a8f136bb715ae6c1768fa009f04c9afa6c9ba1d0904a09e55cf53616b2a9e3e732414b40c22385b038ff
SSDEEP 98304:H6CZetahq+WZ4zKwCsJB2++fGvOxRj2vJzRN+T6frqW:aCZeta5mGIG2xVqzRdDv
TLSH
T1A5766C07E3E600A8E46ED974CF2A9521DA353C8E47B492EF169476E41A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe
Size 3.9MB
SHA256 e5e7cde47c0873ee1a35bf380f02a5eceebd69b33f587c6a5df9be48a09d4bac
MD5 e9cc337d71501b3c610ce2deafd11e20
SHA1 56b561cba1e7931b4c24954a4b347d055f0d32f9
SHA512 a1f9aedcdefb8ff42ad7593334fca51d8b291e144d848cb860e6f506c0c906f412cc425a64c583171fe9a9e839bc388647c01dbff0e350ca487698911384d159
SSDEEP 49152:5rzDe/UyxgEbSUAHobmhLbKqm006NPpIupEdVu+e6NqcXToRzvUqIzYHBigdQBiJ:1esez2tH2mCCsNUhIUBbN
TLSH
T134165A03F29900E8E05DD5B8C7568522EAB2BC854B35B2DF0650B7522E7BEE4AF3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.3MB
SHA256 86ef4aeded8ad9a9a42a0a827ca7044093784656a9a5587cb71ea5fdb12f9e8b
MD5 8f790e7fb9aa1cc6cb49bd9bdfd60781
SHA1 c90ddc2e22472a9013c308028c13e8049cf52e2e
SHA512 2c6ec16df3795fb1fbda001cf94b6c424b1532f8bfbd060adbb6143d94a90fac40865de16581068be1cfabd12d97910191f922ee9d2b1b3e43f6a07415a5bba2
SSDEEP 49152:2F/rjH55EaCWIggE60stBhuXjfS4LWxnF1RU:ojZKojBO1q
TLSH
T11DB57C03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 1.6MB
SHA256 f650b8582bc28ebb352e5d70033a43a4e191521bc90be8e5f62d3d1725d2514f
MD5 03cc070b29309d4dbfd3aa8857a94d54
SHA1 ee7ccd16f6cfaf0cbbc1881f44e36231397bcb98
SHA512 2c1e97fcc95ca22ac04e2d70d394d5010f0fac8f9830b577124bcb1c77987808e123d0b07749cf23886a46cfc8b6d4160cf8e3b5392251902d1683598d40b6cd
SSDEEP 49152:s0vYJ4qfTjev0jsB9j9Chtg/TlXrk9dBLG:5gzPm/O+
TLSH
T107759D03F39900E8D05DD1B8C7568536EAB2BC454B34A6EF0A90B6552E3BFE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.0MB
SHA256 219c7d76d2d440800bae7124957e7478c6481a111cb2e377d87fbc57353f18ee
MD5 8ddc4a045b52e2cbff04aa285087850f
SHA1 b3e39041a09088594f875131036e28c41f65de3b
SHA512 bd912c40408e5c4bed40c0f43617d404dc898fc66cc111d15c66823a55de1f51066f817f12f1c155a4cadcefabde3ce3b107f254ab782dd8e93b0f8f9a82ec6e
SSDEEP 24576:86gohg6QUEhFCPoZugvz5lFbBH6jZs7CtW7KSdHBxmRkkkkkkklQXBysWAtZCLy:82hg2Ewyvz5lFbx6tZrSdHBAVfbCLy
TLSH
T166958D03F6DA80E5E05DC2B8CB368B35DAB17C554F20A6DF0684BA652E77AD04B3D394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 3.5MB
SHA256 0d8c5ca1d1a6f113095d4a1ca5a32488ae37a7e902c762acc0b7f836226a9dcd
MD5 5c90e332c11f82924fe507d2a2474186
SHA1 6739dd1047b4f7a75c2c03299b56ecfef23ec96c
SHA512 c0c726d8ba180cfe242466ebbcfbc84e54d6f43f2b1b00766bbf175f9b7869d4b642022097d0ed16b6897b67bae89fb302b3a14f9b3fb7ef7071e5af472a8377
SSDEEP 49152:6u25yVSVXk9P8OV1OR1k9CRb6YErdz4AkOuaRoBISCaQZCLlrrkOcd:wazxIPOnZ5
TLSH
T18B064903E29900D8D059D078CF4A9222EBA27C8D47F566EF3690B6D52A77EE47B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe
Size 1.7MB
SHA256 ce743de13d9ce9f1361a8a151e701333df7601436d75484ce437fe51ba8f09bd
MD5 7f39014a62183fea7bca283ef75dc9cc
SHA1 a99e3ce4d6914a5028d8cd754aa1246a7b41af1d
SHA512 71f443323477effd7d338b3b580f7e4d70eea43616602a94afc944190f7f2113aa01e761d422db638e0fb944d50d4db7088c8e300055862f9e6db2567b387dee
SSDEEP 24576:HObla5Jd66xbbt3Ohuu9no4AFZ9YDLwbb94eQuJXlPnyF4mfHU9YawsNgNeOYE:H5JdjqFzAFZGDLwXGeHX04mfHIE9YE
TLSH
T193858C03F2D841E8E06DD2B8C7469136EAB27C450B34A6DF0691B6562F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Size 4.1MB
SHA256 de60b8853380d8c8825120043aaf4e5c3a642eafc498e16121d06ef6fd704998
MD5 d90f27a95dfe6c204e6e739b403de1dc
SHA1 e3e5174b79bbefce23963c1c751df1377f8c1f25
SHA512 9f13a4207ddacbcb334251e3c6462d104714df06a872656c02ec2158d54bdf917c19cc83753567c993598b39b51716b9dcdeff4e712fb58554856104892c73cf
SSDEEP 49152:DuVJ5r93aYdod7RKxIRIyKIe4+TjE7zExldDwUIDtaZHWRdpev2y/BajM:s5sCVgcd+RaAjM
TLSH
T1B0164903B29940D8D049D074CE5AD232AB617C8D47F162EF3690B7EA2A73AD47B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
Size 1.6MB
SHA256 0bcbfd09ddedcb68c1055e8d610af1d366b2c0672813be72215d9c6233f6ed38
MD5 c3ee281e32b94fb55cac02eea0ea4d57
SHA1 29d65e92468a1cf8e794c5a98dd5806ab4ae8572
SHA512 41392c26c7318414bd7be375d27bf9796aa71535f214958a551c596d9fbeb5e24c7493f2dc347d3d2eaa10becfa5561e616334efd5730a0da55a54c915ab8f8e
SSDEEP 24576:xtv29d6tKxX3MTxXanu8dPIrve1IPkWbL1oaedpEukUoygGmq/S9Hh+F:xk9d0CXcBSdPIzeGP9bBo7EukU1yG
TLSH
T14B758C03F3D801E8E06AD1B8C7568536E9A27C450B24A6EF0A90B6552F7BFE45F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 1.5MB
SHA256 acdd07eab4c3cf49197bbe2658d24a8e3683c34477989b21ab4ada6411ed2f3b
MD5 e6762e2f51c04422dcb48c2b8359e20c
SHA1 542f795c491e204b121360507bb8510eaabea44b
SHA512 4640e5596cb23ba9d662418ba56cebe03bcd3823899daf75be807ba443f6adaf9af45cb12f238336a16fe3fd083470e87fe27c0fe2370417971c06d4b7544391
SSDEEP 24576:ETY1k6SLzRoPI75eu9YuKxdFrViIUGsVa4i6h27d3WlJpX75O+fO:P1kR/ka9YuKxdFr4Xn+6h27dnl
TLSH
T170759D03F39940E8E05DD1B8CB56893AE9B27C450B24A6EF0B90B6552F77EE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 329KB
SHA256 668b1b6252bd612479853149c78d8aacc368e55f835688cc837063b1a9fcd064
MD5 7cef19c2e7babbaa1bdce8dbfa4a5f4f
SHA1 298a696b4ab3f2d162923dcf008aa5e00d7ee821
SHA512 d04e2ff14f961a9d79821bb17792925c84705bbda9c04bdab9063608bc5e38584abc27803a754269e9a20c249dc9abc24a0db73f8501f5257d96351330f22594
SSDEEP 6144:lhs9Oj3K08Ud5oVRmEuo1wY72lRgU2/iJPsfUrcAGYWw9Wv:3s9Oj3K08y5aRuC2lRe2czAswa
TLSH
T15E74BE25B7E008F9ED67827CCDA18412EA73785147A0E7DB03E486691F237D85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 672KB
SHA256 5b210e0326182a496b20d897af086ffb330a8b661aa79cbd5b6081d18de34ddb
MD5 9bfbac45b238820ee1f33b0fdfc1aee3
SHA1 852ac897bae7f112834393a53bbf74ca5fea0d46
SHA512 4ca04364422c4b39f474fef01b255a405f0bcb1f8b71939b9aa71c893db79a7b5374709a210d759feb63ab56c617147391c48b0f800e4aae318c7920e6750166
SSDEEP 12288:dEZbNVEkaUkHIQVEj2Weds9UrHsRBDZ00hGgd:+jEkRkHIVenrMRBgi
TLSH
T130E43A16F6748735D073C0B9C5D2A69AED7230861B308ACB4286D77C3E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.1MB
SHA256 37294c03d3542ffa292109e87aa395df67d4ecfc647fdfc564f0f2accd8e89f4
MD5 c9280fa96531b1cc5f7e3b5a5e200e16
SHA1 b75c9d41a5832c038a35373d55c6ca1635d8ea9e
SHA512 e1e83b36118eada5cf7a1a4472e5a8b3960fdd98a37c4ad6bb0056d7e642082c4867cb2d766a37b4032158f4a33a8c40a485b6662854df7043aca56d17010006
SSDEEP 24576:V2eHezSCuvCW60WcgrvWN6q8wyuLHsmem90gjdpW:NHezSCuvCfBvYHjy+eCpW
TLSH
T1D4351915F5788323D0B2D0BAC5D6BA9AFE7230464B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 840KB
SHA256 80df030bc9e1dcf2fda25060bfb9e34ac8d75316ea79b5b832353ec32eda07a1
MD5 4f7b9f6162af6726f07be1049d964882
SHA1 82e9b1a8e4f09d058c258c63e3efd9068962f239
SHA512 118c5851ae47059cc18329978586512bdc298f3163c005c99f2a85fd132c2359ec370c83b737b77ffc6b57e4e585b9e1cb1ff090920c1b350a9e6fea9f62e91d
SSDEEP 12288:5IdNkBJj3vtH4H/RE5yXTwsE9eWZars9bf0Im98qfTVtpl9tXcHe7a:5IdgJDtYHsFZaW0TVKHeG
TLSH
T1DE054B66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 350KB
SHA256 60a1c2ef696cc389d62441d6b549acb2f3137c2372381e057ee8bba0bc3a6c2d
MD5 e0c26b4cf6f80cf23207d43852b48a15
SHA1 a10f6e492d114db898ea11f1aa68f76c1fd24ae2
SHA512 83121887b94b9726142c00a0279709f92fbe22c31979649f9cbe61b91b254c220d923dd98cc119f76df4880c6715cfefa24ba2532304a23e4b4207d10627aef2
SSDEEP 6144:OO4s9IBJ/GKWWBNU6ITLBi0qttclOKgU91BGCW4n4hdx6:6s95eBNUbTVO86UTLn4hz6
TLSH
T1A274393BEE28FCE2C67E4DB85A91C600A77274704B61A3CBD175820DDE136E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.3MB
SHA256 49804e09d7c2875781a303299b86c44a5fef69c8e99e0eec554c002f4dd3af6f
MD5 ab9b94f7a5b5870a19a0063293f62a5a
SHA1 8c9d434c8766cd2d1ab0028b6126fc1af5ab8695
SHA512 08c70dd1ca03bbdd104294ad587d96e6fc99563dd58626215561f52033c19ee36562f9287f1f6e2e7c16884922fabf24bb1571dc92adf521277165a5490eef7e
SSDEEP 49152:TGEyoMZQiQu91SrSbsXMikwozLSwdilt/X6I7H63zeuMz+E0PZZx0JbQqAR8NRVP:TGiiLHsDMLAYxeJUqx5CSqA
TLSH
T14D265B556BF880F5E0B7E178897A8AB2F7B678420D31EB4F0191C62F2F336905D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.3MB
SHA256 256c3d96ff44325013fb0fc211a2da16ec781af639cb4910b77d9abed4da3cf1
MD5 ad2ef7d641ad0a60f2e1d45454eba605
SHA1 9880eddca36d8c0ccde7960379ce82725b210f15
SHA512 0e7292ed4463f9654f92da0ba0a23f0427ba1521714b654039a4552c7f3eee50400bd0ed20c68de3b0f2fcf294212b1bc908c9bcaa9ffeeedff24e05152b811a
SSDEEP 24576:U3+Oy9vvT2z+L5WqfrHCYRFiV+XenmE3Pnzc3442kZHJxCXGx:U3+Oy9vvT2yL5zffFiV+XenmE3/zGZpB
TLSH
T11FB56C0976B8C2E4D1F6C77896A2C647F37178154B30A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.2MB
SHA256 0dd23fdc519a33f7d706dbf889ee7eb9e555af3c813f9a77a68e554c0fc1501b
MD5 88ba614aa9482f14f12c394464d28e0c
SHA1 43bbee3310433fc225bb721f29f11f855c6516ea
SHA512 d0d643f1e088dad03a575a53dd68e8c46eb3252dfa77a65ca5d578877217622e8fda5a906ce55830d75c2065441b9bb13905c464683927b1da5ff66e1f1b7a86
SSDEEP 49152:Wjge9B+vl+x3Ip3DJf5SUYLoDpgLjSTYlQcGeZAaLSF259ruMHwpXMi4FqJLd23F:AGRQyi36YOcPZLvw2gAf+PN3xh4
TLSH
T1FB666B13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 d6ab0cc229033fa10c3ef510b5cdc849f8f89edb132ea57e808173078755c57d
MD5 d6c91524d4857afea30eb381c5fe8738
SHA1 2655b5830e59d0a49ecdb9a23f1d1b13e532f4ed
SHA512 8eceec308b9c8fb93dc7c9a4052abcf3b765476371574ced399a6377a0b576045cc9150f634a72083472d71c0e9fe7c674fedd8a9c94d21dd8bfc166c8536457
SSDEEP 24576:ujvMYxmfQ/r/0uDboF+VlNiq7DaHGTNHu7PNU3/5W/ohL0rpBV/monQ:QxyQzYylNFeWu7PNU3/EpBVpQ
TLSH
T1D1952733B2F600A9C44DE1769F4A873296E17C758FE0D3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 3.6MB
SHA256 8ec4e332ab7ed6fad76b0dec4e8ffb5f60d56950a447e629bb63baa7ac6dc9ca
MD5 79bf2bbae02fe369b373133c9713a164
SHA1 097d2a105c255aa8ac85a111be9dcf65b3b14b85
SHA512 63fed5d71d356a96d0afd4567d5d2d6fde0afa8d337693fee3434040c73a493eb77de1ac94d0483eda4fe5954f9040b83cb54e01ae0ec5d3a0043c1402696ad9
SSDEEP 49152:Tet57W0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbIN3Oh6tznm2FQ/nho2qkrk9P:Yy5112gYy5azzVvX69nLKnhZBY
TLSH
T150067B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.4MB
SHA256 dcbc2e62e28f70d5106e95a0e33c5191d709c44b35c810364d720fa804424b43
MD5 2ff121d4f7a0089a43e785d03c9c4c70
SHA1 a239a0442293d60432909819454e311e68ca451e
SHA512 7b6df833ed33e8b45f62159c81f1a28012daaf06f251dad378c2bebc94b942c2c4a3db0c02e33b05a850399c3dc245e39b7f553fd60edf13cb544f6bcab4a5ad
SSDEEP 49152:5JG19Z4pNE+9OBr4tEGB0bqx0z+n217aau1gldx9W:xN2Jmnxd2dD9W
TLSH
T118C58D13F1D901E8D06ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 1.8MB
SHA256 4614da81816af9559bc5de920bb68573842595705590317c7d10a69de7581764
MD5 eb8977c4a99f11efbb954b7013ee6f10
SHA1 03d2995263492c519b36a1f4097f02a771c5093a
SHA512 fc3e134f32b7ecd7a38313ba1e1642219951a560e7b973fad4bbded74c6c0c0413260c8e22fd86fa678cedcb609eac4245d539c66083a1e16fe8e95005b5dcaa
SSDEEP 24576:oBvKAk0ud87+o9Btz/IduCMlO5APWUQ1zNOgLLwH7ReaQXx3EvznZ+xr2:H0ud8qoNJO5AuU44CwH7R4xMNS2
TLSH
T1EE859D13F2D800E8D05DD17897569632EA72BC460B24B6DF0A90B7961F7BBE46B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.0MB
SHA256 edd946deac1578d84a108fda7bffea260ebd149169c40d1970bfb41fc0fc0ef4
MD5 2d7d5fd2a6396cd43fe717a748b8e383
SHA1 7481f83fe9fced9ba0290620b57107fd022d054c
SHA512 d4c74ded0e6fab393d8cbaff0082b5fc5db637d930c80042349b8670797fa8f1e8e6e9352815fa8e7eb8cb52b287b587b6a60884cb1c511771c5b9b288cd95d2
SSDEEP 24576:1ftvL34v6aMQUJZzAQqJPa/gd1HWx3R04FxGgVG2Onks6xt4bSMHnqfMvTqGXccA:7A6VQUe5d12ZRVtOnks6NMHqfSccA
TLSH
T19FA59D13F2E940E8E0BEE67487669236EA72BC464B34A6DF064072551E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.2MB
SHA256 21fa3170c047e2cc12937bdef36c8fe611dc0ccde0a0730193886e2df3c0aa59
MD5 609e7be58796c3ae3384c2fb09c5bb0e
SHA1 3af8d5890c043cf8682dd536013c5a75a1b0c16e
SHA512 d2146770186b77739472e999867bb11771d218b8de2eac8a7dc7a1d6c6550eef816213b27f68b238ed7d0e752308cb0144cf7d79c99c2762a948d90db0ab82a4
SSDEEP 49152:XfAeEx4rgQUGjLAE3dGGj8bqEGcjesaNkYQd0XNJKcvaAcPTY6Y5AwRWJvMlTiV:kL0vjxBDlZLRWJvo+
TLSH
T1B0F59D13F2D940D8D059D079874A9232EA72BC494B3166DF0690BB562F7BFE06B3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 881ee4a09f87b4ef73bd555f89d246954427e088456cb4453a1ceb801e2aed27
MD5 ed60b04851d3b9a6b179ec4fce0dc471
SHA1 75b33871c84f5dda6930a88e21b9a024892c48dd
SHA512 ae22d246f2fb8c44119b22e02b2d9d6ea6aaf8c42dcf15b729823d645426ee12c702b33e8e2b7d1ad0be607515bef2b57ad2a786b999f4a9f43380ffdb3f7a6c
SSDEEP 24576:aObvtR3ZMXEOAn5ODyUg1o7l+i3iy9CTn0AP5+2QLln+ksncH:ac3+XEOmVo7IgiDn0AP5wpUcH
TLSH
T16875AE13F2D901E8D05ED174C7468A32EA72BC160B38A6EF0A90B6551E7BBE45F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 333KB
SHA256 2ae5b9b3e67f536daf6fef7f9133d15f9ef29b99b69b4fda8745060f5e92f4ad
MD5 2b0ef46ac4d137aabe98f197f1db9189
SHA1 82e78cf01f40d4aaf3deb78bd9d2c2dcdfce4f8d
SHA512 fcb620fb0db5f0b6de0eaa8728886739babcdf7b1a133daedae10d4f9643998bd7f97aee4d84b141e701c4245a28ab588961e61315b175faef3913fb1010177d
SSDEEP 6144:alPl5As96gP4EwjGiN+HULC3aYV/PvydArSuZlF:a1l5As96gAEwpeqcPvydUSGlF
TLSH
T14374BF95B3901CF8EC67813EC8159915DAF2BC590BA0C65F13B436265F333A11C7EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 333KB
SHA256 716e58c6670867270720202d741bbe1350948bb33cfad9a05cc985c9926f225e
MD5 260a49fa170b68fbc8a312aece3e22ab
SHA1 5d09f27284853d4bcd498646f82f42d800997d2f
SHA512 9559422d954f959935e4a0f5a021fd257df2d8bda2d1f92dcc00da4491c41a608882106a691ab48daf8bd483970a2c580a92ff521bc7452c1708a974bc262b19
SSDEEP 6144:xUYBRs96SV3QCrSlnsXCsNRvzmYutYPDvhdKfqJpjiq99/4f5:xVBRs96SV3QkSlsysrzm4PDvhcqJpx4B
TLSH
T1F774BF66F3941CF8DD67423AC9668906D2F17C5A17B0C65F13A43A274F333A11C2EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 540KB
SHA256 0bc547a67c9e5e6b3fa039feb6fe3f1cf8d0a6329086ec0eaf4df584ee4505c6
MD5 2167ddb884b78e63e64ee7bd475bed43
SHA1 8f8f3f30105ad9765840f4915fd74cec066eff9d
SHA512 4b8c2054d68c58f79f73876b32378d484fda0f03706e3d7e37ef44a43dae86b45732606f350178b662f3abcc11772fd67281f97f4cee90ebd456e845594fbb50
SSDEEP 12288:lABvREs98z/wim4olGkukaLLbbdIveLGwRF0:lMk/whljukaLZ9awRF0
TLSH
T141C47C90F3E414E8F0B39A359D764511DA767C9A5B30CE8F02A8665A1F336D18E39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
Size 333KB
SHA256 53aed019eff0303e636d7d51c06c77669e560dee3c14d601c42edfe26e7b385f
MD5 6e2ee6505dd3436fca04c7361e37b555
SHA1 0882b864b5e2d2fbfdebe440f346d3096e05475a
SHA512 7c4afa6b93510201168d93f1767521ab6e99b64014cc1a1344fa3c8ec54f4ddd140b27d1388917dce438c1e8940ed92f3dc5036f75875445f56ca1864fe8edfb
SSDEEP 6144:ygPn/rs9XFTIfdmVjoRdiGCZPlVYV/Pvy2vpN:y8n/rs9XFcfdK9VzcPvy23
TLSH
T13474AEA4B3901CF8EC67813ECD565916D2B27C5A0B70CA5F03E436665F733A10C6EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
Size 142KB
SHA256 3c1a2492b86c8f6957b5a92803dd6e224875829111107321aabc20313508b324
MD5 b0e76c37698ca2a6753278e558fa625a
SHA1 6118852259c039f050938548ef20f2f1246f68e2
SHA512 f1bd7dfcaf1986207b9b19765c52663455d3d0d0db88040f87b80e623854f586b5423ab4d3e6a7868fb210b5f09f194afd917608015ca61f070756db62063f4f
SSDEEP 3072:FU39RjlXEo43udtjZqMNbjuxhuQ7PlwEVLfGMQ0SEGFByCcy6lZ7PW3J4qUNc6:Fs9Rlw6vvjQ7PRL+P0SxFByHy6lRPW3W
TLSH
T18CE37CE1A3E86484E533DE729DB48C215877BDEA4DA1DE0D22C9720E09B37D14539F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
Size 333KB
SHA256 7d089bfa16d878a44ac31610ca106889caaee8a25b3f061881000d1fa486c99c
MD5 423e0d08faa702dc6fc1bdb6c0460d1a
SHA1 1ded7a2d0e53f804bc8085b6b719a7fd27fa1010
SHA512 4c764417cd91148d8059e0f5578ea872ebd4d5f78fd01a827f55a6b098feaafd90ccad3c3c9ba13aa5cfe5252c669891b36c6ccfef0dbf95ecc3487a7f5bf4d6
SSDEEP 6144:JZXsCls9M9qjAjsh3AsN5MdpOz5YutYPDvhfcWdZYYEQ:JVPls9M9qjAgh3djMiz54PDvhrd3h
TLSH
T10374BFA0B3601CF9EC6B417ECC569916D2B27C5A07A0C65F13A4366A5F333910D3EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
Size 540KB
SHA256 badf65df72068ced953e0822398cda68df8c66b310ff7dd12bdfaac6c48247a0
MD5 a8c3128966179915d5e74492c38f70aa
SHA1 fc3213c2adfaf311352235154b12828b0c3ea189
SHA512 40d4799ee6da0640bf551fe1fa56e2ed7b64e4d2e9d1944e858ce4ba6c77f5ab835d339708676db316fed651c97347bccd01c815e16c808ca88124dbb004f1ed
SSDEEP 12288:geq3P6vs9rlv6fOU6ZwsD8fLbbdIvDirbygRdt:g93dv6SZwsD8fZISbygV
TLSH
T15DC46B90F3E414E9F1B79A35C8765511CAB67C991B21DE8F02A8261A1F33AD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
Size 195KB
SHA256 7ef9ca1d0beb1bca9ea3ab8753c4a75f131df772a21152213efec2acdc19805f
MD5 5a0a9d04931accc4fc3f4941aedfe62e
SHA1 7d6014840b6b13c95284ed79bd55ac9b8802752e
SHA512 133b3004f42247c3fd04c182236b25c3bfe6fac28f7e73d591479fe36acbb09c811d789733e4f37c8fb2c2d7b3b2fbedaf76fcfdc2fcb8624384b34d13d52706
SSDEEP 3072:SQUzx3tc5fI0ZU39mY5DEmd/MjgvhagI/f1OFOPqx7DhvYamiTUouG7f:SBcBJZs9l5DEmdggIn1Uz3miTUoTf
TLSH
T19F147D0077E500D9E437CA7988604511E6F6BE961B62EFAF9394315A0F366E1AE3CF31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
Size 138KB
SHA256 72f381e05fc22962328a93da8da571425e5642a8942da9535b2b7e92e34a200e
MD5 d48c46b3b88f7f495e3d98c788342a12
SHA1 62ab1c69600cf92c38e15c0d75572a1d6604c0a6
SHA512 f56fd03274d54fa4bee5501ad7117ee59018367de701e4d694d36e426af12d04900cd7ee29212ac2c0e2ecd49f18df806b923175f659e6fe52e434c62c0a5685
SSDEEP 3072:4NQb89U39O28vJEisdBziux+Sk+pzahhEPRSBn6:qQY9s978qdBuDv6
TLSH
T12ED3595163F918D8F1B3CF79A8B485228B3ABD615921EF9E4290414F0E79AD0ED38F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jre-1.8\bin\java.exe
Size 333KB
SHA256 2f9c651ad0fbd795f6848af7ab425c28fcf1f26f55ae731a0cfc2bc755e35ad2
MD5 cd86fdbf38c31da670239b535e67b866
SHA1 bf8f97b7aafaae7b8475a9ee0e5977c7c98ca944
SHA512 655be267b7269e2b1e225af92e4898f24b405a5e506bc7b716d0779125b18f75627367151bc3d1dc9e40f02ac1cce10f696270d773c95d09febdfd7d66768fca
SSDEEP 6144:DeP8Yys97tvMtfjJoqJBTinGOcYV/PvypuESKuvSrGqb069:Da8Yys97tEtfF+GzcPvypSKuvSrG1O
TLSH
T14C749D95B3901CF5EC67817E88658D05D6B2BC150BA0C66F13A8322A5F373D12D3EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
Size 142KB
SHA256 30be10a95a7bdd4c22dec6304433269bf2aa7b99e0a800d7505668ac25757f47
MD5 2f21985b703e767b151fa46803cf0ece
SHA1 7f0dfaa4988ef7c6c0179d7023e108321916a3e3
SHA512 1907ba77441d8a689a340e02586587761a9ec68a5287f6935536792270e7ed97f1c4b21b9161dbc797deef96061a5583218eea760c364395a7c2a8bda35f5979
SSDEEP 1536:DvXuhi3ugIXjMjl+5Fs8h8Zs8h8o4On+uvVK7qjh3rmKPNbW7EPx2YnPcSWpfqsN:iU39RjlXEo43udtjZqMNbWwx2MPjc4U
TLSH
T170E38EA2B3D824C5F6779F319CB49821097B7DA98EB1CE1D6295310E0A737D08478F7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
Size 333KB
SHA256 12fb7f6bc0bb1337bd9fbe7972bd19f0c47af54490595ddf386b063b44c94043
MD5 e32f4dc01f2c2b337ae9863b0b11b93c
SHA1 b1a27d39141ecd51be08077442bab5b6a04c47bd
SHA512 692280c9c3fb92653896027d11ee758ca8633aa2c3411417e37dd0aa80532beda70cd7b65db7a85c7d9b1484260fb2934b51d658f04bd08b83ff1c9870b8b561
SSDEEP 6144:DemY4s92xpU22GL4fsC5p9hJzRYutYPDvhFYSuryE:DtY4s92xpU2pL4EGpRzR4PDvhFYSuryE
TLSH
T17D74BFA4B3A01CF8ED77423ED8559915D2B2BC590BA0C65F13E832665F333911C3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
Size 540KB
SHA256 615d677753f1edb4ecc3895c8a421761c17661de9b30bd6e73883f9d7d4fb243
MD5 572a5c7445f786f613c44d0110cde484
SHA1 d9cf549682b8f632959a8ea2706025b94d0e9b40
SHA512 000ace87e0400a1c75912a04f1cc881983d1f34c383e6130b6eecaba6b22f2e6b7ffa0b20dc2b3ba0675ed53618bf09649d57d64e122363a4621c3130f2ce2c3
SSDEEP 12288:LGh3w2s9o0/ZdPYLmE7+qfLbbdIvWmEBckR/:LKc/ZgmE7+qfZOEikt
TLSH
T189C46B90F3E814E8F0B79A358D764511DAB67C991B61DE8F02A8251A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
Size 195KB
SHA256 cd99397c54c0969635ea9469878ac240367fbe8fe413d1026ca48d7789157952
MD5 38d6fb717bfd88fbad7985cebcbb47a9
SHA1 3acdf10dfe5fa278ad25bed6eb99bb34edaf42dc
SHA512 019e6a43955a65ab395e3e60709af5ca1b6276b38c615dbbf00b89c7d871970f1ca16ba4bb6d2ffbcdf61998c879db0847288998427824b4495f01c4a0ba8e87
SSDEEP 3072:xvTjxFtoXKudvU39mY5DEmd/MjgvhagI/f1OFOCJGx8a7ma/z41k7Y/B4kmKX:xZoa6vs9l5DEmdggIn1UnYbcFJ4kmKX
TLSH
T1ED147C4037E904E4F577DA3988A08501E7B6BE521B51DFAF9384205A0F7A7E1AE3CE71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
Size 138KB
SHA256 b6adcc6f543df1027499ed237a38fadae7c3149b38420682fd451f675b09b272
MD5 8150c703afc5af435c175d60fcc87c0e
SHA1 eeae29cc02d4963fd877cfcffde9fdfc36a1b074
SHA512 9dd4ed052fd59dc5741330a4b0f69159b252e541fd32028c05d8afec75006bb65729e6d2399d84d1c4394e7a5514883a99da80fd78efdadc06531cce277f5bc5
SSDEEP 3072:EOQb8bU39O28vJEisdBzYMsxfIfindcXHSnLO0/:ZQYbs978qdBp4se+ynSo
TLSH
T13BD35B5223E41888F1B38FB5A9B051664B3BFD925D50EF5E6250910E0EB5AD0FE38F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
Size 4.3MB
SHA256 46387e53a4ca71ad94d87b2bc6ac122661f5abb8ede9b50b146a2be1282d2967
MD5 6883be5dea2ac9319d2ac21574c2d10a
SHA1 7359e0f4c5e4602902d1619f4a09d4e41e071743
SHA512 991b1acb368c4270af78a0ce9023f3ee1aecb2623f95ea7f7f8c2a1e13379c28246635ac679504c8607c596d1a95710a1c4ddbb8f9f56f8b88c57b024f2aa3c9
SSDEEP 49152:0/t/g7mWuybS8K73vAlp1yedYLmdheOcemevI34euWbUGptjqAGaLPrA8NRV3THi:0/guYCA/SLWVmGuP75Ck+
TLSH
T1D4265C556BF880F5E0A7E178897AC6B2F7B678420D31EB4F0191C62F2F336905D29726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeClickToRun.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
Size 4.3MB
SHA256 cf6d7c8f2b2024786f09eb6ed8571886bcd17bdfc57e63bbe2fdf6e438f05276
MD5 f5e238f60d5b5c6122208be22e1d7d47
SHA1 a0e3999012f3b669bd6161ebebfcec3c8a6990bd
SHA512 446961bc842ed21e1ede38cb07692cbb91e630158ccdc1cda90720e2b6f3cb33c059efab2043350f24a5aa4de4a167612559c2198a1dd138dc34dfb09118511a
SSDEEP 49152:2yFvnblHcwIxlhBmV7lnvS1tdLNdConKuR7jI3ieuFXTJiwggAwFPejg8NRV3THU:2y/c5I7wPLln6wBe75Cz
TLSH
T190265C556BF880F5E1A7E178897ACAB2F7B678420D31EB4F0191C62F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVDllSurrogate64.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe
Size 275KB
SHA256 c56b5558ad721b3c529a7c19614ce2844455fe4433d8508aa4f121d7699a49c7
MD5 631285f6e4717e9d572eb08278483013
SHA1 6493e78081c2fbaa66a192e3aa84b1d6b417e83e
SHA512 ec92d876edc8e5f8bd33178a2a00c3ef4f6b60c14cff647b9d03635365050bf9b71102b147c2ed9b3555d098f7aa55dc5da9322da0694d62f510c45369e8d89a
SSDEEP 6144:3E97VBs9SWGNTNYdMzATVkQNUO7q5hH+bo4hjm1d+MEDnnJvaqmJ:Uxzs9TGNTCWsTGQ4Lq0
TLSH
T18C54497BDD38F8D2C27E5CB46791C600AB7270714B42638BE135D26DCE136E15E6AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVLP.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
Size 588KB
SHA256 3246a591969fd44efc9407a3db9eddbf034c22a4e008d96a4f49ab039dce8db9
MD5 a2be1307b32e9355d3001a7fdc965f8f
SHA1 8d60354afb84d820318832f1df37d8199b3dc911
SHA512 a0ac819bd243d0e86d0f0b8de8be6aa665e8236ed3c306352ad4848a503632a3e9bb32b622bfc317ee6475a86dc65353df476c4e4f103279f1aab5fc48412f7d
SSDEEP 12288:3gRZm9mlRs9rYluzvNU4TEYicf1kWM3QTMg/H:OZm9eaq/ctkWMA1
TLSH
T13ED47D66EE28D8E1C27B89789696C600E6717C110B61DBCBF17CD27E1E236D05E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Integrator.exe

Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
Size 6.8MB
SHA256 69e0ef964415771f5bcc83606a0f5583397885b0b0e7bc55dcf64c5f392041c9
MD5 cd901b62c513d2a2028572560ae983db
SHA1 4752b73b92d32cfabefe6d0ed08b1b48c0bf936e
SHA512 c1106b77862ed7f2800422cd1f1fd0ff0839a9f2f37eb52e8d9a4442bbb87628c4c10d5096d7b77bebf030da93d2f64f867c94724b8138d18028bd1acc7f56dc
SSDEEP 98304:k3pC/9U1d7Zt9FB1GWNhrrmqJjeb21psg:k30/6bZtZUWN5SzQpP
TLSH
T16C6629596AB481EDE0AFD1748D778772F67278428E33661B0261CA1F2F33E588D19732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Mashup.Container.Loader.exe

Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe
Size 100KB
SHA256 3e6c0ed6fc47f1b60edc7d61fbf5158925740eae1fe0296494eac804dcb665c0
MD5 832548c1c821dde5fc9298d5e7004714
SHA1 0bf62b8fbe8755a260b3e98d8d84eec851215295
SHA512 98772768f337b2065a0c9106b64536e14c485fbacdd7e065b562ad11c12ac797a5550570a776369a77cdd97ccaf32a30b120bdd2a3fe2196e59aed08ff7a2252
SSDEEP 1536:0KSavXuhi3ugIXjH/eAMpldERVTSKWo0oymr8WTFpAj17ZT4t:0flU39oeAcIxhWoVhiHc
TLSH
T115A3E00D7B8C50D3D1120BB858A468A7FA777E610F1297EF6172E12E1E223C4DDB529B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IEContentService.exe

Path C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe
Size 449KB
SHA256 ef0b2c0fa7341897353f4807b61826d814aec10eb7b4fd5f5160520a2ee28ca1
MD5 0826ec6f819989def16dae3c4f0e8d47
SHA1 aed0716d6ff9333c4138d2ee48fbeec24d66b6da
SHA512 0a414602842655439973330194a5f245f08107dca2e48ca2c6cb21e7968b1eed7b88a3bf9f2522b7654f1e86cd6864ea149d009bfa292d01285d4c6661c0f025
SSDEEP 6144:RbHt8/wZSolpug5ejCn6We+qLyF0s96joT5jfcbvnmwVFwelgrU8GYcix:ZHtDSolAgPe+w80s9BRfM3AOe
TLSH
T18FA48D4AEB9084F5D657E278C57BC671F7B2B8890E60674B52A5C62F3F33A506D2C320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerfBoost.exe

Path C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe
Size 877KB
SHA256 7f8f18f84a9708b96aec86ef624c10b00e347278d6999ac94973be06bd5813d2
MD5 18df731cb8f5aa2607df990d31f2f2dd
SHA1 9d10d5b9bc421f2a3d0b68aee739174e829218cb
SHA512 46e7be0218111295312888e5a9a2b107e500123fc5227dd8ba3d044a8fab021eddd261c81e537bf5d8a3d66ded6a27f49af25f508121e205187ed03e033b5f7d
SSDEEP 12288:Ne/ksqVmI7VxO1s9LJuJ39LjF9e9gAvpEeZob4UnV5BMw9ddPB:I/ksqVmI7VxC39Bs9TpEKdUnHBt9rB
TLSH
T1D8153895ABF845F9F1B3A67499B68571FAB2BC521D30D31F0160C25F1E37A808D2A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDXHelper.exe

Path C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe
Size 189KB
SHA256 93f828d48b4e4f80d1e40322311b37578d78e9ec5c3aa8c47c3e52b19a528143
MD5 da04a375320da619ea5083d5c5130b8c
SHA1 159a14bfb0d4c4ea2cd68c126d97201e188f8909
SHA512 66843a4f3277eb50975996f88ced708ec818d5292702d6ca5570040995961c9764eac4c2f1a2e2c752f4deb3f09714f54219618782517da2a41736a538129c15
SSDEEP 3072:37gMSCxpgNq/D7U396m1Q2+zT6lZdAh3SJxfFrgrwH5znTBdXF18ijrM:VSW+Nq/D7s96felZdGaFkraTddj8ijrM
TLSH
T111149D577BE0A0EAE513D274DA699AB1F7B6F2B11D20631F4665C20E0F333917D68B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoadfsb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe
Size 2.0MB
SHA256 c25fabbdd43ca8d016e347b5dfe2ac14edd17306edc5ebf0050202ec75e1ba3f
MD5 79b3ff117113a94664ba8df1713c26cd
SHA1 dac6f2f17537d75ed48928b3341df5537586cde1
SHA512 ada6bc1a612cdd2d7eb56a87b6061acf16a00805c25ae4c5bb044a432872d5cfb457288f2bd546b58bc54cf821c8a574d4bfddfffb56fded988e28570949b2de
SSDEEP 49152:FZkArIclnXDT58Iu/2teix01GFT7bhleNP:jrbew6
TLSH
T16EA52946ABE8C4E5E2ABE2789975C9B5F6F2BC510D31974F2156C70F1F336604E28322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoasb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoasb.exe
Size 341KB
SHA256 76cd8302f267ee2e0af1eab90b71cd53cf57f6c8141d1b3cb575a189babb48c8
MD5 7257edf7e93a2bc79893d9f57298c085
SHA1 31fc6b546dde7fe068d7ed9ebafc3e7195459113
SHA512 1d4d4c497787318238b5bbb796fd9f395a57aeb1fc08a0ebc233f1c8bca1b69cfe649658f83eabad79f01a730cd704541832dde8d6b0dfa123b2f7741bed67c7
SSDEEP 6144:NjNYs9THMUHkPRZ88ViaspmB5XoX9bhvRx9EiOwZexh8E5:Nis9IWkPRZRViaspGoX9bhvTmw48k
TLSH
T1FB7438577BB88CE1D917A1748A96D2B5FAB3F8604F21C30F6962C31E2F37261AD18711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoia.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoia.exe
Size 6.0MB
SHA256 e2b9ec35a03a6f83bd8b9fd8c2f5bc1517f4a19092f1f989e40fc8aa0eb9b7ef
MD5 57bcc8a90dc129313770755f2c0e6aa0
SHA1 a4993beb045eac6fec982c478a40f165d269c7cf
SHA512 7358c15ec6fc67afe48e8403d71e6289a14c27f540c0d8286ccc8d6f295a6d2afd23aa19b89433f3b355be632f9f7561b3f43d426370c5a8722acf9148c68e3f
SSDEEP 49152:LHGTBOl6OooZuNfC5cMQNUCZ5AyO2jh700m4OxWzAEwV8tShvK293+XQK+P5jGSz:LvQACCw9Zhiv5KZCLw21maz1d
TLSH
T162564A55BBF982E4E1B7D134CAB285B6F6B2B8555D31A74F0561C30E1F33A909E28332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

officeappguardwin32.exe

Path C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe
Size 596KB
SHA256 7c87cde40f42846b8fb6c1d0c51d50c55a70bed393d81f5c2a65362e5a3a5f60
MD5 b0df738e702d39f39e3b3ac61c2cdda6
SHA1 2db3a9020c4c1a6ddf642b99ac4c23b342611339
SHA512 e07e09e21a6e07a9339de10e4d29aae44faf4987b73da4d34e77ca570e94539e6e70c4d8f710cb1b3b6b4f4e7632675872aca0f6b24e22094e2a7b5e5b860dce
SSDEEP 12288:SkBUjWmwgWPvtegJWbs9DcIPr0lypFpi2QZ:SkByWmmfWTcAlclQZ
TLSH
T12ED43980F7A881E2E566A5348A668570FA77BC171F70D70B3559F32E2F33640AD29B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocolhandler.exe

Path C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe
Size 6.4MB
SHA256 3632d992018c49f2cbd80158c51dc0ed38b771c6d5742676a5dd8b1b6acc3cfc
MD5 5261ef3c6fa7d315ee57b1df362f782d
SHA1 2fddfe6cb49bd2bfa432c87c34ea7581e64f9258
SHA512 1071b9f89901f1a07f102f54e286514fb896aa757d406f7735beaa4bd7c7437fd7b35770f89de2ff745c9f55d0d987d3c82b5ebb09fb2e8e121f78a173423b21
SSDEEP 49152:VwQHBpGQEzFSuUKBb7O4jnEcMTUjHdcZr4BfLHx+rhfvErwyoHea/BaFEXnI8Blp:EDamLCEZSB1VBp5zHjvn
TLSH
T1A3665A417BF880F4E1B7E2788A3A9675FAB278425E31AB4F0151CA1F6F776508D29331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OLicenseHeartbeat.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe
Size 2.0MB
SHA256 9b7082121c3ed79bc5d734eff75e10cbbb16c42b882ed6a1465197e821f5e79a
MD5 00196dbd6e5d18e619900587fc74bf56
SHA1 c4a896cb7b9cc29d8046e077b8a1076c829d3843
SHA512 a1bdbcf9a2da8554d1f955960eef88c34d35b349ad7be45303aec77be3df8d220550afdd901974c5175ef0fc8a14efd7f7394769b69b49d679215cc8d016d5af
SSDEEP 49152:PODmG6aeeDvRLBX1s8o+LEQ5YrU98xjqrAU:mU2n
TLSH
T140A527416BE881E5F5BBE7B88AB68979F9727C521C30E61F0156C60E1E73B408D39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLDumper.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe
Size 222KB
SHA256 f166371fb5f8f6663b69d370c16a4614de1706fd5d7d449ceff5389b2d30a1bc
MD5 1562c6046df18180d93df1aca45d6dee
SHA1 466bab4341117895db3a76faa2a5015e27df0f5d
SHA512 376249ccd27d4df9d4f04aebefdfa4074ffe45e37ba10804f0adc61d022f809b9d1028c27f57c0e866f042c54251cedc040c715bd0001002b102073d893cd54f
SSDEEP 3072:XkrRkTjI3tJU39Naj4+qrSVzN2Bmt+hlNPO10s4CzB7E3Yi:XkrRyj8Hs9Naj4dizePGh7xE35
TLSH
T17A245A00B7F91064F1B3E6716EF59112AA7BB8991B31D7EF0518822A2F73BD09D35722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohub32.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe
Size 2.0MB
SHA256 a38cf02e57001fd55dd34f9b1161b70d8f805db13d96488d501722fb3255720a
MD5 c54e26560310524128217400d91670d6
SHA1 6c57a5b811ffa4a89ad938f21dbe2f838e00cde0
SHA512 be2e66317084c3e3312985f1274ef83c94985741751d64ae3564a6d27e6bc6cf7f239b2cfd5c02bffa649e03ef725ff29e8457009459d8dee595e332101b39c1
SSDEEP 24576:1d+ekmF98YGgRB1assR/r3ffnDM52A2NBH3NRLOhT7FVwQP26Dxcab4FgwPqe0PU:1d+ekml2rPGp4ULOH+MYu8m1/p9hpP
TLSH
T1EBA55986BBA484B0D526A17189B6867CF772788289334F07318DDEDEBFE36604D59331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreporter.exe

Path C:\Program Files\Mozilla Firefox\crashreporter.exe
Size 3.5MB
SHA256 44305c2a80e7ea7b58a5a6e979683d7a2d093f67b8ee57f65e4810725ed75faa
MD5 5f2b3c4ffbe30df64324611c401cf73a
SHA1 8081c5363a5179783204bd26670fe8bc85a8c1fb
SHA512 13268f296a45cbc259b990c53492a07eda698ce6f0349764c2fe35a657bd714e981f37b72061bd27ba7319fad3ac3078e6ade064ac8a3e5a5fb7ce268b926d58
SSDEEP 49152:weL8H6CFSv8zMEY+O28wsz3iDT4JmeDNB05FQz/5TmXLhm6kV9dWQx:weoyv1Eu2Jg9f05FyhaLhm64tx
TLSH
T17D061842EB611DDAC025C0B482266723B761FDBD073036F74A906735AD68EE01FF9B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox.exe

Path C:\Program Files\Mozilla Firefox\firefox.exe
Size 777KB
SHA256 41e56198a6a6014cebf43c6a69667a4f22f3befbda4e8921da702d4c1d20f3a6
MD5 91445e2cc573830f8276a08f9c59f87c
SHA1 e9de47b27f342a85b31dab0175139576ed1fecbc
SHA512 5d6b3f32d92b67782df9105f7bb586628e75ff22dd6a03943995014ff6208344b0a1d7534e2d6c1ebf4e62096c8e86b72635526ae2fba8b63a86ef3e9bd74138
SSDEEP 12288:lOxEBruaqEOggJXnJot6Qps96VN7bCns5v436LW9zwHJem7OzwHJe0Ihf7EXT2bX:lOixumNxVNPCsZA4SwpemIwpelzEglF
TLSH
T1E105AF03F38516B8E08AD5789642D233A5723C840B51A1DB1BF93F2A3E71AD52B7D76C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
Size 329KB
SHA256 6585d57aec6e07d794148df7d00b26402740e868dd07bd3dee32408579bb85d5
MD5 9615b74f595edd0d85146da8b2be90f5
SHA1 511bb457e138f0d07791dfbba680e26e327753e4
SHA512 c6d8e01fa6ab3cb8df3023267ee4f951a995065d26a999a88cf791e281bfee985008e80cde5b57ad5816bd73f5e11b383b661f90fb3731c5accdf14121624a70
SSDEEP 6144:lfs9vQzUpHaN5wLmeGq1AZi2lRfVm/iJPsfUrcAxZHdu9h8azaWsp:Vs9vQzUpHg5kpG42lRA2czAb9u4p
TLSH
T1D474AE2473E00CF9ED67827DC8A18406EA7378554BA4E79B03F4856A1F237C85E7EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nmhproxy.exe

Path C:\Program Files\Mozilla Firefox\nmhproxy.exe
Size 654KB
SHA256 4ddbdb820bc4b7043d30db42dcbe6b14e2062003a10beed302d5e9065d973fda
MD5 1979a850fc860a5e259c0813792dcb79
SHA1 af932ac0e41775c19b2262b9ed4dde09ef0ac971
SHA512 2e6b448cf835768190ba7b83a5833bad7ea87e3c9131afe20752b07fcc494a32843cf746a90c1b5b8a5b958850f62eec39d6517a269a4d06c4102764bcfa9afc
SSDEEP 12288:5NtFS2welwl6CfMVwuqyS7s9BJc/waheN1bhGF18u:rtFRTlVCCmRs12yu
TLSH
T1F6E47E12FA97D4ADD51EC07486478632793374CD0B30AAFB32D866393E5AAE16F39704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pingsender.exe

Path C:\Program Files\Mozilla Firefox\pingsender.exe
Size 126KB
SHA256 5a5ee20cde1cd28507e47724552344623003be6dd6f6153452ca6bcb82c32ff2
MD5 0822c00ae27c86c7925e5bf2d43627a0
SHA1 5f7493b97e473721f5c2abd07e6ddae3e17276e2
SHA512 bcfa46fe4336d5b9063a543ca6b2fbde2d45be3b7b24dfd5520d48033d85d381f2f1ae4dbf1cd0a5dad9a164c4cb3bb85aec90b9893990ea03fae1e4f6464d27
SSDEEP 1536:PX7cMRQyjivXuhi3ugIXjC5iddSRn6dhSdWA7gwHl0f1dUgv5ylaW9BZnuwCowqL:PXgMjjtU39DYSh2SdWAiNdzQmLK3+7A5
TLSH
T1E6C3AE4345582969C180D3B0E9F75912ABA67944DF6E27DBE318C2A42F003E56F3D3EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plugin-container.exe

Path C:\Program Files\Mozilla Firefox\plugin-container.exe
Size 202KB
SHA256 65a0d8fa32e1c2628abb01ef34b0523f9bcf1a7e5f419c78743cbfe9580d9180
MD5 4ea9fe8aeafae8bc10b2613f52471fc6
SHA1 24f528961adace992f5ac3f70048eccbbf8b7a87
SHA512 258d99dbba86fac514a15ab083acba48ccd8c474017f064cd71f4738d0d98d7ab7503b3d68f37fcaa8ae8e43321d1eeb5f236400877dfa32874bf2ec96f80cdb
SSDEEP 3072:PWkNqLwnU39zaOCWk8/ew1eaPu06jTlr6LZMqsDP/ZEM+2ajf6:PWkNqLwns9W7WkAIEuDXc6BCK
TLSH
T11C14BF13BB8840E4E48AD27463D246359BB2B5860B24B3DF176556213F86FE4BF3D3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.exe

Path C:\Program Files\Mozilla Firefox\updater.exe
Size 523KB
SHA256 d37e465e25f6fe5fb69c510dffd35f90a7ffeea54784cf7fba5e4f823f98ad4e
MD5 9170db53045aef114eeba5c283fcb6ef
SHA1 6d721a31c41bb5a714b55a92393af3d2e2f4ca0e
SHA512 1f1c6cacb6b5e6cca227fe4177b7a7e91fcc774bcb41e6a45b881f986d8f1e687822cb85fb83295f85c8e3691fd720ae2323a129f2e346e9a5e947977fc2135b
SSDEEP 12288:2TCQsSss9AgHWyz9hpbienH2Ze/zSOJAdGypf2fWWV:WCQsSQgHWUocLJ+R7WV
TLSH
T19EB4AF29F3A00DF8F827A278C9924512EA73FC5507509ADB22A4D6663F332D45B3FB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 188KB
SHA256 06513243c33a1a060abc96fa6b5aef04699bf0111373adeec72cb4e8e9eab057
MD5 9b2edbb2057f4e72866ebb67c477f7fe
SHA1 dd94ccefc83ec4336baa017c0c997b5a768e547b
SHA512 3179a062152ee84d0c1b9ce6b12fd0ce99d81adc95c71900ebd5f07105fbf9dc3bb317699c46abb56d123603ea8eed98beee944b61ad7e469588846ae4c58022
SSDEEP 3072:T7R9km9gpU39yxSV8pQFq4XKF3QPGO2RboW62bMsJW:T99km9gps9ASsQFqT3Qedk
TLSH
T1E3146A19D29841C4D16E22B8C7A69A42BB633C6683E0E3DB62C0F53D1F362D46DF9753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4480-1-0x000001567B700000-0x000001567B705000-memory.dmp

Download

memory/4480-2-0x000001567B6D0000-0x000001567B6D7000-memory.dmp

Download

memory/4480-0-0x00007FF69EFF0000-0x00007FF69F0FB000-memory.dmp

Download

memory/4480-6-0x000001567B700000-0x000001567B705000-memory.dmp

Download

memory/4480-3-0x000001567B700000-0x000001567B705000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads