88b11545a290f17bce28b39de34f7d4c6f3156abec6f67bee91e051187405f87

Analysis

max time kernel
150s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
Size 1.1MB
Sample260804-reqw9sbh78
SHA256 88b11545a290f17bce28b39de34f7d4c6f3156abec6f67bee91e051187405f87
MD5 cfe30cf58e3ea9d9aa4686bd731bfd1e
SHA1 9162e22c4f2ec33e1d28aa639fdac10aaba0244c
SHA512 2fcc8c10f1dbf76d65f4e9a10335af40368c110cb424033215e36e8d354440e0162dbe1585bf0cd910be5880682e489bd4de137351b1b0f3fbe0675296f159d8
SSDEEP 24576:KJLpjbO41ky34h/HSZSRplm7DrpyOqTKkPSqVjrc5xaNIBLDF27GbCrMU:KxpOIky34hPSZSRplm7PpJqeCSqVjrQw
TLSH
T1C2358D0A63A4419EFEA7F076D617C60BD7B1784A0376962F01A46B766F337711A2E330
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\G:	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\O:	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\W:	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\B:	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\J:	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\K:	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\M:	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\N:	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\U:	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\X:	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Y:	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\A:	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\H:	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\I:	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\L:	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\P:	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\S:	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\V:	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Z:	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Q:	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\R:	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\T:	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 20 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
388	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
388	2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_cfe30cf58e3ea9d9aa4686bd731bfd1e_agent-tesla_amadey_icedid_njrat_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

64BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
Size 296KB
SHA256 35efcf7670c97d24359fa86fe33d945f6989292d3c8e37e0009b8fea82c856d6
MD5 b44f726bc48ae039d6593c46cad200ed
SHA1 789048af882405d44fddb1d0e672acf07e10ad8b
SHA512 6e8ff22a675f07493cf65b7b73f0264fb220a045eb7cd889a63393fbae9fff4c0c942b7bc60d7b891b03d821e65d4a069ab307e0d3483b4340aabe0038d7b735
SSDEEP 6144:hyRSwrs92T6J5ANFI/2x55bcJtqQ1wIvSmS1WRdETP:8R7s95CNdcyR6e4RdETP
TLSH
T13E549D1A37D84CF5E467C13AC9524542E7B178990B61D7CB6760032BEF63AE0AE3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_89984\java.exe
Size 333KB
SHA256 cc74656dd0c64ebefe617914f983586f3830bf58afd6739cae5baa90d421aab7
MD5 fe3f0342dd01fa3fe7e39029663267e1
SHA1 971b9c10256237859555c663b4a01441207fb6ed
SHA512 5d6ccfb518dc1aafe8ef0dd300cfb7d065f53f5479771d22a7f52714956426f97993122ee9e3045fa9fdf86324126895913240b65a2e08f0b2f168979f747717
SSDEEP 6144:CHP+Ips92i/rJwjUeNEZ4tHmFeGYV/Pvy34srvGwd7Hg+WTHwLEe:Cv+Ips92iDJwXHmBcPvyIS
TLSH
T1FB74BEA5B39058F8ED63413EC8614906D6B17C5A0B60CB6F13A836675F333915C3EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_89984\javaw.exe
Size 333KB
SHA256 0cbd8267930b3451f3262be73f66d0af36749239540cb3843bcc9a0f4be16c75
MD5 e12a2edd6ecc737d620a04b79d6f2895
SHA1 60d728f2ba759861dd98e11c15eeb6b1aea8bf61
SHA512 8f0df95d08b99f91b101bf63da07ddaf9d5c7e437bddced8049a1f1666818f1339b2d236a1cde2f82d7a854664822cee08f61a99506b50adbead300dbf3aa15d
SSDEEP 6144:uawhLs9aSPM2E7jrVs22XmKYz/YutYPDvh52z04jzq9:u3hLs9aSPM22jr+BXgz/4PDvh524Cq9
TLSH
T13374AEA5B3611CF8EC67413EC8559906D6F27C5A0B60C65F13B8362A5F733900D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_89984\javaws.exe
Size 540KB
SHA256 b49e4e9c9f13d3ca5f69e22ee15a345d5bf834c470d3c7723a35e3513ca8dcdd
MD5 e2022bab6c5e539fe87d2a299a00a0b8
SHA1 533027b364440acb8a47823847170115d6d573c6
SHA512 fbf80f54e10fca4adb551296e571a3c39d946139b3e2672b16fc684317b9937a32edb80a1b1fa16a92eb7173df16075502f240d54cda4e8ee2122609a4eccede
SSDEEP 12288:thfe1ws9GtT/6kTN8v+bPxLbbdIvW57COvQ:txBT/78v+bPxZBCEQ
TLSH
T131C47C90F3E814E4F0B78A3589754511DAB77C9A1B30DE8F02A8665A1F37AD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe
Size 596KB
SHA256 aadf863dd268656d305efb2ed2909b88fb7bd34107648bcc86a3229480695701
MD5 e3f652b436e60d31705f803ca8789a3a
SHA1 30e745384ab542f1168a0160d4977df964ef5ffa
SHA512 46e19273f8b9935b86aa6e5130ee430577bc2f71bfe8115404cb1c45e294b3fdb8e01c2073de9560faaf2b1fbac039fc79918d72f78061a9124bc5fef80b6ad9
SSDEEP 12288:6Es9oTQG08LCwjD+pCyrNSUh9T+WDiurpbwIg/Zymzg:6gTQG0ejtgTpDiuW/Zlzg
TLSH
T102D4BF41B3E846E9E06AC134CA538642EA7278960F24E7DF01E4927D2F37BE45F7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe
Size 6.7MB
SHA256 ea6ead8e2579bb7cb1bfe28bc015c01de8d731c05d4eb6604f330db71e281798
MD5 1d9ac4ae25fd05291eda3a43585f5945
SHA1 b0e443614f3ebd84d615d7f1820f32849ae4a468
SHA512 4cf96880bf966b8fb87195f39e59bf5fabd632ed36e4b1dc0ac6c257adcb858fbcb788496a9f02c37132e6c757bc561a274645d628ebfc350ffda8c468748ce1
SSDEEP 98304:ul8YfTaJ1+WZeB2L4HrZt8PIieK5M0uR7F5eup:e8YfTaFL3IiFUpIu
TLSH
T1C1666C47E3A600A8E46ED970CF3A5521DA253C8E57B493EF129476E81A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe
Size 1.9MB
SHA256 f7cca337e04463cb677ef36387e4e9f605b82846c0e0121aa0f5af4e9f8290a6
MD5 be2bdbbf3f8029534fff1afbf244b59b
SHA1 dfb1f39900b7afdb2c054af2e98d075cdb994ced
SHA512 d83df5fe0b6c9b00ef543eaabe62dd032e8b3a58bc1d33d58e89d74ef61bfee6057e718d020da3c3e7eb2005402ea8d4e1fb12ba0c3e5ecfce145f9385feb4f9
SSDEEP 24576:DtHlh6BReIU5IX0fAePsMu/02L2NLb9Ld25PTOocJuJ/cIsY6WfvVOdWxRHK:ZHH6BRFUfAePsKUwpZeToMJseJq
TLSH
T127959C03F6D941E9E06ED578C7469236E972BC890B30A6DF0290B2992E77EE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe
Size 1.2MB
SHA256 0873fb4b33a63278cf5fea7f142402e77393f02b4120e1f6d832647e21c9bfde
MD5 8ff46f91131de27ac6e6924852c74f84
SHA1 d523bd307035ad1d600c853b1d1ac392c05d9a7c
SHA512 0b806042d5ea1578eee590248da1a576ed962e3b3f03296c9e9000ad095457a52573d924f0109faa1ebb9a6c2100144a1659cdb00d584642047cbe1f0ed4d31f
SSDEEP 24576:qsxkq08Dzv0DXWklT5m9RhgpwwOfg5IVprSo2h2BE+p9pVr:qsSH8DzvFQTEHhAB+PpGxEBNp9pV
TLSH
T1D045AE07B2D840D8D069D574CB568132EAB27C860B64A6DF06D0F25A2F7BEE86F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe
Size 3.9MB
SHA256 1c0a53470ab9e412f57ded335543e4f67ed41e43459878234cf828acdcc8cd71
MD5 d666a9b88fabb81d5424f78850a51c0e
SHA1 a063a7afafa19b511f0e2d18c1cf735efa455540
SHA512 33ae832e25636400cffac0f7c52485052c45a49f3d5280a5a60f966177d8b2748bf75c292967ff1b5c0b46bcea49fa50aba045d1262cc70919430ae2efece001
SSDEEP 49152:MKc0CqjO0RP39S3e7U6cq63ojg0GD0AGbuVEusJ6LNzOeL0GKVIeCjIp26If2y/4:3dMSbuVlcm7fwKAojN8
TLSH
T1A8165903F29940D8D059C074CE5A8132EB627C8D47F562EF3694B6EA2A73AD47B3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe
Size 1.2MB
SHA256 58426daf0ba79970a286fe5987db0e1cd8c29d4e56c6fa46adbe2d70247c2b3e
MD5 071c6a7837d16e63a40432fa718df773
SHA1 1c303c8f0386f5d50e81fc6e3ddad83e5cdb6075
SHA512 8dd42d5b3a89e76c7cd7b70b356279cc4336c57e9fddc202ab68084d3382b53a41f094b7b79fd526bbba373c8959ea64da2a85816b267f3e9b2bb2b23afafc8c
SSDEEP 24576:Q9ysVwUNFXuX08GiP5gCis3WWfz7x08mYgwGdxLAb:Q9yGw+FwGg5vTGwzFN36e
TLSH
T19A45AE07B7D901E9D02ED8B4C7568536EAB27C820B24AAEF0690B3591F77EE45F39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 1.6MB
SHA256 e4374347e351d68ee9858ab8fafb02a4e89082bbab20b7a9d735c81532cf9683
MD5 7dcf54797c6c56e0b117dc450513975e
SHA1 0ed9e155ac5652bb12749c7cbcb4b717e3a8cd6f
SHA512 86d980845a6515575588ebc1329c5ab9e58a5cffd42f68e31822c4f7fa85331671ed9b2664fd46871bf21f8c7c9509908932672fbf7b8e246c7ecd8a3567663d
SSDEEP 24576:j9cODcK3Grv07zXW7jAsoYpu9/r+UWdkEcBualkkkkkkkl0T3gAQy1yL0:yODZ3GD0UUslpO+n/IbPQy1j
TLSH
T160758C03F68A81E5D09DC1B8CE764B30EA717C655F2096EF0290BA253EB7AD44B397D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe
Size 3.4MB
SHA256 2882729d8c2985c4e312e6505e5220e95d8185f9706ee19ac9590d406e874d0a
MD5 57ff5e8079092193da058f3c0da59cd4
SHA1 bf56b21733bb97a899c42845a43e16005fa36fa6
SHA512 ec999c6f638d3baf5c36e55bedccb6e4e5502f7619d39247f7182d2197336ab7b5b313103a5adad306c45d3c6571150cfba6f0eb8693f4f753dfc798dd0a1710
SSDEEP 49152:dGku40G8tOFuwqGnTQ9MZXhL8BpUqMzADaulO7Udq+KqOuBk7bVnU7wF62JtYq/i:GZOwaul1EE4wsz/hyV
TLSH
T172F54803E29900D9D199C078CE4A9632EB627C8D47F562EF3290B6D52E77EE47B39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 1.4MB
SHA256 72aea8f1672e37439c3e5280e9669e0ec19969a008c3a6bf650eed9a45bb9b36
MD5 14e0074eb3f9070ac74008dd9b515d72
SHA1 65b69572282f9f3fe06e5a18b761e4a3de14cd8c
SHA512 f5ca8c54470225b5ebf872f45bf1535b906e5e685fb559bb594a46480dad20a4b5a7c680cab584ca29d80b29846fac32821bfe4bbad3fe3633328058099bb8d0
SSDEEP 24576:BHkuc5Tz09jklX6E2P46r1R6G13j4YbKe1qRAzIZYZmzi:1k3zKjft4o/d13jVbKSzICR
TLSH
T18765AD03B2D941E8D06DD0B8CB568536EAB27C860B34A6DF0698B2592E77FE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe
Size 1.2MB
SHA256 1f68394c32880e809d32205c14d6903a132904f5b759a3fec8bcd055c6916197
MD5 96b437e281da38e316eaea1e14236953
SHA1 2110c3a60db2877acca34484dd5a79deb3b399fd
SHA512 21ec8d79ba64a59d557d6260231336aab9f840a150f1079bd41c6987b89ffbfca086495ca4dc61a8c47e0ccb0e9236efc6f8844bbaa730cd2944b26c7a8ecf0a
SSDEEP 24576:rjBxKI3Co2wX4VhmLi+VFjd8rWTHzt6wNRZJ+:rjXN3Coahoi+V1d8rEzr+
TLSH
T16045AE0BB7D940E9D02AD574CA568532EEB27C420B34A6DF0691F2592F3BEE85F39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 248KB
SHA256 0a59881490d70b91968f35c7f973229c730fba5bfd96369e0808073716731b80
MD5 de23ec96b2e040bf9d793b927a474212
SHA1 738b85d218a60e1b5084c67fb81a1af9e2e8c2dd
SHA512 5a68f81e0e6dc7e832d0fccabe0173a9de2aec92d90273c33d5b342d5a0958116d90b3b5c5a750e1e63798ceaebe1584cab769b93d6d5d1e4ff4332f7ea72829
SSDEEP 6144:Ns9JY7dXtqOXVbqGLQR/Cuoh0n5fLcpXeqg:Ns9q7dY6FQRokfLcpRg
TLSH
T1E6447C6966F810F7D07681B48AE19913B331B87623208E7F4394436ADE637509EB7F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 265KB
SHA256 00ea91dc29476b56726e9974e47d30f4a8b9fd264c79ef04da1bac629986a544
MD5 f215a4d113f0031cdd96e3afd858faf2
SHA1 af5bb5bebbee9dea2b210093ca81fac51167f619
SHA512 fcbac47c22420c2fcf20cb3e7dbc63e90a3b9177bd2c646492dc0120812c571f6be1162c0cad36c51480033f6c7eb9a8a3624f0889bd4e73a3301be19bf9fb75
SSDEEP 3072:ZOU39K658gXMraLpBBQj7jodvDctoSGwaZoY46OeR8HvjERubw5nZQ9E0aQj3u:8s9KgFXMraLpBKjnGDYWoht+uoZ4FaAu
TLSH
T189444A6925F810F6D176C1B48FD09943F235E8B263108DBF4291835A9E23A916DBBF3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 610KB
SHA256 7ad21bc885777dd71b5b26f8ef509bc60d217a861b715a6c4bf6faafd171d197
MD5 201d50ea3b92bba2ca9d193ddec76079
SHA1 58caa2140b1091b13e1cfb28302d4a1ab296aa84
SHA512 ecfa6a756820eb0c272ad4a90a61e922acb0ab06bf74a98ecc8915d982945d325e5cd2ec954ef1b501744d816046cf6c2d8eb981c697be3872526e82d826b5e1
SSDEEP 12288:+s9DE/2raBz1AHVlxFSoXd9Wrr15rLthWtsQUb:1E/2ej2pd9W33LDWtsQUb
TLSH
T182D4AE81F3E847E9E06AC134CE528546EA7178960F61F6DF02A0467A3F37AE54F3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
Size 7.2MB
SHA256 5e9948e7a017b708e98068b16a1e26a04df60137d722f81d332923e672a1f4a9
MD5 2e65459807239ccdf8512bfb5a652fc3
SHA1 cbbc509fb009eb03c655d0c0acb0c2abb82ef7f4
SHA512 1e8823d1cbbb79cba531766798305795f5cc2684d12816891e072ea5e909bf70c436e16b261e1e252fce5bfc89ffa9368b8d997c24f4f10c523edb1de8f7b76e
SSDEEP 98304:/6CZetahq+WZIE8wCsJB2++fGeOxRj2vJzRN+T6frlxMOo:yCZetalxGIGpxVqzRdDS
TLSH
T173766C07E3E600A8E46ED974CF2A9521DA353C8E47B492EF169476E41A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe
Size 3.9MB
SHA256 127e184f6e7113ddfd1b2d31bda167c22821bce53b56249051571e0bcc0cfa59
MD5 479e3140ee4d85453fca23b36ced2bbf
SHA1 88a97c6f8b919bc17434b057b56f9895113e6bdf
SHA512 f756fd611f2f8cdad269c81fd8d9beeed097378cd01c6ccf444453365f45a29aa1232c625bfd3058c17c9ba713af0df6f802bd2f9199ecaae9d3ad0335f7a480
SSDEEP 49152:Cp6JqE23QGFmvJSYJHbmhLbKqm006NPpIupEWVu+e6NqcXToRzvUqIzYHBigdQBD:TqBXUJ7J7mCC7NUhIUBbbzC
TLSH
T15A165A03F29900E8E05DD5B8C7568122EAB2BC854B35B2DF0650B7562E7BEE4AF3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.3MB
SHA256 04422e4040a0240c3fe8ae7ce708666bad9be5a795b4bb8dd5dc4ef813d4d2a4
MD5 d7a71deec2c522c7bdce204b11a090e8
SHA1 04038377e99adf9d09c2e0962cfa4ef856735ea8
SHA512 1070fdd7e089be29e882920e0bcf9c945593e328bb2cca9a97460538dbf75fec9464ea609599dec407134f2571d43655c37b4f342ad942dfa4e33da8f5908df6
SSDEEP 49152:hoECquWsLsIT7lw9E69stBhuXjfS4LWxnQ+77:CqpFTjBPY
TLSH
T100B57C03F29900E8E06ED178D7469533E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 1.6MB
SHA256 1fe197487e50530f1b7a3e88c1c9631ed25352227ded918fe312fdaa0c267361
MD5 f7c9a6e1c32f5123eb52ebfaca9710f1
SHA1 dd6ad12a28080c4d98d9275bb313b2a97c1fce52
SHA512 a910fedeb0763ee3b4cf94002b7232a8bf990c5768a449c6657dcbc302f6153f9155c2031df76cafd6743d2802e47a96d13678be60102d3c094abc3fa67762f6
SSDEEP 49152:1tgMKTAqTjT7UbjDpjEeWhktTlXrk9dBH:vFL3ztOD
TLSH
T1F6759D03F3D900E8E05ED1B8C7568536EAB27C450B24A6EF0A90B6552E7BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.0MB
SHA256 89df21371bb3f4e90fe6dcd00058a051ba775c7299f5ed9e23a6ad5205a63543
MD5 0f9470a2c3b52e3f49b004b00c0d353f
SHA1 a3ba459b5bf9c8de2e9c9bc29828a4f401110ed2
SHA512 cc6172aabbeafcfeae182a740b279e13f3e74a750a9d956b679b7ffe9742d2c2c54104eae5f4556603822684db760fbf1150d04fb519bd028d6de411555df6ca
SSDEEP 49152:pakQDGD93YscK0b8bZrSdHBAVfLAoa6ik:0BDnywA1cxk
TLSH
T1DD958D03F6DA80E5E05DC2B8CB768B35DAB17C554F20A6DF0680BA652E77AD04B3D394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 3.5MB
SHA256 2ac987e8e695511c90671167bdcd68af78a1e725e5a04f4a5f6eb673127bf610
MD5 81d876027c4023caee366bcfd8423d66
SHA1 e67b2a843469056bd1eac5297604110c5eef1e2b
SHA512 ef5ae07543ac10e90deb9316e3832143b8416267209c82a06cc756c28c05a94dcfeef529a342e0e64298082a67baa1a07036fd5e802428e4e5529989a3f6553e
SSDEEP 49152:6uJjPW+PFc8e2dBR5GdqmShb6YEruz4AkOuaRoBISCaQZCLlrrIIJ:pAylraOnZwJ
TLSH
T1CA064903A29900D8D059D078CF4A9223EBA27C8D47F566EF3690B6D52A77EE47B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe
Size 1.7MB
SHA256 9c982da69648f6fa462fc900759b865786b62efbe648681089491b6e672ccdba
MD5 d28f6e1f18b45bd1f2a22d12f8d8e8f6
SHA1 d03a3e50849aa58dd5f49a9df5b5d2bd9b9e435c
SHA512 f367b0d13f4d9aed8b1961d7e705681386545a5be79166d12ecef93bddf56264908bd846ceae6b83b4cb212c29b3f56ebbbd68b1033cc16f6eb98528e9364565
SSDEEP 24576:V5ns9l64dUSdigRluBTfB1fgL8iseb9LeQuJXlPnyF4mfHU9YawsN6NU:+lJ7WrB1fe8isIFeHX04mfHIV
TLSH
T17D858B03F2D801E8E06DD2B8C7469536EAB27C460B34A6DF0691B7562E77EE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Size 4.1MB
SHA256 dfb051a3803e15eb7938fa5f9b76b1f65a101820f3b2b01cc743e91774961cec
MD5 960fd2126ae5f31ae25eb8cdad5131ca
SHA1 61c9e3a174a8f31329be22addfa3ae7d1dde8de0
SHA512 f8c1cdd16bd35e95c8457aad471f81f0b5f3fece420814b42ce0f318ee7fb156dabe2787866e0f8b69e9b9f966bb3e0995f3b49057b09242b49ea31f4a95564c
SSDEEP 49152:DuGyCGwAyLMdYbK7QWcLuiS+TjEYzExldDwUIDtaZHWRdpev2y/BaZH2Z:4jnoUtd+RaAZWZ
TLSH
T141165903B29940D8D049D074CE5AD233AB617C8947F162EF3690B7EA2A73AD47B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
Size 1.6MB
SHA256 83fafbb5ebbc382f89b9d2c8ab129f7e862992cebeb075c9dfd29a17193f4ae3
MD5 b6944da9c9a88f0e394dced67eb4a648
SHA1 56b49468a4ad490a3a01f3aebae85bb57355c87f
SHA512 71ad01ddae728bb734eacfd9b3cb81660a4254d67b6019271a9b82e4bb0b389dc346cd10a8982562627f20ca46c3bdbce4a91a630651c64260416145ec66b253
SSDEEP 24576:p0VedZ693cR3AxqAcpuS/ERODCVnOkWxL1oaedpEukUoygGmq/SXE2BJ5zTvI:pPdZcsRwZg/ERoChO9xBo7EukU1EjXQ
TLSH
T124758C03F3D801E8E069D1B8C7568936EAB17C450B24A6EF0A90B6552F7BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 1.5MB
SHA256 6f43919e3de4fc7e9e1320b93a50f097a1155344dd6c427904c22d5891c1517a
MD5 b3164f0a7bcf590ed670021aedffa129
SHA1 735b25e3dd5137875f14932d87104435a8e5244b
SHA512 db2a130ee538cd15e20ee8956d5bf9fe2207f3b04eb147677d2606378c3af9e0e1281aacc2690d3f626bfa93e119680bf660e7b539ebe5d9e9b5a8d7d8a7844a
SSDEEP 24576:ToLZb6ag46jmVLw7uJUWJGfKldbfGsVa4i6h27d3WlPGFWB5/5:YZbtN1FhUWJGfKX7n+6h27dgGUj5
TLSH
T12F759E03F79900E8E05DD1B8CB56893AE9B27C450B24A6EF0B90B6552F77EE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 329KB
SHA256 52deaf3de07f080864d8985428fe615b92c65121c1949d03e78be3d1295aacdd
MD5 5fd25ac4b8bb38b827f3e9654898680e
SHA1 37dc62f3b7fbd8ef691e1063cd2782ad8bde0b70
SHA512 5ad83221f5914708fc711d6fb6e9a4d8b359456f6efdc61c63eb5da11367334372073fc69ca1d1770d49a214ef7d0204207547fa15850445afcbee0139bdb183
SSDEEP 6144:Xdfs9ipv6At6Y50tcR1e13OK2lRtQ5/iJPsfUrcAJmETiJ:Nfs9ipv6At15mw1y2lRg2czAV+J
TLSH
T16374AE2473E408F9ED67827DC8A19512EA73BC5547A0E7CB03A4C6661F233D85E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 672KB
SHA256 d51cf13ed976fab014861f58b46ae1ab0192210874df27bbf9edfde65849aeda
MD5 68f1c40523e1b8530baecb6332b529d0
SHA1 b0200030fd294b7ee0592447257bde10787d268d
SHA512 4609f2b9def24905ef1651120ddffd4a68efd351074a93eea320b4cf7d11cb91a094daa42fdf3a757788b1df0db10b01764896510b90720705819352228b7300
SSDEEP 12288:lvaZiFVBQsUJQGyXX+tfXus9OrHsDqVqzjBY7A+H6Gy:lmEBQTJQGjX0rMmX7N6Gy
TLSH
T1DDE43A16F6748731D073C0B9C5D2A69AED7230865B308ACB4286C77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.1MB
SHA256 727239a797b60831e1b470e7891d6e855f975213b556e2d0c84340d5b5b3a08f
MD5 af13eb07a5efcc0dbd986416c6e3077d
SHA1 953bd50bd8bdbd8c88ee507f61fc23c907e8b3e1
SHA512 ab6227eafefcbc013f24abfdc9d15a69d91e7857ee8ba68f10efc261d2777244f47833e67357ae75c758362edfcdde8ca012baa636008697a322ad9968cd6375
SSDEEP 24576:x4rGezSCCvKPl3OigrvWL6q8wyuJfCRgT6:qGezSCCvKYnvmHjys0
TLSH
T1E4351A25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 840KB
SHA256 43e56ac6abfc0ee6469001be30cf7e1534c9d6b94ebee2fa6f3ca39d3e1e3052
MD5 877204d9562e27b130750dd889d9dbab
SHA1 3c3996c2880afaee6ea841e8a72bb7df6004919b
SHA512 f88d223faa6d33b2718219ce696c27e80de38b61a455586af98bedb757e38f71221eb223401af6e74e7fcbf81bf65a8b88771a71ee276663c9e7fa36512f6327
SSDEEP 12288:FZj99jB+i3vfFzTlLOiggDwsEzFW2g9/s9Bf0Im98+q8047FbBB0:P9f+OfZTIg2g9Y98XFY
TLSH
T173055C66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 350KB
SHA256 a86c069ef96a00fbf4a978e07acf709f38bc5d688d41ed4e41aed28bcc5dd2d2
MD5 d1ce063f1795e6684a445883e1a50793
SHA1 ebf2adcda4f6fd243940fe0e14ae5a2238d87692
SHA512 67a8134fae0b147a3091c5df1326caded4da6466fadb916bdeb7b3967c9577f94baf2a6172bb13bef4531b10823f3b7b2ad22d4f83f245cdced129a26d1ca2c3
SSDEEP 6144:qO8s9OBJ/GKWWBNU6ITLBi0qttclOKgU91BEBiHT5jKn:as9beBNUbTVO86UWB8T5i
TLSH
T18C74393BEE68FCD2C67E4DB85B918600A77278704F61A3CBD165820EDE236E05E75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.3MB
SHA256 0b317721877a217e8ef8e0031a4a4fd5bff9499652c1cfb087f4716c6559a007
MD5 450169fea19fa6ad40c0a9436569ef42
SHA1 9aa5554a7a384915375600e35c62a005095ba7ad
SHA512 cd09f09099f370893ab79e3f0b0daa96f628f02f2a0d50a55257f41ddb627693cec65ed477abfe997df5db20b6ce01eebed59d8be7249bd6aa8c6b5b8d8234ad
SSDEEP 49152:++PqVfEQDzY/7Lh4eTi6qBKB29a+tNLVdzh9qdvyKhD3Xeul3L8U1Wi+riXGwvZT:++SfRY/7rIKgXLiDPKiX7ZT5CEaC
TLSH
T107265B656BF880F5E0A7E178897AC6B2F7B678420D31EB4F0191C62F2F336905D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.3MB
SHA256 72918eb8122dfcfd5d6c5510b8cfddcc8fb629fb50a99d9ab67b12f6a8c13442
MD5 1378585eabb432062ad634a849472d8a
SHA1 3dffbff19eaf4c188ad23eeffcde055a3677217f
SHA512 93c99b4210e900d76976afb5218e5f0f053a1503d7497996febfeacfae037c9facbd68270489126c3379d1273a19181846b33b3580fd8c9488d08c1fbfa66ff8
SSDEEP 24576:Ar3sYi+r2AD2z+L5WqXrHCYRFiV+XenmE3Pnzc344Knz:Ar3sYi+r2AD2yL5zXfFiV+XenmE3/zjz
TLSH
T15EB56C0976B8C1E4D1F6C77886A2C647F37178154B34ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.2MB
SHA256 df406ccdd97817a75046062d68ec37a3df5f14d5277daea37deabac44b5ab87f
MD5 dfb9cb131c4f14162417b4b599189848
SHA1 94359168b2cadc6fbb43851a842286ebb31c6150
SHA512 841ff105f0f34acd8514378be488558995ab46792855fe7a19e3cbc4c3dd66b126cf93aba61b942ec0bc7f8f44d08bd924b8637204c540600d4c8cbe1e5eb16a
SSDEEP 49152:ojN1gRBr1hR4cJeTGp3DJf5SUYLoDpgLjSTYlQcGeSAaLSF259ruMHwpXMi4FqJ9:71jJRQyi36YOcPWLvw2gAf+PN3VL
TLSH
T1F9666B13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 58da5c575d949fe4d5b4db24c93e91f5761c26758904ddca3f45bbd007319b47
MD5 a3003cdcafb26c45cdd64d8290278b63
SHA1 478428066cbd5955f0234210acbeb72cd6615394
SHA512 d275722040e6fc2dc852d811b2eca5a5d7cb59cb25bd1b987747962752ec75c06670c54822a94c0d7090e7b7e4ddd8094170b795720dcdf833c6adacea81c6da
SSDEEP 24576:xlvgTTxlQtru17Dbo4PqbSw7DaHGTNHu7PNU3/5W/ohL0mdr3AXJR6:ITfQhySbbeWu7PNU3/LrAr6
TLSH
T1DE951733B2F200A9D44DE1769F4A872196D27C75CFE0D3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 3.6MB
SHA256 bbc12f9c2dbd29b5c4004f59edb0026e166ed43fa110fb8b5b3383ab2f6daa3e
MD5 b4f02ad70525ea97214c6837622c1200
SHA1 210820edce0b8b7dbca59fe7dd78173e3d5829ac
SHA512 a7b8cddece5f0e157d7ab7e189c91592c5bcecd3fd63b90d966a48e4c63d2c214b988827cb8a39f2dd87313f45fdde0cf1211f7d465834c563e0b4ad929942f4
SSDEEP 49152:wvq8k60pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbTN3Oh6tznm2FQ/nho2qkrk9z:Py5112gYy5azzVvQ69nLKnhZv+
TLSH
T1DA067B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.4MB
SHA256 00caec8b5686b318fcd1d492589fc4f3e9f4b40b15b6f62692e2831f79438482
MD5 d5951ba0c3a1198fee4b4deba77abb67
SHA1 c1f4990b468c490313f9bcbe555c076e7eb3becd
SHA512 299c5322e2e38c8b9d463f328dc55bb3d243dbb499470558fbecbb5d69255238ddf83230f6d55b2ab40200ea2eb9a1275015edbc5661a16ee08a0210052d2608
SSDEEP 49152:B1RxRdZV+MAe/OBr4tEGG0bqx0z+n217aau1glJMlq:SMEJmQxd2dJMlq
TLSH
T18AC58D13F1D901E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 1.8MB
SHA256 1638d15613f7f44a640f4082bc43b72dd6f535be2aa023223ee0f4580252419f
MD5 ce3a71fcfde5298242e3dd64482ff4ad
SHA1 a578ff527d25bbf81a296958b66da670bd4c0c2c
SHA512 02d7d435f2483bd4d38f5093ee41ded138d0704a89f7a805d2ef1cab580a5fccd3329012307d3e37131feb7715319d567db5f9d764f80190b702d2a14013813d
SSDEEP 24576:TlvQYulu1S+oGEtdzJUcuCMjHGA1CUQ1zNOgLLwH7ReaQXx3IM4Q:tulu1PonyHGAgU44CwH7R4xuQ
TLSH
T145859D13F2D900E8D05ED17887569232EA71BC460B24A6DF0A90B7961F7BBE46F3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.0MB
SHA256 e76962c1dcdea2c177bbe00e31923fabcbf774533981f37a40a16e4be07bddad
MD5 57c5893315c617bb7849ff8b7cdee6c0
SHA1 8e69f9912946ce5fc31b2844624f0db65c4cf496
SHA512 e0845c102fd27ce7229c85c17415a314a06aea7c060975e86428f443733f5ead9e7ae64b576e92ae57aca5e126408eabe2db165e45d9bd97b2fc35a7bc9f8d73
SSDEEP 49152:9TV3Qpc3UE2hRVtOnks6NMHqxA7qphkYL1atoGA:+lvji61x+XA
TLSH
T160A59E03F2E901E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.2MB
SHA256 eede02a4360477b11fedd3c68854f9d29ae086a5776ec08d78f63b25e41ea455
MD5 caae5f2832ad603719e2aea0edc0a829
SHA1 43f04176646582481dd7142d3b5fc8a53c721ed0
SHA512 c69eb09471ef607e6c168c8ebd2b5c936c961ccc738305c1dd0cfce9d14bf4d746dbd85642f5bddb7ca858950882eead993953899edd4c8d4cfc09420ae541d0
SSDEEP 49152:GaVXjw+xrB4jLAE3dGGj8bLEGcjesaNkYQd0XNJKcvaAcPTY6Y5AIm4AQdN:vtWvj+BDlZ4QdN
TLSH
T164F59D13F2D940D9D059D078874AD232EA72BC494B2166DF0690BB562F7BFE06B3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 3a3553d80093fade6eb4bfe38e5f0c20f31c22485bebeb12c42cf5c12e830e8c
MD5 c4f83f4bc3eb764205c2f5acddfba921
SHA1 7e268fdad2a66455ead363ae1af4508efbef4542
SHA512 f39a9508203e43731a9459ea8faeb67124fd60584eb2096dcb11893240d3846320ae22a8a415f81a791b7ee1d163c41c8074b9a32fc0bfac7d4d1c115854a233
SSDEEP 24576:Z4BvmXxc+LXEBanTxbyUgwfaTDCi3iy9CTn0AP5+2QLKuE4bF:ZNx17EBIjfaCgiDn0AP5wsW
TLSH
T10975AE13F2D901E8D06ED179C7468632EA72BC150B38A6EF0A50B6561E7BBE45F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 333KB
SHA256 5bdea1ecc1b3cf1590b1529984e161982ef860c66d222a48665731e778ea5506
MD5 63476420f4a16ac7e05504523b7276ae
SHA1 9edd3d3845f911f2ee3c3801fe6ecae3ea82ccae
SHA512 8e8bb4129ff24d2a9a42afa4843ce1268301e9cd027a02c89ff86aeae3886151180ad46a31d727a393f55bc01ab51dec2b0361020ea2aac125cf57aa9472e52c
SSDEEP 6144:jSPBkADs90NleBIjMv4vdF+zQeYV/PvyBCJ51upw:jmBkADs90NcBIPETcPvyBCH4w
TLSH
T15574BFA5B3901CF4EC67813ECD568905D6B2BC590BA0C65F13B4362A5F333A11D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 333KB
SHA256 e5dbe667d1663c42daa526efa4ec27ff81597fa5c2f8be577a9d947775544fb1
MD5 db8dc10a7f386269fa21334d1eb5b99a
SHA1 27e85d9c2af4dcd79cf9a78a004c09e564dfb56e
SHA512 c035047c47dddd37353e0c435a4d568de1ab38cf60e06d6802182845f7982178e504547e79ca0d3632b85960c4747c1d14d24e3bd91e5da309d698d5868ffb2f
SSDEEP 6144:nGc6hs9ASlibTCtlssy9OBo3zJYutYPDvhC9Zio7omcZ8M9CC:n/6hs9ASlibmtlBGOYzJ4PDvhAHsmcKy
TLSH
T1B874BEA4B3505CF8EC67413ECC658915D6B27C5A07B0C65F13A8326A5F373A01C7EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 540KB
SHA256 73b97a7bae60b39524ecc9018dd9c5b894e56d864cdadaf4ad02167cc01bd8d2
MD5 0c8e368f4e80fa2a511ceacf192db372
SHA1 93c06731b586135c25ef22ac857ef68073e2b9f5
SHA512 c04037f6fefcd1cad15d9017e3d7a55a27013779bae7c6db35a35f9345960f777ba21484bf48bd0a71715cae5df904f9ee29c56a557395e35ed992a87e9adea7
SSDEEP 12288:E0HwXAs9JSfoN2Rst3Qhz8gKLbbdIv7sIf0Or:EW/foAq3Q98gKZMsIMe
TLSH
T187C46B90F3E414E8F1B78A3589764511CAB77C9A1B61DF8F02A4661A1F336D18E39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
Size 333KB
SHA256 e254e944672b4447098b3900031edd31337bb416386fd441cdd11db9ebf59c09
MD5 7461905d77c0a54a001bcdb84ee27a26
SHA1 b0548dc515f37d139a6b07c994374b234bb177c0
SHA512 e488ae29059cf50b8ce5004f299fae55fa78d2cbb247eaeaa656a433a547302e618757af0e893af94698ea39de1448cd38751f891041ea8204eaaa3aaf28662e
SSDEEP 6144:gLPGhRs9R2oZYzj0McqCN7svZYV/PvygOjwcYcnetJ6h:gbGhRs9R2kYzoQhcPvyJEcYcnetJ6h
TLSH
T19C74BF94B3901CF8ED67823EC9254D16D2B27C5A0B60C65F13A4322B5F733911D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
Size 142KB
SHA256 8d82ca38c7e164e4b045c7b3c45c546442c50c46456129e4959ea67736176382
MD5 2c0541d0ca2e262fdacf8ff6e21c1519
SHA1 3a95c4d81af95b73193645fbf7198330b797c59d
SHA512 66d4a28d7e5de9dc9ed3e32cc9e4bb24c42b1f3eb75cb5341daa9c8b8461fa5391bb984b73e510dfcbfaeac368dc7ff5a74aa5eaf3ad81621ea94eed056deaa5
SSDEEP 3072:LU39fjlXEo43udtjZqMNbjuxzYOrNE9va+:Ls9blw6vvwYeJ+
TLSH
T1A0E38DA1A3D82884F6B39E729879CC3049B77DA85EB0CD1D9294710E1A773D18479F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
Size 333KB
SHA256 7f0148fe16122df6d87701ef3007013e9e83220b34990a94cf96a45417d5b9a2
MD5 b532efe00de3ebba39f35540280b613e
SHA1 70a19789a7d9326a5b04ebbfb71e9f3af3bed871
SHA512 81e1277ff0aa8a259a768f247a153bb20aada377fa5c9b0fdd333bb5502e4d8ac4a2e5044812e5b18bc07c2e0463cc7e1aad9317b6db30113a628db0cc29b9de
SSDEEP 6144:7CpIVas9rcZ4gyeOLw7sCrNC9szbYutYPDvhfD2dx:7CSVas9rcZ4glOLFsNJzb4PDvhryx
TLSH
T1CB74AEA5B3505CF8ED67823ECC564906C6B27C5A0B60C65F13E8366A5F333A11C3EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
Size 540KB
SHA256 070b1beb0734e9b1a201c26eaeea33e567cdabf99d3b6528d03b7079cbf571de
MD5 5d967d47d9f0efc6ec34c0405902995b
SHA1 7c148ed0debbc973e932e92c1e3ef060e22d64e2
SHA512 422b88c4217ee5e3e51644a40a44bf7e831291c6b589246e50f9c14aa5d16f98b0d294d6dc03c5c80004021637073e0a90ef5505165135e7a88ad1e8d912b739
SSDEEP 12288:wflPUQZs9AAqMCvSWnXWkM4zLbbdIv1INNNUfAj:wteqMCpXWkM4zZUILCe
TLSH
T110C47C90F3E414E8F0B79A358D765511DA767C5A1B61CE8F02A8261A1F33BD18E39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
Size 195KB
SHA256 5b5698a56bdfc0c4d1dd537998442f29fe0dfe30011fa338da9cd0d4a7108ae8
MD5 717c6d06ce4f2027ee280e08b7b0bb52
SHA1 e74e4e89a844df62aaa660d02f100bd43d41f8b1
SHA512 e2bf701cf803be9eb962b4cbddba43c92122640bb0214bfbdca313f59a49a2e603909aed30088dc84d5060886842b132865306c16ee73740a34224307bd318bb
SSDEEP 3072:gtVthx6tMZdxsiU39sY5DEmd/MjgvhagI/f1OFOPqxCVDKAKtQugtnGMJkiDc:AcM3mis9H5DEmdggIn1UwuZo3c
TLSH
T1AD147C4173E810D4E4739A7988A04541E7BABE662B52DF9F5394206E4F367E0AE3CF31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
Size 138KB
SHA256 e10e86cf2c1a6b448901b040fe402972ac8393975cb153a2df2a1492076b48b0
MD5 f40b5b6517a8ef7705ecfe56913a9415
SHA1 3d77210dd89b261d68bc838762702398e8ffbddb
SHA512 3c28c966c3b3ccaf6beadf296d00b1301bdd9ea78d00bd95337ce12ac197dded7568ed2b1baeb3acca6e08ceed4b6e9503e6da222b105a8dc5ba7f05819f0e9a
SSDEEP 3072:uDQb8BU39428vJEisdBziux4e6m6YcOS4:iQYBs9t8qdBobm3
TLSH
T1DED35B11A3F418C8F0BB8B36ADB045158F3AB9524A61EF5E6348514E0F79B91DE38F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jre-1.8\bin\java.exe
Size 333KB
SHA256 5ed53748653b8d509bbd0a154aac96da12b68584c0090c73d21eca616c373fdb
MD5 610304eea26c049e9638779c92543e8c
SHA1 49eff3eeb7161880631ed14d37c3f7a555bb2902
SHA512 eea39397e7263f3383c8dd01885d45eab77c994ed3d2213f59d5f9023db76226f113a1d51355cde5ab7744a88e3ca5301a74b74d943f2b02743d4a687069a076
SSDEEP 6144:GKPUn8s9YcxyBm0jSGgTJQFSnrYV/PvyeoKb9k7J1Ad3:GOUn8s9Yc0m0BcrcPvyI9Ye
TLSH
T16C74BFA5B3901CF4EC67813ECC558906D6B27C5A0BA0C61F03B8366A5F773911D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
Size 142KB
SHA256 986cc01c85befb848db5c78cf0ec6c19f9bf486a3c6e44b9b3611f331dc5c4ff
MD5 ea7513e38c352086b445f2726df4c90e
SHA1 26f742ee96b8b5d8f0d47074e9b8be0fdd73a9d6
SHA512 8accfa6a3849a5de49913cc1315eebe1ecdda1801d03af8282f737fbded2f96dc32f3607bfe027b6503510fb3441ae02dcc03e6cd5d33da0fe9144a4e9d90649
SSDEEP 3072:nU39fjlXEo43udtjZqMNbWwx2ZB0DLOMRXNyuNb:ns9blw6vvWvcbRXPB
TLSH
T130E37CA1B2D86488F1739F72ED748C2058BB7DA95EB0CE0C6195710E1E727E19478F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
Size 333KB
SHA256 51ed1964b38c72bf30ada18edc89fcb907961cee69b0e67d5ce53d00bba0cfe3
MD5 07672b1d8056c2c827e579cb3afcce3b
SHA1 5b56f439b96130617ef95c0839109b7629009163
SHA512 d0e8f27323f5264c2332357cecd4ca37d4336c6abde75643596657747205185767f43e8103304e7d133ed98d106ac8e235d36823cec2374964b25acba9f4aec0
SSDEEP 6144:lbaZgs98sVXaDwYfAs1u4aZN3zsYutYPDvhcliU:leZgs98sVXa0Yfdg4aTzs4PDvhclH
TLSH
T16574BFA4B3501DF9ED6B823ECC594906C2B27C560760CA5F43E832A65F733911D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
Size 540KB
SHA256 b35f7e9b36a6df01b5c3180ba2a8fc9216882f8b6f7b9176cc4547a683b4babe
MD5 89943debbabfd58d21ac25fcfa1627bb
SHA1 b3d83efb825ad15a0b18cd2cb63ca64007e22a5f
SHA512 accd9e6950374e234aa420e677d93f8cf92f238122d2d05a76d4dd977bd2a9eb1e0e7b366fbc6503778d04f7ee36a7773cada95ee3415546ce217a1a68b23bb8
SSDEEP 6144:Y8Y+zjVLhs91TxM4B28UIKBx1CHp//gqjSurG2WLbpqmHdIvWTp4SJdof9Y2:Y8XPphs9ti4B2RIKBQAArGxLbbdIvW1Q
TLSH
T135C46C90F3E414E8F1B78A359D769511DA767C9A1B20CE8F02A8265A1F337D18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
Size 195KB
SHA256 a799927bcbb782927c5c2ff5c1a91d4ff971c85aba4492f3f732d8aab97242ea
MD5 d779750a96a7f7d9317b0ac37da2c015
SHA1 d37b44a2279588eb230a33cb7377092828d064fe
SHA512 5a26c62baa4f075396b342bcfc0a62c6a00e2a8fc1569d94e2a6107af6c848f9abc0ccc9e946d1798fd8078c697dba44ff9579b9976e0dc7166d7b311c18c678
SSDEEP 6144:AQEHMoRZds9H5DEmdggIn1Unmc7Mml4Bl:AQcM0vs9HBHdBdnmc7Mml4Bl
TLSH
T1AB148D4033E90595F573CA7988B08902E7B67D511B619FAF9391215A0F3A7E1EE3CE32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
Size 138KB
SHA256 c215716b130532e1fdc0c3213deb4b3fc4b81cb5b203297dbe32bcd2642f144d
MD5 223d36619e92efee00b5140c30f61d3a
SHA1 81eed3ca4b25382318dc6fcaf68dcb3ef1d71a9b
SHA512 5e2407fb8ee8a02db4bd88eea2140289f045ffc8508ef95d45dca3f127280a3226b652e2bf58adcf107f5149d280a5cb01a8f195ee7bb24ad9877ad46e2ea9d9
SSDEEP 3072:+DSQb8xU39428vJEisdBzYMsxGe+CJIH24Ss66Wq:+OQYxs9t8qdBpSn2W4SsFWq
TLSH
T127D36A5163E904D8F473CE7AACB040158B7ABE925D25EF5E5380410E0E7AAD1EE39F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
Size 4.3MB
SHA256 d7b4ee54d5c2cb6eafc63a681f322c7eec73742108f18cb560648dfb0735f85f
MD5 5412491c557fe8fd686ae9caf9f64eeb
SHA1 2be0f2395091780c4e08d1e8b2db362779fab0b9
SHA512 8197fd296975d49e9760d9bdd73da44f895ee1bebb4672454335eb6d40a0ed5084aa66331f0e72d20435bab6399ddbecaa40ecbb9c7adcad2009859eaabde9dc
SSDEEP 49152:lzWFf90SYIWUc5iJaosYhx+LMLRdtARvZeASA33BeuY6pzoK2UkI4VFHD8NRV3TM:lz4Yz7oa4LODCI+Fw5C4Q
TLSH
T109265B556BF880F5E0A7E178897ACAB2F7B678420D31EB5F0191C62F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeClickToRun.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
Size 4.3MB
SHA256 b65a5d0f5bcf831493163e5b73b84a6f1af2e182fd0fda09bc8c6adb5d917320
MD5 c25d5532f42b61928cab4859ea3ce18c
SHA1 895c51ea553fc7533d874f4b68a43425a259adf6
SHA512 b4717466219143104f0a1a8c16296c368e49cf27e159f71da8123de8f9470cba627ea45975dcd84c3e19d0c6912842668cfd236deebbd1ceb04e72cd700b3ef9
SSDEEP 49152:2WztlQybUOmBatvk9/y20xRvVLIdOZ3j+aa4V3VeuOB0cYkzZldY9hjF8NRV3TH9:2WFU+s/09LtbYd+hK5CVM
TLSH
T1A1265B656BF880F5E1B7E178897A86B2F7B678420D31EB4F0191C62F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVDllSurrogate64.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe
Size 275KB
SHA256 0a836359a3e0bc57370e859b6dba49764511a0303fceb60d4a5290ee50184291
MD5 a351bb47a1ecba06f2a7592b0bab9a22
SHA1 b1f5a027d00e4585837a369d495cbbb946562fdd
SHA512 5d71dc5fea4708c191171911ce588a147020c8ed0929da5df10c506ab484b0366100cc9e5b924dea9b0fa9f358a1e41ccc47d7f67ace3147ec1a8d6dbd33fd11
SSDEEP 6144:3D97nis9SWGNTNYdMzATVkQNUO7q56l1ygW+VGB:Txis9TGNTCWsTGQ4ol1hVV4
TLSH
T1B154497BDD28F8D2C27E5CB56790C700AB7270718B42639BE135C26ECD136E15E6AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVLP.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
Size 588KB
SHA256 6f87ab5a0e619c9eec6bb39c654896e68b14731e2c024e39f95e6c20d26f5fb4
MD5 8db73c56a857c989fd6188cf75d4a329
SHA1 2a7d9cd5bd972253c1225c61bb50c1ef54593e96
SHA512 aaaf281ea513677d0164bca0d0ae28ef8089c7832d5efac61f8c9bcd287a8d082a9881d9e521e2a1baad6551eeb3db16eb4c0e021624bfe648117a8352df319b
SSDEEP 6144:TD8kWw1lUTH4NuKuJfjwzs9GJTsC7Jf/U+Eo4Wp4hzvNUXITiXt9Z+M47iUlfZta:f8PH4mGzs9LiluzvNU4TEYicwTUY/TTJ
TLSH
T1E5D48E76EE68D8E1C27B897886928701E6717C110B61DBCBF16CD27E1E236D05E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Integrator.exe

Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
Size 6.8MB
SHA256 0c56fd1817edc21f3ab6aa0b5000cff8a85fa60877fc15b7c800270528ff4250
MD5 676c5bc33367eed9cfb8511501554aba
SHA1 fcd3c5ae695cd25d68e19facafa1fa571840b70d
SHA512 91efed2b8fbce2880cc439447f2bf08a8e752941b3ca9d64137be380b64dddc59d61d7b4f626d8615a2d257afdf24b69d0da7cbaed4568600628624f5cdff89a
SSDEEP 49152:uN7HDwrUr5Ijkz/0d3bu7YsSC5tZF6RHzZ2JxNr9RMkZ9YPUJwQ9zOB17/xYtuHG:uFOxj+YSMNWcTFB1GW+hrrmqJjeb2d
TLSH
T12E6629596AB481ECE0AFD1788D778772F67678418E33661B0261CA1F2F33E588D19732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Mashup.Container.Loader.exe

Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe
Size 100KB
SHA256 8ab7ddb9b9997a7cc60455a5adb8a9ae925ee859d82d5a395eaf40cc1a83798c
MD5 b212dc4de543c8852dcbd3821e0f6121
SHA1 3630e2673e6d30c27f2712d13f941a5a72c0ec14
SHA512 2b720193825f64b75497434822cf8d466208d83389d05d38a49ef5a31709830e959492307cc22ff985091f8622078162720b34ed82366abc61d63cabe1b28267
SSDEEP 1536:0KQBvXuhi3ugaXjk/eAMpldERVU8t3VHTj9iXOciBLSizv4UNGR4:0VsU39/eAcIR3Vzj4OciBLSizv4wD
TLSH
T1E0A3CF033B894492C3521BB410329447F772BCC45F65FB9B6285A32E2E16BD7F93AB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IEContentService.exe

Path C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe
Size 449KB
SHA256 aacdc6be8b1c5a3fe72bf827f46934b01ae6e23759783fe84929fa1e71c3eaf6
MD5 6dc2681deb683f20c97e60f7efdbbf94
SHA1 89e70a1abcb25611e2888fa6197622441779751a
SHA512 cb29ecc1ed1c3724d01727c143f48ab3e91320b1bdf20ccc480029362fcc8a6a9cb6545e765b76c905aec88c2f5add16fd93c244a729702a835be2859eea78d6
SSDEEP 6144:z8atvj2EQLiGugHHgN6+me+uE6G2s940oG5jfcbvnmwVFwelyyLcGNFhn:gatjQLiTgde+bH2s9bRfM3YmJ
TLSH
T1D9A49D4AEB9444F5E253A278C6BBC671F7B2B8881E2097475265C76F3F33A506D2C720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerfBoost.exe

Path C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe
Size 877KB
SHA256 9bbbf776e266e11f79527dfac577db217a3ff7dbfec133a56eb389217a142727
MD5 d777fc98a2503efcfe713b352514bf3f
SHA1 50b3e5208aef178842020ca4a11b7bc1d85fb475
SHA512 73e68cd185e4f2be2716b3097cce70fd8b297631603da9705d2c769804c51239a1dcf39fe335e57266f7afa6a42ab8ad888a306c87e0d86c01dfe36a6d799555
SSDEEP 24576:Ag9tE1HWfavxAoQ9+41pEKdUnHBt9QNef2mdlk:7evxApU4HDUnqNef2mjk
TLSH
T1FD153995ABF845E9F1B3A67499B68571FAB2BC521D30D31F0260C25F1F37A808D25B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDXHelper.exe

Path C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe
Size 189KB
SHA256 28bd6c84e0ab6b2e18f04a0df5b4a3769d5aec3bbc565d609ad726017badcdd5
MD5 421355d321ae5cf5962d02cba5765dbf
SHA1 1198713a68967f741416092488a013610a1962ea
SHA512 800ffe2ff8fd51052e4e3bb78135bfe3689bd4e5b02a152dcaac85b79822f49b03b00708a471dda9acca81709e6a0c5721688b08a983d028683cd9c40c384881
SSDEEP 3072:H/5SChpONq/DUU394X1Q2+zT6lZdAh3SJxfFrgrwHSjRA6HWC:hSuYNq/DUs94GelZdGaFkrdjRA9C
TLSH
T197149D167BE4A0FAE413C178C979D6B6F7B6F5B11D21636F5261C20E0E73281BE19B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoadfsb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe
Size 2.0MB
SHA256 f7e4162b0b35746121c5fb8685041e6ed21a7d3342ac6a7a84fd9c1b1d35fe9c
MD5 f1d14377476070a2268d2d2c6daa540b
SHA1 e36be2c528bd7d5616e2a5f37eb864f6f4735a05
SHA512 b0e4e35e8c3956a2c5b385abe2178e307ff016aef30f41d7cfaa70262a5588bbe953b462e566af08ad0600fbcac588d6e9e6bc23e32a03452d2bc77dafbd8103
SSDEEP 49152:i0DsUtsShMeiDxm/8JoOP01GFT7bhl6IK:lsWJ6I
TLSH
T142A53942ABE8C4E5E2AAE2789975C9B5F6F2BC514D31974F2156C70F1F336604E38322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoasb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoasb.exe
Size 341KB
SHA256 13433177476c587165818a87b1654c40d4988087dafbf99e9586232a1af62187
MD5 7e3e7b923b87f545adb33ad660825fb1
SHA1 f4a67a6a8f4721b0e9b87888a94f21452343b585
SHA512 29ca4258ffef642ce0bcf76997d50bc59a559051d64dbd266678ca9194824ce9fb2daae282a189c26a07314571ff61c4a72daac22154e45bf4ac21cabcded657
SSDEEP 6144:KrN+s9ellULmHPRZO8ImasphaBuze9bhvRx9EiOwZexhWwq9dU:KAs9memHPRZfImaspfze9bhvTmw4WT9i
TLSH
T181743A577BB48CE1D907A1748A86C2B5F772F8614F21D30F6996C36F2E33261AD28B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoia.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoia.exe
Size 6.0MB
SHA256 6b8d446eaa90dfd0df3ff868e2eed2ab5922d6e09e4e16d47fda289b5ef27ec6
MD5 72b1e5dabe426e169570bc58d2eb1eeb
SHA1 e0f8bb186b707aab7d34f66e1b281a05fe5de427
SHA512 103ff74942969e8bbbfcc1e4c2f9b0d8b89e8d969066b645caf7f0d24620a62c2e178e6578246810f6e9741bc3864da97ed0ac0621e74489ea83da8942808e64
SSDEEP 49152:VMqm/3EeKApQH78i1M4QRNgmrsNuCVPgMeHSL/kpE92PtHIdK293+XQK+P5jGSUd:Vui2LysX8d5KZCLw21ma6
TLSH
T1B3564A55BBF982E4E1BBD134CA7285B6F6B2B8555D31A74F0561C30E1F33A909E28332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

officeappguardwin32.exe

Path C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe
Size 596KB
SHA256 c4c125aa8b61c648e561985db39e58c02a58cb26c3fae44a2e7e86b45d3156a7
MD5 8f6180cb863da814a8d5198649318247
SHA1 cb7b6a04b9ec48d5866e40ffe412aec3e1b45c39
SHA512 05afe1e929fc80573d8f6f21d577835f9ae27b2005193f910bcfb405404b87f7167d09402df2fe9eb013993bdbadb11f63a302fa02c36b1eab2a2f0f214dc2cc
SSDEEP 12288:YQorRWncgN9vtlgAjss9mcIPr0lypFpjbK36M:YQolWntJj7cAlcfQ
TLSH
T14CD43A41F7A881E2E166A5348A66C571FAB7BC130F70D60B7559F32E2F33640AD29B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocolhandler.exe

Path C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe
Size 6.4MB
SHA256 079f30eae159cc23b0501ef5be0d7d1b3f2936d07be7557f074a8d0533786b6e
MD5 fb180926ca21de62bd841b6c5b8c5ac7
SHA1 7c136e1af6922d512805a488340344d7fcc4e08e
SHA512 834317e55c7dd6d199e1ab05f936f2e61251b4179b555dd2914984be369fe4c86a935bc5eb6b5ff3e4139d0cd6cad9641543e4105fc60c057dbc30d0768852b8
SSDEEP 49152:b+O8HlGQKb2XocKBlwNqjHrs+V7mcDgh4gYx6cv6UarMz8wV1racJZFKTxmVL8g7:xCd2xQMpNJG3s5ezHj6GSH
TLSH
T1D9666A417BF880F4E1B7E2788A3A9675FAB278425E31AB4F0151CA1F6F776508D29331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OLicenseHeartbeat.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe
Size 2.0MB
SHA256 5d912d26c71b7ab1e44e06f683840ec0639a0274a6cfbfc1b5f023bc595be9ee
MD5 49f9043396b1e76d1d4ac80f48e3ed4b
SHA1 56603b71fb922da05b3e08fb60ac8326da7132b3
SHA512 4c9a2e5bda9efe0a83e725f1bdea1c5b732887d6abee0bdc56c128df68efa7e23ef169094d02c4843ae909daef07c62b8c541a0c32a29c93fe2b367fe13b0525
SSDEEP 49152:2iu5GqOGtiFMB2fg2lys1RIHLYrU98xjqrAZD:q4cwD
TLSH
T1DBA528506BE881E5F5BBE7B89AB68979F9727C521C70E60F0156C60E1E33B408D39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLDumper.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe
Size 222KB
SHA256 ea537bc9823af721b0d1d6baeaebd9e56ac0c84a52c8347042c3f39c0ddf2b8a
MD5 cead363e66316149fa298365e78879ea
SHA1 d2d9b7956dcbf63816dc759889294e6841f4c003
SHA512 3813d557d9a898b7c5c50fba1ba32ee44175b37ae79d030fb26a22266515daa02381d5e5d91d5331e5533870f821cba1ac5797c812005c9fa2d797608cf4a608
SSDEEP 3072:XgWRJkIdPt6U39zaj4+qrSVzN2Bmt+hld9WbYca2AvrqtMXgFuHmefUK:XgWRSI5Is9zaj4diz8cLcOWNHmC
TLSH
T17A246B107BF91058F5B3BA70AEB58152AA77B8911B31D7EF0518826D1F73BD08D38726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohub32.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe
Size 2.0MB
SHA256 32c0d03eb1ae46621b5a72443c153de19c5bbf016f1655a66c59772e3b7102f5
MD5 02a0ab0bf7a5774ae97e975413e7f028
SHA1 36132fd0c1cbe2b8c8b466d7e3b3a67a679c99ee
SHA512 b3d062a15c95b455d31a2b2a8c0c8d545bcaed0da335a4a423e2983b63391d7da96b0ead8cafd2f80c1aafd4e23a78ec093863799d19bffd178c5fed3f926705
SSDEEP 24576:I6gyTOFsVYGgRVassbS0gJFEDM52A2NBH3NRLOJB4FVwQPx/7mpMLb4FgwPqe0P+:I6gyTOf0AHY4ULOH+MYu8m1/p9SQ
TLSH
T164A55986BBA484B4D52691B189A6867CF7727882C9334F07318DDEDEBFE36604D59330
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreporter.exe

Path C:\Program Files\Mozilla Firefox\crashreporter.exe
Size 3.5MB
SHA256 02fc4d49062d22e02cd756fd4ba523510154a3782b3e584c8d76a7d0b3b71395
MD5 6e6d310d9013c5169c8f48425b1eeb4a
SHA1 508beb326035a11d4259fb23e476d04dc6ea3391
SHA512 75adcca72a7597eff654310170af6ab76a6e35436deee437936fada5be461046d517797abc6e0a52da01811b191f36f966d7d7039a0b2514aedf3dd628a84181
SSDEEP 49152:lym6x7OeY3Fxt3kO28wsz3iDT4JmeDNB05FQz/jTmXLhm6kV9/gG:lyzTY3Htp2Jg9f05FyvaLhm605
TLSH
T1C9061842EB611DDAC025C0B482266723B761FDBD073036F74A906735AD68EE01FF9B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox.exe

Path C:\Program Files\Mozilla Firefox\firefox.exe
Size 777KB
SHA256 7fd295799917ad7e7f2c720d631a41c19e5c2f9231d4ddce2c00e394d40d8293
MD5 23d623c7e50b60cd67dc567293fdabef
SHA1 2761f8baac859484a576cec48b287febfaa33905
SHA512 768037aad7d787abfa69c39fc16867db37f2523650212a06eb6a9287462ba5ba766288c9bfda1a60b7484b727670369f7dfec22fe902db154bb7b917a1051309
SSDEEP 24576:6OJ3rsGQiDLXY9fw4SwpemIwpelzE5lwIK:vJ3rsGTDLXY9fw4ZpeapelYK
TLSH
T14205BF03F38516B8E08AE5749A46D233A5723C840B51A1DB1BF93F2B3D71AD16B7972C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
Size 329KB
SHA256 63dd4fad62037d5f4d040559b6418f921e28d274fbb22be70eeb30416ab4dbca
MD5 304817b82a5a3604471e1f7b24444cb8
SHA1 2d191220555dafba7e321c1fac16db34f5cc0490
SHA512 af5a13f824f6cfcd99e878b684fde57b7dbf5db5ca93b4ab16764cb8de3bc3b3f3543b30209655e2254b331c8d074ca263d1837fdfb1f05ed12b400ec4466722
SSDEEP 6144:2T1us9kxGLF0ln5Utfe1P12482lR4l2/iJPsfUrcAbJR9eDYG:2hus9kxGLF0h5yG1W2lRj2czASYG
TLSH
T11374BF14B3E00CF9ED6B827DC8628516EA7378510764E7CB03E486665F237D85E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nmhproxy.exe

Path C:\Program Files\Mozilla Firefox\nmhproxy.exe
Size 654KB
SHA256 f1597e345d4c91cda1aaa2a4508ffd88d3033e447e90c4645802c784e14e58d8
MD5 9f88f7b9b7f7d195dc4de2e6d1361b07
SHA1 426f5d289fc7743938bc244154786f8f9b738d98
SHA512 172482c14e3df8f6a11eda101944580cacbf36aee8b3930fdb99029933341c07527edea6eee1b08de1aa6316a1411c493f2675781b6bf23e14b42451aa59c1ab
SSDEEP 12288:NCMPT/ZQkIUB6MYwl0yxfs9+Bc/waheNbjYnA:cMPDqkl6hHKLbmA
TLSH
T145E46D02FA97D4ADD51EC474864785327933B4CD0B30AAFB62D89A393E59AE12F3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pingsender.exe

Path C:\Program Files\Mozilla Firefox\pingsender.exe
Size 126KB
SHA256 0319434b9083c037f3eb895541482b45ad9950b3bf5da2e5a8c6200ea94cf9a7
MD5 c2ffbce4beb7cef2261336229d332019
SHA1 600cd16f76daf2efd8255a518c671017283c142f
SHA512 9b120d4f28d92ffd3027b24663093eb8de71cb1ec946c9791ff030a9cc9117b887f32a0ef1a28dee6ce7337468598a0e598cb6b4be58b09e97582f0f1296a213
SSDEEP 3072:bXoYtjZU39HjSh2SdWA3ljDCUhE1IzCQkViY0G:ZtjZs9HOFdjqUhE1IzCQkVis
TLSH
T141C3D0479A2420ABC852C3F0E8EB5922C7753A198F6D13DFA3658A162F027D51FF93D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plugin-container.exe

Path C:\Program Files\Mozilla Firefox\plugin-container.exe
Size 202KB
SHA256 1dd63e76276026a795cb2fc8e82eb82a6abce6c3002c5c10d092b1410ce65a16
MD5 4192063943002a78de8657ff31e947bd
SHA1 872a1c224a53a7f2d92e5e095d272e361612dfee
SHA512 59df369389a5648a3c1c92d5dad5e8cd6bf8eb3393498ff1d285f49c2f2ae5c2abefbf4c736c0ff3d68dadf9c886de11cd3bc7447e17a8c8fa74f42b3769d2bb
SSDEEP 3072:2Okpq7TUU3928EIWjCRfIidaPu06j2YGEohtKcEneouTuLwcxN:2Okpq7TUs9j3WjHQEuDMEuuL5N
TLSH
T1AE14CF13F74810E9E489D279A6D19222A7B075860722BBDF23E565213F06FE4BF7D390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.exe

Path C:\Program Files\Mozilla Firefox\updater.exe
Size 523KB
SHA256 acaf9c5da7fb1b22dad3525ed6cb4b8b3c8524b2d187395a544da11217f7fac9
MD5 11f03bb333f5db3eb79ca57c1ddb4a03
SHA1 f3bd4f51e1655a1c3dab7413cab763167ddbd2c9
SHA512 0353184088bb0458f169c69625f9311716494cd57cc676819cd6ae5a0694d79948492175f578584bd2ab7cf05a2003b1684b8b02f35a846529a55cba8f899df5
SSDEEP 12288:bZpus8Ls9nd69BM9ePb8ckB2ZesnSOJAdGyOkkN7sH7Jk9:9px8ed69pIFUJ+Rpm9
TLSH
T17FB4BF29F3900DF9F427A278C9A28511EA73FC55075096EB22E8D6663F332D45A3FB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 188KB
SHA256 83ed5bcc9debc4b5cb18f0ae9d31b983a766c5cb5dbcfec963b667b874ec91b1
MD5 b7d48a15e8c3a82e754d3a66e3756f68
SHA1 3c37e202c3adf1af521d5e2eab9c1c199492a166
SHA512 99d7838fe146c213ecb1edac621f8f4ed5e7d70701113f60025c52fed719c585e46657fa84e943ec62d02da2325414da2607cb61cf4e48dadb946aea9cbf989f
SSDEEP 3072:YrKICIS8uU39/C1/V8pQFq4XKF3QPwxEanDnLF/ynxjyDXnxN/MyxNKjyxRo8:YeICIS8us9s/sQFqT3QonhiW1nRR7
TLSH
T18E147C59D28801D5C16E8175CB669A45B7333CA187F1E3DBA6C0F63E0F72290ADE9B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/388-1-0x000001D88CE30000-0x000001D88CE35000-memory.dmp

Download

memory/388-5-0x000001D88CE30000-0x000001D88CE35000-memory.dmp

Download

memory/388-3-0x000001D88CE30000-0x000001D88CE35000-memory.dmp

Download

memory/388-0-0x00007FF6AEDD0000-0x00007FF6AEEDB000-memory.dmp

Download

memory/388-2-0x00007FFF73090000-0x00007FFF730B2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads