13fc3833ec175393b62dcb495d144ac4c9d624e821fdde3770598d36e155d5a5

Analysis

max time kernel
149s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 14:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
Size 1.1MB
Sample260805-rb3fwsbd88
SHA256 13fc3833ec175393b62dcb495d144ac4c9d624e821fdde3770598d36e155d5a5
MD5 8e270e46ffab9316db289dfaccbf7fe2
SHA1 5a7e2e3dbc9ff58e1b00d04805c768c1dd41bd5e
SHA512 a52a1b91b5bae1fee04ecf3a3b8ab5431a78c9203cf800b150708adbde558caffd34eacccf42490c34acdf1431cddee42cc3da02131b4de54cdc968efd964b4f
SSDEEP 24576:zXldb691syOfSP5XfS0ptjqsNhpyONJKocSqwjrc5xaNIBgfPz4:zVk/syOfSRXfS0ptjqs/pJNoJSqwjrQj
TLSH
T187358E0A23A4419EFEA7F176D617C60BD7B1784A0376962F01A86B726F337711A1E331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\G:	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\K:	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\M:	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\O:	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\R:	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\U:	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\I:	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\L:	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\N:	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\T:	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\V:	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\W:	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\E:	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\H:	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\S:	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\A:	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\B:	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\J:	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\P:	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Q:	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\X:	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Y:	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4724	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4724	2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_8e270e46ffab9316db289dfaccbf7fe2_agent-tesla_amadey_icedid_njrat_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

64BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
Size 296KB
SHA256 a6140fc33eef42506ddda6d790c1d58b8c4662c4b0d61d808de31eb4ef32c6d7
MD5 a2af59c1e9796bf951cf1cd39444aefc
SHA1 b011b60647053ed716b3b8374cf210259884d6ae
SHA512 16d8ac5e75635f8009d8d9a5c9d3764373815ae3544c2c3622bb9f64d6d5cbca7fe9639b02c979913b3116c9093ceafdc7b526d9bf97c0cc09df91a9f548569f
SSDEEP 6144:hBx1rws9OTJeKQ3YO/xx0mucJtqQ1iUubSTJ:Px2s9b33McyHUubS1
TLSH
T166549D1A37E88CF5E467C279C9925546F7B178540B30D7CB2760422AEF23AE0AD3DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86921\java.exe
Size 333KB
SHA256 a33127897a0bb97ed913dbca6eb706728e3470218b0a0edcfdffeb1bdcf32b6a
MD5 958e7c42417ef208ec8a197794382175
SHA1 8043b3c58b9ff534e80db909b1a6968f6e01d607
SHA512 5a8f71545f33a992aa3a409e528449e8b0a953fa6a2e53dcf976d0358adf517621cfd47a843acafe013dc2c0bfb51ebb2fca33751cfda6c3a4b2a61411d09634
SSDEEP 6144:C9PKrJs9vY0nJej3PrpTh8+9NYV/Pvy7mHDjSW:C9KrJs9vYSJerHXcPvyajjd
TLSH
T17774AF95B3901CF9EC67423EC9654916D6B27C560B60C66F03A4322B5F333A11D3EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86921\javaw.exe
Size 333KB
SHA256 52edcafe99b358dca70645982393898cb351831315a66611175ac36a1b56655f
MD5 04586a30b2a163411f639bf1613ebdfa
SHA1 a481af7af3a90184a45435b78aa97cf1ff1e7085
SHA512 50e918b7418a5726a32b85a893b7a4a20b2b7df083436f9090616d9f0ea3508cc880dc8ce7d0e44029ff84c2ba1e7301febe7ede878b470946ddcb9891dd2be3
SSDEEP 6144:coYYNms9ig0So+q3tTs30iiJ1zJYutYPDvhTtpxVsQx:cwNms9ig0Sop3tAkigzJ4PDvhTtpxVsa
TLSH
T12874BEA5B3501CF8EC77413ECC658915D6B27C9A0B60C65F13A8362A5F733A10D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86921\javaws.exe
Size 540KB
SHA256 359410e105c16feb25a606f1a69dd0ac25d395dbe40bc3c1ce48df71d60e23dd
MD5 8a747e3e55271466870a45de3a084a67
SHA1 842580f050bf0f2947fca1971bb07af50c5560bc
SHA512 ce0250c6a9922b70b7d71de97852af2e1f4ace04c12301c256ec64ce9bcec0a0de3575b25591553622cd2f91a488bb4f484ea006150095b34878c935ebea9cdf
SSDEEP 12288:1QdkeRs9YHJBsWvohfLh/JLbbdIvWYdZV2v:1g7JBmhfLh/JZw92v
TLSH
T145C46C90F3E810E8F1B38A358D765511DAB67C9A1B21DE8F02A865591F337D18E39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe
Size 596KB
SHA256 2d7e85f19d4df315212a5ffc371a072ac81baae0a9abab49734ba06424b65e83
MD5 442b26960b5c9e336389ae4c1d969acf
SHA1 09e5ab3f29074906dd61418673a77398972a8d83
SHA512 be06b749a61156f041e26aa5e2dfa3e251020709e5c0f474dc6712c553eeaa2834ba00d0590698c58ed61a0ecc503ca220b8bf0b2d82821a533e20b1fcbd27a4
SSDEEP 12288:Ms9tLsYdzCspLzEvDBrNSiNp+WDiwzK+bb:dLsYdvLYtppDiObb
TLSH
T17BD4BF50F3E846E9E06BC174CA578542EA7278960F64E6DF0190927D2F37BE94F3A321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe
Size 6.7MB
SHA256 0da10ccb3c51bd1adc2f425dffe68dc7f4d86c2d3821aba06c292bd2eb5fc05f
MD5 819471ed8765cd52a00a3719027c7b43
SHA1 2721ee40032afe589e8ddc12d45a73ec4d729218
SHA512 e14c429694175dc8a93e2f3f12bdb4270ad97bf9c562a0553019d9f33b908f49d1cbccc683d92c58ffd41a6985adf2b5109ae026234dd9fbc15b534dd2cae546
SSDEEP 98304:ml8YfTaJ1+WZmB2L4HrZt1PIieK5M0uR7F5e7:m8YfTatLMIiFUpI7
TLSH
T1FF665B47E3A600A8E46ED970CF2A5521DA353C8E57B493EF129476E81A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe
Size 1.9MB
SHA256 2f41620e85ac4716cc529f52f3d81c86346b9d8a7386edb9bc0fb2d290f5d36f
MD5 9ebebd6ea0b16540800a356909573eff
SHA1 d472898114bf8d3acbb01bfcc59601bec361c959
SHA512 a2151f3f03adc8bfc31b6ff498d189318204a47d3a7dd834b7176e88906ed942d84402a99e62fa9dc061cc5e34813b667ced2c4dda46f5da910db69ae6851851
SSDEEP 24576:A8ITfU3H/ULmXkKh6iGOEvQr/L2NLb9Ld25PTOocJuJ/cIsY6WfvFzdiS5mW/huG:RIbU3fUKh6iGORzwpZeToMJseVpdUWJ5
TLSH
T136959C03F29941E9E06ED578C7469136E9B27C890B34B6DF0290B2992E77EE45F3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe
Size 1.2MB
SHA256 2dd4000bdfe3238d146415408d8c66113a210abe6ce99e1bf477f83cfa562101
MD5 146a663a23839fcd898fad22b0f1bc97
SHA1 caeaac427c9f25b76b32cd77c16d8a19a0a6abd8
SHA512 d30829f0c0ea53c525db0b398b592bd4b3f9f4be4b13c21f70f01dde217d5c2ff56b00d77b2f18ceeeabf57b65ab6393b2126c49464e0cd294f32b31064839e2
SSDEEP 24576:BdD8Y7z37vEaXF2TQwHMj2oMP/qXF90IVprSucGwjjQ/:Bdwiz37vvTwsio6C1zpGucGw0
TLSH
T15345BF07B2D941E9D069D4B8CA668132EAB27C460B74A6DF06D0F2591F7BEE85F3D310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe
Size 3.9MB
SHA256 a7ca9e9e2c786d2f1ab5951b25bacadb49bf92e99c7482ac1465c3bdbbeffa6e
MD5 038516d12b3efd676dee5b53a9e4064b
SHA1 8d3e394d9233dc1bcb2f68831bad13bfeef9a572
SHA512 52a183e2071a0150935278a267d2b396ec6bd99c2b4fc1f50509ed3814737ebfbe45c183a028c0615d1b7133d431fd027ed4b61dcd0100c49ddaf5b645c99344
SSDEEP 49152:80lyvE/kAvIIfS+YbSxRmQ/rZu0GD0AGRuVEusJ6LNzOeL0GKVIeCjIp26If2y/3:jV1KSRuVlcm7fwKAJXHw
TLSH
T190165903F29940D8D059C074CE5A8132EB627C8D47F562EF3694B6EA2A73AD47B3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe
Size 1.2MB
SHA256 95e7b0c02cbbd78d9c61951e928077ea012f5bd4cb2cb134db46f48bc024f63e
MD5 961780030075d9f871f8bffa8de06a6e
SHA1 4fdddc334901bdc36e833283916039b188ededcc
SHA512 f87e0c2b881010508c25f4acad9a814095b1f7b46dcaa06845d9c951f44cd8e8f8f4b364af90df3c3f5b18d7b8caa9419885765b68fd64f805d7199f9650ffba
SSDEEP 24576:9Ue278iUFU5X9qHmZ8xIeItbrz8oL08mqEb9erBbH:9Uee8hF9Ha8irx/8SNTyerFH
TLSH
T1B745AE07B7D941E9D02ED5B4CA568532EAB27C820B24AAEF06D0B3591F37EE45F39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 1.6MB
SHA256 6c40eb902453a41d1dab74759c5ebcf3b2fc7f19663b285aa5bbc52da8ba9d91
MD5 9ea2b90b86de4b7bb69cd34f22946fa0
SHA1 e83f73d7469c4bc89607e0050c65b1e262604ece
SHA512 fa8e9d1af4d09511d43b2e685496ca1c7f795d9c3243f25a3230af7108b2290a93f324d634711e45b373b26494e92c4b77141b7b6cb336906d1d7c45d7f9c3f4
SSDEEP 24576:wiTkAxqGHXlw0/CX0Y7WMY2RDT3usuJN2rld6lkkkkkkkl0T3gAQCS0//X0EJ:SAx3HXm0YWB2duv4Z8PQCS0//EEJ
TLSH
T150759C03F68A81E5D09DC2B8CE764B31AA717C655F2096EF0190BA253EB7AD44B3D3D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe
Size 3.4MB
SHA256 609e14da589a0c0504214b0b16233a911974976949d2a0aabdb1793b3097d6ab
MD5 b4789fb5947f664a897342ea179ecfd0
SHA1 4797f509849f48481175105e89d7680967b5fd57
SHA512 88ca15ec3704457e34e3aa7ef8457e8c3d4b04f8836100827a796556531b4000981ed1cf0445203f8b31fff2b11ebda4478cf476075407bf6053e1af62c2cea6
SSDEEP 49152:mSth5nDMAi3b64hqfPjxUFl9sRXInUqMzADoulO7Udq+KqOuBk7bVnU7wF62JtYS:WpHuwoul1EE4ws18BC
TLSH
T169F55903E29900D9D199C078CE5A8632EB627C8D47F562EF3290B6D52E77EE47B39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 1.4MB
SHA256 0789802c78f343def0d8d50e5d9743ba1ba9b343249981ce65a916859ab0d68e
MD5 fd2c8ac69157027d4100c23ca4aaf802
SHA1 ab6ce1a7425d6ac7b0074eea179568008d8e9869
SHA512 9eab75f84605b4671d4e94f2d0273f3457fe177f52b1cb639533a79bf9d5570336257b78bce3eed7f1ba3205bf1f0de31c9751e3d9d0f26b05e9791fa392fc79
SSDEEP 24576:7EI1c3JG5UjNaX+cU/eMvu+IQ5XQbALzOe1qRAEW/ie:IIUGKjNgMWpQXQbSzOSEW/v
TLSH
T16F65AE03B2D941E8E06DD578CB564536EAB27C820B34A6DF0698B2592E37FE45F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe
Size 1.2MB
SHA256 4947265e9443a12ae5151313e117508eb241f2d9d98cdcc2b5d65fd4da9676cf
MD5 0119cd9702734ed0ef6aa11d1217c796
SHA1 bbba6e40358bc6ddec587755f962d7ff8c9c625d
SHA512 4bce4cc083662ee1bbf7c4b45d8abf2d76e38d24173e37bc8e95c285b9fb1119dd6b61b05625277a7c644a2afd98ae5b37c9782beb3ee1f9394efca73c6154ff
SSDEEP 24576:G7aep9u1OooDXalkcd/eV7Y6VofKHHUYTf:QaAI1Oohks/eV86VocHUE
TLSH
T1EB45AE1BF79840E9D06AD574CA568532EAB27C430B24A6EF06D0B2592F37EE45F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 248KB
SHA256 87513cdf7cc1c2a088cc9c1cdb1666265b6bf0c6cf2ecaec1de058a4ce797c0f
MD5 014a0a282193c541c31472d5a5b6339c
SHA1 c96b0342531cd5e34796bcc719e9d4b37168e4d9
SHA512 a6dbf47db93f4efee6303b85c08468a414160d485d1fe47f41846053994c7d23a5a8a8be27a5758da190d198de219e8a66a75a07b7899c7ef82bc25411cacc34
SSDEEP 3072:rU39hyXQTsbMH3WhWgnbWakw1MIKuR9CbOwWoY46TW8sgyhNCOV8qeNoHb90DN3v:rs9h3IQH3WhPbzklIR/Cuoh0mgocr
TLSH
T1B5447C6536F820EBD036C1B4CFD49503F735B8B657208D7F4380826A9E62651ADEBE39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 265KB
SHA256 6d8aab67395bae1540860df6deb2f854b1cf23d1cdc98ef63b345e97e60a7f94
MD5 0855f6a49958c72c1eda04b0b76f9423
SHA1 b163133b189b0eaec0882acb0dc6590266fe9470
SHA512 82f9e88ef3db451fa171a7a07ed2ffac3cad6f07df07f0fd436e5e84987d83d69f12a8a936ed66f8fadea06afb97ca635c89c44e5583c4a8e466068466880dc5
SSDEEP 6144:Ms9o1qS1rarpBXzyl/YWoht+uoZNc5txTW:Ms9o1q57a/Ho375TTW
TLSH
T137444B6A29F810F3D176C5F48BD09913F274F8B263108DBB4291435A9E23A916D7BE3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 610KB
SHA256 b7e44785c3b5d8f3f6835185c2e40b924df784ce04d13058f9641611f7824d5b
MD5 528c03748c75c26daf5f3b3e7a3c4d51
SHA1 03d29e0c190315d82fcf13d750e4e31713e92582
SHA512 82561165b089608fccebb07566b2b14e23e1829b71505842eae21d2fe14dd3a4f5a74fdd67b52d0968ef7b025af2ac272e5b2e36b550232ca2dca73656d59e9b
SSDEEP 12288:ws9XewBRPeqocHVlorSzJ39qL+15rRsf1oakV2zoY:7ewBhWL439qq3Rsf1oaKgoY
TLSH
T133D4AE41F3D847E9E06AC134CA528646EA717C960B61FADF02E0527A2F37AE55F3E314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
Size 7.2MB
SHA256 61b5d3129e4045207d76330cd8c4e9f6251f6ffc4e38b1a0363570fb06eaac78
MD5 7ca2d6f533233a81c61a3cb4644b0a03
SHA1 57305de915462e6176f36fde8704096db3db5773
SHA512 a4bd1b4112c29b4ad91563af376f081581a8b1e34aed203475ec5c745b0bede30bd428e3cb5369d8f7eb3b25107c871f3ea7aba40fcc9aa84abf3c586d014a1f
SSDEEP 98304:Z6CZetahq+WZzfbVwCsJB2++fGNOxRj2vJzRN+T6frkm:kCZeta2ZGIGUxVqzRdDB
TLSH
T1D0766C07E3E600A8E46ED974CF2A9521DA353C8E47B492EF169476E41A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe
Size 3.9MB
SHA256 e1509502d2ec148b06fb8d17d5b9b1ad0226208761fbbb0e5993ff9783ebb755
MD5 fba17b6432ed81696bf13f5e3aa934f3
SHA1 fab8a18a3fdfb9140f7ba328d747231a102a3eb2
SHA512 32b20904165b2f4733d46c56efde04a80d4f14c420b28abc07fa9f3baadde7e4e50c5f3fef1ffa0fdc17e6f9a2da5ef2ad088abaa2d7bf15fbe48e47d0be11b3
SSDEEP 49152:Eu/ei9H5Zi2Odh0e6bmhLbKqm006NPpIupErVu+e6NqcXToRzvUqIzYHBigdQBvM:B9fDuSe0mCC2NUhIUBbcM
TLSH
T1AC165A03F29900E8E05DD5B8C7568522EAB2BC850B35B2DF0650B7562E7BEE4AF3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.3MB
SHA256 b2532142f26cf9a4e0a19adbface9da5a74b165869f5f98fc85332c10af0a4eb
MD5 3e711f5a642033de6d7bbc72af1b232f
SHA1 3047419e70e2b0fa29f592cb653c4265a00ca023
SHA512 7c89ee463fc834c399b85fe343f617544dde35563c7a7a88242f36350f0a57e97296b23d319c4c0709dd8afac541ec44692cdd7301b1863d0ed147a514ac999b
SSDEEP 49152:VBEJVHohCVKgcQMbE6MstBhuXjfS4LWxnuwB:0VI57gjBny
TLSH
T10CB57C03F2D900E8E06AD578D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 1.6MB
SHA256 9ee3e1dc55fa2eaefc62e5f649fdbf38c0b8ee1ceaec7fc5661aba976df17a74
MD5 8dca8f6d15c717af04032c759d0cab3b
SHA1 b1b695db9d1e0c004a360495858d831fb2a2fd9b
SHA512 c649ed97c8f74232c6e238ff94a5a859c7a718a2d03f07e21fa9e3ab7f0ab9913b7e3adcf3b7ecfa48ccbf2eb0a97455e74c50ba431f937acc8a9b9df569ba6d
SSDEEP 49152:Zx+3dhABTjkU3/ca3Rdrf8oTlXrk9dB8Re:vYYbUoO4e
TLSH
T144759D03F39900E9E05DD1B8C7568936EAB27C450B24A6EF0A90B6552F3BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.0MB
SHA256 0659e9e265096605b32fb7d14884bae8ffdfd3e304ef52cdf83275018989b33f
MD5 1333732521df620c0f99e2fe21e2fc82
SHA1 6eff3d81bf586adbf35e7b8f9a44ef6962a7f837
SHA512 763ab710d9d06e72d7a83bed160249210f06ac32ed331f31d315a8477e46e982ca2f2f22c4144e9c7651999eb4e936051e198ce5c5b5c3de63550bdbd7807008
SSDEEP 24576:c4tMoe6+8xTw3TYmu89jfUkXH2xqs7CtW7KSdHBxmRkkkkkkklQXBysWARIHS0iV:cJoeYxQr9jfUkX24ZrSdHBAVfOHS0y
TLSH
T1B0958D03F69980E5E05DC2B8CB768B39EA717C554F20A6DF0680BA652E77ED04B3D394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 3.5MB
SHA256 f6f8f9523b6992413e684c511f7b4030a23f1b3c2f21bed5957b5dc0528056a7
MD5 cdb3d5c9178e6d63dfb20b83ff03b7a3
SHA1 a95711019b74f0fa9b69f62aab5d2345bf027494
SHA512 d2d4e8892d052b75baff852217e8d872b07d007958913d11d782f084cd1e582ebcd65642562aafd4d46bf7298583d65767402bc9adac45b4e192cf3fb6af22f3
SSDEEP 49152:6uK8v1bB0OnC1kvKMsHSNSxOb6YErEz4AkOuaRoBISCaQZCLlrrgH:9tWMHpsOnZR
TLSH
T1E2064903A29900D8D059D078CF4A9223EBA27C8D47F566EF3690B6D52A77EE47B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe
Size 1.7MB
SHA256 07536adc93d3c023231dbf12ee14ccc1913bb8bee03c457ec5dd1f9474facd94
MD5 737d562e8fab053b4734069de249be7d
SHA1 3ead0b7bc8c41beb9b0b84817cbe0fa3b14ffb36
SHA512 b78d8cc426e3aa96c5d6277de0556f3690dd17ec042642a505287621ac34c635f81be17886694ef3a3481825b2fd17e432ffa1d86562eaedfa32b3863ee2471c
SSDEEP 24576:YRQ/mJ6WiXuUJ3jCu/HR0wgPc8vMYb9UeQuJXlPnyF4mfHU9YawsNa+tCsdg2I:2JTGJx0wg08vMWaeHX04mfHIa+Urn
TLSH
T153858B03F2D801E8E06DD2B8C7569136EAB27C450B34A6DF0691B65A1F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Size 4.1MB
SHA256 b5bd2ee551ee065214abf7163d11b13509d0edd59d41dc2d7aee1af15c7471e2
MD5 73c9579f01191a31b785611ca914d714
SHA1 b2afdca93ec41f64e2f8a7ffb01a2a6a87cf9846
SHA512 e6b68efae2c7be62fd9d776985ab79ad1d510f8d3125e801527a796595873623b209c668cd9674a2bfb98d8a80ce8a5b6b2a5ebf61c6b90cbba20ca74395aac4
SSDEEP 49152:DuhipXFx61kkS1LZ+nFXPyr2xT+TjEfzExldDwUIDtaZHWRdpev2y/Ba55W:tXF9z6y8Id+RaA5g
TLSH
T1D3165903B29940D8D049D074CE5AD233AB617C8947F162EF3690B7EA2A73AD47B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
Size 1.6MB
SHA256 a0f31dcba3c8f620de26999066531fd44b72366ab356b913768df759d1c0907c
MD5 7ecb772b13a5668d5e4b6ae571865bae
SHA1 655453b284deb9ef70814f31b2867ee833797548
SHA512 9ce9716bf73fba22930ece20a36eb0cf6e4cd01d879088088a4016fe38f9e2e2f70cfddab69bc329aecd58b62ce9ef731d2b6934e48d4a3378d57c3f53ea3be6
SSDEEP 24576:zdxD4XE6cJH3NUoP75UuVpqfJq6xOXkWVL1oaedpEukUoygGmq/SNi8f:zb4XEp93OUDpqf46sX9VBo7EukU1Cf
TLSH
T1E7759D03F3D840E8E06AD1B8C7568536E9B27C450B24A6EF0A90B6552E7BFE45F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 1.5MB
SHA256 9009b71a5c1644762280e9ccaef96a2c90d5e9f16891a1762446fc53b24c4cea
MD5 c9a7e2afe3c47263f8b344e4e634aaf7
SHA1 abef8e761aa08d6d88948dfc5bfb2630231e5b4e
SHA512 3d36582d82dfc2ce0246ce4453fef8bfcacf744dd472c1249847d705a5067488d932471423181245ddeeaefb76ea5caa310dea6389e07af07fb7203b8f75c353
SSDEEP 24576:JKHzR6fBpKZhh/6I7uQiiyeTnkNQpGsVa4i6h27d3WlHEzM1:wzRkrKRC4iiyeTnyyn+6h27d0p
TLSH
T188759D03F79900E8E05DD1B8CB56893AE9B27C450B24A6EF0B90B6552F77EE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 329KB
SHA256 00dfeb8f6af32a305a7ae13e6e57e7e6093c89cf758ad2ce2321a7f01e10b5f6
MD5 3b224e032d9cf5baadc6fb2764428e4d
SHA1 e9194cbb443b8396640fc73f6c4a7a8eb1926425
SHA512 7bc56b66a5407bf9735d5c23585c94348df35650ed8c62d998a75188c2b587af5dd83c5d97a40bd393be1f050f50d0eb0b8acb783cbb4956bd9147ee48821d7a
SSDEEP 6144:KKs93WqgQVRy5glxxKZ1DVy2lRi6N/iJPsfUrcAEDrYMA2:3s93WqgQVQ5qPKI2lRJ2czAEDcMR
TLSH
T1FD74AF2573D408F9EC67827DCCA28412EB73785547A0E79B03E486691F237D85E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 672KB
SHA256 7cffb8cf5f50e6869c69b697c83714d8d0067a58513cd9e9386488d877e3dc4e
MD5 4c717c423c2f05679449b22c61115f29
SHA1 ba8911c520ea1a635da49e9c4701fc84118831a2
SHA512 420991d886ff4dcd0e0a8fa774f000a2ee03428f2daa8b3dc38e5d24d67d70221c9246b166748564c6def7404bdcb0a839093b751315dc2e22ce24c2ad2504c1
SSDEEP 12288:uvH4iVsymUov0QYu6JpLGs9KrHskhakemSs:ghsyVov0hLUrMkhak1Ss
TLSH
T112E43A26F6748735D073C0B9C5D2A69EE97130861B308ACB4286D77C3E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.1MB
SHA256 21f7cfc3a9148dd8f0ad8c872ed4eac6c77fd6557fb4fe7b5c4416b6aadc481c
MD5 6ca74d2ce619a870dbad647b21522e36
SHA1 efddb28688b3d407e52a4c68a47dbbad4e7341e3
SHA512 196deba8e99ff38b1b8462cec2b1bf6800036ab02a160edafcc5ce7f0d2dee29c40abf37a95d22b2d59a93c627de09aa5c644a9d9fc66cdbb6a13aa0301de38b
SSDEEP 24576:OvLVezSChvg2mXlZgrvWe6q8wyuo4aAWDR:8VezSChvghwvDHjyFFDR
TLSH
T1A9350925F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 840KB
SHA256 3b832a845d8618c0899c5ca5dc10e8bddc73f8c5f2bff59e82cf17966b8323f2
MD5 7f6eb3c79539e6d1fe8e9468d6121c3a
SHA1 8864e1317711d0cab977158b0607337b55eab4bb
SHA512 b3ff003686ea555bb9d12d74410b89271c51773fc4c14d2318e3584c5be75ccdee1a0e00d14b7bd83100dc2132ab8612eac466772f2e8d4147d46d81fde151f6
SSDEEP 12288:vmP9BVO3vFR01IN+yJgKwsE6FWfggs9Nf0Im98mqAE9GPd/gC:vmTViFW1vXfgjVAE9GFgC
TLSH
T1B7055C66F6B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 350KB
SHA256 78d6578bf37bce41a957f3eac77cf03051ed94d1b2f1c0aaa301f8d784b8a054
MD5 1426c799fbc9820999b22b54f40e0859
SHA1 d08f86d8f035b42993ad0da6ab3644175e0f1250
SHA512 5a2ee5a789d1ec08b6f6868961aaa63a152f971aaca5c6f4c8f69cb1f37056ced721dedd3c308c3a7c85687504e3a4f7c084ccff408691262c75f2d6f62bf5c8
SSDEEP 6144:OxO9s9mBJ/GKWWBNU6ITLBi0qttclOKgU91BAs2qMDYEIu6rOCe:Fs9zeBNUbTVO86ULMDYEIVrs
TLSH
T1B774293BEE28FCD2C27E8DB85691C600A77278704F52A3CBD165820EDE235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.3MB
SHA256 8395c1035107a8dcc40cbbd190d91b0857ceea5d7f8ce6dbb4765244e3cb3fe4
MD5 8e0c38f87d06c2258461e39953815368
SHA1 193e8ab99edcac23a65cebe20320008ca43ef1df
SHA512 649484740ca5a8ab64e937f3c088fc7d03eaa97aeba86a0007bfa9c3e93ad15f778962f9982102e577864f5847fff6ce7fe62c27ad4a6a30417fdedd060ab811
SSDEEP 49152:XU5d8tQ8vZOJUFrgbkPSBEK/NLddTvEgoCJVQ3NeuyT5hiphNX4VYXUrA8NRV3T0:XUYvXSkAFL8E64KUD5C7
TLSH
T126265C556BF880F5E0A7E178897AC6B2F7B678420D31EB4F0191C62F2F336905D29726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.3MB
SHA256 d292817fa1dbfbb9ed2e538506731f003a06540c461064775ca607a16b232d54
MD5 2be5f4b598d86e80bfe624b07cc36e25
SHA1 ce33394c30250483a02c095fa1122b5da9eda841
SHA512 a6085ed68b9779b9b8b4b7b02ca268832c0a53ce1f4b7f4b93a658fd3e035250e21abf5406fb6e2f25f5295bbd63ed3917c650cfcb97db60d2c370b317a9af17
SSDEEP 24576:iJaDsqOd42z+L5WqbrHCYRFiV+XenmE3Pnzc344fG7NRcj:iJaDsqOd42yL5zbfFiV+XenmE3/zhs
TLSH
T198B56C1976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.2MB
SHA256 7a89fb1883ac4733c74d2d95ab52f7d9376f11218c27bac83feb4addbdbc857f
MD5 cdd46831cca7c8aae6672cf1a26776cc
SHA1 20972b5a5f79e090237924a7e7d8aaee0aff0a85
SHA512 1b32e8afeacfc25551e48f4f0fc2657fb297633a913b9bc9c62ef73557e2024201092df80577811b749b120c59174dfc4886c9cf8fdb59c293b93b98242aa378
SSDEEP 49152:Sj8D28J+gnBKp3DJf5SUYLoDpgLjSTYlQcGezAaLSF259ruMHwpXMi4FqJLd23UG:chRQyi36YOcP7Lvw2gAf+PN3RQ
TLSH
T100666B03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 9255183dab8c82c17f69171ce3dee459cc417a5eff3d1759b21aceade54ac2c5
MD5 d6984fb39a22e190590389c8217629fa
SHA1 2a5406d9020a7e8735ceae1a7b7075b2ebc7fe57
SHA512 a628c9beccc5191aad21ece816c3192fe902dfcffe808ea8b840d1a3fb82bff7a8608e732ac80bda2b7ebaaa0f2b45cc00124d4c158cb7b52820dd5547121372
SSDEEP 24576:PjviSnp5dQhrM57DboSMLZTe7DaHGTNHu7PNU3/5W/ohL02WVOgXJO:O2p/QtWKZSeWu7PNU3/AVpX4
TLSH
T1EA951733B2F600A9C44DE1769F4A973196E27C718FE0D3DB811572161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 3.6MB
SHA256 4b5fe8a3c33135d45866d2bdff1cd4efaa6a2c312a244ba3f1aac62770cca5a8
MD5 0def0f0a7a7febcd19a9cfc915fb7340
SHA1 1a1826fef5af1a0617fbf874bdd1909afcba9e93
SHA512 388fb9043d89265a2799b86490f71e80fa4fec9e4c678a676135a971d0b12d97287f35a46ba2b1d56776434da1fb3a3b24f78e9bf7bdbf4e57c6bdaa5baa7213
SSDEEP 49152:9Wf+b0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99N:8y5112gYy5azzVvC69nLKnhZqQg
TLSH
T124067B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.4MB
SHA256 037223c1f1b987d4fad05a0ac061719934c748f17c5b9c6fc775bff09ec04302
MD5 39a39de65954dd9738588499f04faea9
SHA1 c43d308782747fc3fa7c232d8afd3fba8b7406ba
SHA512 7757d40750f4ce6b18aaf986d082942c2c6311ad637fe3337d50fb2e71fcba8af27b6fb1eef526ba8ad44a6f8e17defb3ec5859436b89fa385bbaf5df3e5ad83
SSDEEP 49152:5sTKLYZysVu+OBr4tEGq0bqx0z+n217aau1gle1HdXA:js4Jmkxd2dehVA
TLSH
T113C58C13F1D901E8D06ED578974A9233FA62BC490B34B6EF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 1.8MB
SHA256 3c64214c3e089f0b742c5c4367231a2f707fd9c54434a711a6e673b050513dcf
MD5 d90530403fbe82b05072647e32a305c3
SHA1 db317497e0e4276cf3575d673841ecf88f0fc347
SHA512 a7a1c5e9f0c3bd9edff9b5675c0294b8b14a3eeb27164dfa4267c1fd22fecde47d688e4b97a29806406a25b1ea986e9809b79b31cbaa50901842bd0264690578
SSDEEP 24576:HBvsW7Mamcv+otWZzqNiuCMLiuAuFUQ1zNOgLLwH7ReaQXx3g0yO:6+Mamc2oUSiuAuU44CwH7R4xw0yO
TLSH
T1EA859D13F2D900E8D05ED17887569632EA72BC450B24A6DF0A90B6961F7BFE46F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.0MB
SHA256 908f592ba295e773951682642b1474bfc12950adf04ba7c3824dd5bb7588192d
MD5 4acd2661fe5c6ce5ebec958314797530
SHA1 7c2fa221f1b332bd40085354edcd88e99c6a532e
SHA512 987fb48cbadbe49da376e260e9e4bcd7e0874835291be6bcc6545906494e8bede134b3ec923957b4431b37fb24728a1e5a0b641d6a69fcb938d55ac44d4b5385
SSDEEP 24576:teGvPfC4DZpQribZAViZPa/MAvHWxiR04FxGgVG2Onks6xt4bSMHnqggU9fSc7:7VDnQmSoAv2ERVtOnks6NMHq5efV
TLSH
T181A59E03F2E940E8F0BED67487669236EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.2MB
SHA256 f15a51a3f57a73c474f1f48615d8cf8f9166a7f3d5595bbe5e6d082b493ad51b
MD5 d60a9c044c30a3902cef364aa387839e
SHA1 6d9c10cde13a745560c861c4ce480e4c5645246e
SHA512 e4b39db0f3e49511084cdb4a9cc659ab69a0d3be065850547c4021a585b90cbf4879b30b15193be5faf345afa128055eebc5e18a0f2b754ddccc28c7b24ba8d7
SSDEEP 49152:mhNFxylUIm3YjLAE3dGGj8b/EGcjesaNkYQd0XNJKcvaAcPTY6Y5A9:pO2vjiBDlZG
TLSH
T180F59D13F2D940D9D059D078874A9232EA72BC494B3166DF0690BB562F7BFE06B3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 0b3f9f38070b7ad51281d463b9bb7875be33148d14ee45c9d1aec7c83653d1da
MD5 05799ca46e35b3ef0df47ddc2b32e617
SHA1 7cfd5e9ae9cecfd1fec0dad11b6269623c33942a
SHA512 06980c70f1454b7a40ec99c0709cda0765c2119447f2b7e1b9400f6237a235d4e27dbca24c81c69e2b527689d237d07dd987a81b4d86d69de037750b6f89c8b7
SSDEEP 24576:fiVvUoqG1sEKEnyYfyUggV1d8/i3iy9CTn0AP5+2QLeGaC:f6qIsEKq3V1m/giDn0AP5wiGaC
TLSH
T1D975AE13F2D941E8D05ED174C7468632E972BC150B38A6EF0A90B6562E7BBE45F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 333KB
SHA256 76ec6fca7b0ee53b001184382cd46f8ac26201ade0092b215d554d1f43dc0e9a
MD5 9005b71a15971ee06e9e27dd9322ab59
SHA1 89f0499ad6957db24b6df93bdfe56aa53077f27a
SHA512 cfd977af95ef254b2e32ec649e01190bf150678e17701f5a1b89d79b2c5372153dcce2ee52a4ccb71c4c079af42d9105deeb9aed088b1ed416bb1ad0f8425524
SSDEEP 6144:jgPZb3s9TSfYYJjYwd4cf0GIPYV/PvyW1TrfFHKsuoO:j8Zb3s9TSQYJVfOcPvyW1T5HKsuoO
TLSH
T14974BFA5B3901CF8EC67827ECD558906D6B27C5A07A0C65F03E4362A5F333911D3EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 333KB
SHA256 755ab77e7888a479101845b149ca922f2151ce319ac945f2dcc3c67518747959
MD5 d34b2dc5a00b93a3790ebf1428f18e96
SHA1 7f0ebadafa03b01fab15b13fd6aac06b6ad39e32
SHA512 0ae948b5698d5c6561e9d865a25e012bfdaa68f77b241c9bd668d6c4c29db332d8bea0a2f2c6b4a09ecb44f7d0b89eec040d3ac4824925d2977160a2d5306287
SSDEEP 6144:FO1Rjs9AJlEkjbrEnsvTTFfGz4YutYPDvh49Gt8VCXhoGBf8i:FCRjs9AJlEkHrEsLTAz44PDvh49Gt/3
TLSH
T12074C0A5B3901CF8EC67813ECC655945C6B2BC5A0BB0C65F03A436665F333911D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 540KB
SHA256 46e8cfb9e7a707a81e46f3f87e7aa60551ad9dc75e441316e70f6dbd721bdc35
MD5 e23225a5114e01e4b0e630c87b51d692
SHA1 d51facca79dfed308fa2de75c14c1764c47c468e
SHA512 6534254ae303137b449126d8726e7148f20b2f4da74dd0ee4624a30dd26b59832f40ca9d81abf1831cdf2056a8868e932e0b9798ece5579cefe8b290b50f55f7
SSDEEP 6144:coYvyc2AWs9KTWEr65LTtANW5UHpvcnT9MuhjPLbpqmHdIvNXfBts:co6F3Ws9WHr65ftANL4dhDLbbdIve
TLSH
T14CC46B90F7E415E4F1B39A358D768511CABA7C5A1B31CE8F02A8661A1F336D18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
Size 333KB
SHA256 2972c04621fa75b5ca1681c49c5f61acc04fe62c59c7e24f8fcb4053b93be3ee
MD5 5b666d1d5423754c6a16dbb53e665066
SHA1 10358aed520e180f585a3fa1c78c7014b94b8e27
SHA512 a3fbafb63c5218ac7e442aee19462013604397bcd8ac79efb715e81621d07a48de8ffa057ce7a6cc5b4e4089dc055a644c48bfabc79e98c956a0bec1f02726c8
SSDEEP 6144:C4PpEws9XzH1I1j1kd82qHRLXYV/Pvy+E2ak:CkpEws9XzVI15xjcPvy+D
TLSH
T12674AEA9B3A01CF9EC67413EC8259915D6B27C560760C65F13B8362B5F333A10D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
Size 142KB
SHA256 23f8ad751e208177e5871e165814f52c04faec5bea21a768d1e14f28fd9cabad
MD5 8c19ac30b1490cbc8ed0d25ea0431af3
SHA1 0bcaaa81649d8ea55db50f2788d6214e7860d784
SHA512 eb26b334e0facd51f067ec81d1ba70d9d82b75264448b7106be9fdd0e1e3e2ced32413abbe8c4dfefde4f6099acfc40636229d90d090f3cd3e81d4f192f5ba02
SSDEEP 3072:IU39LjlXEo43udtjZqMNbjuxH1pLGjk69u:Is9flw6vvE/LG4Mu
TLSH
T18AE37DA1E3EC6884F6778A729875883258B77DDE49B1CD0D5298310E0A737E1847DF3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
Size 333KB
SHA256 9bc5c00e89bc185b82aeacf5fe0884e2e962631a5351fb4cac99d14c3dc2eec0
MD5 38647c32f87840fd4d4a46eb1c272747
SHA1 434769786882773ab5b32e61eb0db4959233fda5
SHA512 55fd0009d2f745d45a24e30e8e1bfb117bafce9272ffbbf36687044e82d3dca60eda3eba1bda7c2be7a91ee03bec78933c9ab1fd49281232c8776c3658add066
SSDEEP 6144:jVv5ss9TR8c9yqEBc2sWPI/2NhzDYutYPDvhfyuZL4E:jJ5ss9TR8c9yPBcPoIYzD4PDvhoE
TLSH
T16374BFA4B3A01CF4EC67813DCC664916C6B27C5A0760C65F03B8366A5F733915D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
Size 540KB
SHA256 c8f53ac3ddf14697ae4bd9cfa1d02ae1b17efef0c9d689d73defee68422015fd
MD5 035ebfb125792543cdc1cddbf8f588c6
SHA1 e0373e2f20f72f44ff94468f88acaa9512aefbbb
SHA512 3da25dbcc597d1d9010d54b2afaa60361c30e03f9900aa38a7060919f59d96796c609f6a5a1ac2269b46126e9dd3635358f8035d2f777b8fc3444ad917500f4d
SSDEEP 12288:Eo02Q5s9/C6qz8Pa2q7HVtLbbdIvS3XjZlKfFeZP:EFv6qB2q7HVtZnXjZleFi
TLSH
T1E9C46B90F3E414E8F0B79A35C9764511CAB67C9A1B61DE8F02A8625A1F337D18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
Size 195KB
SHA256 2ec8a1bb7819d47cc007414346a390c16a45ce3c3bd26c26da06f08b92923ba4
MD5 c9b16a5722f01df0a4e1456180a703fb
SHA1 c074192c154d548767f0e01eb68c6fc6a09d81be
SHA512 aff1ba2558bec50672a35796c7a3858530dd4d091e4e81d062675a4ae9b6b6e2945bbf35175a04a97d1107d683bb9cc56adeb18ebea7a3df9ad4459baf2551fe
SSDEEP 3072:ANz/xbtkJHhaFU394Y5DEmd/MjgvhagI/f1OFOPqx85hR4Rdzx9v:A1kVMFs9D5DEmdggIn1UqfR0dzxZ
TLSH
T15D149D0233E801D4F877DA7A99A18501E6B77D521B61DF9F5390312A0E367E1AE3CF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
Size 138KB
SHA256 746be902038a59d2620672128e5b2b0cf3ae215fb327f3c479c1b064ac290422
MD5 62c781c46e6f693a0053318f51ab14d9
SHA1 d64b9f4457088ecc5c9fa60395e11ca542087aa9
SHA512 8010b64ba73459ea4e2a587d131aa003e9ed8def30d3009429cae3acb9393ab498222e2fa97e58ab4b6fb70e37d4fb41535637d38c88fd2118fac84e2f0b5da7
SSDEEP 3072:onQb8lU39828vJEisdBziuxZiiRbJa59Vml2jEFs:MQYls958qdBnbrFs
TLSH
T118D38DA027F80498F1738F36A9B485198B76BDA15D11EF5EA3A0414B5F76AD0CE38F31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jre-1.8\bin\java.exe
Size 333KB
SHA256 902a02ef249fd73f90174ca66537d054c79bd9cb5f4f4c8eb9e4febcb6ec7175
MD5 1a85e4f3fb34e47a4942ce033cc5016d
SHA1 324d008fbd927189b8afdef17d28697f3fe32e97
SHA512 c70b8fd7b112cb1d80a2be07c64fecbf4687109615ea89fd49c76e239a85c32d4b8d27c4a481c17969379e3bcdde7bf69c9ca43b8ce558b42ed90742c972d250
SSDEEP 6144:N4JPE/hs9QiRs2WjHyO8s+iwNyYV/Pvy1H++rRGgV1h:WRE/hs9Qii2WGz4cPvyd++RGgVX
TLSH
T19E74BF95B3901CF4ED67823EC8659946D6B2BC5A07A0C65F03B4332A5F733911C3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
Size 142KB
SHA256 9cd05edbdaac6806fcf7ea43c4864c883acdabb8a5543472302ee0cf11f3d54a
MD5 3e8985e0d40507b15f6c7cbe447285de
SHA1 12d9521d2c0a86f9d63f932b85d601a600a3364f
SHA512 1809d1d758a03bc819c79ff0c89e8b180eebe37598110f91ab05e98d5cecb19ebda2f0ab1a77928e9f45643a89ab9cd0915b4e0ffc4f4a17122a69969f15bfec
SSDEEP 3072:2U39LjlXEo43udtjZqMNbWwx2wrIEzxmalPJkthd:2s9flw6vvWQz9NJkbd
TLSH
T1D0E38DE163E858C4F6379A72DD749C2049B77CAD5EA0CE0D2294310D0AB77D098BDF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
Size 333KB
SHA256 b31e8ede37ddd4dadf9adf6d702de2a4ebf8147e139eed68315f09888334abd5
MD5 56fb7d9e39b82da98179f546d62392c3
SHA1 c5f349f5c81a4ca068eae697c350c8f5052d32fb
SHA512 f29a18d87cb606cf792ce630c027a296ae1f44ef78b81816acc981d3a0bd11e674e1c5a49ed48a3ec5eee606b046a8061587114b348fde8752f4e0ace96edfcf
SSDEEP 6144:tksWks9e7g3ljyJ27s6SkvqizFYutYPDvhrHk:thWks9e7g3lGJ2oBkhzF4PDvhzk
TLSH
T14974BEA5B3901CF8DC67417EC9658805D6B2BC5A0B70C65F03B8326B5F337911D2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
Size 540KB
SHA256 6d0188dbf535d711382c1f2546b2d5362932052d80a4f7b170cdb438780df5b1
MD5 bd34a112be33cb99ac6abc5a077aee26
SHA1 8da7d5cc1649c06d2fe8595ca6cdb514b821ad76
SHA512 9a87859495099975c3527d9ea9ce95d0e9e17c76f7fa8e7519859eaeb6b82b067631e1650100000ef129331e9d86aefda286c4406d9c37e999f66c69a6496fc9
SSDEEP 12288:mJHFrNs9APRB7cpPQoTK19LbbdIvWGVkuyhjhZz+:mJfRBiQoTK19ZeVkuyh7z+
TLSH
T139C47C90F3E814E8F1B78A358D764511DA767C991B60DE8F02A8255A1F33BD18E39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
Size 195KB
SHA256 9afb6edfb44f95d219565b429e1700ac7903b0fcfded6c702c604595519ab7df
MD5 d110336fbfdbe9c7a4530aead99b2982
SHA1 178a16123eb4dc04db002fc98c97cdabf5383e5b
SHA512 8d33de2852f76de064164d627b32562bb3b358b0b8d7d4065f0d985fd306c9a210e976b07ddc5e9977407ff10d2bd475158c5739b9c245c9ea75878bec8f6fb0
SSDEEP 3072:lODzpx7tizwJqsU394Y5DEmd/MjgvhagI/f1OFOCJGx8KrGgqoOFJ8wkl:lAikcss9D5DEmdggIn1UnyrnqVFJQl
TLSH
T1D5147D4033E814D4F477DA3998A04501E6BA7D561B52AFEF9384216A0E3A7E1EE3CF35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
Size 138KB
SHA256 2a6abb7a623063ff12dc0588c308b80172ad192408ed30a877f7dc0cf3b12634
MD5 ab3545c0d2aeefdf6ddbd66f2c208731
SHA1 1cb285ce662f9c51ff2a863f4b36dd204a7ac3f8
SHA512 355778167acf6d758c6e0abedca7fd99b575c454d0c5069950691070c92a9cca406ed3d418a21d4a5da665da50158349d86d76b560640ada8213552c283fe045
SSDEEP 3072:22Qb8aU39828vJEisdBzYMsxkl+IQi2LW:LQYas958qdBpxl+Id2LW
TLSH
T157D36B4167E818D9F1B3DF75A9B881118F7ABC925921FF5E5240820E0F7AA91DE38F31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
Size 4.3MB
SHA256 dbf2d4af8280cbf6c269303ae1bd900ddbb154dc8a4a3e2b80de31766b194c28
MD5 0e6ff840605b1f5099aea094b97948a8
SHA1 3f8e136d8dc374dd3400bc9c96c478ed2afad106
SHA512 4cceffed60fda65e7c2a78fc54ca4c8673cf6d8ebd7bc41ab5731095f82ee59401c8b240491f0d0279f618cbc561747dd21397cbe23db578fa27bce7f82fe1cd
SSDEEP 49152:oiEojZdQpXMjryc4+TKrjZrnNJLbdzj18ctFuj3qeuI7ceEc0Kmdt3L108NRV3TA:oi+XFuKVvLnfZdtLN5Cqzg
TLSH
T12A265B656BF880F5E0A7E178897AC6B2F7B678420D31EB4F0191C62F2F336905D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeClickToRun.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
Size 4.3MB
SHA256 2b1327ba94b20f06533a1f3a41885a0e0c07f849f8a085468ebe1d391300a39e
MD5 d7f7ff9b7ff57c5f3b2bdf5fdad56f9b
SHA1 13d349af3c7b16ca7c7c32b872118040030012a5
SHA512 bebfb23d75bd53a0b8d24c2ef564c6d426b99f4f00f2bd10bcc4437da5fb149010dbaa030e3152d4f08560ee163f0c139e42dfe04e70e2d6fd5edff3fb168147
SSDEEP 49152:J6obsqWTetl6kaw89vNE35rtviW98LhdQ7XrXdFBr33euK33TA6scVwIu2aR8NRg:JFbQkOi5vGLiKdwR2v5Csra
TLSH
T1C5265C556BF880F5E0A7E178897ACAB2F7B678420D31EB4F0191C62F2F336905D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVDllSurrogate64.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe
Size 275KB
SHA256 f2ee3824130ac72897a9640c6bfb4e0142cf2c71de404d5c27ceebde57939bc1
MD5 f8ba79addbeb0aa537771e1ed841ea65
SHA1 392611f8d556dfef4cc2790cbbb8a5aff2a59c9e
SHA512 334a9f07da4ecef9974c29b442a06cc448de4ed84b2d8cb47337d566e77c0623deab408f4dc006aaee0a50839393f450f243e06f8592c141d04e6132fd7e7bfb
SSDEEP 6144:3r97d3s9tWGNTNYdMzATVkQNUO7q5BAfKw:bxVs9QGNTCWsTGQ4fAfKw
TLSH
T1EE545A7BDD38F8D2C27F5CB4AB90C700AB72A1714B42638BE175C26D8D136E15E69C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVLP.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
Size 588KB
SHA256 01b0cb0a0ed4c037789ea46446214701fd3eb7502f259a908d41c1bc1c67bcc4
MD5 4eb6a54203b8d07e13f41b52e2aca1d9
SHA1 51473701e09194b32349951042782398193ec81e
SHA512 feca6bca11839b3c7d07e74928f77235e0b487f56a72fd79fe5e65552ac5ae1b12db83c28d7857c735505e504019dad432bfa22485dfbc2c9711db48ec8d8dc2
SSDEEP 12288:zuvVVAMds9bEluzvNU4TEYicioCKSvVNI355:eVVNuq/cdCKKViJ5
TLSH
T153D47D7AEE28E8E1C27B897856928600E6717C114B61D7CBF17CD27E1E236D05E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Integrator.exe

Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
Size 6.8MB
SHA256 0d5b08c87bf3a830f0f1d2b5dca89cfb40147f87d3b47d1652841c186c7d5f16
MD5 320e1f93d16795d83e9ea1fcaa31f100
SHA1 18f66be367ec4f59dbf7e5291a9edd06d20dfc52
SHA512 2b1876fcb3a6fa78c82520996c57634bf32f787d2f48b6b8a21764f8fe7c3985875a24a7c282f415da05e2b7a3e8ae5c1de4a3f0177b1470cc4d1e7998a2b74e
SSDEEP 49152:TaYty8qhLGqtEfFKkrc917T4I2gpksQyJB2jKga9CQU4cIkwcCQ9zOB17/xYtuHd:TgLtt+leRjEjyFB1GWChrrmqJjeb2q/
TLSH
T1576629596AB481ECE0AFD1748D778772F67678428E33661B0261CA1F2F33E588D19732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Mashup.Container.Loader.exe

Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe
Size 100KB
SHA256 360845fefe228b891298999d31d6b27fb641c6552a35b9fd82145f9bb3894ce8
MD5 da09a07fdb141de9e13a2a943e8bd115
SHA1 c0b53ea19a28ef04541faaf16124970562a47587
SHA512 071e0ae39843fbec51b23e934299bc191d0bceff2e19a1fe37d25ba477382f5c10ca6d7c19f00282c27bcd2dcf76ae6e74e0af8ad3d45683d637cdb335de7f72
SSDEEP 1536:0Kr0vXuhi3ugWXjA/eAMpldERV9qugrrfrJdx3xi+02hsnA861lRy5B6:0SjU39XeAcIXqugrjrJtAc
TLSH
T150A3C095B7CE62E7C2211AF88C958ACAF634BD910F60B78BD325C31E1D677D09C79908
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IEContentService.exe

Path C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe
Size 449KB
SHA256 1f816160a7244e88fdee13f5ec9be0b691f876232b701e3446ed9847932728f9
MD5 8a17bf539ef6eca6a2a1c51c966cd99c
SHA1 de65cfe23592c820b88e55663e87d162eab8c1cf
SHA512 58a11dcc18d760c4aa814179d9aab38504eb94c2f2916cf6d7cd1fee97720c5f0470ea98af6ee3ed9c41e40d3f608420c7d041fbb2498df7c71b6b66449758a7
SSDEEP 12288:kdAjMxokgRe+wEbs9eRfM3eP6BwCgFFdK8QGiv:akMxs5RfkeP6BdSPhQGG
TLSH
T11EA49E4AEBA044F5E257A278C57BC671F7B2B8890A20674B1665C76F3F33B506D2C720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerfBoost.exe

Path C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe
Size 877KB
SHA256 1250536f45852c018b02f1d4534fdfc6911e0188a1fd5e55b912f49151e8c0a2
MD5 04da5b4c76f9964a23fde2165e56baff
SHA1 d99b227af165f418030059e8605c57657e6a022e
SHA512 a6178c1fe244a14909c688b406163c76cba91afb219515cda2a18a2a4c611fa86b215d352a69af609a2e082952b50c98dbb65af27eb9106567696f67885bd0d8
SSDEEP 12288:gadPVtAtG939rRs9wK4VagLcogApgXvpEeZob4UnV5BMw9d38V+iZQ6:ddPVtAtG939Ba+17pQpEKdUnHBt9lyR
TLSH
T15C153995ABF845E9F1B3A67499B68572FAB2BC521D30D31F0160C25F1F37A808D26732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDXHelper.exe

Path C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe
Size 189KB
SHA256 af65ada0623bda1a5ad8ff852906e2afcddf73b5aa8d0644dc59a78e1a016c02
MD5 767607a09a8ebcb8317f9794f77797d3
SHA1 be6ce80161b2acb8eb100863d90da4965613a59c
SHA512 0f9bbe0cdab50485aa85502b9b2e5403f0bc9cb1dfa0e2e0cd97471b640e2d8158c69a62af5832fb3fbfec7082a4e826613f6d03b9d037156d8bb72c26560d89
SSDEEP 3072:ZpNSCxpwNq/DnU398j1Q2+zT6lZdAh3SJxfFrgrwH1VVST06P3DdNdY7AdpH1MB:NSyCNq/Dns98qelZdGaFkrMVS/Pg
TLSH
T146149D1A7BD4A1E7E413C178D869AAB1F3B6F1B21D20536F4365C34E0E73382AD55B24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoadfsb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe
Size 2.0MB
SHA256 802000d6538feecb796946d1ff9e5033f71392904c654e2c83170c68afb2f775
MD5 d008f916014512c8ad4e88c5d555d1d8
SHA1 c53b6e79d6022e6730166da38d814d224a282937
SHA512 2603fb2dd5544f4f26776e0b90ed6a8370b585e3f2daaf22d7098ce991ac1c9eb07fb54837b2008a28a0d5a10305aebefce0e11fe0eecd077d99955ffe24003a
SSDEEP 24576:jdvP4biqI2yiBwqzRLrKXOo4iV/vDOhNfnb1zgg+aR010dFT7bK7+6mlvKp6f:jlifyawgLrKXOVk/ibggL01GFT7bhl1
TLSH
T187A52946ABE8C4E5E2ABE2789975C9B5F6F2B8414D31974F2156C70F1F336604E38322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoasb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoasb.exe
Size 341KB
SHA256 bda5beb02d27009d8382b52d69bd5a3f03e505518e93e00cda8fa5251a1ad1f8
MD5 75801c7f975797b9ee57fd4913a2226d
SHA1 f1b9471602eb46296e11f966ac316fdcc452716f
SHA512 1465373e0f864005cd2f9004b5f68e3427ce0be6771d4bca23c3991424de7f8f2b8822d2839d142461c08690f1a4287333669bb6c4048c852962c1d7ebfbb289
SSDEEP 6144:HHNes9PoSUy1PRZI80Basp3AwmMC9bhvRx9EiOwZexhWsb:HAs9RL1PRZV0BaspeMC9bhvTmw4Fb
TLSH
T1B4744A577BA88CE1D817A1788986D2B5FBB2F8605F21C30F6952C35F2F37261AD18B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoia.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoia.exe
Size 6.0MB
SHA256 ff533729f731d085e3105070d14adc52fb76a81f8274a415e9fcfdea6f2d7e13
MD5 fd734b8f3afed99f89dac9e106400da7
SHA1 86e714f9ddc77264e50a164940471c5cd83c98c9
SHA512 31090bd25d61640ea7cd02e48111637b23cbde079da2c54f76564b884a6e30ba744d5cf92a4d4a41ad9fe72153ed5b679478e6b72a4394cf932a153d5ffa074b
SSDEEP 49152:0m9W/Vb8kb24uzp4C2QNf3t4Nf3FJLOPGhWILmv6Ei31tAsQK293+XQK+P5jGSUq:0zgJvpGAcQ5KZCLw21maXzZ
TLSH
T194564A557BF882F4E1B7D134CAB285B6FAB2B8555D31A74F0561C31E1E33A909E28332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

officeappguardwin32.exe

Path C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe
Size 596KB
SHA256 77a0d5a71f520f2e11adb0a98f15ecaaad09cc4870203373666cd4ece6cf0a1f
MD5 bb0d47e6bd8d93ac108c6017cb182d2e
SHA1 48c8bd2f96e4c46cf61f46f263636305463e1d4f
SHA512 d6dbc5a467962b4a71bd790d963cb7a889a34f5abacf09f943b748fb6c8598992179c982c7519bd1e8df36d675902eca3b694e010a90c0669b3dd1deb4f158ac
SSDEEP 12288:M+UYkSmPgwhvtwgutIs9pcIPr0lypFpwn:M+UJSmBut+cAlce
TLSH
T182D43A41F7A881E2E566A5348A6681B1FA77BC130F70D70B7559F32E2F33640AD29B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocolhandler.exe

Path C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe
Size 6.4MB
SHA256 df8814a4343a44ff393ded03b4b61d68dd2d0340972ef3bd67875165e62454cd
MD5 2752485aa12d6e058d40040cac2dcd2b
SHA1 1a64ce38b00f32eb89a0a5d280c95558310137e6
SHA512 99a74b1f3331e968fb6657d1321eb702300a1f47244b2fbb57c3cd0613dd2cb263a06e2757b81edc2503916ce4f0dfe072302f59a97035e9ba2de8a7e2d6ab50
SSDEEP 49152:XW+4idGQTwm4i4KBnrjZjgW5Rqa4cNf+4//I3vtU+Bqr1PpSN2a8eZFIrU7FpzuA:YDQLIkrB9eBrgqBzHjdM9U
TLSH
T13D666A417BF880F4E1B7E2788A3A9675FA7278425E31AB4F0151CA1F6F77A508D29331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OLicenseHeartbeat.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe
Size 2.0MB
SHA256 65809457264fc241105cb589ea6f8126b62f587ba5a84ba3de9c6b283fe6b2f5
MD5 a423f6b526d94cd67cb4767e72ead176
SHA1 90cfc805c7bcdb76b64ae2790807912195ffb48e
SHA512 61a63cf7f787a6c0d75c69c7c30b1f7d7ccb539226956c621b4a67e9e068dc3ca2029001499735746630ad933d0676a6206a906b1436667260091b8ed2dfd74f
SSDEEP 49152:RTEBkGgp6aWyukAAQJQTis9BAYrU98xjqrAM:R6FBD
TLSH
T172A528406BE881E5F5BBE7B89AB68979F9727C521C70E60F0156C60E1E73B408D39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLDumper.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe
Size 222KB
SHA256 8b74e664225d1aa4078e9fdd0294d0c0609af7412276665786f5ae3f1387a6e4
MD5 d5540eae59591cafc6ebcaecc89b2e30
SHA1 897cf5edd0f1a5ace8cb88539f7ea04fd986fd74
SHA512 946210fd08c034862024a4302c3219138de82db3113c5534be7fae706f764c0dfd23c6cffdcace1bd434437a31eb54087d4e48f93d96500d9cb64fa504562842
SSDEEP 3072:X/yRRwkr4tqU39Haj4+qrSVzN2Bmt+hlR0+6iWZyesZmw4NMyxsHTda:X/yRakk0s9Haj4dizsWZyesZmwUwTda
TLSH
T1A1246B0077F92058F5B3BAB19EB68252667BB8956B31D7EF0118C1692F33BD08D35722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohub32.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe
Size 2.0MB
SHA256 0af60053927376b749b04e0d77b7f552e1de49d71f57664b6605fd65eedb0655
MD5 46e71dc7342018a352163751e9597950
SHA1 ac6234d9812c70679d09caad4a0c2ebbefad6968
SHA512 9b6d4dbd2996d786ffa017fd35bc1b70c1611577c97ac75b16435ca7475a9a1595f339b93cf7fc3b9fccf038e0f64656eb23cc7ef3af454952431944b655c44c
SSDEEP 24576:wycvLEFupYGgRkassRKPVFVjDM52A2NBH3NRLOHnuFVwQPOdOhBXb4FgwPqe0Pj1:wycvLEwPnuM4ULOH+MYu8m1/p9y
TLSH
T166A55985BBA484B4D526A1B189B6867CF772788289334F07318DDEDEBFE32604D59331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreporter.exe

Path C:\Program Files\Mozilla Firefox\crashreporter.exe
Size 3.5MB
SHA256 d535678d5ad1f73b6c22de6e42d20fb7cb760f21c86b481780fe08e479bc1b53
MD5 6449efcb087720b26eac4a044e2c9342
SHA1 923160b13754f86d113f5a63010aeef375f77d78
SHA512 1571b706c40b18a1353fcb9a06dcf823bb57654db05fee3ce9631aca84654ac2030815ee86a3a4bd67dd3f600eea3cb011439112ab6b53e53780d0437b8994c4
SSDEEP 49152:UGXC02dZMqONpqfO28wsz3iDT4JmeDNB05FQz/DTmXLhm6kV99Zb:UYV3qepJ2Jg9f05FyPaLhm6UZb
TLSH
T125061842EB611DDAC025C07482266723B760FDBD073036F74A906735AE68EE05FF9B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox.exe

Path C:\Program Files\Mozilla Firefox\firefox.exe
Size 777KB
SHA256 fef1a2bd3d6dd72252ec9bbf2537f831d1252ba962e7975bc1f367e8e699277c
MD5 f08d60a8479a06ebf5bd6a8476887e58
SHA1 ab3cca45a39d501738398e40a1d8e0e1f7718927
SHA512 1b797611abab7b6b780a76256a4b7bb4d2f0a1ec32974b45c1e03180d8ac78b3941dc38b69171e2e287010e3c74b6247e4911c3c6c8ddb71a994ad004bfef4d2
SSDEEP 12288:mWAlFAvznEOggJXnJoiaucs9YDkZuMVwXcK36LW9zwHJem7OzwHJe0Ihf7E5qMY:mWsyvL34DkYMusK4SwpemIwpelzEhY
TLSH
T19105B003F38516F8E48AD5B89A52D233A5723C840B50A1DB1BF93F2A3D31AD11B7976D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
Size 329KB
SHA256 87540b324d940552680fefac57e8b83af08f91aff47d35775d36d72b4aa00058
MD5 9023ef34a640c5a9cc19a8113a562f1b
SHA1 426d6e2abb0594afe370924e7e20a4846139abd2
SHA512 20ec1fc544f8a062cbe93b93f27ed3d8b4d72c7e614fb1860c2396b0532a368b01d9a57745b49d6d3e94fb222a0d01c955f182f3598c8983ee5841ed23af628d
SSDEEP 6144:nIs9Z3MeXqf45jFjWmz1Thd2lRo7P/iJPsfUrcA4nUfmf5:Is9Z3MeXqg5BSmh2lR02czA4UOf5
TLSH
T10D74BF2577E408F9ED67827CCCA18516DB737C550760E78B03A886662F237C86E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nmhproxy.exe

Path C:\Program Files\Mozilla Firefox\nmhproxy.exe
Size 654KB
SHA256 2548380c103a3b93805902559ba6cf5183fca635420c3f355363e9b17c22a684
MD5 f6380c4e4588f703c60c4fe4f74b016d
SHA1 03158cad962985cffbbe4163bff4573f15400177
SHA512 6929b133efa4a2c8cf6cec960db032d63f65c2b04a5c80979f1f98b6a1d6cfef829ebac41eb67eeec7e79ca03129a10bb0716449bb9e49efd027378c819056fa
SSDEEP 12288:vUoZKZmrjcXFSuhHwYjyozs9eKc/waheNKAUOwYuOX:coZHHcouxN/cHuOX
TLSH
T162E46D02FA97D4ADD51EC478874786327933B4CD0B30AAFB62985A393D19AE12F3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pingsender.exe

Path C:\Program Files\Mozilla Firefox\pingsender.exe
Size 126KB
SHA256 0ca762139bf4cc26976c7ae1dce433b27dce76dc86526eed5086e41ef2a4209d
MD5 11d2285ef106a0dec0821eaf477cbf41
SHA1 cd08c75b6bc15b4ff3c5959e92a67dcc6ca490ca
SHA512 55de5ebe6d5d0e5d6d9f4681ede2352c96e754e64ca71b5dfe01b1d1c63bbbebf7000dc5647bfefe1fc679497dcb44dce7a6ffb5068c1b2905ec8988dc822453
SSDEEP 3072:ZXovtjlU39r9Sh2SdWACJ0t4QwEvtLmzVHQ4uE:Ytjls9rYFdlBNE
TLSH
T157C3C052DA201BAAE4588AFCD4F76629EB317985472217DBB35CC3121F413C06FB97E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plugin-container.exe

Path C:\Program Files\Mozilla Firefox\plugin-container.exe
Size 202KB
SHA256 d4ebf91f6b52369b4fe4f2ec217e590a25a8844fa08c921b275db018a3e9ed16
MD5 267d93b76838f6f5abc99024857c9fc4
SHA1 b424c118bedeffc4b973c03a471ea0d51048fd8c
SHA512 3e64fcae3d8ce6db6dee18f7d9a4267ef698c4ccc753ef523d6558ba4cbbe63ab1c6d3801345483e30c2f5291d3502ebab5c5b081b6707d7fef1acf4fbff6536
SSDEEP 6144:rdkCqvJ7s9PiW7bcEuDTA7qZRNwxXO+1ZSIi3YYx:OpvVs9vnETA+4Q3Px
TLSH
T14E14C013FB8C00E5D08DD679ABC2922297B2B4860B20A7DF265825113F55FE5BF7D3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.exe

Path C:\Program Files\Mozilla Firefox\updater.exe
Size 523KB
SHA256 7f90e3e37f74aee52c289d616c467c6dbc6ca50050a8f1514088085dbe3c4cea
MD5 388fe8c7b279e0fc67cbf98cec776ee3
SHA1 14dabc3103d3e2ac9cae9978f6b087a14cb08533
SHA512 b7ddee829196a19c65ca50d368a2989547c9a8e4df5fe8f19e10c97272d30e912be380d878f715cb5d5a22b4c5f03270fe08c1e7c10093592913b0123414e610
SSDEEP 12288:avSFk9s9GenPkRQFAbGBkB2ZeUSSOJAdGynGKneb:iSFkpenPBH63J+RnD0
TLSH
T196B4BF29F3900DF8F42BA278C9528511EA73FC554760ABDB22A4D6662F332D45B3FB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 188KB
SHA256 a857dd5a69cb53879721ff85980263288f1d8d09a09f940124cfc1850aa0036a
MD5 33c5ac5f99d8a19cb3dfe5dc9bd37259
SHA1 711da8791db6720b59ef3d8fc94d8285b3c7e410
SHA512 4a0f879e01c3b4df7d165b8d59e85c752ce903ca2f7aa76529063be5f2d2d3b8fe0f92dd29a684af88f025df33d8ad04f7a2af1f09283ae168b8f0e16e5b459a
SSDEEP 3072:5+QxnrvuU390wvV8pQFq4XKF3QPxHH0dlEnpTii:5Rxnrvus9HvsQFqT3Q1HBndii
TLSH
T134147B1AE29812C4C06E2172C7A29645B7337C6197E1E7EB96C0F57E1F366C05EE9B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4724-0-0x00007FF707A90000-0x00007FF707B9B000-memory.dmp

Download

memory/4724-1-0x00000229347F0000-0x00000229347F5000-memory.dmp

Download

memory/4724-2-0x00000229342B0000-0x00000229342B7000-memory.dmp

Download

memory/4724-6-0x00000229347F0000-0x00000229347F5000-memory.dmp

Download

memory/4724-5-0x00000229347F0000-0x00000229347F5000-memory.dmp

Download

memory/4724-3-0x00000229347F0000-0x00000229347F5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads