dc001e755b9c48853d7da834293f1cbae96f31c18961b48567d7f310731f35da

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
Size 1.1MB
Sample260805-cdfmkstvbv
SHA256 dc001e755b9c48853d7da834293f1cbae96f31c18961b48567d7f310731f35da
MD5 7a0baaea17953aebde3eca4679598ed4
SHA1 0446aa14e82881d2f7011073086025cc60cbedd7
SHA512 f5a67c52d7b29ac017df25d88bbaf77ffbadaf898845d37d4abd3cb61075c27af23f4c63a61230e9c55c02e43f4e284c2def5107adb1821833921fda174b63ee
SSDEEP 24576:0vuD4bEMd10y8Hs46URSqpgYkI4pyOHnKXFSq1jrc5xaNIB8/g:gOUf0y8HsJURSqpgYkppJHK1Sq1jrQa8
TLSH
T1EF358D0A23A4419EFEA7F176D617C61BD7B1784A0376962F01A46B726F337711A2E330
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\N:	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\S:	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\U:	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\W:	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\X:	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Y:	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\J:	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\K:	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\R:	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\V:	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Z:	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\B:	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\E:	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\G:	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\H:	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\I:	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\P:	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Q:	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\A:	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\L:	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\O:	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\T:	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86734\javaw.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\setup_wm.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Time.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 20 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4164	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4164	2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_7a0baaea17953aebde3eca4679598ed4_agent-tesla_amadey_icedid_njrat_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

64BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
Size 296KB
SHA256 db6aa74e5da4eec6ef1f99b48da8238f7a579b199a7752e319f44a989c30093c
MD5 bfd79b6f47d4e2c1a5a9a61cffc8d450
SHA1 ffbb593d08ada5003a2d839f668a9e0dd857a1e9
SHA512 40cc6d401f04b2d40f7a28038e20bde1e4b82bda98aef9b0daa4fa24061442db385b9940204b1f46d1fe4e753dc07269a4429378e46d479f671af85f8ad22fba
SSDEEP 6144:hflqcrs9BeT9MQjqfK/7xkBRcJtqQ1j+vWDFmYLrS46:BlDs9rmqtcyd6jY
TLSH
T133549D1A37D84CF5E467C239C9919546E3B138944B61D7CF2764032AEFA3AE0AE3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86734\java.exe
Size 333KB
SHA256 a551295d53c139866dd2efaa373b3b72324a12ef67c42f19686b71530116770e
MD5 0da1a3406fdd9ea123054bb07da98b45
SHA1 40bc8365fe07d3f8c52f3447a48619b81895b6cd
SHA512 c3629c09131bdfe5d4b18032ce6b031876c91b5072fb412c1606641dc73ab9144edca39e6d677110974078def181709d407a7aa533b9e6fc24bffd51a8cd471a
SSDEEP 6144:J4Pl7xs9qxiXelj9W7EZdjQFlYV/PvyqqOlHdZmb+TtT:Jkl7xs9qxgelLs7cPvyqHl9Zmb+TV
TLSH
T19C74AE95B39408F9EC67817E89658A05D6B2BC690760C75F03B4362A5F333D10D3EBEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86734\javaw.exe
Size 333KB
SHA256 6f5be5348c534b7550c7bc82b250db97b87bc7b44ae3f79fd30ce9f65410b136
MD5 b2c13f8b7000344b10cd867c8c7d1496
SHA1 646c3a356835c89302cfc96feebcd4193a7d0a2b
SHA512 18c43ad2c76897e29d1f15991d2346448f808b7f59157055142acede65af6ce49f307ba9760abba32cc6d67eb09eb6b22fab08e64a2d55013062650cd2163a70
SSDEEP 6144:Mm1++ks9JUNYlZ+inTsdYvhbKzNYutYPDvhleDfoB:M4++ks9JUNYl0inACvczN4PDvhEf4
TLSH
T16774AEA1B3910CF8DC67A23DCD665916C5B37C5A0AA0CA5F03A437565F333909C3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86734\javaws.exe
Size 540KB
SHA256 f5e736e72fb9689afaf56e05c6eef91eacccf977f0785dc59c44f372ba6ee3ca
MD5 ac579aa8cb99bb3c629fb3cce0496f2e
SHA1 40ad21d3e1e8db386ad5be45810da69ac4ef352e
SHA512 0a94c7a035421f13bd7250a7e164541367372fd1f1f715691a64d83296de8e917703a2fe3e31e4803a6232cd0b9b0976f7ec0fadb6aa267756ac82da85d23949
SSDEEP 12288:daw4i2s9id6oqHaUyDM84iLbbdIvWcDFL6o:dHm6oGyDM84iZEDv
TLSH
T1FDC47C91F3E814E8F1B78A35C9764511CAB77C5A5B21DA8F02A8621A1F337D18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe
Size 596KB
SHA256 6ed36e1bcd735240019c6497122a581463b351b7440a43cfa9fb59108ec0f77d
MD5 407e090545b853c48e4babfc51118d9f
SHA1 77cc35c912b3a34e6cadaa747566e069699bf293
SHA512 d61b35211e362ab09ce2fe9931e65d4bfe2de2f08e0b3139585cf4db9de268b42b5d304c19515d0fc9ff784fd2d582a7a5757d842dd7f12fc4498f11dff5ff49
SSDEEP 12288:Qs9aeUmhPa/8IeZmUPrNSon8+WDiTD5m6:eeUmhvIsb8pDiTF1
TLSH
T1F0D4AF41B3E846F9E06EC134CA538642EA7378560F20E6DF01E492792F37AE55F7A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe
Size 6.7MB
SHA256 28998f392b694e78b4556546a9cdb8a1809b69a0b09356aaf7896faa58be8919
MD5 05bfbd65f4ce358334594bcbcbc4d248
SHA1 b9f06fc8660b9769a9704d5066a10335828bf419
SHA512 a740802f03758a33ddfcd2a1eab09a6b1f6c0724669167b0b3de3688793f2af350f1b0677609afd42ee8430f18dcf5014e98a6d5d7e3a38767018431b961d692
SSDEEP 98304:Nl8YfTaJ1+WBdB2L4HrZt4PIieK5M0uR7F5e0:T8YfTaeLDIiFUpI0
TLSH
T1E9665C47E3A600A8E46ED970CF395521DA253C8E57B493EF129476E81A32FD87B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe
Size 1.9MB
SHA256 9ae61a49e00532fd844068b002eb9d95cdb74e978f3ad21bd5768c7fb4051f50
MD5 e4cc0457ad217621095264145258c177
SHA1 43f19ea4d9fa96b516c2ed6c1e98a347aba4c6fc
SHA512 44aa47e4c980581baf084377f8623ed9a42f6c06f3e16d872666e40fd1f865cb5d5dc822bddbeea4592d3f6a843a4e0731c389c708a7ed96187bbc5e2bc2aca8
SSDEEP 24576:wDH4MmW0NIQUVVXgy5lJ4XJ2y1L2NLb9Ld25PTOocJuJ/cIsY6Wfv+i+o:VMT0NbUL5lJ4xlwpZeToMJseMo
TLSH
T17C959C03F69941E9E06ED578C7469136E972BC890B20B6DF0290B2992E77FE45F3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe
Size 1.2MB
SHA256 e2e120182dbf4bdcc51ed1ecc62f69e89edca8fde83cbdd0605aed0b58ca7af5
MD5 1584602db78d59bf0ec73e6652af43f3
SHA1 392527427b8cfdf10817c2950ae818ad4de0a2cd
SHA512 a88682e2f9046a5733d000390c834381a4c80875fb43f8620b2dfae09b3d50e593220c80044e454354e883c97aa6650de6d2d4f231d7a58f3a1c4e763faea2a2
SSDEEP 24576:SNZZycrnwvdmXGMTVnw4su5QUD57x2IVprScYs1M6p:SNbjrnwvVKVwVuy6NFpGmx
TLSH
T1C345AE07B79840D8D069D574CA668132EAB27C920B64A6DF06D0F2592F7BEE46F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe
Size 3.9MB
SHA256 e65ca02a771c6e8ac8f3c4a4815e7309374fa2511b07c47a12470120549ecbce
MD5 c619ccfcd8edf42a60ba585134e0941c
SHA1 66d2e60c6d97ade00d88c36b592bd1c3357d24bb
SHA512 a6a2b889e7660ea262c72cd9ede4ed111446053a1e4c7b9a30238f9e448c58ed44c381c4216d9d05cd38f641a70674faba849947dfe1013af8346415957239a5
SSDEEP 49152:U53Bfq+XxGgFtSnmXt2rWW73Jo0GD0AGXuVEusJ6LNzOeL0GKVIeCjIp26If2y/s:IWySXuVlcm7fwKAj4WL
TLSH
T1B8165903F29940D8D059C074CE5A8132EB627C8D47F562EF3694B6EA2A73AD47B3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe
Size 1.2MB
SHA256 2e6bea6c41a9723289bdd8209a53c9f7478f30016792ff2d2d70c7fbcc20cab6
MD5 c9d6ec804092de4adf98f20156b16ff5
SHA1 296b08678ba3edc7fffa26e598b21c4f4975c638
SHA512 80c13e2d4332d376e060c3f6f3963dfab77679a2626757c3ef56e62be81b44b3519b25bafbd97201b8f4b9dcf2be7aabb76ac3ca721b4b3bb9700c59ae786979
SSDEEP 24576:9+9NgZHO2FkaXbcjg9RHg9OcyTzVsr08msVzjH:9+9WZHjF+jQRAUNfVWN7
TLSH
T1AD45AD07B6D841E8D02DD5B4CA568532EAB27C860B24AAEF06D0B3591F37EE45F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 1.6MB
SHA256 e82359602f4c97969f2493a104b216e1ef775cce13549ae16fc3403aa1d60cbb
MD5 4b7f6a7cc321ca856c3bd1c3ac86c158
SHA1 e389d039e9e0c24629c72abcf7d411953504ec18
SHA512 db2c4e206dc104c0a944a957c3ed08df934031f5fdce8420e595cb21dbdc78714ae90055b46dd84973e5d7036456929faba85cf26e2c91dbd8d6dddddb2095d3
SSDEEP 24576:QaU1h2A/dWlGT0BUXeWcwrAVwbcbhuHQXuha8VTlkkkkkkkl0T3gAQ403:y1h2wdWlC0/wcVFhu2ULpPQ403
TLSH
T10F758D03F68A81A5D09DC278CE764B34DA727C655F20A6EF0190BA253EB7AD04B3D3D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe
Size 3.4MB
SHA256 fb12c94ba92e5bfd1b7dfe6a5f30f1d42030761e42af9826f449608e535ad6ea
MD5 3940e5173f01e2a9a12b6e0918528e94
SHA1 3956aebff36699458b50acc9649caaaa55218db4
SHA512 6b3131f2d021510a14acf68ae5a461ce30481fb06ea2aab0966f5a2f655b624ddc601c79bb341f4207c37d40ee82a89684b0cd6f86a7ff2a3afbafe7514cdf77
SSDEEP 49152:g0VX7Nk3LHbDA1qswJ7zwLC1hN7UqMzADJulO7Udq+KqOuBk7bVnU7wF62JtYnW/:LauwJul1EE4wsSe
TLSH
T138F54803E29900D9D099C078CE4A9632EB627C8D47F562EF3290B6D52E77EE47B39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 1.4MB
SHA256 053ee1ee3de1f86f7e99f2bd8541f43b1e19e0565fddba328ffa2baefbc5290f
MD5 f6c0fea0d299035308c12348bffcffbd
SHA1 a38b64b7fb9cf72af1af16609ccc01cf1adbab76
SHA512 3a512cb4eec7f70af9f086051cc9e9ebe9b4d8251f481dd295f0b9e1801578849007275431e087a588d329d8f9f8a0d478141bb43eb43562685f6537ffdf56ec
SSDEEP 24576:8qDkcVlxyEjCvX3vDB/uuROz0kh8KIcP9e1qRA4a3/:DDXxJjyZuWOhh8KJP9S4av
TLSH
T1AD65AD03B29D41E8E06DD178CB568536EAB17C460B34A6DF0698B2592E37FE85F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe
Size 1.2MB
SHA256 02bed74c1a76c37107610c7534a665332f6a6268608338f6cc0440fb8f88e64e
MD5 7ddec2567ec458ff6c7a7424955be5bc
SHA1 ed9b72aebe8ae3328dfe808cfa38390fdbc1384c
SHA512 f3c1c35229d5bbaf031e0c64ccbaa29fd5c419392d6f4b2d41a0bb9b2e6d50a308e4be6dd059b3ad50baef929607aa3c6e73c3e6d23b92202a011aa96987e6be
SSDEEP 12288:VM92GiP4KaoLiXOTv2Yfks95Ymxn8vFJ22YVT2KKs8JVepPCyhIhzGoqwtuMZEQ:Y2GiP4KaoLiXSpYmyXYVCKxp6GHHHQ
TLSH
T1F745AE0BB7D840E9D029D578CB568532EAB27C420B64A6DF06D1F2592F37EE85F3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 248KB
SHA256 26319150a5817b1818213eb4508a143f00a32569bdd1c24bad8b5d0cf0863b3a
MD5 4fbab6d988e55d2ceb08a44c3c863105
SHA1 e796ac65293492e914306cbff88d4c0617595572
SHA512 2110aa9b851ef8d22706a007cf2443282eab27a592c532bb40ae15ee60f34616cbc6c639a6ab8464ce2e507f70a5a4fc45385e47b91dde273e1c69a90c808d11
SSDEEP 3072:RU39NbZQTRgcnT6opgnbdPaj1pIKuR9CbOwWoY46TW8sgyhNCOVTWfW+p+Qfv:Rs9NaNVnT6ocblaLIR/Cuoh0kWff
TLSH
T1D2447D6976F810E6E037D1B48ED49913F335B87613208DBF4290426ADE63650ADEBF36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 265KB
SHA256 497d6ce442b4bd637805b896446b09e47b3975863fa3b61d556844a52d887077
MD5 e76bdd581389a0ca6bb78f345f0448fc
SHA1 9c31bf98294f59e65b757540488afe7bef87b136
SHA512 697423b67991cfd219c561e2a5420c4586b3fecc48c6df47cfb91f128b35da4ece39fc17cf6d63562f070b543a5e1a62bd05cbaeb80fba5d54ea424b8c95c34c
SSDEEP 3072:Z9U398w38ngTrakpBtQa7fzdkqctoSGwaZoY46OeR8HvjERubw5nZaSDJIY+WLyl:rs98oigTrakpBOaTKqYWoht+uoZaSDml
TLSH
T1E9445B6925F810F2E176C1B48BD09903F275F87263108EFF4291479A9E13A916DABF3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 610KB
SHA256 1f3141faf1c36c392cb7615d0276cd481bfea85a87328048a3df4fc8b975e383
MD5 1b2d06fa70e0fcaf1061ce9eb78470b5
SHA1 da0d32cb910197a18ecc382c4bae00097592a98b
SHA512 36cd33c86d968e871e2d49675d553dca546317086be723396385cbb2cc6e433aa7827ca84942b60e67d8d151c20928c5e0c15b875841a6d33a8fe34e28470219
SSDEEP 12288:9s9lgXwfOrs0gHVl3DSPJN9Uoe15rCB6d4W0HXXH:egXwWVE0N9U53SWq3
TLSH
T1A1D4BF81F3E847E9E07AC134CE528546EAB178960F61E6DF02A4427A3F376E55F3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
Size 7.2MB
SHA256 41fdd5c03b100c9ea6526e636095905935a694c5526858fbb53e96a343d4070c
MD5 e3c3a62c06d1b36cfe71c0fb356bf67d
SHA1 2f264ca29d4cb23a9eee50bab8becd33951f59c6
SHA512 2de750cc70293906eeb0831549c18b0a6ba654d5bda0a7d7e0543637319e1f3c372464a15c5977d05dd987e1b666329e0fbdea50bfdf03db61e54dbf21d5efab
SSDEEP 98304:f6CZetahq+WZidSwCsJB2++fGaOxRj2vJzRN+T6frIeV:SCZetanUGIGVxVqzRdDIY
TLSH
T108766C07E3E600A8E46ED974CF2A9521DA353C8E47B492EF169476E41A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe
Size 3.9MB
SHA256 f269e15c19520fb79766f55b8a0a964db804c2cc3fdbddcf9d719e9888be690f
MD5 97d6de3301c2250ceb6db6697cf96543
SHA1 5dd2f7580d690c9b6d14aa11f9a10e4c118f285a
SHA512 1d8d857676644607eda6f2af5cfe7205206b79d44c4274ded3a7a276842e3c382951cb9d771163b9a7cc086c216f9cb3ba77bdfd4373ccd682207e362892c80d
SSDEEP 49152:DxgyuXvw0XzOJUmMpdbmhLbKqm006NPpIupElVu+e6NqcXToRzvUqIzYHBigdQBU:DuFDGj81mCCsNUhIUBb5sc
TLSH
T1BD165903F29900E8E05DD5B8C7568122EAB2BC854B35B2DF0650B7552E7BEE8AF3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.3MB
SHA256 13b9839fa6b424c3161c5cd004af1442ae6253f23639597cae872ad710b500a3
MD5 daf287a12819bb862333c3167b7684c5
SHA1 6b32258e6bce0444604aec12b27b1726ff4fba7a
SHA512 769375c5b5989c49f2f9699ac136c10d777d53d548637c9784f21bcb4081b4ac6b89015c28b5cbba03dc072d0e01dbfb26dec16a2c653231e68b83d67cac626c
SSDEEP 49152:95GhXIix+DiZYOHUKE65stBhuXjfS4LWxn20:YIiUunjBT0
TLSH
T102B58C03F2D900E8E06AD178D7469533EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 1.6MB
SHA256 9efdb7b200a42325f5119745c76be1818a7c01d556f8a08825fd863e596f3e34
MD5 acd804923d0d3f5fd59f900cb4f4e52f
SHA1 f4ee0c2b861170f2d71ce3105e69728fc05a25ee
SHA512 baf69563f11baa3235a6cdf66c1484c9e4956371c412fcd5e500a80561ed6469d0bb95114cc16cb4257a9caafe5983ddfaa65892a908f87dcde45e2f066fd6d0
SSDEEP 49152:UrUtdy2ML5TjsxQQRgK7tYn/STlXrk9dBA/0kWvb:6UzKx/SOEMz
TLSH
T119759D03F39901E8E05DD1B8C7568936EAB27C450B24A6EF0B90B6552E3BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.0MB
SHA256 4b0ff60d5d66e567fc8b08232f87a332f12a38c390c7abf21eaf27af1bdb11e7
MD5 1eb35fb46ad51b7865e2bfa018dd40ba
SHA1 69fffd837b2c63fce15de99e4d85e1b30b500e36
SHA512 32f9ab6434702856736d73b92ac78648c12aa14c0c3e9cf9b9ce73081a451564b9668c743c085de97776b8984c164d47a33fa1cbaa89b6053e664e9683aa3897
SSDEEP 24576:67H2YuP6BBLiJW9VMugiNOB6SSkBJs7CtW7KSdHBxmRkkkkkkklQXBysWAgE8ABe:66YuPqLVmiNOB63kHZrSdHBAVfNBe
TLSH
T1EE959D03F6DA80E5E05DC2B8CB768B35EA717C554F20A6DF0680BA652E77AD04B3D394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 3.5MB
SHA256 44f85a38fd7aea4ed94027fb89b635c0213959e626552d9eef3337950b470fd3
MD5 f0b952fb1df38d3ce7593eabbe815f73
SHA1 b2acd84e57a1530c19f715a8c0250c13e2432afe
SHA512 d1e53ac4ca143d9728d7a77a6e04da43946057a117e61a7dccae620f5076c0c4cc8ba4ba1e3927b677aafdc6ba14dc60c0dbcf2671c8896af098c5656fe936bd
SSDEEP 49152:6uZIC1+rlQs05K537QABN6hcnb6YErkz4AkOuaRoBISCaQZCLlrrYV:+K+m04OnZHV
TLSH
T164064903A29900D8D059D078CF4A9223EBA27C8D47F566EF3690B6D52A77EE47B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe
Size 1.7MB
SHA256 4532ab55ad561770f01e152d92517a9afad9dafba32faeedba9fb268ec72cf13
MD5 cbc87c588270214f342db48b892b4680
SHA1 60651a0bd15bf0111283d8eb2b1a249ac9096bda
SHA512 63b16e562c324e04726ef7690fecbe91d7dbddbc57bde4ac25044a60c0c9e9f93214e4e0cd0eec3f519e0d31f7409eece6b572c5cd3b4eee5e8ca4e38725aac6
SSDEEP 24576:J4xTYkC6v/GvvjPKauAgMm4N73F+w+b9veQuJXlPnyF4mfHU9YawsNjqXoDvvjyv:gCiuPnm4NTF+woheHX04mfHIRW/
TLSH
T10D858B03F2D901E8E06DD2B8CB469532EAB27C450B34A6DF0691B6562F77EE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Size 4.1MB
SHA256 ba3420fa0d98b39d7567fad4e7adbe3522a5241946e50aacb08f48dedc009bfa
MD5 9a9e86123175e4dfb43a1c8076ebca9b
SHA1 3dd69965cebc7753579a4ceeb3252e69b0cd5633
SHA512 29e5053001a01ade6f149bf3d35f8a1e7ab36c422746a421bb97f943ee7a301748f7a76c3f53667fc0e24b85c4a6dbe94d83ba96ed320665ecad3632d5c2c79e
SSDEEP 49152:DuKkr1gE4U0UIlaFxgkU84B+TjEXzExldDwUIDtaZHWRdpev2y/BahY:eOyDaod+RaAhY
TLSH
T1FF165903B29940D8D049D074CE5AD232AB617C8D47F162EF3690B7EA2A73AD47B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
Size 1.6MB
SHA256 474a8cd95b015e29ee33f0a157f3a552fad81147299e062ca3a7d31316b09c70
MD5 8742db481f3c6d260eb4612314bfd4a3
SHA1 74d9686132eea0f0f93d291cd1d1c8f0a97c65a2
SHA512 0a29e6398e5e9ad84eda08ac2d3ad5b2f4f01f3fbac81b5bef124207119ec53ee5e2694917675196bc0078f3c66f6367ef9c0ccf8f1adb785d1240de9d648a9d
SSDEEP 24576:ujI2B8U69kI/h8tbq60uBA7hohUHJ/kWnL1oaedpEukUoygGmq/SSkM/l:uXB8UcZ/qMYA7hgUp/9nBo7EukU1l
TLSH
T173759D03F3D841E8E069D1B8CB468536E9B27C450B24A6EF0A90B6552E7BFE45F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 1.5MB
SHA256 f6d81268be7963a535c510262eec3efc082a12f62ec87c3535cc9941676a2582
MD5 55b7abceb6b5823ee25d066e8eccfe74
SHA1 e07b3d2922a150131938a3d2483039796377cfce
SHA512 ee47a15990cadd719ed71decbad1bd052487d3c76f56689d27eddb1de052c8b56371555415dd2dd5c8ad3d64c4bee8e97aebf5d89f8d06d71512f72eae55d039
SSDEEP 24576:yu3QP6ymx8iYIKwiuL+6AGd6W1Lo3GsVa4i6h27d3WlKFvgDOJQ8a:XQPNGO7u+6AGd6w8n+6h27dLhgDyQ8a
TLSH
T1A2759D03F39940E8E05DD1B8CB56853AE9B2BC450B24A6EF0B90B6552F77EE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 329KB
SHA256 ae17d9c643682d9c49939acaf0c8f982e81bdf3227965a52b13d753b8518b8d8
MD5 2da0dc31ad39eedda2e2fe044b47fcc1
SHA1 84523da006e19e5ffac5533675e9a678a32741a3
SHA512 f8a0f8a1c64b5765e9379937a03d50cab76691c50dca975668ce6dee5159c9a90e391e1c3b7e91d8030cf97e72bed205c69ac2af5ad85b91400cb711c6b73a1a
SSDEEP 6144:sYvts9XJBGviUOK5GX+r0y1L3a2lRNhQ/iJPsfUrcAddPnm/:Lvts9XJBGviUz5Ck0j2lR82czAdx4
TLSH
T1EC74AE2873E408F9EDA7817DC8A18811EB73B8954760E7DB03E485661F237D85E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 672KB
SHA256 b7cbe98e67e9e37519283338d1a71d7ed530417cda8a9431fc4df3aa74f552b5
MD5 0116d44f520c8823ef9dc8c70cfeba29
SHA1 77f81fd383f4c69adf15be0a7c69f3de863dcfa2
SHA512 7e9bffdfc3820b7a948cf8589125e8ccc1dadd7ccf4419f4eb3f303ef092c89526a12130ae753c195da69cdf634cfb03eccfc9f4ee1ed3c254a566780504273f
SSDEEP 12288:a669jiVTkqUk0w7aRcC937ps9arHs3CXmQGlw5:EkTkh/w7y7JrM3CXmQGlg
TLSH
T12EE43B16F5748731D073C0B9C5D2A69EE97230825B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.1MB
SHA256 17e88235718c60a8736ae99edb835ac02c932a89439f512ed346641b30f0a756
MD5 0c1c783a4d505768118c8463319bdcbe
SHA1 32a634c53c6c145015cc88b6a46fc44c9fc8f7d1
SHA512 74a1de89aa7918a71779a3f4a97d7cbb961009ba90c4c5753509f038a61ffd0ad7dfd14233e7e909640ce051da51145d9ef87460e8fd5f0389cbfdf1f58fd891
SSDEEP 24576:nFaSezSC5vZo+tHugrvWI6q8wyuP9OTLg:sSezSC5vZzzvZHjyS0Lg
TLSH
T1F2352A25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 840KB
SHA256 e0b6867108ea960578ae5650f1c8acf364e3fad30dd53a0ea2073332e95448fe
MD5 6ef739cebad7a59186243ba39c9b501a
SHA1 95dad6c8df94b3c161e1c88c6ddff53aebb0a5f3
SHA512 25afdb6dc289c8cea31865e5e70a9ac61cc06f6539f6823ecd53f10b6012ec71def1a70681b119cc667d8613ce376701f575ab9eb9bb79e755b6da795a04664d
SSDEEP 12288:TOc1zB3r3vzXzU7Z5G2mnwsElgW9gHs9df0Im98dfCBbTG:TrD3bzDUDX9gYdKhTG
TLSH
T1EE054B66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E6B7D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 350KB
SHA256 2fe434d06099f819070dbe816b30387b11f02d7d2bc506745e867e5b4cf31f6f
MD5 507fb2a5fd2a7d2aa76fb3c595e24772
SHA1 3409c7f6dc6a8a4cbe76be2ba50866a22409fbce
SHA512 5b35b061c3b2be80e37e5c810274b80089ce9c192ce5642f2fcd849ff798f139f689af4a465ac8efb3d39855402e010efe37d6163e8148ee5707771e6642a988
SSDEEP 6144:yAOOs9sBJ/GKWWBNU6ITLBi0qttclOKgU91BJ+Zvj04SCiRVhNLU0u:1s9FeBNUbTVO86UzWr04SCiXhtU0u
TLSH
T1AC74297BEE28FCD2C27E4DB85A918640977278704F62A3CBD165C20EDD235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.3MB
SHA256 75d499923db291837e3d9a9054e7d697468d131e7c91b73084bc3b84c0caf464
MD5 e63ddd115e1ee5a8ebf90f8b82e0a301
SHA1 bca7d2bee76ac74759a399b1afa8cce668e8648a
SHA512 bc045861233c7a95009204ef9af0037ba916bb8c8356f03c819a5eb2ff610cfc478fc1165428ab284cfd4cc1713c6e2ccdcb4d97fbd82dd0ab9848cff04fd803
SSDEEP 49152:US0pCIx1kePm6MRGQtWZN2gi7Lvd4xzL5QkSlWhj3meuRFNl1ZCMv0T6wCg8NRV+:USyk6Et6mLizWn0Gw25C6pA
TLSH
T127265B656BF880F5E1A7E178897AC5B2F7B678420D31EB4F0191C62F2F336904D29726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.3MB
SHA256 c95f805951b203962d82c91d676221808b1e472719e6c8480a423b5d7f95b4a5
MD5 f56f97b19ba035c38a67d003edc0b9ec
SHA1 2b1a8ca115610007f559a76dbc1f501b1fcadb91
SHA512 bc57907402fdae620d78d55788cbcac55f3a8bdfa828c974407a8c5d7f9ef37b975076b02b49f9099435426618ee39bb8026f4e010d2fba3cd18523f4ca70156
SSDEEP 24576:XkY60uAfX2z+L5WqirHCYRFiV+XenmE3Pnzc344bwDgng9:XkY60uAfX2yL5zifFiV+XenmE3/ziwf
TLSH
T17BB56C0976B8C1E4D1F6C77886A2C647F37178154B34ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.2MB
SHA256 ca27b37d2a86974110df73fdb2a82ca70708f3fb744a59e4daad597d88aded51
MD5 8d656639ddbf74dc786499d4cbe15409
SHA1 e136e30f086057e659d1b03be82b123be102ec30
SHA512 336dfe6fa6ee3384df5b1fd2b071fb34384683f51d6ff2854839f095d5c2ae81c2ba65903b00eda039688967f6dce2dd61ea104b36093ba9aa8fbe314c3185c7
SSDEEP 49152:SjVFMYdRn5NTgXp3DJf5SUYLoDpgLjSTYlQcGe3AaLSF259ruMHwpXMi4FqJLd2C:rhRQyi36YOcP/Lvw2gAf+PN3vjT
TLSH
T111666B13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 0d018ab3bc401710ae4feee528297424f4ac34589e4453070cea21bdddece4ba
MD5 9bbc45c59cb8ac37cc1316a4eb2b2f70
SHA1 fbd7b89e67c08e897b77e02a23390b510d80e893
SHA512 f86ee442f304183121aee62eb085c82c1e2130c9cb9fa305cf1d2c49d8f943ceb0a4ed58c4b5594f69bcc7c9b1588c0b7c6e6aec8619c64a7f178386614b7c9b
SSDEEP 24576:iovFQce0lsQRrFD8DboeR+hbE7DaHGTNHu7PNU3/5W/ohL0J0kj/VCHQi:GcrlsQdeMhQeWu7PNU3/S0kLV9i
TLSH
T1C7952733B2F600A9D44DE1769F4A872196E27C75CFE0D3DB811572061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 3.6MB
SHA256 9e3ebde2c6d929e7d2a1a6b2f8c5aa6bdc4d20eb57565d6fe6767844e6a84936
MD5 874522ba9b35238f527009d9f161d60e
SHA1 cef071bd49c0211194a2dd05d206b1085caaef5e
SHA512 610436313a70752f7ee67167d93c6802685d61402657eaeca5e7aaa549e1e0740aa8159fc45f37797829bed4e66ec1e5f4f3017c8e3fce1314fdaea72293d2d0
SSDEEP 49152:F3Hdgjc4Ny0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbbN3Oh6tznm2FQ/nho2qT:wy5112gYy5azzVv469nLKnhZ7kIM
TLSH
T1A4067B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.4MB
SHA256 90a7b5ef59497b133e9cda815a4053d2224fa45477975642ae652fb19882f345
MD5 e85fa5929a2e4b7f58f1c8b066912722
SHA1 f631f020cf6343ac56140db8fc65aee5e0ddfac2
SHA512 8fe93d09f97ecfa01c1e488737cc20d374f38bd6e4de44fe8477e154774edfc9ea3ce6cc2e626d2f5297b796528697c7aa458d6a3766e387e0c12d327a68523f
SSDEEP 49152:kAAWJ6ZnNMMIiOBr4tEGC0bqx0z+n217aau1gl4x/:gMZJmcxd2d4R
TLSH
T1EAC58D13F1DA01E8D06ED478974A9233FA62BC490B34B6DF0A9073562A77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 1.8MB
SHA256 0ffe5765000cff6b95325bf9356161813941de7e51d5240504858f959e53b7d8
MD5 d96f490e38b90b6a14ea9220ce8878b3
SHA1 8402bfd35b7fd4805bd4996a08b1bf22df487730
SHA512 e585f7ac8ae4db7fc3de87d671e99335c97574f2518ee55bf3af8347841fd60f65865c3b48043f0fe1e2064f97486650f6013624aa91f5868a0bfe0c1e0454ee
SSDEEP 24576:Q4vh/hzS0/+oe3TzBEwuCM4rDAcaUQ1zNOgLLwH7ReaQXx3uNsYSu/ZWZRU5:fhzS0Go+drDAnU44CwH7R4xkJBr
TLSH
T17E859D13F2D901E8D06ED17887569632EA71BC460B20B6DF0A90B6961F7BEE45F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.0MB
SHA256 d58f272b450f890cab1f57af85bedb3bffd99e93052fe6e48d1b08a22d9cf4f0
MD5 96df5897947b66571a9edc43d95cc687
SHA1 eb695bd41df44226feb051d5e7a394f747a3d7c6
SHA512 40ce381f5a3a88ba70e27a77b78ed0b09bb5a7a032550adbd9057df7a08ee643bc33339308d48baedf1afd55faa1831b1dafb6a4114435d4e9bf0984b7cea2af
SSDEEP 24576:e1Svvvjx6cCQzEGhAo0nRPa/O8zHWxzR04FxGgVG2Onks6xt4bSMHnqPDKuTP:HV6pQwBoy8z25RVtOnks6NMHq+uz
TLSH
T101A59D03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.2MB
SHA256 90ab25bc35c54876a59bfdd0c09e14aa7f98a5d73ebef04a16be47b5e5735cb2
MD5 11ec46320253163ca29ed3a617ffe6e2
SHA1 888eac26717eddefd54250a2b63aa5f965db2b4f
SHA512 6d41a4d9d147742fc2b8dac120aae7313628a868e3dc05d294a62210708d15c19f7e225f12fa5a18b29957aa8777258e761a212d63181b498304aa44ee05af82
SSDEEP 49152:Ss3/KwCvH9VgjLAE3dGGj8buEGcjesaNkYQd0XNJKcvaAcPTY6Y5AfZm:obOvjdBDlZv
TLSH
T190F59D13F2D940D9D059D078874AD232EA72BC494B2166DF0690BB562F7BFE06B3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 3c86b364f83baaf1830eb4633cd195851d0faf98aec833b27d1e871a4c37cb85
MD5 563d054bf1fc7adeb5cff818e71cdf8e
SHA1 b49db48e787787a3eb0b9a54da8f4786ebe8b9c5
SHA512 6f5c848b9ddb2f7800ed94951b7f1e450bca9343492af0be9af600ba89f2baa5044304dc1dbc49546f30cfa1b3ae906dccfc762352ebb5946572195d1336883e
SSDEEP 24576:jkVv3JstwkEmznV8myUgg+XmE4i3iy9CTn0AP5+2QLcIeylgY:jisakEmTV+Xx4giDn0AP5wQIp
TLSH
T1DA75AE13F2D901E8D05ED174C7568A32E972BC160B38A6EF0A50B6552F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 333KB
SHA256 e3ef7122fca9cb73d5e432a9ade7460c5e340e395d24dfff9d45594e109f3a4d
MD5 2e28e936e888db2258fd7bf493be99f9
SHA1 405d494ea9462d727fb5de58852608761a13c567
SHA512 1b90f9c747e2a574bc405b643e79df6f7c24d4547f0a1e1b009568ad278fc99bce499e6f43a91fc99defc89116fe286070417233215abc6d63fef2d06669c8e7
SSDEEP 6144:ECPLnrs9CBP4nBOjsdi4Kx2mWnYV/PvyV1rFo9Hh0m9rO:EWLnrs9CBP6BO5R0cPvyV1pr
TLSH
T19274BFA4B3901CF4EC67823EC9659906D6B27C590760C65F03A8366B5F733A10D3EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 333KB
SHA256 f5868ab0094916c16cb99c16d76369a2ae707f36594e07d61c21644161e3fba1
MD5 e23978b4f937e7cb4e5b2d3fcd17f1e1
SHA1 a7274afeba9506180162e5b3cad8994e3ce4c5c5
SHA512 33007d544a986334434f06bbefdeb25dfd0adc8fed85524ddd6ef278d8f874b1a762218446557f40625beb6cb3de62c527b1991ef5797d3d9cb749de99fceb00
SSDEEP 6144:x8TP0s9aqBrYtTGVYs5btKZtzBYutYPDvhuveHxJ1uF:xaP0s9aqBrYhGVVVtUzB4PDvhJHxJ1uF
TLSH
T14E74BFA5B3501CF8EC67827ECC559916D6B27C5A0760CA5F03B8362A5F333901D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 540KB
SHA256 dab334e071e14c7a9c4d1bd6d69f3ca38467f25ddf5772fb366d246917a1b9c2
MD5 dd1a727d3280c2aa6df1f45774578bba
SHA1 38f91609d374c36adffb250d55dbc2aea7988d7e
SHA512 46878a41af8d092ab9f95a09416f5187ca3e5f9df86e528ba3f4fa2c499c399f019930f34a2941eb05ca98619e680343d3ef04bd01f7ede1dfd00494f697ec91
SSDEEP 12288:VRllI8s9+fQrTpNlsq9l5rLbbdIvlctsv:Vb1QrFsq9l5rZactsv
TLSH
T183C47C90F3E414E5F1B39A35CD764511DAB67C991B61CE8F02A8265A1F33AD18E38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
Size 333KB
SHA256 1df1d3a6d8189c8c47c51945476bbc372ce73954d49358eb86a039ac2cb90410
MD5 7212b10c1f8b2df8451cc44d0cdd3dcb
SHA1 6a9018187e71ca67375ef126515376edec78dd7a
SHA512 79616b3cd9078588e9c9f9d9600e49922f606f7cc4b968613107a775d4a5a3892f362dd7c9e958016fe3871c9a0779c1f36cd3f3d29fad0f6a5afa1d2e74e981
SSDEEP 6144:uyPNars9Z6rnm7SjwERqNxYqaMYV/PvygHO:uGNars9Z6rm7S+HncPvygHO
TLSH
T18074BFA4B79018F8DC67827EC966490AD6B27C550B60C65F13F4362A5F333A01D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
Size 142KB
SHA256 2da52f23e2bcce064a5bd0a5278aca88b7d72b4a061b3f8378ac6848569cdcde
MD5 a245fb85958309371fcc65515c6f04d5
SHA1 5751d96e3150d4c9522ddcb7ba670fb7de063bff
SHA512 a3c68cd4d13f6d0a28a9903e3a2063b1df116c91ee53ea360017d5b98caaf726bba84b2213b7f96e281559ca27e091124a89556cdbfad1875b036a6011f805cb
SSDEEP 3072:IU397jlXEo43udtjZqMNbjuxErivG04gRvam93pq0TK:Is9vlw6vv/8fDRvam93pzK
TLSH
T1F8E37C90A3E95480F273AE7398B9892148777DAD4DF2CD0E51D0320E4AB37D59478F2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
Size 333KB
SHA256 9116485bf3e83bc0ba04c74fd326e2522c9f5cf8a41b2ecbbe7be273a5b080b1
MD5 28e42f9f3b580f9b1de9ef6f78b080db
SHA1 1713eb3692eff53539605de406f2c22b3872e4ca
SHA512 3288f165f494d08d70fde3f83ee49ba14d54c439a8e0b15adf387f1724e038ad43acdbfc4a859415b526143877ad4d77186fbd98479e23ab3a3172ebcbb1b6c8
SSDEEP 6144:Bk6MQs9trqE5LgX6LsGUPmUAzYYutYPDvhfbxA8NZU0/:BLMQs9trqE5kX64PPOzY4PDvhT+UU0/
TLSH
T17874BEA5B3A01CF8EC67423EC8558906D6B27C5A0B60C65F13B4361B5F733A11D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
Size 540KB
SHA256 c0e30a12e1ff5c5449fa28bc8b65e761ad824e9492f7d866175f23f17ac39bba
MD5 b3e83e5dacb5eb3822de77bdceb0098b
SHA1 42bd86b4d67427ee0d279dd4aee961f4f54e7c9f
SHA512 a4c7618e5539f66a42bdfaefe0ed0cd16fe0cf3d3d4a6e97c846855c277bd1557f2cab17a33f9c0983705fce30e19a6f0abf85ac6538ee9b38e0f9016bd6faf1
SSDEEP 12288:2oLfFws9JPQsNZlShlmf43LbbdIvMWPWTR:26TQsAhlmf43ZnW0
TLSH
T10EC46B90F3E414E4F1B78A358D768511CA767C9A1B61DE8F12A8261A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
Size 195KB
SHA256 4a101eb9e30f361555a2db254c3aaf5bea02dfb7f8a6a6f55e3059f743b33a26
MD5 b5a4b94936273655b5e6d690029c115e
SHA1 1e38bcada0d6cb374c1094f4593855e17d127620
SHA512 5bc34324cee20381d9391994f06ec0ff07fe7c633cb6c8f60ff67ef33371e904e0628ff244149dbe728731c91d517bdba8e6c3d8fb29b3e2148f8a824617950b
SSDEEP 3072:2O2FxktKMhaxDU39oY5DEmd/MjgvhagI/f1OFOPqxnHWipvhw26iq:2wKyyDs9z5DEmdggIn1Us9iq
TLSH
T1BF146B0173E81194F477DA3D98604902FABABD521B51DF9FA344352A0E3E6E1AE3CF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
Size 138KB
SHA256 55f4d3b19636e5e8cf8c6f4319197cb3650bf4c296894bccaf131c471aca4675
MD5 05685f8dfc697f4c8c79997cc0fd31ee
SHA1 cefe11d8cca34b5d7fbdec82bcdc79bc38d86d18
SHA512 1505793da067b85674e0b273231b74e308c072c372aea32eeaaad3e46e4bc2ff8c7ca0c76aeba28a45a05e2733b924aba7655a3ccc51a7c280cd27717e112175
SSDEEP 3072:6cQb8SU39M28vJEisdBziuxowQlv/OK1fs:xQYSs9J8qdBYT/OKq
TLSH
T1FDD36B4163E92498F1B78A75A8B445108F7BBDA15A22FF2E5380510E0F79ED1DE38F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jre-1.8\bin\java.exe
Size 333KB
SHA256 a36ef92f5652ad4446a0934adb9d4913e4757228b9c054524e4c52269c27efc7
MD5 8f1c3211c3c46592785a1c1aea085923
SHA1 07c0192de4616493303c96f63ce27ebe0b016dee
SHA512 e8491e8c7b700601376206acc35eb69a671df0695c2e25fc5dbda6fc5c13021c351202700c7905a49742ed712addd4db0dd12c0652897cf9c990b2926cd23b33
SSDEEP 6144:KhPs+Gs9zZyw8Tj/UfHdp+LKoYV/PvyLqxEn:KZs+Gs9zZP8ToYzcPvyuxEn
TLSH
T14074AEA5B7900CF8EC77427EC8554916E6B27C5A0B60C65F03B8362A5F733914C3EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
Size 142KB
SHA256 bcce47fa665622cbd3a7264298d966041f95589a2ba9a61249f7204d7394b314
MD5 ce7f8224018ded06ff2fb26a1ebe5569
SHA1 0f36b686aa18f8c2d727ed1312d6aa44a50a9558
SHA512 df4e0964bdea1862730e545c019c53db59c88c4fe4a36efba91f748b9237c3b7a0798b4713b78f36ba61b0b36e1069410cf7c5acf58753ab6c045fe47d2b924e
SSDEEP 3072:vU397jlXEo43udtjZqMNbWwx2nTx0c2ZeBbdr1fwm/81L1CkV:vs9vlw6vvWTx0cV31ifV
TLSH
T130E37BE1A3ED6485F5B79E72A9758D2089777CAD4EB4CE0E6284310D09773D108B8F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
Size 333KB
SHA256 ff209ef63a0fc218b1aa400ee2b556c5b79bd1bdbc2868fb86f134b43a6d056c
MD5 ab8fd11909bf203b79a8b71496aaff8c
SHA1 faf3ca8ee8ba52a057659de27d8610442816967c
SHA512 5ad6fb521b4379667868f41459aeae154ba832cdaa1ec0a9d9b03c510c46a885bca53906d7309568876795d08ba253ffbfc0ad00b086f62095fb8ea5185dfb95
SSDEEP 6144:ChlxLs9CrDH7XRRwbsog7bQ/z1YutYPDvhduy17xyTCHEE5f6Brk+ly:CzxLs9CrDH7BRwIB76z14PDvhduy11y2
TLSH
T1AF74BFA5B3605CF8DCA7423ECD658915D6B27C5A0760C65F03B8326A5F333A11C3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
Size 540KB
SHA256 d0118b1bc340415fbde61384e5c1ed02300e56ad097cd9c70c5b922c0ca3b2d9
MD5 ddadd05a6461967473babe139beb479b
SHA1 74c0b67802e0be5efd6242131319e9d789b92e10
SHA512 042ee194fad38fbe7390a159dd76a5fc0f54fe888931463182650cde149d396487eedd9376f1883258af66c3f20e19d389b24620faa3a24945e2839fc59ec619
SSDEEP 12288:28rXEAs9KgacDOw2rtgkwILbbdIvWgbcnyjADgDDEh:2qwac6rtgkwIZgQiD2
TLSH
T151C47B90F3E414E8F1B38A358D764511DA767C9A1B21DE8F02A8265A1F33BD19D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
Size 195KB
SHA256 49f963ad14e75fae175f686cb082c78474469cc76e50f7efa957e565fac26923
MD5 5c1be33e8a30e22c3be647c4fc06c8db
SHA1 4a0feea77956fae504c8c8648b4b3defb366c085
SHA512 46e27221e8befbde4f7b5724b226cf7804df8493d28001c3c89c02ff8080c836f738f004c34e5d416307eeea7351304ecedc9cfc12f0e5e13e42b11c8c398688
SSDEEP 3072:iYCHxltLOT63hU39oY5DEmd/MjgvhagI/f1OFOCJGxf5gMoEccVTyw:ihL6Ahs9z5DEmdggIn1Uny5gxEFVyw
TLSH
T129147C0033E81494F477DA7998604516EBF6BE521B61DFAF5384715A0E3ABE0EE3CE21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
Size 138KB
SHA256 b8d36baef79b83f0de63d1141453ccb155a4b792bac2ce218ecd57336c591276
MD5 e53084a561209d78b566a455cf5dfa67
SHA1 c8d5181bdb68fbb3cdb87eb272c61690c434cdc5
SHA512 f76b6be2515ec78fe9408dc2d67977ac14bf198ab95fc99f130c525c2ec905a52880af937bf3c8e945dbe8179b4e364b2c666223460ba4a28df1b9d55c2a9185
SSDEEP 1536:7P3Qb8FqvXuhi3ugGXjb28W1VLs8h8Us8h8Zs8h8ise8MJ2zfQ7I8Px40d98roQP:7/Qb8LU39M28vJEisdBzYMsxnv8rRVso
TLSH
T12AD35A4163FC0499F1B3DE75AEB481128B7BBD921A61EF6E5344410E0E7AA85DE38F31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
Size 4.3MB
SHA256 e397268e3e45f569a1ad663687284e972d22f3cfbe8260ebbf637191dbd67e83
MD5 4253bd3198411050c259e26961f9e16f
SHA1 8e1b0b6fb794da5ef38dbd88a6faa08bf43bd1c0
SHA512 838aceceff7448897f419e9d3a65dacb4b020aacc1ac08b2a4e22da371192bcf3a06744c12076a785a1d1dc0d160801a5949098c494496a7386a304b146ad6a3
SSDEEP 49152:Lj4T7wyznXFRyNjZwfDgNt6IOL3dt8qjJvdOTuA3yeutU43qO/o5Ac2tMo8NRV3K:LjWn2wfpBLXnUAltI5Ct
TLSH
T16D265B656BF880F5E1A7E178897AC6B2F7B678420D31EB4F0191C62F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeClickToRun.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
Size 4.3MB
SHA256 4fbeb505c8d8aceee510b9ee2c00e239e504b6984f53d37a006289002f2a3da7
MD5 ac51513b66afec2657f3e1a0c745cd79
SHA1 e2314d0ece8f1ba3fd4705ecefaf022daf8b12dd
SHA512 49908f8d498f787b3fb8f9f9c5bdf91998581591643bad203fa7d924ac3df3a27a578338678db2b73b4f05afaba1e26a8cd9f7862a7a25a3a19dfed2f0322f47
SSDEEP 49152:lRkAOM2XmWZmP6KZ/zZwx++MmmLhdztqLK8QNR3TeuN9ppncJRU9ak3wim8NRV3M:lR2m4IZTbLcsj9awwY5C54tm
TLSH
T117265B556BF880F5E1A7E178897AC6B2F7B678420D31EB4F0191C62F2F336904D29726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVDllSurrogate64.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe
Size 275KB
SHA256 9f983f2ea5777124133606e1b3a96a4246bd7592458a2b522d9e3ed796f1f72f
MD5 22c0634529517e8f06a643778fb0848a
SHA1 54e6514eafa0e9b3b6bfadf057f98863a02b973e
SHA512 e0dc2d847ab2f096971dc84a65f39cdab78b9c94e081e612bdfb59017d5ed9968c4476d0281acb99fe7a0e77a127e8b3203cdcbd310eb062ea19455c47d68c68
SSDEEP 6144:3997ovs9gWGNTNYdMzATVkQNUO7q5VOuN2:tx2s99GNTCWsTGQ4Pu
TLSH
T1AC544A7BDD38F8D1C27E5CB86790C700AB7171718B42238BE175C26D9D036E15EAAD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVLP.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
Size 588KB
SHA256 1eaed0cf7625fcdc33ab2277f93c126b62ea67b8894358e4f751254840a1f4da
MD5 a510974e3a6bbbf6f59ba08c67ecb2db
SHA1 8c730bf6b169706f37789868e6af1c3639772253
SHA512 29165c51cf407044957ccc280ec44ac3d7e0146421a8fea1c84235f15717780adbde7d39da9acd69d375592aa3e85b4679e9e8cd6fa39861fa9f35f8e68dc210
SSDEEP 12288:yBbgo3S3s9qcluzvNU4TEYictkogrRKoV1R:SgoCTq/cEKoXR
TLSH
T1F5D48D76EE28D8E1C27F897896928600E6717C114B61DBCBF16CD27E1E236D05E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Integrator.exe

Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
Size 6.8MB
SHA256 34aed6839aa5dda0b1f1ff56f8f9eeafa7634ed11979ae98e1ffaf91d694a071
MD5 89e9f9373f70349ea9c0f98ff13a6bab
SHA1 c3ecd26f6a8efdbfd6bd574d9237d48f46ec6a37
SHA512 6e53da7d75c9d09d68b910e358e6dd4dc7501a44578e46dc1babb208aa8472caaae772019670fee908689d20a5fc8be3ae07f3d4d2eff9d6ccdf60c3717731e8
SSDEEP 49152:L1gyWFCTTdHyIVNw+6cpnv6NaA0mmxVk0/2SBo39y9J3sq0bsfQ9zOB17/xYtuHx:LQoly8oOvT0l2FB1GWThrrmqJjeb2GU
TLSH
T14B6629596AB481EDE0AFD1748D778772F67278428E33661B0261CA1F2F33E588D19732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Mashup.Container.Loader.exe

Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe
Size 100KB
SHA256 90f938788c06bedeed0ece23131e97a3f1e8d0243f51b6feef91441d1ab947bf
MD5 e3395277e0c1c5c52b665431df197e1a
SHA1 58bba708247213f7b71781d45c4c8c3cb19a466e
SHA512 76f331be1afe54b31815de424cc149d076d52a0216eb054124e40d3cdc0ddf5ac3d524aaa5ade37fff1e4ea5cc5a32cbc109e3383b7121957c175376ff35f1fb
SSDEEP 1536:0KgwvXuhi3ugGXjw/eAMpldERVpCbLlnpy6Lps6Zjsdwr51cA:0JvU39feAcImHlnvLps6Zj4IXcA
TLSH
T12DA3BF422B5D59DBE1020BF8929ACA96E6373D900F62936BD172D30F1F673C4DD76822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IEContentService.exe

Path C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe
Size 449KB
SHA256 1d3159d89682521fca31e05c7752a06133513262a1b7a4c12ed4663f7dcbd74c
MD5 94670ad9cf7390b6b181197343737272
SHA1 8c1a17436e74affc5fd045dd01c67dd6dd775436
SHA512 bcaabe683430cb3ac4bb3df89e89ec0e53f481066defff5983ea7e90193998b393d4a86a2645cdc60f02f5ffbf3afea4543b189ffa5e8b435dce2f6641387d5d
SSDEEP 6144:idXD9HemV/Tjkauglwi1jR4e+xF7Qfs9sRoq5jfcbvnmwVFwelIZRk1:EXDb/Tjegoe+3Mfs9gRfM38U
TLSH
T14CA48D4AEB9094F5E657E138C577C671F7B2B8890A20674B46A5C76F3F33A50AD2C320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerfBoost.exe

Path C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe
Size 877KB
SHA256 1beae79e0c4db7b71aaac9ff379e2db43e5632bf3e11c3595fd0eb2014739184
MD5 55bc2c9bf242a92b625bec5db3bb63f0
SHA1 6fd4de48722fafdb995c5437cb406da74e24f23b
SHA512 4dd7686054941d942db37e0cfdd13c1a810de3624e6b433ee226c7152a262eef3735e84e87190bee5bd09b7b242ce81208f73b6376b097bcc712e3c5abfc671b
SSDEEP 12288:Qu/C8lToiJYI3ys9OJplmLLIVW2K+IqvpEeZob4UnV5BMw9dby:d/C8lToiJYIkm/FT+ZpEKdUnHBt9s
TLSH
T1E6153995ABF945E9F1B3A67499768572FAB2BC521D30D31F0160C21F1F37A808D2A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDXHelper.exe

Path C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe
Size 189KB
SHA256 09b90bd5457b623a7b563427aa81fb4df4774a905531a0385e86a738d01bb3a8
MD5 68e2c912d875a44aeb45aa1dc8d0e2f0
SHA1 a5f6fbed7a3d541b955166fdcc3e59dc42c85f62
SHA512 6d7fc8d6a4b997717a3b19c26ba94159adea408a015f13eb04f434c8237286bcf9635aeef2d0714147c62a22a3aa32a1c048bc2a8d30f42803d2bb9b3607c88d
SSDEEP 3072:8cvSClp9Nq/DPU39sq1Q2+zT6lZdAh3SJxfFrgrwHAZ2suiK:jSyXNq/DPs9srelZdGaFkrl2AK
TLSH
T1A9148D177BA1B0EEE0128278C9B59AB1F7B6F1B15C20636F5269C18E1F33381BD29715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoadfsb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe
Size 2.0MB
SHA256 900f4820ad5e4baa05d545a675d31100342e07a8c486941a01bd2c1bfd5cec5c
MD5 f532ddb914ba2946aeb661b599b62283
SHA1 d789c0e18a3526279fcdd855000ccb299f86e4f4
SHA512 cc0e91d36dd75159ffdf9e4cec60adf7f36cc90d65a4dce92017d38fe07ef2e9e8cef6efd1695a8f9c964c0a4d0b59153619e76507c43fe50b03123f020940d6
SSDEEP 49152:SO2IS/guXxt3obS/rm1pn01GFT7bhlaI6:GIg2Rl6
TLSH
T1CBA53946ABE8C5E5E2ABE2789975C9B5F6F2BC414D30974F2156C70F1F336604E28322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoasb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoasb.exe
Size 341KB
SHA256 eb7aa0d9daa28043154d37764a3b8eeef427d7a949047c93813a93b8115c4d7b
MD5 e9231d3cd63409b507241ac0b4beffc6
SHA1 ff47c752d19e7cd35a71305d698203601faf1866
SHA512 948cd9b33505b5e5a8f4db6afefa3d54794f410d7a2701e643a5721d24b4004f01786292a8ec8868363ac4af24d581c96241be7ad73c954ea2b0622d2e439704
SSDEEP 6144:gINls9H0zUGDYPRZU8A4asp2gqAVL9bhvRx9EiOwZexhOKjbyxk7G:gws9o7DYPRZ5A4aspTVL9bhvTmw4OdxN
TLSH
T13E744A577B688CE1D90791B88986C2B5FBB3F8605F21D30F6952C36F2E37161AD28B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoia.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoia.exe
Size 6.0MB
SHA256 48be26fdc1a00eb2ee47c51f5e0a328b34baa5e88687625aef7836d30a605612
MD5 98699ff1e178da60fdc216eb2a11a03a
SHA1 bc724685d6ba5ff2ffc9083b41f94d71351892ce
SHA512 e09de512112f82c7cce39dae42b401ca7df81b515ef1cea7d2d5dd9ca24da04a36bd573d0645da787d8a8048dba3ec8627b4bbaf33ef3c6a356ac0c07356b3d6
SSDEEP 49152:XNgihSivnOJbZSaGz39Q097gDRVCThZLX1TAlIjMEW7itwadK293+XQK+P5jGSUZ:XjDD/Tph5d5KZCLw21map2b
TLSH
T1CE564A55BBF982E4E1B7D134CAB286B6F6B2B8555D31A74F0551C30E1F33A909E28332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

officeappguardwin32.exe

Path C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe
Size 596KB
SHA256 0ad752f4de7398913f5a6924a77b054b7346232838c7165a281bd8ea04133956
MD5 c462325065d6a8b3099d81cbf83561fb
SHA1 cc49197ed14ee20626831a043a3ad93b3bde249a
SHA512 290d4e83af87bb70d5a61960b546c82db7a501baa5add6522210f0cca766c3331c47b2cfb3decaac6ac72ed12f01fcfc8c5e7dbd83e6c02bf2af1e32afbac4ff
SSDEEP 12288:rqerMG72gjNvtSgBmrs9TcIPr0lypFpAyu:rqeoG71XmjcAlcsyu
TLSH
T172D43941F7A881E2E166A5388A6685B0FA777C171F70D70B3559F32E2F33640AD29B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocolhandler.exe

Path C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe
Size 6.4MB
SHA256 125d84ef1357441d5c51b1a289c7c339b53fff3c32b1f3d54901627e994edc5f
MD5 a8058a1864603637f5b8fdb9a49c7bf4
SHA1 dcb16989ac61b35d5107d4f87e97ecf411f36276
SHA512 c6214c7ab30fbb3a63a6d9843d3830ef8c96c4c5ded468b6c4fccaf5c7ef7b177e42347ec190177950508573a358f8e6715da4b8629650366af2c11e9966b3b0
SSDEEP 49152:a4p1rpGQHn79A7KBl+u4j2/x011uDtsP47ir1F/2J7cXpxZ0kLaDwnFxi/ygmGCI:g8+9rBXzSwKX/uQzHjB
TLSH
T1FC666A417BF880F4E1B7E2788A3A9675FAB278425E31AB4F0151CA1F6F776508D29331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OLicenseHeartbeat.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe
Size 2.0MB
SHA256 c3ea3a1493b3b7742b7051ac9a869bff3e91bf2ae405a0dca443d383c51e9457
MD5 416f7c12f967ae9ebdd9a73f196864b5
SHA1 c45a7a670019d9f0be54abc60d9739955552afbf
SHA512 d76a50a94f98ea453438021207ff849e5ebe2632d286ca1eb87c8a75a310b9602ee5b6b9b4d7e4a550cfec0db3573d14259985a58e34fbcad4764c464f66e60a
SSDEEP 49152:13fgGOP1JslFa+uHqMghm9O3YrU98xjqrAah:LfTBh
TLSH
T1B1A527416BE881E5F5BBE7B89AB68979F9727C521C30E61F0156C60E1E33B408D39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLDumper.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe
Size 222KB
SHA256 e09593ac4969977b9800046c9347b4338b5f3398a2584ebebe1604eace1b48c8
MD5 b150bebc26598d04723c66262c013630
SHA1 f36443b8fbb7b9032362d3a8a10d6037e52ff7a2
SHA512 f1b2e7cb4baacd8ceccddc03ebcf182c5596d1933950ec587c7fc1cb1efbe195e3272d53ea1d0465a6e74fd3995a49cec8a24855c7574f27de9ea77388b25240
SSDEEP 3072:Xe9wRgycEOtQ4U39Xaj4+qrSVzN2Bmt+hln0Ft8rlVRN0inx0ciQX:X4wRrcJC4s9Xaj4dizXFOr9NNnxyQX
TLSH
T16F246B0077F91058F5B3BA759EB581126A37B8956B31E7EF4118822A2F73BD09D38723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohub32.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe
Size 2.0MB
SHA256 c9e9adf0f9784d97d4599b0a642983efcfd13467845e8cd3e56daa1728359486
MD5 551743d682075d3a895d4f21c25d2b0f
SHA1 8c5f0a798f8c272469f16e305b1aeb4493f84360
SHA512 2eecf3e282111d581a195cef9f1b4e2b41cfa8bc48c1bfcced0f91aa463fd25b2305595c49b76ab45e93ca0abc0e97d3ce0336ed7ce1920eb8ee63d81297b47e
SSDEEP 24576:ySm5iKtFwuYGgRZassTk2rDd7DM52A2NBH3NRLO+blFVwQP0yUnNGb4FgwPqe0Pk:ySm5iKt+2fb34ULOH+MYu8m1/p9ia
TLSH
T100A55985BBA484B0D526A1718AA6867CF7727882C9334F07318DDEDEBFE36604D59331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreporter.exe

Path C:\Program Files\Mozilla Firefox\crashreporter.exe
Size 3.5MB
SHA256 c890a171302465db1efafa44b464c6daaa43c1459c1b8bf138ab38f7af5a23f6
MD5 f67cc042ad791aa9bce0457da2f116f0
SHA1 fc20bfc8b4ef2e7248338ceb3eca669464b02a11
SHA512 64276b81b5e7ff956a6dec8a7e32818b02fc43f32b461bc3f4050b8d6a4efb647efc0042debd9d7c68988a584889dbf7342ca19056cb06c8558438bae542c029
SSDEEP 49152:wBFWJ6uRFltynOnO28wsz3iDT4JmeDNB05FQz/5TmXLhm6kV9GeYP0:wHQpl8n52Jg9f05FyhaLhm6+i0
TLSH
T13C061742EB611DDAC025C0B482266723B760FDBD073036F74A906735AD68EE05FF9B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox.exe

Path C:\Program Files\Mozilla Firefox\firefox.exe
Size 777KB
SHA256 505d9eaff534e6fdd1ec6ccd62327e12d95433f2009421a93608b028f1e46358
MD5 11bd4c0b507708e47c3efba6b2b7d519
SHA1 cb5ef19d4632dac990b1c706b485284edd8df0ec
SHA512 07fcde276a5a82fe5499155be3b7129046af1f1fcdb87d808c6a7fe53dfd25c246ccec100a5edd2a93187efd72783977899bdfbb3a63e2ddb2eb983aa0b07988
SSDEEP 24576:N6hfF5cd+HY35Kp4SwpemIwpelzECPnSGpa:8hfF54+HY35Kp4ZpeapelH7E
TLSH
T19305B003F38516B8E08AD5789A42D233A5723C840B5071DB1BF93F2A3E71AD56B7976C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
Size 329KB
SHA256 465e95c920498393e7125966dd8e914370d74249684989b620a177add66229fe
MD5 841a2eb5d092963272c1129ef1b4cc08
SHA1 99ede041d0424a744129ab5fae539bdbaab30954
SHA512 4b640c98af9c7a40c4df6dfe8de1e7cca4221b7b41fc6481de5cdaad2146e1a11d3b03327dec4c73cc70ac3e7a78bef9b430ac903b353ec4088461cf646dc9be
SSDEEP 6144:9Zs9wGtBAtFu5FLD2CH1HTA2lRwYd/iJPsfUrcA7y5t:rs9wGtBAtA5xKCO2lRh2czA7y5t
TLSH
T1A174AE2577E408F9ED67423CC9A18906E773B89507A0E79B03F486661F233D85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nmhproxy.exe

Path C:\Program Files\Mozilla Firefox\nmhproxy.exe
Size 654KB
SHA256 82b6dc70de8830d38227bdfb45f2d624243eeeeeeb92d6417fe7e8279e4aff92
MD5 c3b31000819bd4f224ef62abf6f31975
SHA1 ef057db53e89c371a502a36d8d4cb71a65e40514
SHA512 3e8f4385874061e41a83f456e1a56161038e2b4c323f4fa0684cf918289cd08bf4cdfb9625e353a8a7340e7b73264dacc869c77f88ab64e63a37dd9eee7d596a
SSDEEP 12288:GP3oz6K7DMM8YCrwopyVqs94xc/waheNq+cD6ptl:E3oGoDAYA/CO7J9
TLSH
T1E8E47E12FA97D46DD51EC478864B86327933B4CD0731AAFB22D8AA353D19AE12F3D704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pingsender.exe

Path C:\Program Files\Mozilla Firefox\pingsender.exe
Size 126KB
SHA256 5794a20e84ae3f43555904bcfb47b50d36a4b82a71407e9005a4da208081de70
MD5 526281d53cc8b970421425ebc35c9eca
SHA1 d8c4ba5c1b9c70604a0407f3c0681f7b52d5df3d
SHA512 00c30122e9caf7e581ea62922d1602999d4473db315b3d1461f2e38f554a95023b809b41317c76cfbccd4ed695b72394efae7cc202b0fe77ee3f41ff5ddf0221
SSDEEP 1536:yXcOyz+zj2vXuhi3ugGXjOmiiKSRn6dhSdWA7gDHFpkmBufBCD5FBnDixm4B:yXjy+jRU39BzSh2SdWAwHF2mBG+rDOm6
TLSH
T13AC3D0430B6958A6D82482B4E0F79952D3367E499F6A27DBB3A483002F557D43F7E3E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plugin-container.exe

Path C:\Program Files\Mozilla Firefox\plugin-container.exe
Size 202KB
SHA256 e2c541b76d36981c9b19032cd2924cfd0958bbfe64d72a210ed08a0f181c6918
MD5 54e20db01045c1e1d359a981dcb14622
SHA1 8ff15ec88a317609cefae48bb82fe9b8ab5da733
SHA512 5acbc2340b34c33298f7ba01de80ef91912b836a346815fec33ea33e5b4d48f1b615aef8516fb5c1609ed7d18de62d42ed859624bb25de0e3c99d9a04bf4a828
SSDEEP 3072:bykYqau/U39AbWhWmUD9OJWaPu06j7wGMT86r90kX7sWGq376n:bykYqau/s9WcWmH0EuDBle90kjGY7A
TLSH
T1EB14C023FA4810F5E489D1746F908633EBB075CA1B2167DF266956203F06BDC7E7D2A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.exe

Path C:\Program Files\Mozilla Firefox\updater.exe
Size 523KB
SHA256 daa509da64e6fd687451e5928927f0d6a338a7089fe3ce93e4f21401133342ff
MD5 c83e3f5588b3f9eb9e9dc01d54fe47b4
SHA1 b3b1046b254de58ce522ecbda9cae4405d212830
SHA512 c395664225b10c775e6f8883c5c223350426fc65250e5b390c984e1e8e8110f8873c43ac1e7818523453c531f09f900bb95b919d90bc6ab8b7e6719d9a799f5c
SSDEEP 12288:RUY/Qsks9X/KhlXuOCbMeji2ZeVGSOJAdGyMVJa:OY4sv/KhtnkdJ+RMza
TLSH
T116B4BF29F3900DF9F42BA274C9628511E673FC554760A6DB62E4D62A3F332D81A3FB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 188KB
SHA256 7b6984e2d27220ea2bbc6ec2b050aa8f6c9d518e76145a5ed31146e2f490160d
MD5 72403ee40e91c4561555236d4bc99750
SHA1 d0e650d747f53c2ca5bef10d7630f2b339c8bdab
SHA512 8d4c39332f3a6ac3de96e36664033ad12961c6cc7cb6daf8d205eb425cb329afd06797510f35972e08f80063ef7cdc3550f841b611490a25880ffe0eaaadd15e
SSDEEP 3072:hRRg1qHhU39KNzV8pQFq4XKF3QPda0obsySn+fvyz:hDg1qHhs9kzsQFqT3Q1aVbsyS+fa
TLSH
T17B146A18D29452C8D06E11B6C7564A40B3337C769BE0D3DB96D0F23E1F326D4AEE9A93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4164-0-0x000002A542460000-0x000002A542467000-memory.dmp

Download

memory/4164-7-0x000002A542490000-0x000002A542495000-memory.dmp

Download

memory/4164-4-0x000002A542490000-0x000002A542495000-memory.dmp

Download

memory/4164-1-0x00007FF6F24D0000-0x00007FF6F25DB000-memory.dmp

Download

memory/4164-2-0x000002A542490000-0x000002A542495000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads