66c4edf121a8992bb2e0402c461b17aeaf9fe11c270914fe868995fd226116cf

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 12:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
Size 1.1MB
Sample260807-pavcsaff79
SHA256 66c4edf121a8992bb2e0402c461b17aeaf9fe11c270914fe868995fd226116cf
MD5 0077f22e0d0d62919186e3e4e155f354
SHA1 5a6091b7bc0af0814d3fc18d3dfc83de6d9ce98c
SHA512 801d27e3ef92a978dce480ecca2a1fc16327ff4ca126846f60669c304a16131f1f954607b54598e0be73ed2c7b2a5a595f4f7618b454a27fb109a82652a021cb
SSDEEP 24576:FeAs6bSi1AykTfkm2YSrpvzDJapyOmKKqVSq4jrc5xaNIBddP:FeXTWAykTfd2YSrpvzD8pJm7aSq4jrQH
TLSH
T15B358D4A23A4419EFEA7F176D617C60BD7B1784A0376962F01A46B726F337711A2E330
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\I:	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\M:	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\S:	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\W:	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\X:	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Y:	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\E:	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\K:	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\N:	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\O:	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\A:	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\B:	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\H:	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\J:	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\L:	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\U:	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\V:	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\P:	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Q:	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\R:	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\T:	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Z:	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95875\java.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95875\javaw.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\setup_wm.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 20 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1112	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1112	2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_0077f22e0d0d62919186e3e4e155f354_agent-tesla_amadey_icedid_njrat_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

64BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
Size 296KB
SHA256 a3cf76a8365eb5b9e7aab22fb49f02b345ee4877700a50ae61e5166c842af770
MD5 8c023efaa9a99f61135a5a8d77e877bd
SHA1 a9a493d1c49e09ffad5048c5a22418348f132cef
SHA512 c9cb960d956eecbb91e0b566575ccedf957eb6738bc8ea7a97c84d302ee47d4f01b0e979d26b00feffeeb6dad57c54a91de18b96d23b9bcbeda1faf9c94e23c9
SSDEEP 6144:h3TfrNZs9gTNPjGZmz/ox5p/cJtqQ1pGMUtFjRj90nJ:9TfHs9oSZjcy6GMOT0nJ
TLSH
T14A549D1A33D84CF5E557C23989528682E7B138954B74D7CF6360432AEF636E0AE3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95875\java.exe
Size 333KB
SHA256 6757412812d461972dfee9739fd18e36771529d96a9fa2c04e1fcedd10b934a6
MD5 736df16f219ade4686e75dceacc2cef5
SHA1 1fee42f02219e1eb411a93bb61ea098aa62d5e1e
SHA512 15a73287b53f564fb1497b8c15b4b369709494cbb1dae57687572040ae65731559c6c7b636910494561584b4bffa2b1a20c5c9c4a03197cc27982834274167d0
SSDEEP 6144:sbPtpQ+s99FuuKkjCvd2Kz1wo3YV/Pvy88zioMvB:srtpQ+s99FlKkwaOcPvyGoMvB
TLSH
T12974AFA4B3900CF8DC67427EC8659D15D6B27C5A0B60C65F07B4366A5F733A01C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95875\javaw.exe
Size 333KB
SHA256 71f8b7da888c675a934832355058f2f94aa98f6b54ff738a93d61532f2c50bb7
MD5 e0bc4dc8e0cf5a9ac949a9f8e5430ac5
SHA1 f18792097c28e8ea6ca36d3fbb20d8a10c1d0b89
SHA512 0cea27e7c2d054392be918cdb9c4cb7bdf347d782c555ea6f18855bed9e39a91e477db4271b9017555b1c5d1fc2c58a6983f6bdcee2424a3c8b0972e796d384b
SSDEEP 6144:Rmr5Us9z5NX/pFyOiksRPqG2CzeYutYPDvhTtELb+Jsaqh:RY5Us9z5NX/PyOiZxquze4PDvhAvh
TLSH
T18374BFA5B7905CF8EC67427EC8664A15D2B37C6A0B60C65F03A432175F333A11D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95875\javaws.exe
Size 540KB
SHA256 bb593404aa09aec4a359d059932c7bce732e98a12c25cb86831852dfdaebfd69
MD5 64c4440281d93420ef3748f03bd8b1cb
SHA1 01cf617e0a99b8b999ee4a5f12ca22978d2b73ca
SHA512 d4b85e9ad919c7fd8c3fd5eb01c98c6ff73fcbae2e8620563159c4b3136329c59355266a300cacb81ea89f1f6828db19330129954fc47453d3f4d28a8558c417
SSDEEP 12288:AU/J1Bs9xUB0yQJ+RVyHDhiLbbdIvWhhVYpA:AGRB0+VyHDhiZvVYA
TLSH
T16EC47B90F3E414E8F0B79A758D764511DA767C991B21DE8F02A8265A1F33BD18E38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe
Size 596KB
SHA256 1c64903783e22432f9aa473a10c6587237356a5c038e5c4f80fa4ff47c654ea9
MD5 7583dcdcc847987b188915678d00c776
SHA1 184fda0609cba9e94eaabae5598434dcd5563a42
SHA512 1deef3dfbf9a7f0bd752fef8facd603e88587465581c9acd6e626d4c1d26899a435f5009d11563475005d87a17e6e73d197ab1152745e00ee9c56660f850a573
SSDEEP 12288:qs9iU8fK7WJba5lvfYKrNSzfWx+WDiL0R91:UU8fKGavQYxpDiS
TLSH
T1E2D4AE41B3E846E9E07EC134CE578542EA7278960B64E6DF01E482792F37BE55F3A321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe
Size 6.7MB
SHA256 25a141af43ea4340ec927405cfca64ff32ed9e6e2df75d9aa136be5663ff4b1f
MD5 9fb5d80215b12d045f1fdb525dcea438
SHA1 27974b4de51bb7017c32fbf12f889c82c7f6dde9
SHA512 7df029e72f0ffeb43b599ca1a5470a885dacf355c3c0b13a8787359fa226c8258a58923f4191723ede5d8436492ef69e2f231cd39f1af098fcd8af3eba959f71
SSDEEP 98304:8l8YfTaJ1+WKnSB2L4HrZtXPIieK5M0uR7F5ey:E8YfTa2LSIiFUpIy
TLSH
T1AE666B47E3A600A8E46ED970CF3A5521DA253C8E57B493EF129476E81A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe
Size 1.9MB
SHA256 6b1e262191039c8a9d5c5aabbb390a79d952f99db5c59568fcf8fd6dc46f8b99
MD5 0ac5266ab449f5219ed6c0c68f59cf43
SHA1 77dc605f4d32ed9517d9853a0a9b9d56ff550d72
SHA512 333e5da8f577249201870058877b6b79a1b97e327d22cbc801dadf4b5207ad03de43dee245039b4572b36606853a66c3e36b6e9aa6feebfe513b670a2cc3b902
SSDEEP 24576:e1hcMP8dQUOqXRNhRvtLpPZyL2NLb9Ld25PTOocJuJ/cIsY6WfvoDJIkt/pY:ihvP8mUHhRvtn4wpZeToMJse4DJdHY
TLSH
T17E959C03F2D941E9E06ED578C7469136E9727C890B24B6DF0290B29A2E77EE45F3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe
Size 1.2MB
SHA256 ec35d16be57feb9dfc8aa29e41ce2ce1d2f155fc4e58a677600132722aaee6e4
MD5 262db8f752485e3663b2850cdf2e4f96
SHA1 69a3bb73cc4c73704d5aecede41211fb2ea91e31
SHA512 5bb3398276e1231889cb0c6c6d02f446efd2925ade8e8a21ab81ccd85a7f1b2ef713d013fc755782abe87a0b8bcb8eccca70a7a3e42c184216f09593e89d9dad
SSDEEP 24576:HY55YBHzShvXNXP/mhp+yIBuKZGtxtI2IVprS6O7Gr:HY5KxzShv1ehcDu6i/ApG6Oy
TLSH
T1F945AE07B2D940E9D069D574CB568132EAB27C820B64A6DF06D0B35A1F7BEE86F3D314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe
Size 3.9MB
SHA256 ff9346e98a00e01c6026678ceb751c1415e0e2c5e4779039111ac43989305287
MD5 f971f1c3406ed819bf83d89f3b74b145
SHA1 cfa85ce079583230649e1e009ad13a6dfecae8a0
SHA512 1910e894838a87a413e487b7ab528a6c3d01c3990bc35062bbf59e6c04405396a1ec319d12845029232bc8ddf7a610c5cef0db17a25ab22a3430899c0fc1673f
SSDEEP 49152:DsZAcIPRCvjRHYFihYSutaKxDMXqxh0GD0AGuuVEusJ6LNzOeL0GKVIeCjIp26IG:hNlSuuVlcm7fwKAo0
TLSH
T118165903F29940D8D059C074CE5A8132EB627C8D47F562EF3694B6EA2A73AD47B3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe
Size 1.2MB
SHA256 62507813e416420edaed02eaeb6aa013798a134fde37b35c26d8a9a3224ab6cc
MD5 7fa859b35c753ebf67135ff22b5b378c
SHA1 d9e3a1ff97d0fd23cfd8b044730153b3106cb17a
SHA512 8821e50295ff37edd11ddb02a69541dd08aa0bacbb23d712578668ed1dc34b3678a9b067470d89578d86e5156ed95e831349e8825f1a93c6d8b11af1c3768a8d
SSDEEP 24576:x+IzfRhtIFGhXtHr1ArfTFeKI1D22TLD08mr3223T0AkMo:x+IDR7IFCL1Wf5VeDRTPNWPT5o
TLSH
T1DF45AD07B7D841E8D06DD5B4CB568532EAB27C860B24AAEF0690B3592F37EE45F39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 1.6MB
SHA256 cce9bd9c98c01f07c084461071cf7945d1e0762df841147ebff7102ee694d57d
MD5 3bd69d943cead45c730831e2b1fc84bb
SHA1 5cf90281279adca648ca248bac2f9661384d529c
SHA512 36285ba91f2a017b7fe3cc6126cf0632f8ff7138aae446fa301e45722a9b718f3ca3f8939c2c0321d96531ad0a1ab5dcfbf6b7e987ae7886f559744bda45d76c
SSDEEP 24576:uRQNtqPxfwKvR0GwXPFoHk3McV9X2E2xbLVkszlkkkkkkkl0T3gAQbcpgSKOy:VNt2NwK50IH+Mi2T3C4PQbcpA
TLSH
T165759C03F68A81E5D09DC2B8CE764B30EA717C655F2096DF0290BA653EB7AD04B397D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe
Size 3.4MB
SHA256 7fe5d9471a8253060b9da6a4179da756627ac9f82f33e231041dd3915f535850
MD5 e817638397a7480dbecec479f5f3f803
SHA1 c44e66b696a3b6b6df1822e42e0da15875e96036
SHA512 26a4948f063e561358c72765333be8c49a1410c2dac8ba093293ccf6d8217131957b73f2ea7af9de39ca3dc507f6e53a5acb2c529f4c42a62ee9349d9cac8fc8
SSDEEP 49152:4irHiJ8tAKBVfqLsU4dayleWOUqMzAD6ulO7Udq+KqOuBk7bVnU7wF62JtY0z:V9Pw6ul1EE4ws1z
TLSH
T1C7F54903F29900D9D199C078CE5A8632EB627C8D47F562EF3290B6D52A77EE47B39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 1.4MB
SHA256 10d99d88001c8e21e4137a9581e0974d901f906d299ff118b59ca7a2069a87be
MD5 2541dfd2c8f1069afc0e09251f977a5c
SHA1 7fd6e970550ef38c0dd2315e70d70531452bdcc0
SHA512 6a874b037e3ed275d5dc92700a8a721f0812652054b56627440df927b205c4ac068a5f07e03e6d11d77332fae2f8493b7e452e170ceae250433111500c48789d
SSDEEP 24576:bVMycmHxX1qwjxxXzTYOGZLtcLPmOlNG0ue1qRAOTcALyBwm:ZMQxX11j/HGZ2TmOl40uSOTcA2wm
TLSH
T1CD659D03B2D942E8D06DD478CB564536EAB27C860B34A6DF0698B2592E37FE45F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe
Size 1.2MB
SHA256 c87246c1ca262db3db40c176b4a6aefc8a4432159a7952210a7eae8b078b30e7
MD5 c91ba3188d0016177f0a24a7b784aad2
SHA1 e207cc76ff9f75a189da1e78294ec8483548f3d5
SHA512 a7303599286ffdf46c39b244c1c1c6f8be5079cd353e5c908ba5335f829e9fd2e1e5830003b80f23fa369c0ebe92eb625bd87c620b9655dd1fbb7c3da235150e
SSDEEP 24576:jkGniaggoAuX3C7XEJJNVD3Groj9HpTYLxQRa:jkKHggoc70JJNVjGroFpEz
TLSH
T1A445AE07B7D840D9D06AD578CB568532EAB27C460B34A6DF0690B2592F3BEF85F3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 248KB
SHA256 1e10445edb6ee6db22831c9bbc271ac4c7063ee104fa5852cc47eede1111820f
MD5 c43f4c2657aa8c753f8193fbea1e992d
SHA1 8756f5ec51532141cac9d5d8a06fabbaf4d28749
SHA512 b0196759b85d79100bcd533fae8f523406d9baa48bc2d4a7e09afc6a603800d29133f83407f4dbb58e2e669851d0b5f741d8719094135922e86f37926728be32
SSDEEP 6144:Rs9GTA8yvfSbb3xjdR/Cuoh0FjL7rFFee7pZ:Rs9cApaddRowjLtZ
TLSH
T1D8447E6936F920E7E077C1B4CAD59503B231B8B61720CE7F0390426ADE63A519DE7E39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 265KB
SHA256 6e25652871c67a2e7c0c4c46fa90116bc1212401d76e73fd44150c3dfb77bb40
MD5 6299e4e3375e60070e0509ded59697e4
SHA1 5afc2e5d6f9a4caadc595bcf177d8c4502b14a32
SHA512 ab818c929852ff46127cad3e48ef420396db023f79e94c3dada944c409987ed04e784636802324e8b3f093f0c7c31478f38a468fd7e0c508183ed51ec2704e52
SSDEEP 6144:Ws98czVarafpBQ4+6sYWoht+uoZWHEL1C4Chjp9ekvmtq:Ws98czJfZsHo3rEL1C4Chjp9ekvmo
TLSH
T14F445B6925F814E2D176C1B4CFD09903E235F876A3208DBF4291835A5E23A916DBBF3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 610KB
SHA256 b9464fafc33ef0eab6eab3f726c35507aa014b63cee09294e2996c0750c2e899
MD5 a4d5b089866035e100243a1cef3d7ac2
SHA1 4d4c4e7063c920b49b026c50bea3bfb99ba63f11
SHA512 94602bedb645a99a150489dffd5c0a3fa844c330741ae4c583b8f29918f39d30bb3dfa7b84c4e8432877080c714a98f761441e71dbb62c3505cde611b6c1fe86
SSDEEP 12288:jes9s/IiWzUbydHVlDlSl1990F3215rwUu:q/IiMpxA990w3wL
TLSH
T160D4AF81F3D847E9E07AC534CE528542EAB17C960F60E6DF02A4527A2F37AE55F3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
Size 7.2MB
SHA256 7e8195db9a06108d101371d4e15dd5c2f1c1db8aec5e7f6c976f06a75fbc82e0
MD5 05a92e5b5ace19ff5a0d66971c29cbec
SHA1 24ef0da75d050aaf1d1ef5598b47c3a659293888
SHA512 ea7b2344aec8d86721fe90d86a3b81d61405ee4eb2c05b54adb9a744c092406ccd43566da978e229e8e0eb736a3767a7eec06475869e9e679d7992599e31556a
SSDEEP 98304:F6CZetahq+WZvMjwCsJB2++fGbOxRj2vJzRN+T6frdV:QCZetaOWGIGixVqzRdDP
TLSH
T114766C07E3E600A8E46ED974CF2A9521DA353C8E47B492EF169476E41A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe
Size 3.9MB
SHA256 32c91b0733c2ee8385a748ab48d06a19fb81d80bd6b0b9f7ef69dfb66a2bdb88
MD5 55fc265959468dd0b5859bfba296a3d7
SHA1 4023feb8550063c47d5be5aafc9a325f8df388f5
SHA512 2d70f91738f7e1d799a38cbcf5d26d6da76f701ecfb725777dfc50cb167db20413bd637f8ac1e874ee634cb8ebd9fe65fc6c5fb6602596108ee2f5f77964d6ea
SSDEEP 49152:f/8kp3udNgnAgr6MbmhLbKqm006NPpIupE3Vu+e6NqcXToRzvUqIzYHBigdQBH:3pm6AC6ymCC6NUhIUBb2
TLSH
T1E5165A03F29900E8E05DD578CB568522EAB2BC854B35B2DF0650B7522E7BEE4AF3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.3MB
SHA256 8a05e7a48e82b97c6f09ad0c5825a025253f60d2daa79a742f35cf2978443041
MD5 eaf6f9922af88ee7d3fd9ac0672d2698
SHA1 7038926e80e7aaa86c2e605df26097b536e4c870
SHA512 5e1b193b6556cbfa0e39add7663e719da229615e8fe8503b598a9cbaa7e080792918b2e520e1c6ab33c2dae0e9e62fe80d210b1b880fbf32e225d3fd7cfce68a
SSDEEP 49152:MUcueUUeLVJ5/vUkjJE6rstBhuXjfS4LWxnPkq:Teh41jBY/
TLSH
T1ECB57B03F29900E9E06ED178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 1.6MB
SHA256 1733646675d52f5ce3e271a2fb413bd354d6e26bc18e613646588c9dffef0fa9
MD5 4ad88b2cc70b0e61ca69b3b2a6c5f5a8
SHA1 5bc231c70b38eb34cd6e57069613617aa310246e
SHA512 9d71f62b7a1d4a6d9b3084d6d0d58e8138ac012f2625156197365c08740f59875116ee7141bf8377a7288baf45122273d5b2313265bb33fc2f0b0b8939cf8fcb
SSDEEP 49152:zMmN5PIvJ7TjTB+hSeJw4oZ/TTlXrk9dBhSMvWzuU:Au5PQP5TOQwE7
TLSH
T1A7759D03F3D940E8D059D1B8C7568536EAB2BC450B34A6EF0A90B6552E3BFE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.0MB
SHA256 02dfe76c38b4824c566dea8250fbde70ec6475a73e5b9b6665e3b355a521ae39
MD5 9f259619cff66a195ad6487b5037eee8
SHA1 148b982aab70c6b84a20938f6f8564a450c10aba
SHA512 b3b55bb5dcc69ffdd7ccfe018502749b41a7d0000a5e9b87c2b9c83d2fedc6842273c49e900dca23023eb945d0cb4e70cea6008c7ddab30f4c4ee17d2600f97a
SSDEEP 24576:BDogod6t8LkHpGc8uqlUC9OD3pBns7CtW7KSdHBxmRkkkkkkklQXBysWAVkhv:BDod3LzblUC9OLp1ZrSdHBAVfVkhv
TLSH
T1CE958D03F6DA80E5E05DC2B8CB768B39DA717C554F20A6DF0680BA652E77AD04B3D394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 3.5MB
SHA256 39c07b74a1e9023a7b2d57e6cff23c41a69efafb41ae85bb625a6d9a804d5f11
MD5 c71f3c825d01d9ae23d955df5ab61918
SHA1 e642906aa2a3c0a204b5622e899b20b0738993a8
SHA512 dd5aa281e4a876b28f7afb23216aa46a700c9e662cf895b9eebd3fae3d1f45b21ad82a0a8809679b9194385f92a30d36672b961a01d4229d5cd28d6d0ea5c37c
SSDEEP 49152:6uYzsYVYZWQQgcFqrLPl6iF7sHmb6YErxz4AkOuaRoBISCaQZCLlrr/NX/Ghh:QnwDJbOnZgCh
TLSH
T14C064903A29900D8D059D078CF4A9223EBA27C8D47F566EF3690B6D52A77EE47B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe
Size 1.7MB
SHA256 dbc165bf4015b32d5652f9cc3df9bae75a166be38663c2d13a13227ebf772914
MD5 cba435cbdf25a2817bcce8a2ed3d7437
SHA1 12d9bc36481f68b220c0fc83ba986c9dfcc6ad3a
SHA512 bf94f97cfb717cb9fcfa156078942b8451ff6355bbf90d3668a972b8544792cc8c7a673db1fb0439f2ac30e43f803c0f290fa5251d9664374cf67867125911c6
SSDEEP 24576:dcmd4F6Tr50QdsGhuKGDUd1Q6mRwk0ub9WeQuJXlPnyF4mfHU9YawsNzsD3:6FWGK6Ud1nmRwk0YAeHX04mfHIk
TLSH
T134858B03F2D941E8E06DD2B8C7468532EAB27C450B34A6DF0691B6562F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Size 4.1MB
SHA256 a612c84260d490a7514b9103a515441f8957573d9e4cac6efb5e74a027a88fa5
MD5 dd1587b3856a3888ae16d18d742a441f
SHA1 e841f5b158b93e354038142b1dd740408dc4230c
SHA512 93a5efb621d26eff8c03d0f22ad4ee89e2abca929ad609888ff8d2f5c201b9389bc9882dd585fe21261158d0d2365b72468e8cc17234a56843c74c6f95ac5fd8
SSDEEP 49152:DuaYR+KfbmHysVfs/AiYBsO+TjEGzExldDwUIDtaZHWRdpev2y/Ba7wE+k:yXjAhnd+RaA7pn
TLSH
T18C165903B29940D8D049D074CE5AD232AB617C8D47F162EF3690B7EA2A73AD47B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
Size 1.6MB
SHA256 ded491d8e9a21d918bf5b3778a09f3516bad5b1846b99bd63a838d3569eff6e3
MD5 b3ee5bdeb0943c4e4bb3510269fddc75
SHA1 5e68d1f550ca802d1c8d2190d840a20eb8782e57
SHA512 337b72a66afae16dcab40a3176725a17e2c2ad2ee5d2d24e47cdb9a819a43ce16b338e8c4a9d180c8f89f48869ba5091179b27d8ec698be6d76efe9010d44f82
SSDEEP 49152:Mr1J6BFap7cJXrCYLPK9LBo7EukU1mrZb:iz6BFJ6Mi1
TLSH
T16D759C03B3D841E8E06AD1B8C7468536E9B27C450B24A6EF0A90B6552F7BFE45F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 1.5MB
SHA256 efe4bca46f125624aff1af48147d549b4ddd30df7cb5b1ee8ad52bfa15a7dea1
MD5 49a2b86115003f97f897e3cfd4d44cce
SHA1 4f5aa2f43ba5f9769390fe7face51af13548edfd
SHA512 16398e07b7c6c36c6304a41b1b67f5adb37b4b716caba9df1fc81e73b556eb2eb90bcc760b5f5f2d462e573af50a26b90ccaa72f01f7b501100039001c3db089
SSDEEP 24576:HhokY68YEIuPea9Cu5hWBUJfYBvQGsVa4i6h27d3Wl1idJkf9d4+0H:2kY7RF1VhWBUJf6In+6h27dtTh
TLSH
T170758D03F39940E8E05DD1B8C756853AEAB27C450B34A6EF0B90B6552E7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 329KB
SHA256 06011e517c8665644ad51ed68b9f2f927babbdbc98cf6586a1c0a347b02e3cc9
MD5 7c3ad2467fbacdadbe0bb6f0c0846006
SHA1 2b978ee32bba441048194f986cbe5bf126c0a046
SHA512 03dff637302e7f76980f2693fa8df0248496ba0b17d7ce5506a139333e4bd1dd5a411dd5b8417248e73c5d3fbe38966ae1eda1e6e89fc2821161d6e7f554da47
SSDEEP 6144:rl0ts9Djx7R0gv5BBSmnV1UqV2lRoQt/iJPsfUrcAl4mvUjg1F:rSts9Djx7R0857xnB2lRR2czAl4mvUjS
TLSH
T1EC74AF2573E00CF9EDA7827CC8A18915EA737C554760EB9B02F8856A1F133D85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 672KB
SHA256 7eab8918aff6eafa50cd0bbf7a151da44b75f1ac115eddd87162fddc509af76c
MD5 b38a999e6abd814a806a025bdf39bf1a
SHA1 8221de42a5ed956f705a5cfe0cdb7738393c5f61
SHA512 602e4163609d27cea8aab4e00f48909c8e9d43d04109d42b870339f476b9557ab9a2d586227ea24577129e45329fedd00e4abdee419e4ee0f12d5c3e86baa17b
SSDEEP 12288:QQpRcVTfFUrNLlmJeE1shws91rHs/88JHxu3unDz1dG:9oTfKrNL3hBrM/JHxuiDO
TLSH
T10EE43B16F6748731D073C0B9C5D2A69EE97230825B308ACB4285D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.1MB
SHA256 ab395d771287a6c60fee0ba4c3c5cad1acf9d03e057898493e62ad692783a022
MD5 a1705bcb8b0f21e4a122070a03f09f96
SHA1 66768593db8b81a61b9af81bf434e9834a640707
SHA512 4e48931c0cf68839ea12fe9efb183b4dcc3b7eb68ff8c3f5b87ec7dd9030154083709a9b8ce7834e6accd17bb5485d0b1a2ac57406404b4a943f5192690f4f88
SSDEEP 24576:6hD+ezSClv2VA4kvgrvW/6q8wyuSstWSWF:u+ezSClv20mv6HjyDs0S8
TLSH
T1FD351A25F5788323D0B2D0BAC5D6BA99FE3230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 840KB
SHA256 0379832a42784ac79fa4dcaa8753bf96a3296f56a12fdf1bf93dbf35eb4cf00b
MD5 5fe7db950df94c56da026dc6a1975f4c
SHA1 09066ce5a5608b8a4f980203e764d75e17f623d0
SHA512 94ae0454ac31cc664683423be3657b66d77c49f7afede0283df8bcbf3aefe88ac2450dbc63b28b175c300c16bb26534a78ac210be99ae3b1f70ce725c9d5a23a
SSDEEP 12288:hq05MBV63vRBlfAiov1GdwsErgW/+Ls9yf0Im98u5fH1SbtEJyJS:hnYVWRPf6V/+BuHoxJS
TLSH
T120054B66F5748331D073C0BAC5D2AA9AEE3234424B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 350KB
SHA256 96a765a6ae3a79bfcdbf5d9a6539013875a404f6319c88ffef444763b3aa9f91
MD5 7ddd47f3012d276b446a2329e66c2dd4
SHA1 12d47921299b9796d62e31174423246bea2b26fd
SHA512 8c18cd5bba2cba569d977e3597659512e6a25585aea1389938d87726e3cecfc89aebfb14fcad8775d6dd5a239f04237a23d848da7b09831b8acaca28e2a019a2
SSDEEP 6144:HOls93BJ/GKWWBNU6ITLBi0qttclOKgU91BJP5VbubZ:Is9meBNUbTVO86U56Z
TLSH
T1A174393BEE28FCE2C27E4DB85B918600A7B274704F52A3CBD165824EDE135E45E76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.3MB
SHA256 da5ce88f9b63bed37f89588c347d3c36bb5ef172f5885ec609665033cfe85145
MD5 18930f80e7359f18ea3453ac228b930d
SHA1 14355832697230dda3de54c35e08ad5d102b2688
SHA512 6e8a4561ab77034d26cabb12c18607c681402352e6b8504637148097a71900ada9481296d8566f1bd03388aa09bcc942b2bb26cff9ccda3342345bdc92916534
SSDEEP 49152:GlNsv5sS8X9sZJGTzfT6P2bG7/L0dwn4TypgBGRvP3teuPkNWNjbzMl7hT1Q8NR9:GlRXMWTuzLOVRltTx5CAshG
TLSH
T1F5265B556BF880F5E1A7E178897ACAB2F7B678420D31EB4F0191C62F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.3MB
SHA256 692867641e4ab450f5cb06b12a5e5d432a8373696de879771e6c41a23d3aed9b
MD5 41818f6fc448d47b42c44baa2b108c97
SHA1 f4c8665dd39fbbb1b568786961c4482791109680
SHA512 7e000306226a24fbe56bace6e791b8bf2c31bc07628e6e3afa4c9ce3563f1ed4633afd40cdb2021b16128cac58382e8914c0814ac37d4d6d8034ef61d40234c1
SSDEEP 49152:1LgEyVM6h2yL5z6fFiV+XenmE3/zz4TGriG:63hzVjnmG2G
TLSH
T1C5B56D0976B8C1E4D1F6C77886A2CA47F37178154B34A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.2MB
SHA256 db377ae938be558934a98378fa7c8873fd14be11cad7329248f1115f9e68c408
MD5 8a7530792185d4a74d86a6cc9690a279
SHA1 748202caca300143a2f5b7899115dec45129670c
SHA512 08fdccf38fe2df5669602dcfbba5f6da0e2a2acb484bab797936c8974a43a928c7ee8c0c536962abbb32910a9dac3e1f18f352c524969698efed1f1eb7dc6afd
SSDEEP 49152:Cj8eNoGHRRHU9p3DJf5SUYLoDpgLjSTYlQcGe3AaLSF259ruMHwpXMi4FqJLd23f:sKRQyi36YOcP/Lvw2gAf+PN3qz
TLSH
T147666B13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 2e8a141698e089f8f5bf26fd0a95bcbdbe89e0b89641067922b257ec615eb0e6
MD5 1f431103fd0304d963dec5fe375a6de4
SHA1 38ff6a03d18bf9df6c0942e1fb9dc7f5ebf1a5bf
SHA512 9e1fff2855e899ceed5c591a5972a5fe8f116b6330fa991a441373ad7ac15cd6120b0bf1d9e89eb5e8358ab94c505d77e5b682d6b5a18c6776b134a819b402d2
SSDEEP 24576:+5v6DAS/O7Qqr2E3DboB/vZQt+7DaHGTNHu7PNU3/5W/ohL0Tm39B3eGR:jd/+Qk03ZdeWu7PNU3/31R
TLSH
T1B9952733B2F200A9D44DE1769F4A873196E17C758FE1E3DB811572061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 3.6MB
SHA256 165eaf081669c70fd5c943f3c71e880adfddfe9404295fec6b0f95a24354fc36
MD5 aeb21672e2258a2bfea82c1c16f8c1a4
SHA1 e1440d46deb896e9ec87ebbc94125da0387f48c4
SHA512 dcdcb18a90ef9309f737033a8e94d931c44a4a1c8d2647683414a1603e1b5ad7d92f93a598277cc93245cec9a890e37d6b8c341a76b3c174d8609bdf52534c0e
SSDEEP 49152:GQT2ks0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbQN3Oh6tznm2FQ/nho2qkrk9J:Fy5112gYy5azzVvX69nLKnhZjCP
TLSH
T1C1067B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.4MB
SHA256 f93149813ad179bab3d49b747602d5425e725d937f9f70f816eb31ccf401f953
MD5 d5f2dc685ba87cc1fd67da894021fd16
SHA1 4ca8f82eb9162d7e9aeb667a821fcb2e29424fcb
SHA512 2aba800b9d9403d9ed783e90604bbfa63904a0001c4b671aa19ec9b7f48804c0f340d4b0ee30f3ca04d06fcf6e3f05218a02064a03c174f25698425527fd912f
SSDEEP 49152:2CWz/vr1Zvez4aOBr4tEGx0bqx0z+n217aau1glac:mfekJmHxd2dH
TLSH
T112C58D13F1DA01E8D06ED578974A9233EA62BC490B34B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 1.8MB
SHA256 887ea20cbb9fdf02827669b35a57b8b4d930c42d5625e72e84cec8e8f6cb4794
MD5 8e6f09320595aa2f0f269e80363c00c8
SHA1 a25df2f86d8d7ee57a2350cd0162e64d385e1869
SHA512 90964a27884f2f66346fc5a4f9bfdec9b4eabd51a4dc7257c36da9ee25920e7ec2cb5cdd019b419955c706a1bb37bca96ba627daab443f135d793671fa941833
SSDEEP 24576:OivvmvJeo8+oy2DzznfuCMr+4AqxUQ1zNOgLLwH7ReaQXx3KRLkJ:EvJeolo9I+4AuU44CwH7R4xWk
TLSH
T112859D13F2D900E8D06DD178875A9632EA72BC460B24A6DF0A90B7961F7BBE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.0MB
SHA256 a1e175660dd5fd8920b70f37f9a0fa38c3bfe06d3eedab9c7c7a21b5d50d2b64
MD5 10709c0d3dc1ea412277efa2f8a39539
SHA1 4265929172dbe51c639abc1eea33112182d2fa46
SHA512 b8e4a5edf23ae896a1e9e6ceb8a0b51bed5a39ac1d889e5ba8cd3fdae96822fd2234148c5a14a165c9b277a50cb5a7d566a9b27a9fd031ef02c0d108e350ef40
SSDEEP 24576:m1/vbJUW53zPAQLwrSA7KaPa/n1NHWxUR04FxGgVG2Onks6xt4bSMHnqyy6jPpZc:4JUGzIQsXu1N2uRVtOnks6NMHqyy6jPI
TLSH
T1FCA59E03F2E941E8F0BED6748B659632EA72BC464B34A6DF064072591E77EE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.2MB
SHA256 33d2b07f8f6bc6a2f43f4c2159fa269a0035bab867db49b7db0506f68adf3b72
MD5 0265dc8bb99a3fe4e0e7061574db018a
SHA1 231002d9a89082001072e926a88f3f9ff26b3f80
SHA512 b324d4870f73515ba319065a4b81a58b8508684af5a34e79dde8afd4806b7c27964bf35499e53504c40ae8fe1964039747d8d4db8673e746e9eb31520123889f
SSDEEP 49152:54PlNhKtuIJtjLAE3dGGj8b2EGcjesaNkYQd0XNJKcvaAcPTY6Y5APexS:kiBvjFBDlZ0ek
TLSH
T12FF59D13F2D940D8D059D079874A9232EA72BC494B3166DF0690BB562FBBFE06B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 bcf4e5a93f7f7d1546c424cec337898901be48a9a4979276e5b05094d4df2f46
MD5 648a8f310c3be3d84144368c3a3f9e62
SHA1 7821c8f5bcf88d4dae887d09129e6c3e4429b3f4
SHA512 91026099e6e2dbf856673da991b41247437dad21e23e4534249c72234180f836442fb08b23c87c31d336c8f0c17639f8bc2e2175cf284d61432eaed35a120256
SSDEEP 24576:PMIvUE4MdJXzLENbnaRxyUg2cnhEi3iy9CTn0AP5+2QLdHIkiIn25z:PCEvdZLEN7AcnigiDn0AP5w+Qn2x
TLSH
T1FD75AE13F2D940E8D06ED174C7568632E972BC160B38A6EF0A50B6562E7BFE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 333KB
SHA256 3f450c4e181bbd0e8ab175ceab2096be351f9be4ef494503a22e8e61db2cb7f3
MD5 ecf0c6e2b6e7a02a1448665941e3dfd7
SHA1 0a228249e5f80fe1c97753d949956b382cb0c5c8
SHA512 f7bcdfb01e96493b9d759c200745bc5c1e8b242c21113c5f780de2fe21cb2e3f11c2763d448100f80d3d53fed003fce7f315d89d68e94ecfad55187cefe5bfe7
SSDEEP 6144:x4Pn9Os99nAnJqjbUmgPo8BezYV/PvynQXYUmv:xkn9Os99nKJqPk4cPvy8Yz
TLSH
T10174AEA4B3901CF5EC67423ECD259905D6B27C590B60C62F03A8366A5F373911D3EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 333KB
SHA256 6b8b40f665e21268e451e4cb630499fe78f31a1edf1750396023c110eb7f939e
MD5 d69dda44966b61a3ec1e4bb4cd0d98ba
SHA1 c863addc5cb8237cf1b59a6f67ecb30510486739
SHA512 7e82f967510eceba4865d5f71f5eccaa16be6af9e5a06e38610027fa265dd3d10b3c07d4858517abf1f1d8e9d0757777d0e77ea2c53de96fde422f1f6acc5346
SSDEEP 6144:aQiMAs9wth2WR3QVjsVf7nz1zZYutYPDvh6vYpalI6iC/GZQporMJ:azMAs9wth2WdQVQp7ZzZ4PDvh6v6HWUK
TLSH
T11574AE90B3505CF8ED63423ECC659905D1F2BC5A0B60CA5F13A8366B5F333A11D7ABA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 540KB
SHA256 6fe1fb82323e29e8d81eb46b9005d1d66944d909af60bf6e7624c0a9745070ab
MD5 c7e69888be592ffcb20ea30ace24846c
SHA1 8425ae5b21127926a21677fa9a358fb8115fa523
SHA512 0b09becf20e883c13fc2e0aa0ce1351aa91be76f9efb8b7192d03cbf57cf14586e7075447e47aeda8d356dd8cb45231a9de4f0ded67cfa0d5d0b6c2ae5b59f06
SSDEEP 12288:JxD9Z6s9LxxJv7EExDgiv6iLbbdIvj9PUk+mKI3V:JZjxJlxDgiv6iZI9PBKI3V
TLSH
T13CC47C90F3E414E8F1B78A35CD758511DAB67C9A1B21CE8F02A8665A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
Size 333KB
SHA256 6ff299ccddc09626348422ff8dcd2a5389b81f6f9f9ce37d67de898d8a74c12a
MD5 ba865c7d57463d77c114e741fa828a17
SHA1 2fecccf134b5872df0da19fa8e2875ed34eacb44
SHA512 ae13a8afaa91e233836be77751d9e11c0584ac8fdb347f450cdd0b38302f40572beac6185183dd4aa5a3d50fed3cb54973a80cf67195fe7f7c9037d1bb1165fb
SSDEEP 6144:pTPdAns9y2/O8R4jRz4qepCnndYV/PvyJ5cJ8AJ:pTdAns9y2/3R4w8dcPvyJyF
TLSH
T17374BEA0B39458F4EC67823EC9558916D6B2BC5907B0C65F13E4362A5F333A11C3EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
Size 142KB
SHA256 fc50fd433a212466465859e1a036e72776403f9ae9f5ebd904610238d9c9fdfb
MD5 dfe490e10eca0fee7a166fe908d09334
SHA1 8c3b0d721ca36ea7d78ed62f9ae37d778b558628
SHA512 bf31705c3d86f951952ff2cd5a0c9f2a6f944c79d2b020e7ea7b26ddcf260f441f6c1ad15088bc0fbb974cdab25266d53a6b1a3626ca12a59ac6a33db31a4f4d
SSDEEP 1536:8vXuhi3ugFXjMjl+5Fs8h8Zs8h8o4On+uvVK7qjh3rmKPNbj7uPxGY4iix731L9f:LU39KjlXEo43udtjZqMNbjuxiigIj2Bn
TLSH
T171E38CA1A3E86884F6B79E729C788C3158B77CEA5EB0CE1D5295314E0A773D04439F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
Size 333KB
SHA256 058711dd6ecceaf4241e4ed1d6d75631accedcc140a2121718b74771c7827963
MD5 eb080f9a0a35a600816b0414015bc916
SHA1 11a12b777ce7fd296b926092a458f8186a336cdd
SHA512 5725e2f70653f871ac181d59972a90c60fd55a530c3ecb7db177eef4f56cc57bcb9a7f3e45de6fd87f1231f921587eb6d53bfc93b92dcebcf085f87d0a11e3c5
SSDEEP 6144:WBVvYs92NizV/7jFUsgFZ1KqzfYutYPDvhfcQnnU+EUXy5:W/vYs92NizVzjFJYZjzf4PDvh0z+EJ
TLSH
T1FA74BFA5B3901CF8EC77823EC8558915D6B27C5A0760C65F13A8366A1F333A15C3EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
Size 540KB
SHA256 fb30e6ed63d7b31fbba6ce23f1784be1b132b5cd924cef5e6dcbf60193922bb2
MD5 927c8322c8fbbe1f540fc023f7466357
SHA1 8ff29c316bd6bef5fb6daa781b2d24f8ef1616fd
SHA512 807980e10a672235b1d2ab654f04da15107bfb559e9238a262d63306938b4688048806207bd0f1a1542bafd958c1e3fd8fd00672c99d04dc6aa0983c92752ea6
SSDEEP 12288:a6PyRfs9nDcoNcjZBgwZIAILbbdIvcAWOKD2M:aUtcoOgwZIAIZ9AWOi
TLSH
T188C46B91F3E414E8F1B78A3589764515CAB67C9A5B31CE8F02A826591F33BD18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
Size 195KB
SHA256 c14d64bb43d02dff58b0a375a9a92ea94ef158d287c3f954fce11757e0fbcf0b
MD5 d50feb73f49363f743c4947df573e2db
SHA1 17f44a3aca7a68b4d2f324e1f326113ecf536126
SHA512 bdfa2295a27673ebc960b36afd3106291943624a3b413077698d7ee1e4c8f6f559cf07f8beaaa42310e08a20d5c6268bf6386fa1e620d8bf663031f92c120425
SSDEEP 3072:hujSxFtmc05FvU39NY5DEmd/MjgvhagI/f1OFOPqx6l7RbE9iQ:htmDfvs9a5DEmdggIn1UwgcQ
TLSH
T1A1148D4033E80494F477DA3D88A04551E7B67E520B62DFEF9359602B0E367D5AE38E36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
Size 138KB
SHA256 bba249fc90be7d4f2801934e9d454b748f8985a0b92942e5cd0fd1b911dcd202
MD5 866fc533fda4809054d7bc91b6ff2fa2
SHA1 76bbb934916d70c7d3a476b0a3eb736a61e54db0
SHA512 5376f06a3004833041045398cb953683975aa047e69b65c4841996d467baeb35c3a332ce48d51c4733122f340ec4377ca96bb826806b9d8376a44b271ccba6d5
SSDEEP 3072:F5Qb8xU39d28vJEisdBziuxQQnxPxnsfyNMqS:rQYxs908qdB5nAyNMqS
TLSH
T1BCD35B4163E80888F6B3DF75A9B445608B7ABD915E21EF6E5340520E0E3AED1DE39F31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jre-1.8\bin\java.exe
Size 333KB
SHA256 bc465b45cb0dab3e46d22f08eb7068c11bacc167b107ecb4325e3bd652dd7cdd
MD5 d307590988831030d025a9c1e505b66d
SHA1 55c2684536aa46b6932de358843aa2a8e5ab8245
SHA512 7bd7d3c8edfcfea2f83a07954231bb0c93464372c57bb09dc805f4d89337d52aad34712c6a7a10e8388562eb40b3407a3711079028fa6cfb770a73fbba64b9c7
SSDEEP 6144:uAPTDKs9/nGGdTBjCHijPRZxOQYV/Pvy9UcZ:ucTDKs9/nRTBtzXcPvyGM
TLSH
T15174AFA1B3A01CF9EC67423ECC558906D6B27C5A07A0C65F13A4326A5F733911D3EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
Size 142KB
SHA256 577de1f6d8bc7acb652fc90b1abc687302f33649052b9215c617db8f27873f39
MD5 99cf42a32f1b7c9ff1e6ec7bccc696a7
SHA1 c324ecb8c770976ff19fbb5aa9e680162da2b489
SHA512 2d716e5b3c417483bd1a8c224b4058418aa6d9be57009064cb6cf42c45d88eaa682bc0de7ba5ed342c5aab21d6b581daa599d4343d2cc6029815e960a657fe15
SSDEEP 3072:MU39KjlXEo43udtjZqMNbWwx2Vu6eGKxm2B9d:Ms9ulw6vvWVt7dU9d
TLSH
T1E0E37CA1A3E85884F5778F729CB58C30487F7CAD1DB18E0D5259320E0AB3B909479F7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
Size 333KB
SHA256 4c9efd839a3bbf226f6af55fc8879978556e20c0b4e6f0eaa7062caa2632fef6
MD5 c2a06d5b09798a6d4b2182c356bba965
SHA1 658d1b49d7f04e9728a986d9722fd94ff3aa0df7
SHA512 63cce96a25059f5bea9dbcd06c875a486fec662cbad0a368bf63656e02b1f3a213e26603b328d42cf0460f7025957d6d37a1381ea2441e48e4786c58a9c138ab
SSDEEP 6144:/P8pss9r5UEy2eMlPsZXyJLozBYutYPDvhBp5UapS4Tn:/Upss9r5UEy9Ml0tyqzB4PDvhB3pS4Tn
TLSH
T18E74AEA5B3901CF8EC67823ECD654906D6F27C5A0760C66F03B4362A5F733911D2EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
Size 540KB
SHA256 edb0bd1fcf8960d6a091ff1498b56dab511127e46564c54fc758bc150d353e46
MD5 ea1ec98fdd906347fe908e27b6d39849
SHA1 8ef791f3ac392a2fb2d1dff98ab1d217d0910205
SHA512 d397c66b32b167e018991dfb49a7163eec302e9e884b4187913c599b049d881e432172a7a9985f9c36ed31d1a16dce81c33ace6c8b1ffe1ae7e8fd2ffb1bf116
SSDEEP 12288:cpUqZMs97cw0yVYFSoudgLLbbdIvWgvrvnPDwH:cuPw0XSoudgLZYzvPDq
TLSH
T1E0C47C91F3E414E8F1B78A35C8764511DAB67C9A1B61DE8F02A8651A1F33BD18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
Size 195KB
SHA256 ecd273178971fe5c0768a2dbd10c109709e0e95d57ed69614ca5666f22b735e9
MD5 751871676dad4d128fd7282d73ea64b0
SHA1 37077623ce8208efeb4408e7a86c011ca1ff2688
SHA512 7294c3bc5e185e454dfbdcb946cc96e2e0ed8bc2c9766a4b201e8d8184c7a54ae1135758ca145e6808c0842ae2ffae12337b0b04f670b5b8e8b6994b43e67be8
SSDEEP 3072:D20fxQt2xAFCPU39NY5DEmd/MjgvhagI/f1OFOCJGxEH7oZ2iuuTU:DU260Ps9a5DEmdggIn1UnXaWYU
TLSH
T15A148C0133E900D5E473DA3989605541EBB6BD521B51EFAFA390316A0E3A7E1EE3DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
Size 138KB
SHA256 d6f75d3323d715cc1f22b2fb1307a4894d74fa067e743a52ba82a45352e13d9a
MD5 618a5cc464b33661c2a3a0d22a1c460d
SHA1 ae864ce8d40eaeebdacab44413ab03b0e1ee6aba
SHA512 e25c5770019caa5e14821b1b7b65b0bac1cfc1d2f256c02ca0cfea195ef0da7d2cd70db6ce413834d477bde5b20f7e0564876ec5995e70bdc16fae1804771062
SSDEEP 1536:FTgQb8FRvXuhi3ugFXjb28W1VLs8h8Us8h8Zs8h8ise8MJ2zfQ7I8PxDcpXWwWoC:F0Qb8yU39d28vJEisdBzYMsxDcVbWTQY
TLSH
T10BD37C5163E824D9F1738E36ADB045248B3ABD625A22EF5E6350414F0F39AD1EE38F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
Size 4.3MB
SHA256 b51361fa4d7d6d642b160638cc6b7d1a10e330f9b63ed6ebf2db170afdbc532f
MD5 a15597c63f8e4d99895505eb4dd880c1
SHA1 40cece15c0acea251700712a1e8043d2418f571d
SHA512 158d9f7384d185d830b1eaf558fb6f37f4d3bb530b3b537b58fdff219835568c89a161a14c313cb82423f9e66bc99d2f3e75ec131a9db8e04913bd329ac544db
SSDEEP 49152:MoFuOoetPf+diU5ysVuTy+oh/LVhdztPK2e40x3xeuM6hob87/Hih4Kpm8NRV3Ty:MojPTgVr5LP8Ti6KH5C+K
TLSH
T116265B656BF880F5E1A7E178897AC9B2F7B678420D31EB4F0191C62F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeClickToRun.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
Size 4.3MB
SHA256 1bdfb59b2d83d7612fdb490dfe7be9b0b60559e932950c2161c3a76f8443d816
MD5 d4e2a7768a404ebb77fb46cca799aa29
SHA1 6f55eff5d15fd48c27c4b0dcebe6afe3ac4d7958
SHA512 b92469ab145dd704efc0eabb40c1311e6f32c80ee58da8082b6bccc62339a0fea61eb1a98d41f065f74e8e5efc43fd2e859266f506db9eb4edcb18f9d57e5791
SSDEEP 49152:bYXydma69ALH0VocZlykOEd6RumLWdp0NLsJRvOg3/euTG2+/BDpUOqBSBW8NRVU:bYZALj9k+HLTsjOESz5CNs2
TLSH
T1E6265B556BF880F5E1A7E178897AC6B2F7B678420D31EB4F0191C62F2F336904D29726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVDllSurrogate64.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe
Size 275KB
SHA256 f59e1f9317379ce65238a13d50bdadd4273e0c39e7fc3ae97433a311c690658a
MD5 6ef47d2936ee06afc8355bc99879e078
SHA1 146327a5c415f334a0d2c3b48256a6afe472dea2
SHA512 edc01b59e66a7efc3b5f5ee712785b7c0b62914a1ca832232d081a29d61f9d37e19180a181c2d1d04d7ae8853409826731bef89b378538288a796203a1f5de73
SSDEEP 6144:3l97OEs9eWGNTNYdMzATVkQNUO7q5lC0mR:VxXs9nGNTCWsTGQ4u0mR
TLSH
T120545A7BDE38F8D1C27E5CB46791D700AB7161709B42638BE134C26EDD136E09E69C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVLP.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
Size 588KB
SHA256 369c420058fc06485b49f32f75cad7bc7a39bec585930d54eeef3104de70d8d6
MD5 8306fb5ed3affbd6e81d98d0d08ad55d
SHA1 b0bf1f58c5274b105367bd682208bd664c1c970e
SHA512 c8acebdd188e0390fcb579c969ca35df8d43dc84f8fc303c8a37accdc67a920b5ab1d496447dd3469a34b5b0dfc3ff439cf27bb3fcfb78208de25953fb7cd503
SSDEEP 12288:GKk7F6Tvs9viluzvNU4TEYicQr+qYXIFDRi2b0ZLNdrc2lt:u7FEyq/c0+Z41Y2bm7c2/
TLSH
T12CD48E76EE28D8E1C27B897C96968600E6727C110B61D7CBF16CD27E1E236D05E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Integrator.exe

Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
Size 6.8MB
SHA256 100dbf4671a8f15c57adfb4575129d556110ed68c7c6ce96c3334c2702558f04
MD5 e73304994e454333b631b88815a784e8
SHA1 1ca4aa9cc86422f3200767ef9676f61814274e66
SHA512 ca76204c729f1e17d3b76f30f6a1ccbcb6be3a69062db52262e8c6c43abe8174e168fca5df9e37394e4e1e666e6f3e7689776ac2e22dcd8702ab3b5fc099f961
SSDEEP 49152:l0WB+8lD5Tzn2s86CrZNnkkBKQisy7nSHt3ID2B2Q39cTV15AmJiWQ9zOB17/xY/:lUoB2VhhjP4F3FB1GWChrrmqJjeb2tf
TLSH
T1556629596AB481EDE0AFD1748D778772F67278428E33661B0261CA1F2F33E588D19732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Mashup.Container.Loader.exe

Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe
Size 100KB
SHA256 1ea4aefe15fdceaf3bae58d0ef3a2eb15d11cb1d0b1c36e97a6dc4cdc2a16f91
MD5 f651d3703ae04f6304981d2fa2f64490
SHA1 59a6778a69a0e414f9a53252ac88acb80e57e73b
SHA512 4830b410656680e3cae191da5ddbd09cd94a5b5bb9d50c77633beb646ef6c5e12b14103830d887fc3c7295842c415441caafdc9ba53e3ae4bfb79804aea09138
SSDEEP 1536:0KJsvXuhi3ugFXjx/eAMpldERViwzfVajCN6HYzc4UYnNJtnJz:0AbU393eAcI7zD6HYzzdnNJzz
TLSH
T1E9A3D0226B6944DAC35207B08662F9C4A272FD611F41C3EF2276D21F2F177C8F976A25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IEContentService.exe

Path C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe
Size 449KB
SHA256 db477efec2665f8aaf3d88f67959f0dd326f9c54bc485ed0a68b2b298ac1aaae
MD5 1d0dae6a96974e96e7cf2aade1235ec4
SHA1 676877dbaad55478d2c0d385863857e3a9771c74
SHA512 b1c4bee8d28598c7dcf13dff0fc1c40ac9af16069fb5156b7fc083cbb0ec6526447bd6b663e94c374719ca1694f53289c19bdbfa7191f8d12e032c330b1e5dee
SSDEEP 6144:xX1b3eeX83EpugtGtAyohe+wrZQTs9Hxo05jfcbvnmwVFwelUaVA:l1bv83EAgVe+GSTs93RfM3dVA
TLSH
T1F9A49E4AEB9444F6E657E238C57BD671F7B2B8891A20674712A5C36F3F33A506D2C320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerfBoost.exe

Path C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe
Size 877KB
SHA256 d7e03d9572549b9e403e138570197bce3d892aaccb289577da26bd28556f5259
MD5 45df84ccd13da1737769fa98b18ba0fb
SHA1 02fc45a79ab5b2b3d662ae2b397cadb645a47fee
SHA512 11e4911b24840cad9277533333be48587e7fb08ae604a52c1f13c089e5f710978e1fc825d2a1c2240fcde3a500b21e2e9c81f12d5899362c6433e8129e528707
SSDEEP 12288:bDFzie3wm6uGa6s9O4vSUkLEM1LFxWvpEeZob4UnV5BMw9dAdD:fFzie3wm6uGfUSFJF4pEKdUnHBt96dD
TLSH
T106153895ABF845F9F1B3A67499B68571FAB2BC521D30D31F01A0C25F1E37A808D25B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDXHelper.exe

Path C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe
Size 189KB
SHA256 79fd69a380158a89cfcaf7df365db5c2dd46e5c0a91a3dc3fc73462586ee1d0c
MD5 b58f071644b54e625fef71201e4577bc
SHA1 c9d9a0f8ed17af43f0af494c9e273ac023a480c0
SHA512 739b4013039e324e8f87f66905a4559f5b52d60255808f4f25cf80595eb34760c9c91c18a98a2143ee75f8f521e10c2a69ae95d18d7c153f302a20b388fa817b
SSDEEP 3072:szgSCipKNq/D6U39HB1Q2+zT6lZdAh3SJxfFrgrwHLabl4WsFeFE4ynBl+BP+TZq:lShMNq/D6s9HgelZdGaFkrwRFFeFNynq
TLSH
T1ED148D037BA4B0EEE403C174C9A8AAB5F7B6F2B25D60631F5265D25E0E33391BE54B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoadfsb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe
Size 2.0MB
SHA256 1660057a1601d5cec44718fae92301729fcbb23c50707cf8db202a2940cc054b
MD5 b16dcfa008c7e703b433e6fbee7de9e2
SHA1 a22f6e76dc4aff7c83d1416176c23ad78ecfab6d
SHA512 a3b2ddd42426ddc9bc54ff64b73273f66233c17099db259db30939047732cf0aa0125a56f549204f757e19388f77a57fb3cabce32db0c9c2f630b53651c64ae1
SSDEEP 49152:LSE+Rs2eseyUMQ5/BoKTJ01GFT7bhlQxwa:r+Ps5ra
TLSH
T16AA53946ABE8C4E5E2ABE2789975C9B5F6F2B8410D31974F2156C70F1F336604E38722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoasb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoasb.exe
Size 341KB
SHA256 d69c1ef9c2aefe768f10a0f0a49ea8258618889d724eacf5373fde3134e759f2
MD5 aedb71c81bb9b9f2d63e2093814ca059
SHA1 ae7f26e20198a9024446c9f8ce78fd1d934f2a66
SHA512 af673e56998f9d3bc6b4f9e9df84abc2c98451c3b7acf38a0164bbcbc7bbe10e6a984e4481d237cd600557ae6092bda366d9a8f8e5f01d3bb457580991facbf2
SSDEEP 6144:52N7s9INzUxqPRZo8eUasplVRxUq9bhvRx9EiOwZexhPZNd6R:5Qs92IqPRZ1eUaspDUq9bhvTmw4DgR
TLSH
T1FB744A577B688CE1D917A1788986D2B6F7B2F8604F21C30F6952C35F2F37261AD28B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoia.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoia.exe
Size 6.0MB
SHA256 89380300adefdf2084ac40715ab7a66bd4220b6064887f8832d011284596bae1
MD5 60377260f6fa84fc609b0a0b34071c03
SHA1 2a26d861aa3bfa7446776adab056b6c7be9ee5c2
SHA512 f7c2c3f8433bcb394a5c54c89b85b1200edcf8a0797a556427fb2671ce727eb0d2035a2570404c77b092b401d8101d897ca0c736e4a36013c9640bdda9e155a2
SSDEEP 49152:kNfH+lbcsW3JxtJAdCmeLAQZzk/sZ3Uf+WuUT/42CdTE0ZmtiJmK293+XQK+P5jX:k4z3mNaTCLm5KZCLw21maGt6
TLSH
T190564A55BBF982E5E1B7D134CAB286B6F6B2B8555D31A74F0451C30E1F33A909E28332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

officeappguardwin32.exe

Path C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe
Size 596KB
SHA256 2522e134490df3dc23135a4b5c36ca290dc1fe5a81eeeb4d0b012e713a7c6e36
MD5 a34e45343a267df18f90c26d97a175d1
SHA1 875b3c89c9405f07f329bfb2303f5fef2c960e8d
SHA512 1cf1ad168f1bd203745cc45ced4c8a564511b63300536709445a67a2468b5f7f467088c46ef86f3a1d464892a9ab8057da8dbdea61f76c8cd48aeaa547d834f8
SSDEEP 12288:M+rWsDLOgZCvtigy8fs9qcIPr0lypFp3ZA:M+rPDLoE8AcAlcDZA
TLSH
T165D43981F7A881E2E566A1348A668171FABB7C131F70D70B7559F32E2F33640AD29731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocolhandler.exe

Path C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe
Size 6.4MB
SHA256 87ca4262e53c5ce57732671272d7a1b8f9b827ee5cd02566686797c20eafc20e
MD5 465d9b129a3183106b5e5deb7717f50f
SHA1 e64ae0280bcac3f1b66450cc30e6a8816f7ad66f
SHA512 c6c90bc2bc3fba0e44e54a815686fb55b5ea8f50210bd468ad1e0c91e26cf9f58a8265f77bfaf039e101c9e4da5eaaa4afa7dadf405e9da4cbfad97426a54ba4
SSDEEP 49152:5S4gKpGQpFNkvfKBN0Gjj3prHw3Am7kW4ENciiZEn8eLewMrrIazbsF9OYQZxFZI:SQH+cIL5mbymF0AzHj5O
TLSH
T128666B417BF880F4E1B7E2788A3A9675FAB278425E31AB4F0151CA1F6F776508D29331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OLicenseHeartbeat.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe
Size 2.0MB
SHA256 f61edade0ae67ec4319e4148ecc5c39ac6439bbf86f47a4721eb696a3dac3d51
MD5 b50a8815ffb511c6961a08d9e270bc60
SHA1 892a568202a80fb8f8031dff08562e9a830981ab
SHA512 74f9a63bfc60db5212f9bf877e7181fa0c5582f20b9865a9ce47089fdf6935508b8a64bc15e418887eac6249cf419f429253e43fe241d99bebd843ccc0326de9
SSDEEP 49152:eQ/FGYQPZ4y/vWa3DLnoy5a5YrU98xjqrAWv:cZ+Rv
TLSH
T1C0A527416BE881E5F5BBE7B88AB68979F9727C521C70E61F0156C60E1E33B408D39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLDumper.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe
Size 222KB
SHA256 6ac8253d1f3b02deaa4bb7e027c2b9f4167234ecac08124525cdd2a99d71b174
MD5 fcde6133cfcdbc26c608c54977e53b97
SHA1 2519cc2c71359c42a0f31dc41af945f1d3f946fa
SHA512 22b8e9671e97f0117bc8d17ca53b9fdd6d678dab67e27dd9f8e27aced32adce853a464ac7b64c6382941401656474a203633cfd06cb1c1df1c7c69e912e7d613
SSDEEP 3072:XY9RrhZsptxU39gaj4+qrSVzN2Bmt+hlXmwbZBLGLYDp52jpM77:XY9RdZm3s9gaj4dizKZ98M/
TLSH
T10F244A007BF92098F5B3AB709EB581126677B8A56B31D7EF0158826D2F73BD08D34726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohub32.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe
Size 2.0MB
SHA256 78b478f896bef1c0239eb4a984fb41d86e4dfa2f1f313ea6d69e85db1563f1a0
MD5 13d7d87d3e542fdbcde362fdefbe2e5b
SHA1 1df5797daf3535fafe99753aef8d41983ad5e2d0
SHA512 1dc21e296e5116150c8fcf4621bcd9ea6b5520fcbdf2978fa2538c02135d074496107fedefbd02068e2656f24682180fd9f637d9c0840a65f941a8f85556a923
SSDEEP 24576:lJaNmYlkF24YGgRg+assRqdzP97DM52A2NBH3NRLOPOPFVwQPHV4mORb4FgwPqeF:lJaNmYlkbudjuf4ULOH+MYu8m1/p9TJ
TLSH
T140A55985BBA484B4D52691B18AA6867CF7727882C9334F07318DDEDEBFE36604D59330
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreporter.exe

Path C:\Program Files\Mozilla Firefox\crashreporter.exe
Size 3.5MB
SHA256 3bdedb4523ac99b49177990455aa9e491f259dcc412918124c08ad1ca43a90b1
MD5 985c9a45ee448ca285a7e06d8d159b34
SHA1 767f3f85a607b4a0a2a4cfec70163713f1ff781c
SHA512 6fa3c59c9838cd4493cbb1bd8f7e92fcfebd09ecef4f2b9e55654c17cf457272e3deaffaefd89b165b3a6e52d05d078716bb9b423687c034ee98a2330604034a
SSDEEP 49152:HYZm0TqXAbnw7fO28wsz3iDT4JmeDNB05FQz/zTmXLhm6kV9oGtv:HY0RADwC2Jg9f05FyfaLhm6Iv
TLSH
T125062842EB611DDAC025C0B482266723B761FDBD073036F74A906735AD68EE01FF9B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox.exe

Path C:\Program Files\Mozilla Firefox\firefox.exe
Size 777KB
SHA256 b69aa39642227afc6ec8e51fa6e7564b3059a1ff16028f9c0e70ff0a0461ec9a
MD5 b112f01fbaa8e4dddae0f1d5e168d2d1
SHA1 36042eb549309bd82a0131f030705c39c0a127fb
SHA512 43d934be96df8629c9c66f419388cdc917e232db9457607e3bf320bf6cd7978097fa0a7edded7496d3b302532f354ce18a85552d5dd15ca3df7d2d4ec5f70ac9
SSDEEP 12288:sslypFxdbbEOggJXnJoxfkhs9RRA6SoqGPpW36LW9zwHJem7OzwHJe0Ihf7EJ+0g:ss0jxdEcqRAlohRW4SwpemIwpelzEdC5
TLSH
T1E505B003F38516B8E48AE5B89652D133A5727C840B51A1CF1BE93F2A3D71AD12B7D72C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
Size 329KB
SHA256 1d57baa224e310f270e014055ce795a5d3b9605150c2e77fc71d065a332ee580
MD5 dbbb66f8459be174dd85d6cf9d23d870
SHA1 17d42b79af4bc7d07b6a7cf3591988a81965afe9
SHA512 251b59958c4319a5d04a5346357e8faf28834de0876bbe95171ed04cfb3aac91c8c9a924b133f48f9230efaa8c7285fa88f5a9546509848f98ae959905f930f8
SSDEEP 6144:6rs9F6X70WuA5rWKyif1RAO2lR1ns/iJPsfUrcAJyQ3iHU:2s9F6X70WR5SFi92lR+2czAUHU
TLSH
T1C474AF6573D409F9DDAB827CC8618506EAB3B8954760E7CB03E4C52A5F233C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nmhproxy.exe

Path C:\Program Files\Mozilla Firefox\nmhproxy.exe
Size 654KB
SHA256 8d3732896894ee725be7eb61dbf63d38d8f181a2a44385a90289b194b04d407b
MD5 5ece55be2766f7f6173389ef09eba16f
SHA1 0ee96840547bc4a460728b4c70ad38799c5354c4
SHA512 a97187fcbef459d9c117931ef8460d09fbc656cc5724a4b716387bd81227078debef7a827851b2ae585b24a01d404cc8ee8e676a793574c54fb09a9ddeda7ca2
SSDEEP 12288:oaALNsFv/NI1KuzwruyR3ts9rpc/waheN4abajxK6:7ALWN/KKIbq3cjmF5
TLSH
T17CE46D02FA97D8ADD51EC174864786327933B4CD0B30AAFB22D85A353D5AAE12F3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pingsender.exe

Path C:\Program Files\Mozilla Firefox\pingsender.exe
Size 126KB
SHA256 e6c7501b59f5d67c44638c3323b2687784ac2210073537ee26e92045702af529
MD5 bda132ed9f2e303c4c12a55c2c42150f
SHA1 f25939fa545ca717e9566d1ac8bfdd69dbce95b8
SHA512 9f3a4e4cd4a5a0f73b361672276291355f7d122a407c30fbf59381189d44663a705e26fa2217c229e9d464613c88c1c118f475f38d0c9bd28a15df8ff52ccc04
SSDEEP 1536:CXzh2BKQj0vXuhi3ugFXjReiPzSRn6dhSdWA7gPrAWi38oeB+j1UYdrvuBxw6e8P:CX92fjjU39flSh2SdWAmAsojEw6Mzk5
TLSH
T121C3CF436B105456C96583F8A1EBA923E3A675859F6927CF935083012F093D47FBF3E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plugin-container.exe

Path C:\Program Files\Mozilla Firefox\plugin-container.exe
Size 202KB
SHA256 028de540434c81bde2dc0f75fd23953b9a6050c76723f674e5eb98cb52bc1e72
MD5 d6ada562093d4a08ac3b22ea5b5ae95d
SHA1 b2bb0f21cc77ebc3b3261c1303b96b89eabcebeb
SHA512 dbb465bea4745a541579566a94b0522236897c7c6c00ffb0ad7799319d01311d4a14e56ce352db62057131a2503743a16f2f3ab5cd892e27b78c4578304a2e72
SSDEEP 6144:GZkTqoGqWs9vaWzEhEuDcJQg3DTsg6lq+cADNRP5VNJDVn:3Wo1Ws9HIFcJQgSRhVNJDVn
TLSH
T18814CF13FB8801F6E445D179A7C24122A7B671860B21B7CF23556A203F56FE4BFBC299
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.exe

Path C:\Program Files\Mozilla Firefox\updater.exe
Size 523KB
SHA256 4c3a1c1acc4f3a958fffff1ed97cf827fde49521f208c145ca49d0cbf791ad95
MD5 52aaf601852224c3241713e72f14fe89
SHA1 c42f5dba679621cebc786abc4267720c4ad20f68
SHA512 aa4fc01cb8e8484f37ca0e0008f4ea4fd359d645edc708976707fbedf7f0d9da5dad1c1b3671a08223f301c4b9e8407fa8bd8f2faff1a50659113e8c9dec96fc
SSDEEP 12288:wTBzLLBVs9rpQO7hZAybDrGFE2ZeceSOJAdGyuLk:8BzLVopQO8qrO0J+Ru4
TLSH
T183B4BF29F7A00CF9F427A274C9A28511AA73FC55472096DB62A4D2663F333D41B3FB94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 188KB
SHA256 3284e28b05f4f90ebbc470dcec717639c31abcec99563911fc4f3dafced15262
MD5 e8a7dc5be6e1c86956648caed60c9672
SHA1 789f3a7527cc633fb68d934c3c1e85c45bda46cc
SHA512 a7b5509f5816dce37eb2255639e21fbfeaaeac4d96c404b8ba8e283be44bdb38a5e7fb8d7971dc1fb1313e1848fcaffe8152afc7ce0fdc98b2a16429ce8a46ac
SSDEEP 3072:8ExAN4dRU39u2sV8pQFq4XKF3QPbjZ6YUgKYEGPJ0Zm00q2TCadNyzMX:8iAN4dRs9XssQFqT3Q38YTPJMmZqoCJU
TLSH
T195146A59D29842C4D06D2179C7519A82B7333D2187E1E3CBA2C0F67E2F366846EF9B53
MD5 SHA1 SHA512 SSDEEP TLSH

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads