7fd88b5f67c62f311b7c3fd89b14c5ada0c3a4b031be8a9b9eb0c53ce9a79322

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
Size 1.1MB
Sample260807-stem8agj4z
SHA256 7fd88b5f67c62f311b7c3fd89b14c5ada0c3a4b031be8a9b9eb0c53ce9a79322
MD5 c1d178354674996da88ab811d8c84f0a
SHA1 21c02150df76da7bbb6e8904f171dc1c24e680f8
SHA512 5906d4202b3530071816f7cfcc67d877cca420676b5946c6763ec0a61f7c865887a7cfd1cbc0061bbf40c46f0255bea18b1e8684ffd2ef4f4d944b31c814aa83
SSDEEP 24576:VBK4bph1VykI9jmifS/pbJnh0pyOBYKUJSqsjrc5xaNIBgTH7:V4mzVykI9iifS/pbJnCpJBlESqsjrQa1
TLSH
T1B6358D4A63A4419EFEA7F176D617C60BD7B1784A0336962F01A46B726F337711A2E330
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Y:	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\A:	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\B:	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\G:	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\J:	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\T:	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\U:	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\W:	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\X:	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\H:	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\I:	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\M:	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\N:	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Z:	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\E:	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\L:	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\O:	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\P:	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Q:	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\R:	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\V:	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\K:	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Time.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 20 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5016	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5016	2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_c1d178354674996da88ab811d8c84f0a_agent-tesla_amadey_icedid_njrat_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

64BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
Size 296KB
SHA256 9dfc53b789ebb9f50a511b07eb017d70f8fc55d9ae5b33fca9fe6a5d9bf2f40c
MD5 17148cb405a4f1fd4bcd8f7884268d9a
SHA1 b0d81fd23182f9303faf1e108fa668214c90b882
SHA512 4e394e73f86b68b5bfec77dc1024abee674c0c8582b0c2fd15c62bffdf75fb38f1f6409ea2acd1e775d11c2992f405a52a1195b3cd9d2b75d4956aeb46a64fc2
SSDEEP 6144:h+JW4bs9ZTBSIdoLg/NxIiKcJtqQ1Fm4xOYMl:AJHs920o5cymm4xG
TLSH
T1AC549E5A37D84CF5E457C13989929542E3B278854B34E7CF6360436AEF236E0AE3DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95875\java.exe
Size 333KB
SHA256 5e5704a6fed51c64a21738e6d5f69790ccf585ad13c994a68814d181196b5acc
MD5 070c3d4c02a3f4f34285906206ae8374
SHA1 9793187a9c715208d0a486e1efed785da8b129b7
SHA512 423e08ce1d7f1d1a725809ed434e5f4b4894cfab63a1da75f5daa0dfba18075778597e1615f4d287c7424ff5d7f8d2ba081ab2b77542afee74c377d7aa02f076
SSDEEP 6144:21P95is9RsnsPFjoBkcETC0kZYV/Pvy6eOwonK2H:2F95is9RssPFLnAcPvyl7L2H
TLSH
T1D274BFA5B3901CF8EC67423EC9558915D6B27C5A0B60C65F03F832665F733A11C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95875\javaw.exe
Size 333KB
SHA256 f1a35a6164c8b6b8970edfaab814ff95fec749b3ebb83c343da67c354b384f05
MD5 4a7adb04dd7f8556b98116e940ef830e
SHA1 e52f968fa15cd2c231872bab78870042fa8fdd0d
SHA512 d7312eef283be1834dab19d1def371718a7c56562cd8a896058ab83f4698ec21c586c6cdd532dcf5e975dd8f4e80fc0d86168867b683549631845846488194ac
SSDEEP 6144:KO3vBs9rTFP9vfscIes51GnH2RzJYutYPDvhNLak2TNy:KYvBs9rTFP9vEcI3SnGzJ4PDvhqhy
TLSH
T14774BFA5B3A00CF8EC67813ECD558916D6B27C5A0760C65F03B4366B5F333A11D2EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95875\javaws.exe
Size 540KB
SHA256 f15b1b6fbe8406286408abe7fd16c0f6e2ba359a5dcbe1d6b3162cac45388a17
MD5 6ad831b26e110f4b93ef57d28c42966c
SHA1 035e9d6cb61a71eb20cb7fd68451aee0aebc30ef
SHA512 1671227b26733c493ebe1081f4c6a122a1a36d6afa61a890fcb526e07e748308df874fb76dd1563f48ec92f1fc9de1580c08d32f107b8be7c8d59b291c9360d5
SSDEEP 12288:piMVCGs9XhP/6aCEMGbf0PLbbdIvWPa0g:pvoP/HMGbf0PZnbg
TLSH
T1A6C46C90F3E414E8F1B79A35C9764511CAB67C991B71CE8F02A8265A1F33AD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe
Size 596KB
SHA256 e8038716e6470a48e04c106bdc09123cc82cd12df99196fbcf25b5594b72c2d5
MD5 be06c0db94e7b2f7a6f480c1a92ab811
SHA1 d497186e34bdef21292f8ded2fb3e338b06b23b7
SHA512 1236ff6b31a3913ab4d08df890db52e32af0ff46c10396e0f61b675941cbefdfd535787e0857c4d3db042ae28cc5bb617de095ea3c642ed51e78663201644d9d
SSDEEP 12288:x6s9NYfuSdQqXoPaof6rNSB6v+WDi4+l1T:hYfuSDovKvpDiLT
TLSH
T1ECD4BF41B3E846E8E06EC134CE538A46EA7274560F20E7DF01A492792F37BE55F7A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe
Size 6.7MB
SHA256 0e9b2b369c31888c774d4688548dedc398b67092f7a2ef43bcd1dfc2ae66c9e9
MD5 95c4c366968a67fe4ba946fe4784bc20
SHA1 084490f6856c16dea5962a66f803bd2bfb40fece
SHA512 a261ef9763d7550bf60c40db7fc70c3fb9e4ef96eb4be5172b18896edc7d7978ff1d851209d2fa2f55c5a2e8d9488bb70922873252b438beddf3ae8ce58e52aa
SSDEEP 98304:+l8YfTaJ1+Wl2B2L4HrZtDPIieK5M0uR7F5ebiC:u8YfTaFLyIiFUpIbiC
TLSH
T16E666C47E3A600A8E46ED970CF3A5521DA253C8E57B493EF129476E81A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe
Size 1.9MB
SHA256 f913756cb549f619b598faedcf9de70cdf29b9322558625bf0bee4bf66e9c0fe
MD5 01f4f7f6c10724edec1a1336c99be7dc
SHA1 7eb225e1ea5f1c70f7bf4109737a4975b9cdfa11
SHA512 c8485fb4ee22b7bfa71307c61f51d5b092e22c897eb3706f6a8b15e652dd2a4a60f6a600ccbd951ebebd20980312402f3ca0df4f7951073432cd40e7838f8611
SSDEEP 24576:wunaGy1PGU0BXHqlxjzT60L+5L2NLb9Ld25PTOocJuJ/cIsY6WfvafPc3R:TnTy1uUcWxjzTQRwpZeToMJseo03R
TLSH
T1D0959C03F69940E9D06ED578C7469236E972BC890B34B6DF0290B2992E77EE45F3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe
Size 1.2MB
SHA256 894a0ed1658926bab22dd05de12ff2d87abc0bb69af20119b68d18b0de2630a3
MD5 0491ccc4931aa04c52d3ae09ccc457aa
SHA1 739aa20b4c6ad59cd971ac031856cc6bf114730f
SHA512 d12605cb917eac304a6145a6b0d8e475cfb0e6fb27c9eb472f4a57a89f3fb055f8924dc466a246ab25fa0bec37a9a89e0003fb13b30d51382c8985144e1e8744
SSDEEP 24576:vrjGGw22Rv0gXaWx9h7X+v52vlw8ihIVprSBAUcX:vrSz22RvSG9VOvE9L9pGgX
TLSH
T1BB45AE07F69840D9E069D574CB668132EAB27C460B74A6DF06D0B25A1F7BEE86F3D310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe
Size 3.9MB
SHA256 f86415e9b28d58207e436f8e70e8666e5e63f96aa77d14ee999b634df99bbe40
MD5 2d32c2bfe4e9e8edc78b1f6b6e03bee4
SHA1 5006d37c96948cd00838b436a5d88d4ef41bc3a3
SHA512 bb939acab6c18cf9c210281cf5b777f6787c2a5e1946739e4d5b7206367420908e7e36ad9fb8a6319cb480b159275792eba18c5e2f38aeae552d5e1423628244
SSDEEP 49152:MFD0Doiq6H+KmSJdfmfIPCiEQAC0GD0AGIuVEusJ6LNzOeL0GKVIeCjIp26If2yg:xMmSIuVlcm7fwKAt
TLSH
T1D4165903F29940D8D059C074CE5A8132EB627C8D47F562EF3694B6EA2A73AD47B3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe
Size 1.2MB
SHA256 48ee40f3190c779750b8ebba8f8013aa1fd2b80cfa311bf94597f28865a1f7cc
MD5 21feb1a77d6221f59351a6a60cc44beb
SHA1 113ad1b4fb48c19ad1cbf0f710aab9eccb2163bd
SHA512 c205b2150856b66f310997d8c6449e102122c9e8a292a76609219eb973f647d46f455dffde01fa4d1476063795e1d122176e4cf914ee04c9513d2d8783b5fa4d
SSDEEP 24576:EZO01XZoFCSX8gdKfBlCpiFCq4Bpr08m4qtDRu:EZOaX+FFdsB48onBdNwzu
TLSH
T11145AE07B7D941E9D06ED5B8CB568132EAB27C860B20AADF0690B3591F37EE45F39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 1.6MB
SHA256 2526078533c9b02bdad6e687b1e09012e497e39ba0a12e4f336bca2c21401b3d
MD5 21a20943b85162ae950cfc94155e8abe
SHA1 35642cf5bf7955784775eb5000a730e670438389
SHA512 9f12a2b3e4836c1b9a6dd9b7b409b3f063a729947b7a7cc9d48a3c057d19514aaa1f63f1da59b7c026b278911e7f739f7ecbe879fdc0ee599d3de099270fe3c1
SSDEEP 24576:87bsxgqFf+V0wzXGn4c90YerHcv4hND1tGK2Jlkkkkkkkl0T3gAQKyUNfQ:msxFFfE0B99eU4nblwPQ4Q
TLSH
T18C759C03F68A81E5D09DC278CE764B34AA717C655F20A6EF0190BA253EB7AD04B3D7D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe
Size 3.4MB
SHA256 72331d845e396a5528fe62448156862fe9b1abaa344f82ce9a697c2677a33dea
MD5 ec83b2ed888c8a844a1a4946eabd17e2
SHA1 82e92b046d923145421d57d2f036a5d21706c89c
SHA512 8163ed7dcd241317c169029a4ff2c807f0e1b8c6dee146bf2dd7c8d7635b18081ae75ef617ffa212be8229695208d354f7d84e036520a2dd5a6ac4065e5a2260
SSDEEP 49152:+voEhbgahLXEnqurdcFVBrsFIjUqMzADiulO7Udq+KqOuBk7bVnU7wF62JtYIFcH:Po2wiul1EE4wsFk
TLSH
T1A2F54803E29900D9D199C078CE5A8632EB627C8D47F562EF3290B6D52E77EE47B39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 1.4MB
SHA256 6302d49b6207c20dc56e9ab4f4165559f16c5964e8bc585d5c34d6e88320fdf1
MD5 881756ec2bd146883d6280bf952f5355
SHA1 d6bcac1994287cb9f3df52329b7e3b6be4b6ba7b
SHA512 3adc06b7a84e2e04b797345708c56b7f596fd75dc8a9355af368227b62b2cd48f40933f1537d4502574b96d6d953edcbdb5bcec406c5fed81a9a1ebac15b5077
SSDEEP 24576:Ms8Kc7X5lojWjX/VEi0Hd776k+TmrZPge1qRANQ/e:B8x5SjG509vn+TmtPgSmW
TLSH
T19B659D03B2D941E8E06DD478CB564536EAB27C420B34A6DF0698B2592E77FE85F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe
Size 1.2MB
SHA256 d0cdc2f4caee9f236d00a8f7071c5fd0671e49c56b63dcc02218baa116bda853
MD5 7ad0a089a81355c2ad163a443973a6d8
SHA1 85479ee282cedc9027e305f9890716f14c4b0d10
SHA512 5bc041dfcf5ff078514ee5c663f4cb854b9744adc822403352f5b366b81ae705bcc127fc7a9e781475718b4e2be824b94264717c49c2bf9db6d23d186544b340
SSDEEP 24576:l6VZShBGoqdXhPcH3FJVAvoXzKIHS7ElO3:l6ToBGoGcXFJVioXzZw3
TLSH
T1B645AE07B79840D5D06AD578CB668532EAB27C420B34A6DF06D1B2592F37EE85F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 248KB
SHA256 b5ff6e3a914fb10458a7960b1d03b4018fca2033c318475124dee618a5ee1b13
MD5 58a6e13bca3e5f8b075f59964ea2b658
SHA1 e10126ff307be294c7df59bcbec73708e6d468e9
SHA512 8c93e81256bd39964f804284451c38b239c0223d2da42f9cabe2fa00fc126dcdc1c38caf30500cffef952782080b346e94673825e76d1aaf70a08987aee9beee
SSDEEP 6144:4s95nhaO9y7qAbEtiyR/Cuoh0Upw7tff5:4s9VhRsqUyRoRpwB5
TLSH
T1E7448D6936F810E7E03681F4CBD59512F335B87613208E7F4390426A9E63651ADEBF3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 265KB
SHA256 e18cc180ec7b2ecec48666fd5a2b9748685b1e3fc5b5ce6cbc7d61276776302f
MD5 5fefd6a27d2952912ba8d0c1b604f3cf
SHA1 0dcde3cc1eac2527987c2372aff972c526075875
SHA512 a7c3d36c1848c6cf46650d03f8137e7181f39cae88a0d27e53897acd201a7fb7da8777cfcbbe60d125816f3c47345019618ae15522453785fae0f49e94190d99
SSDEEP 6144:9s9jrGbBrawpBj86fWYWoht+uoZQjOSUiAWirkl5v1n:9s9jrG4WxWHo3Vj5UiTQUV
TLSH
T13E445B6925F810F2D176D1B48BD09903F235F8B6A7108DFF4291435A9E23A916DABF3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 610KB
SHA256 eb2b1a8ee5fa98f034afaf38e3b6efcc877fbe6a6ad80b7ca086406785261179
MD5 562ece2797a2455acfb15d12b290405a
SHA1 4dd22296f3a3109c7e85c4721c458656fe406a26
SHA512 c1f1e354ca1232c8b2247e6aec2f5ddc10f6fc6bee3a04edd8d024b34cbbef32605cd87f93fe88ec5c10b9f3ac1717fa01c98c0f40186fa05bd717a23432b5d4
SSDEEP 12288:ss9K9kJxFL0YXHVlaBSNOJ9WR915rBrDLF0:69kJnRa/J9WT3BrDLy
TLSH
T122D4AF81F3E847E9E06AC134CA528542EA717C950F61F6DF02A4527A2F37AE55F3E324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
Size 7.2MB
SHA256 f19d4ed6d794d98b3600035717ccf26d68719a63bf17ced6417529531fd99627
MD5 95600855ca0c6de50c02230aff0f66c4
SHA1 0018bc60ca43ef1fd1b902142d68dba300c509fe
SHA512 f4120272b670e6b0b38b50120b851c1ef9dac765784c736a94673534429fd97dcd2a8e0f8b06e0128bd03618ae284e822f10157a264eed167a09997722f5402d
SSDEEP 98304:E6CZetahq+WZxbuwCsJB2++fGNOxRj2vJzRN+T6frSR:HCZetasiGIGUxVqzRdDSR
TLSH
T185766C07E3E600A8E46ED974CF2A9521DA353C8E47B492EF169476E41A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe
Size 3.9MB
SHA256 500a65bdad09fb977319c681996201053e250494462fc1e3f3531001e71a3bc3
MD5 5005307d2386f1598ee77f8568725fe8
SHA1 6ec370a2ae1dcf7c94ed0ea9a3f2119c4e95b338
SHA512 edd0cb746676bbe6921f14c2706cb29ecd72ef4b134065d86b23636e961acdc186ae28753b853c663b5a59b2407e7bef1cfeb20eb45c93c64ec899e34ad3f528
SSDEEP 49152:BWPyK0bBs44jVsZ/U0bmhLbKqm006NPpIupENVu+e6NqcXToRzvUqIzYHBigdQB9:TKYs358cKmCCMNUhIUBbxS
TLSH
T14E165A03F29900E8E05DD578CB568522EAB2BC850B35B2DF0650B7562E7BEE4AF3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.3MB
SHA256 1d85e7fda00ae056a1f3a5c4d457a363834d189012ba31d2c98b236ff85921d4
MD5 1ba9d77dbe49f04531af52da17d38c60
SHA1 6055a596031d5e5125b4a300a453ee3c273b21f8
SHA512 7b011ae2e6b64072dc7fb76baaacb0075fdde01e6ccda54c3d588d48578e8babe00bf4fb2b53b01bdb8403b4de0be0646aabd3eba5ebeb5ae125beaf965d8a22
SSDEEP 49152:G6YAFglogRwC8Y1yE6KstBhuXjfS4LWxnr0n:lgO7ijBVn
TLSH
T176B57C03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 1.6MB
SHA256 b1fc66b2c2f6b149a1c1ccc4b041c924a0f19c295a2a9b562d27fdde3ffd2ea8
MD5 10ec8e3e69c391dfc6ac9997220076c4
SHA1 5dfa2f44667423cfb7d6f509a2600e8b6a8ce220
SHA512 612d111e82aa7d6008bdc04d1302ab722847f7b761421b804b8e53d2b4125dcd18e30c9d89e894a0567e206540ec986c35e5664b93116ef3763a54741324570e
SSDEEP 49152:5Bk7SfHHTjjlrRIOf12KnGJTlXrk9dBnhPJ:fqUrGJO9PJ
TLSH
T173759D03F39901E8D05DD1B8C7568936EAB27C450B34A6EF0A90B6552E3BFE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.0MB
SHA256 732df1e759a8589fe553ff1d7382f2e63c7ad3e34b574fd5d394c5631bcef8f7
MD5 46699575ef35c7da4481b59112216ffe
SHA1 71116e7a35758252d70c1e28ef0f34b7aa0bd6bc
SHA512 5cadeef98ff8633890f7c04e088c97deb3c1493dd327928bbfeafc3e93f6858fe8ea5e88a19dc75310202f6c3c0041dfde3201b0120eb06717d69a0e18f9332d
SSDEEP 24576:d3EPaUue628vIwz1Q4uhrR66BADxius7CtW7KSdHBxmRkkkkkkklQXBysWAjwJdK:dKueQvBgrR66Bgx3ZrSdHBAVfjwJaV
TLSH
T10A958D03F6DA80E5E05DC2B8CB768B35DAB17C554F20A6DF0680BA652E77AD04B3D394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 3.5MB
SHA256 3373d71b6cb561d76eb4a7f05ba090da227d3cac608680982ea554c8fc70a5f4
MD5 98337398ad2f16f1588ca9592b074f84
SHA1 dcf2ccf970d4baab5fb9bf020c5bcc7b550a487c
SHA512 8ed6306c0709ea14086eb0ed60f877e630560a3466da1640f5c7b565902650a71bcc3fc14b4fffa58d2a8b507a39af7fc0e8e8830d902d7d560e951a98c20e8c
SSDEEP 49152:6uz6Js5er3GA1xWKpdjSb00v/b6YErpz4AkOuaRoBISCaQZCLlrr03Eqy:gVLEV3OnZt3Eqy
TLSH
T1D9064903A29900D8D059D078CF4A9223EBA27C8D47F566EF3690B6D52A77EE47B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe
Size 1.7MB
SHA256 e4524f0fde79eb26a250a0e82ec1852d8fc3e3d736dd7c039931bc4fb616be89
MD5 bd831adb40edbfc160a29de1cec7c3f4
SHA1 ad9d1abfad24df76534fe9f3e5fa88b38333b6d6
SHA512 9194c14dcc3de8114a6b0e7f34365eae267564277aad29562bbbf780c31f5941fcd1cce0935bc79d50ecf6753a9860a373fceb026dd7f1a86fcf38e5c1f361dd
SSDEEP 24576:BngNsd6zu9cOaaSXukJZE1b4qjVmab90eQuJXlPnyF4mfHU9YawsNRdz/C9+:rd2oqDE1bDjVmcSeHX04mfHIrw+
TLSH
T162858C03F2D901E8E06DD2B8CB568536EAB27C450B34A6DF0691B2562F77EE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Size 4.1MB
SHA256 dbf45f2727df2ff45c4ecf4278362fbd7e2f6f97774aa9c24ca0f6e2c386eb23
MD5 ea56207799a9e6f0a43c53cefcc17277
SHA1 3eea65db74f9a8864af44b832198edae19c82a9e
SHA512 20e05c574685d04d61cd3476b424e94fc566278420ee1909240c6a1b73d5f2d3ae1bbbd25ac1f680778c2db2caa741e31c044a58497705fc6de9286b99534b21
SSDEEP 49152:DuBFE05Ck+cxDRfliswBL4M8+TjEYzExldDwUIDtaZHWRdpev2y/BawS:QWgOjKdd+RaAX
TLSH
T1D7165903B29940D8D049D074CE5AD232AB617C8D47F162EF3690B7EA2A73AD47B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
Size 1.6MB
SHA256 1da8e8f5f0056e4f70e14351c6fdb6739003501c4e65b80a96989cd6c5ea71cb
MD5 837dd86a41ef445a77a71c05791ac9aa
SHA1 8bdfe657dab7b1376e28379f1c877745ed007dbd
SHA512 e1a0c1e86e1a89ce8d54a2a704eaa508f383f7f98466a48074933516845ee7f66625d63c2dc587f824e2b13498bc79387b035ecbf94919856d80a5cd658ad462
SSDEEP 49152:tdxz6UCtNuhNC1s6T9oBo7EukU1z8JjJC:7F6UFY5eJjJC
TLSH
T1F2759D03F3D801E8E069D1B8C7568536E9B2BC450B24AAEF0A90B6551E7BFE45F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 1.5MB
SHA256 21f20d365c2c6aacf74aa597d135557b0c5c0b12f9bbab8018fff4f21fa0e02b
MD5 461de6b17369ad07401acbe4d52ea921
SHA1 b77288275cf705efb51cb948ffb8c0e4d5e2d89a
SHA512 353a5aacc12986e8694590230c9fe32fdd242f2b94d23055e276deedd6237da5b85c70f0090ee3c13858eb09bc2df0a2db92b37c2f026b701a60cb36b84fb1d0
SSDEEP 49152:KRGCwXbjGjJleHLux2n+6h27dojZDep56Iz:+9Mjk/ptKjZDepb
TLSH
T1E3759D03F39940E8E05DD1B8CB56853AEAB27C450B24A6EF0A90B6552F77EE45F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 329KB
SHA256 929352a4efa8a89b326a1479d9974fc95113ce1ed2913717e7f8eb6026e4d13c
MD5 68be40663b2c479f657cce8a86cf0936
SHA1 cedf7074266fdc71001d179f454429c42f28ba18
SHA512 08bd727d05ac26f4307e8f1d498d334addf1954bebe3c7a38a8c0a15c45cf981468f8d4a6be20b7989437472de3afd4fab681e84535212bc17dfb640663d1bb0
SSDEEP 6144:ZOs9CvMdM6MU5UbKTKu1Rmk2lRIbT/iJPsfUrcAxbNPFSsUsjcz:Es9CvMdM6X5M8KS2lRU2czAxbXj8
TLSH
T12A74AE2473E008F9DDA7827DCCA19815EA7378514760EB9B03F486661F237D85E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 672KB
SHA256 8fb3d26773c2cb7461ca991dbc5db200ee7e5ff4ea8e87a1d6e0c87b0313772b
MD5 59e44fc585a3e57cd9a5c1a05a17a467
SHA1 96e0997733b1487644220332dbce9d0460f905b5
SHA512 581b9429926a901667518d1760f6e9a73da13a76e9b06b9c43671fd6fefb3f3a1b7055ed009c0447e8e167ac255a8910acd32beb6f39efe3bd240a895c3d2aaf
SSDEEP 12288:5aMAJVRqpUyASCGqUftD3s9lrHslGJjnsBZ+MV:9mRqmyAS5DcrMAJsBIa
TLSH
T1BAE43A16F6748735D073C0B9C5D2A68EE97230825B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.1MB
SHA256 2d17733bfacd7fbaf8e1b601695485581cc0a7fb0e8b6cb1a5481fa4de19e437
MD5 670f45aa6d101970453f9ee2a77f23cc
SHA1 ec65028ee324c3e4d93a675c10909e4d616c933f
SHA512 a4980cae71d7f372f493d566ac9d08fbf298cb9117300c2d8dccb8cedfff895039a73273517b251c573d4bcacb8b1d58485bbd58db5cccc3ce6f9518a8d040bb
SSDEEP 24576:iJuyezSCmvWsxXt8grvWS6q8wyu2Ntf4hkxiQx:ryezSCmvWchvDHjyRtgCx7x
TLSH
T1EE351A15F5788323D0B2D0BAC5D6BA9AFE7230464B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 840KB
SHA256 90501da640bcfff2e59d209a9aa2683fa3667f77fc627eee5eea131bbf153da1
MD5 a8afd2d8935af2a8204c086a51136860
SHA1 84179c106b26a3993ea550a8c823abd56f5596f7
SHA512 609e908edcab0bc7c01cbb38e08e8d0a4c0b6d36677df207f8fc2b605995f572284d38c3f5552b533a65fe6e23f31f554e857ea584ef8926e77994969322be2f
SSDEEP 12288:NJXkB+53vyFWpBNd2zCQwsE0LWVprs9if0Im98LD9/S38ksJhPKRmIq+CT:NJm+1yIplfVp5XlS37QAeT
TLSH
T199054B66F6748331D073C0BAC5D2AA9AEE3234424B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 350KB
SHA256 3a37e8a6676930dbbc75f13c87a75a0ee19c6bae8c6a6ac568e7a4d530c66b98
MD5 b257b5e314cfb3625c3ea93d742aa748
SHA1 7eb748899e2696e6f5c811e2adc453dbe08ff21c
SHA512 f2af6652a01bfc0a22fe23759b727415e82fbd226621ee55a3516511fc8cb76fd51c7563d1d283c516cd03f4aab534e1a1117057ab59ff47235d95e2881d225b
SSDEEP 6144:tOCs9sBJ/GKWWBNU6ITLBi0qttclOKgU91BewE7mwLWuABU7:Js9FeBNUbTVO86UIwE7guABU7
TLSH
T1B974397BEE28FCE2C27E4DB85A918640977278704F61A3CBD164C24EDE135E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.3MB
SHA256 69da2457ede08ea854b928e85ac90e84cb0696612f1698df7bb1c67f7723bccb
MD5 57a18cbcc0e291d14e503a8ffdeb9ab3
SHA1 31d663a136fdd1548102574b1831af8a9f39b9b7
SHA512 f5f47e8f0e71bf06668d00c86f985c7464befa3052d2d171c8718a5680de618af885c326eccd9e5f7d695e36b4d907e803363e9cbc21f9f678ddd04436890f77
SSDEEP 49152:ZXjzrwo+Fpk9N1pUUMt6z6ezyrgjLGdENvF1Lh4C38eu1ESU4pMIW7/qhqQh8NRu:ZXj92Iz8wLFqU//oqF5CnD061
TLSH
T154265C656BF880F5E0ABE178897AC5B2F7B678420D31EB4F0191C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.3MB
SHA256 12f2a735b57b4f09ab3f6ae7b10d3692d4ad4e75c75cac1e455a0bca850b99ee
MD5 508347ff4b847e5b39a46bf0f8c4cb73
SHA1 eea831d08c3a256002c7702aa3b6a4b30ffad25f
SHA512 ffa78c11043c63f33418c1f26686ca6ffa22b0e084c85491d9bd9c9d95606a53be5fbd785f254b0cd7dcab1611365dca8340cc07691ed999f84c1c01d78d598f
SSDEEP 24576:SsuK0Qni82z+L5Wq4rHCYRFiV+XenmE3Pnzc344hMgY/n3:SsuK0Qni82yL5z4fFiV+XenmE3/zT3
TLSH
T1BBB56C0976B8C1E4D1F6C77896A2CA47F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.2MB
SHA256 0e947744e8f545c5a451d203a1ee0661d6ce2dc45f559d37271c24957bf2c5b1
MD5 2a664e1cb42d789a1f471643e5abf089
SHA1 8ec00311f9e2cb252da19acbb4d7e307eabba2bc
SHA512 e6355eab9ca67ceac4f634b49e5a259835c4780ab0af9052d6e920840e4729d667dc8565d65b27a36b02a8ce51e5d5e8ad0684ac171a1813e8a6e344be8a42e6
SSDEEP 49152:GjcPYlQQy6VjypMSp3DJf5SUYLoDpgLjSTYlQcGeGAaLSF259ruMHwpXMi4FqJLG:BUERQyi36YOcPaLvw2gAf+PN3To0A
TLSH
T1A3666B03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 258f4967a17925f775cd5273b2d90af12ef81e363996cf7681091d09b91636c2
MD5 f16b5bf4db7f80ee37c38e9dca617adc
SHA1 7b46402e7e9831f3260da45c932a2259d2af5240
SHA512 ac4f4f16dda00c207856f9fc04d46bcd7bda952b2567471ee06a9ada8839cfee4504556ae47bf3bc2adfede8006907e276206074f1c226b7e791f319d40a90a3
SSDEEP 24576:vMv3Sd4GGd8QmrESTDboq9AEkF7DaHGTNHu7PNU3/5W/ohL0asDzWdnlzYwP:ME4GGOQ4L2EceWu7PNU3/1sDzYlzYwP
TLSH
T1CE952733B2F200A9D44DE1769F4A872196D27C71CFE0E3DB851572161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 3.6MB
SHA256 8fa67c3839a04f31040ca4f426e91b5c0799ed49ffd57c171d00d3fc3094f415
MD5 b82a6e746c71130468253ecee3ca06a1
SHA1 0150edfbb37dfab2482f12edd9189f55a180d169
SHA512 ab88ec4659fc2cc2790c3c72c99cbeaaabb8fcd2fa1b11cf1cc62f819b14f79cc79477b67bd0348168571a1a5e2e724ae7abec048c1267ed4272e8f2e2e0de11
SSDEEP 49152:rEA2l30pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlb2N3Oh6tznm2FQ/nho2qkrk93:Aiy5112gYy5azzVvJ69nLKnhZ0/h
TLSH
T12B067B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.4MB
SHA256 b8f1401cce2f675c7a5a1f34c217076038fb63364fbb0238bb888d660bb2c9db
MD5 04c39688e1b24ff542fc46711b1a6351
SHA1 ded20e0a2a64eb828aa46c1ada6a0038cf87c125
SHA512 35c989cd3fc61ecd662157ded76e1b20be478cca1334d02c7982e3b8e1d036aad1ee57ea205484bbd98c930dfb7dc45e0f2d26318381687c8bfd2aa59744ac55
SSDEEP 49152:1x1f6+Z0p2+0OBr4tEGF0bqx0z+n217aau1glo60B:t2pDJmrxd2do6O
TLSH
T115C58D13F1DA01E8D06ED478974A9233EA62BC490B34B6DF0A9073552E77EE4AB3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 1.8MB
SHA256 4bc46fafc9ce2ce6b0be2f71fe5801b16b0bc73ad81060b0fc8bba417e55e87d
MD5 ec734102e63ba33cdbf87610dc71f0dd
SHA1 2146852ab18abd0911aba657c00e5372379b5da5
SHA512 1e3b8c47e6945905bc4017692cbb0fdad4e5af0aeccc403a6f4d2e80e8762f0cf39436160c7d1805d68735b947d5b790bf913361d6b0db024f1dd76b4ea5d4a3
SSDEEP 24576:iDvhgHNXTl8+oFmhzT3kn8uCMvxhA+DUQ1zNOgLLwH7ReaQXx3ui1K2:VNXTllo8UxhAAU44CwH7R4x+2
TLSH
T1FF859D13F2D900E8D06ED178875A9632EA71BC460B24A6DF0A90B6961F7BFE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.0MB
SHA256 2210ade221c907576b36ce8303f93ad9ad06f839939e7cd6ba60bb9facd7c38f
MD5 9d604421417b54c5c2be28b1f6850e8b
SHA1 835b210df8136380e188f43497b4ad6e9bfdeae0
SHA512 fd2061a761d109e199c7822cac2f74b54c8b7547ba35cde60cb5117847db70649f333ddfe9fc34307641ee24126b653355aa86c7a79fa0eb2ee1f180874c95cf
SSDEEP 24576:h4NvvHozomTQsDSfAd+OPa/+SlHWxjR04FxGgVG2Onks6xt4bSMHnqhGeP:u8o2Q6HZSl2VRVtOnks6NMHqLP
TLSH
T14DA59D03F2E901E8E0BED67887669632EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.2MB
SHA256 7fe033e18c9eca3e608261c4001370f2e5dffb85d7c60c314fc236ee48bf44b3
MD5 931e4358b6291fb430bfe7f4e044021f
SHA1 bab47ef20867daad49106f45061ef841d61686ba
SHA512 ce066d0b3d1047e301a8936bbc05a76fc36d8b70a9cc73910559c846ff1b65ad32e1d7955129d8c884b6f263d56f38fb4a57544d98f9007f6d0bc75a55aed202
SSDEEP 49152:Ri/D8CKMZIO208jLAE3dGGj8buEGcjesaNkYQd0XNJKcvaAcPTY6Y5AA3c:UxCvjJBDlZk
TLSH
T1D8F59D13F2D940D9D059C078874AD232EA72BC494B2566DF0690BB562FBBFE06B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 4826831042e502d7aa5afa12083cb754b1837e72749f60ab1eaec825b9f179a7
MD5 9df57142bb97c9d2650ebd0e7386f892
SHA1 fbbb44d8c39775ced68c1f8654dd365b694b762f
SHA512 44e99b5e4a56054f01b4125c6b77b03db82244e0f9e135c2c5bb8a4b5d5061bda3956ec8fdf98cee17719af6eefc0a0e033d830b4f7032d0dfcd04f7e5c14d65
SSDEEP 24576:GcdAv9FyT32+SEJunNglyUgJKo4vi3iy9CTn0AP5+2QLHuPYZgm:GczTmpEJs1KoWgiDn0AP5wWm
TLSH
T188759E13F2D901E8D05ED178C7468632EA72BC150B38A6EF0A90B6561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 333KB
SHA256 fffbdb543fa00f78619ded7712459df752e5920ab14a7fcffe52b3ed3c727949
MD5 63e03bff57157e6ae77f0c7aab439fee
SHA1 211b2537131ab9aeee3feec50bf08432534cbe6a
SHA512 91cda7d8467f31d89f43e4b1e0ea610597a63e70d3ce333ee444b23d37de3ad157c47f546dafc8d79d4d93a66c800c715a7608dc645a39d6dcad002c0ce93f05
SSDEEP 6144:YpP/l1s9P12kJ0jtWYDNyIMJZYV/PvyH5GQUf:Yx/l1s9P1vJ0ux3cPvyMQy
TLSH
T1E474BEA5B3901CF8EC67427EC8558905E6B27C5A0B60C65F07B832265F733911D3EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 333KB
SHA256 1dd0e473ae0d58d143a6a92ef440b34df429d2b4d2679dbd34f95bd65f7c16aa
MD5 6dccdacdf3a7404b5d4f20b4b7c42427
SHA1 e0a8b737ae8fd09a1cc9d4065aff0a87bd70ff8f
SHA512 bf0da4f65e3e5dcf8a324e1637046d03a762bb073981d178919d97acd21c852343ffaca504fc27bfbd8f171aea7be3c4a2d3fe49733162295e380787e7be072e
SSDEEP 6144:+vfj0s9XoKb70C69onOsdZu14xzaYutYPDvhkAYzCdshDH:+nj0s9XoKb729onnumza4PDvhkAYzCde
TLSH
T19C74AE64B3505CF8EC67817ECD554906D6B2BC6A0B60C65F03A8362B5F333A11D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 540KB
SHA256 f86f81334b9e7a59fd54c0c0d66c5f5a3bcd9503491269be543a0a532d212882
MD5 5a7dd2966dbcd4743221c1eac4a3734f
SHA1 df8e56b39ae62b8f4d2525451c901703a4b9b261
SHA512 d6748000014db7464fbd9ae9947c52508197ea5d46f8c4b0632266d8fe46f1ba5a68be86036ae6895c1384297d9573470663a415cd490643d462c3ba3fdcd422
SSDEEP 12288:FM03i9s9x7qlr3Li4+9z8ISqLbbdIvUgi5rLq:FhPqlLO9z8ISqZTgitLq
TLSH
T15AC46B90F3E414E8F0B39A758C764511DAB67C9A1B21DE8F02A8665A1F337D18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
Size 333KB
SHA256 d221e028c719618eee44f98c55401f823cc2b99cfe2466aa8e53d6409898d62b
MD5 6fc553266162f1ae145fb43d6d8cb472
SHA1 f478e1f6147f5a7bd34fde6388fee45e14050963
SHA512 3f1e75a6e31fa0c6f39821facfd784b6284efcf4fb15b984c82ca1d7cc39c42dfccd8f0a60546c8daad7f9cfffded91b152cf470a4b7b8ed13ccb6ced8d9c5df
SSDEEP 6144:/RP6bLs9QV96A1jBj+YYkf14GYV/PvyR2iFn3zEyL8:/J6bLs9QVoA1TNzcPvyRKz
TLSH
T1D274BFA5B3901CF8EC67813ECC658916D6B27C5A0B60C65F03A836275F333A11D7EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
Size 142KB
SHA256 34df649de02736bfa3ff645aee7246e7bcc1a075aca12b291879ce7c898d585f
MD5 b24fe87e25ef22d56a044dc4a0ed4527
SHA1 1b49e98d6575e8b9362e355a2f8575da87008e06
SHA512 9e6b125393acdc5251746e96f8ac7228084abcfe3b94c2be7fc09782881796abfa4caebd71ca52b5ac0850b0eea9a4dbbe78cd53af9bb5e5b18e01d0a85d2804
SSDEEP 1536:ZvXuhi3ugVXjMjl+5Fs8h8Zs8h8o4On+uvVK7qjh3rmKPNbj7uPx0K/XO7vVxbKF:EU39ajlXEo43udtjZqMNbjux0KSbKbp
TLSH
T1A9E38DE1A3E86884FA778E32A9749C2548B7BC9D5DB0DD4C5294320D0AB33D0957CF7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
Size 333KB
SHA256 40e59e834538b9625a3b5eca5f6c733fac384909a094d90c7de5c0e1d9ed3fd1
MD5 738160713566b97a24c1c322c62d9994
SHA1 8cfb644ec1c4cc09168ce87e26b59b15015a868f
SHA512 88891ca7aebb0c6857a4e83995d0d9190eb1266bbfe18522e3ace7f18b35d2d0db5585b5e4199b5ffde06e067c7557df28ae85c2973628181b504c62da61b9dd
SSDEEP 6144:j5Uges9P7iHDRaGinsmDMslJzqYutYPDvhfjg7/X2C1DR:jqges9P7iHDUGiskM6zq4PDvhr2PlN
TLSH
T1B774BF65B3A01CF8DD27413ECD554916C6B27C5A0B70C66F03A8366A5F333901DBEBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
Size 540KB
SHA256 4d3c7330f06becb6ccb83c885644759d39fd121baee2f72a1bc05ac177344e9a
MD5 c01cbfd920d293bc2df98103e0f8c8a1
SHA1 4996a743841539ad459464e3d758364ccdba0fd2
SHA512 4841fe3c09705ef1296b03d1c8f35c6ea433b309b0948e3f5244da9444c22b60bf6c6898ff17471190fa044e178746a278e6af4fc6c429864157ffeb0698d094
SSDEEP 12288:iCoi+es9TkbBrdk+bdyrJsLbbdIvRNLl7Xdj:izebBFbdyrJsZkNLl7Xdj
TLSH
T13EC47C90F3E814E5F1B39A758D764511DAB67C9A1B21CE8F02A822591F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
Size 195KB
SHA256 c5990612284ebc37f4bca8c9d93afe75751485f8b05a6bb0b8aef017acf2a53b
MD5 5d9f94bcdf271d7238eba3ebd39bcc0d
SHA1 8c09ad7c012b7a51958841267e3836977c588b15
SHA512 939d0ce0d076297f3f1a63bdd51967b2547c6492c5a6a35b61851213aac917fc4d6728512803801f3f876ecce986acae39bb76a2391beaeba0f68f4deb1e5da7
SSDEEP 3072:sMDcxbt9CkOpDU39dY5DEmd/MjgvhagI/f1OFOPqxv7QkSjF6ZUwZ:sr9BODs9q5DEmdggIn1UJch6X
TLSH
T19A147C4133E800E8F473DA7998A14501E7B6BD551BA1EFAF5384611A0E367E1AE3DF32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
Size 138KB
SHA256 e795269d7443cee56066d3f98e36de6346a5e5e07562b1bd44fc9cfdae1a9e63
MD5 b3c7f21a26ef0eefb0e9dacaffdae288
SHA1 14ce15ccc38fc77f7659558e6884f9815b6f1dfe
SHA512 d8ea617070cf98839309a03f9f740f9202c448fb4c3b17342b2b58a1c0b7b2330f0e4ab09849f71454bc295883e206823c4f874cbc34750379aa07e9a6e3f4a1
SSDEEP 3072:MdQb8/U39N28vJEisdBziuxErv6jkcZkPP07:uQY/s9k8qdBUrrc5
TLSH
T166D3492263F51498F1739E39A9B441118F3AFC815E25FF1E5390510A4EBAAD4EE38F72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jre-1.8\bin\java.exe
Size 333KB
SHA256 8984e2efb0d029be57a4d0f9cb498ceb88b846ee9679b3f84939621453217399
MD5 cc9324645ba33e35eb54d186a9d4d323
SHA1 db9671c011c9cbc23cfc3f24657a013561dfa2f2
SHA512 050d519a3b3bf45fe7b3d09a8463faba008dd36828b3c3fdefa124b61965893c5831635cf013d072cac916e02996534b565dcc809f253de393248148e6d525d2
SSDEEP 6144:+WPYkS2s9upSuvqjfOQt10gDizYV/PvyXkgk4MnGl:+iYkS2s9uppvqYCUcPvyXtk4Mns
TLSH
T10E74AFA5B39418F8EC67827DCC558906D6F27C5A0B60C65F13A8322A5F733910D3EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
Size 142KB
SHA256 02d6096af9e894468b1124859e714b61ddc2cfadb04465007e47fdda4653e609
MD5 e78fa93a0d6934a86feaf13233b0bbdc
SHA1 1457fed7690bca9db65639456f0ce9be16891924
SHA512 8904db42ae20c4061400a9e6fb9722c356470df2db27094d7baf6fc817eb485f2a1d3e2b72f84bce74b4ece30492b59c03f45bbbde50656a1f2851fe4fddd5ba
SSDEEP 3072:aU39ajlXEo43udtjZqMNbWwx2/f062qIjsPgOdbCy6cy6H:as9elw6vvW/fB2psPgOdbCy6cy6H
TLSH
T1FEE37CA2A3E96484E137DFB29C758C21083B7D9D4DA1CD1E52E1720D1E723E18978F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
Size 333KB
SHA256 ac58834f5031c385654c0fa5d53d691df22c271ba6031278418603128ea28c51
MD5 1965b4f6b8739a1234c3132c22a5bc3d
SHA1 5cb613bef0d8c817cc0d7915744f283331269e95
SHA512 a3150fec36a18fae4c6957d37e313eb1d1d72087ae0af09397c3f51633f6f2ec3c354c224f3f74af5773d4487c810514f6941e430e79dd8d07470f7ffab99ba1
SSDEEP 6144:kpW1is9ZqnXQ4PmHy4s6n+LjgzbYutYPDvhlz7R4:k81is9ZqnXQOmHsw+gzb4PDvhR7i
TLSH
T1FF74AFA1B3901CF9DC67427DC8568915D6F27C6A0B60C66F13B832265F333905D2EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
Size 540KB
SHA256 f0fa13c55056519360744b55d7cd1a216770cecfaadd1f75810f3c2b0a025961
MD5 81e55c5dc3c9270ae34a57b6616df1b6
SHA1 c5edd24061c36cd30feac09b9c7ab315b2a70f18
SHA512 d85f543a21cd2cc59bcfd355423bb258217851b45a54502579484b94b3cec0020faa161a7b76dfa9a4ac5cdf75de913cb869db38f61bda4ee66d06b1eb07248b
SSDEEP 12288:Xhwc2wJs98/V21GOS/SSnW7LbbdIvW1v3lY:RB7V2+/SSnW7Z9O
TLSH
T1C3C46C90F3E814E8F0B38A35CD754511DAB67C9A1B61DE8F02A865591F33AD18E39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
Size 195KB
SHA256 8b6a1a98dcb17f92a46da7494b907bc8c8505925b96d6845314e4e11c2e6f595
MD5 2a8183cfcdf11ab8a2ce5d0deba96429
SHA1 b35023b0f3eff4fc86863e60bd5ac182c3eff5db
SHA512 badc70a4a9969a55fb4b23b79fd69f64520828a38e355a2e70e56660251a5fb367a6d0e0797e6a7982a21304dc09c47c6636fe08d348a8b965a2aedabf5b1fa8
SSDEEP 3072:OsGqxHtq8LdwRU39dY5DEmd/MjgvhagI/f1OFOCJGxGIWWWmpWZrvhGt:O6qYKRs9q5DEmdggIn1Un6WWAZZGt
TLSH
T1D8147C0133E50494F473DA3998604551E7BABE521B61AFAF6394216A0F36BE1EE3CF31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
Size 138KB
SHA256 3782b3177812e84e128fe28343fe9668a4f92be5a3cbaa20bd63253e36bf4d64
MD5 bd30830b119b8f3c61ac277ab146009e
SHA1 3e9629e3aac2d8face92bbb52eaebb7aabd4340b
SHA512 ebb7c3fc8a8a95cd8388f26ecfe94b0712a02bdd61e2757110e54aeba63711751f7c34bf10ffb6af3e92caa9ab35da500534fca7e4b535d2bd20921466ea640e
SSDEEP 3072:p2UQb8jU39N28vJEisdBzYMsx8iMv0HEY/B:fQYjs9k8qdBpxjY/B
TLSH
T18AD36B8163FD1499F2779A7A99B041168F36BD525E21FF6E4340420E0F79A81EE38F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
Size 4.3MB
SHA256 a3d433452b190754c8c899bd5bcb7c7093e74b60045ff726adee243460e97b01
MD5 512e73139dcc34ce913f68f6f5653f3f
SHA1 8d5bc6858b2af200ca751fdeb1f02cbfabddb31a
SHA512 a82f3d841746f8ff77d047400cf04c21aa56005dfd5d424dea0e1d76f8ceecc53eedbf5b10ce80ad1669f2b25de70b009f36a55d1c8987718ef58a763648dece
SSDEEP 49152:NhmZQmXpe669phu9vsuAgH+asL7d3RUqKyFol38euikQUe5iA2NiU0q228NRV3T2:Nh6e5KsrRLATWNR0f5Cr14G
TLSH
T1D1265B656BF880F5E1A7E178897AC6B2F7B678420D31EB4F0191C62F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeClickToRun.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
Size 4.3MB
SHA256 c410a67299ecb6137a0bffab7cc5093e8b2431b8194be73c0ac9906c99197cbd
MD5 b3c4de71b715da7ad28ee3f75517f17e
SHA1 a36652f0081d30f48a3952b715441328ca2aed72
SHA512 7e387547d8cf4d6a13a76132f27e7531055a3581952c1eda03582da510f4dfe6e0fb69370cfa538484755edb722c838f7b1b6116fa41011ea2b36f8d21552f49
SSDEEP 49152:QedXa9omcm1GZDhLgqqs4+4yhSLedrY488MOHL3XeubPE6qwhcZ+G3Z6KFY8NRVy:QeqcdDquAL4Yp3EKl5C1b
TLSH
T1BD265B55ABF880F5E0A7E178897AC6B2F7B678420D31EB4F0191C62F2F336905D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVDllSurrogate64.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe
Size 275KB
SHA256 44709d00626514c8b6490a2423ee01464291bc50cdb404f2a7a9a2540a5dc4ab
MD5 8eab2fef1e1754d1c81942159b1963d1
SHA1 8763fd02cf64a4d557f33810401cf677be2fbf65
SHA512 64dc723086b67b6666a7e1f2bdf2f091526da388bcd76c062f541640ac4be999b3d7eacec87563a8d7b9c2a1b5d4773620783627104e59cc3a60b5b1e51d52f9
SSDEEP 6144:3P97a8s9dWGNTNYdMzATVkQNUO7q5nfBLwqo:/xTs9AGNTCWsTGQ49BK
TLSH
T1D254387BDD38F8D2C37F5CB4A7A1C700AB3161714B42638BE175C26D9D122E15EAAC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVLP.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
Size 588KB
SHA256 c42d1baa1a356a95f33317a932d56e33ffc87d62d031df9d0401fe0aece0017e
MD5 6524a180c02fa744e4a6e5cb0c9f23fc
SHA1 1aaf97260c3529eac29a75c8e92ad5eecd4fd28e
SHA512 164e8bac63b7e987dd82faf47583434cb25b4906c078142ed9456695e35f42579e63107ab57056a6495b4b093f3062a6877359cb91ab443d13187af462a9a51e
SSDEEP 6144:lE7vIwE3zMvTI7PFncGfjzss9u4ThC7Jl/Ueno4Wp4hzvNUXITiXt9Z+M47iUlfc:+71I7Ooss9VpluzvNU4TEYicYJ/asmk
TLSH
T1DCD48D76EE28E8E1C27B897897968600E6713C114B61D7CBF16CD27E1E236D05E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Integrator.exe

Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
Size 6.8MB
SHA256 aae2ebd6022c8e8c29913a169632d1ffa8379a02b9ff25fe943d2b79aa3ee8ba
MD5 7c64d203e0340651297b1f421a37cbd6
SHA1 e46531051a86f6b73bbfde348f11012a3b6aca6e
SHA512 de285e5320aa29019f3531c4786be9c692642b2378f622910608e925be41bd5cdf6db6c6a702a26604a8301afb2c7348497235fb0aecab36f70cca34e3f95ef5
SSDEEP 98304:vW0qHcrT9NgffFB1GWXhrrmqJjeb2HxhI:vWZHC7gfjUWX5SzCi
TLSH
T1656629596AB481ECE0AFD1748D778772F67278428E33661B0261CA1F2F33E589D19732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Mashup.Container.Loader.exe

Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe
Size 100KB
SHA256 b972ddb511424eb27f3f19551dc4570de12a647f1f231b29e3701723489875db
MD5 3ee13f5e280fe905a0de7e4adfea113d
SHA1 6323e9a718334dfc103473d18fd1aaac63076c29
SHA512 5100282bb411980354205b23f3679e6aa592d764466c9fc98d1905da0ba840de209df2ce1eb1b5273e5f0b2adc04c01218a1abd17fbd99dd88932f4a88c4ca28
SSDEEP 1536:0KwIvXuhi3ugVXjU/eAMpldERVjdXekcUMYbxlK6k1T:0xnU398eAcI7XdFMQxTk1
TLSH
T170A3CF563F8E85C1D1620AB04292C68AF4B17EA11F72EFDF8741D01E2D277C4E9B1B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IEContentService.exe

Path C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe
Size 449KB
SHA256 9dbdc14c8b9f35c60db61b58639472f2f62312d470687f7f277bd4149b2a3d27
MD5 82bcf86003336cdedd10401b7704a79f
SHA1 57142cd96c377f3e97c00f9d7730da159c23ecf2
SHA512 56762a3646bf3877aec2029f2f7ba10ba92bcf0c8b42fa5fb96da0ea5921a2ba4c567500ec4e2e62526c3802d51146e42061a62274561fc00eb56ebd165dbc5d
SSDEEP 6144:9qPdQ1J1wlk+ugHGr12Gwe+15sm9s9XroO5jfcbvnmwVFwelJp:EPdewlk7g9e+TJ9s9HRfM35
TLSH
T15DA46C4AEBA484F5E657A138C57BC572F7B2B8890E20674742A5C76F3F33A506D2C720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerfBoost.exe

Path C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe
Size 877KB
SHA256 77f0ad34cf9850557ea14685cb2ed22b8574cbc9485e8aa5e8fd0dc2d0199a02
MD5 40ef6534533df6c6f3f91481dc494945
SHA1 12880d0d1d5ccf2336c8be1a8ffba57e590dfbec
SHA512 ff4e39e49f291a7effc525a64cf5814d2587ce3af22b1c568ddc03a6f0b89f14145e763668e1d9f9d933df90a4cd33bcbc2565a5839e3b70c9c3fead94038894
SSDEEP 24576:GFCb3TxLZ+jghI9vZvpEKdUnHBt9crkkkq:4E+jg65ZRDUn8
TLSH
T1FF153895ABF945F9F1B3A67499B68572FAB2BC521D30D31F01A0C21F1E37A808D25732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDXHelper.exe

Path C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe
Size 189KB
SHA256 6a85123dabe21127284aa776056a67b4449c4a9255d63e8ec3a0cdfe708c42cf
MD5 2c7e95162bab8debe52b786ee447f3eb
SHA1 ee4f7a8b33d95c17e1abcf4c5380cdef66dde6d7
SHA512 780ec2c26fcd5d1ed989324936f0d6236a8abe3dea04fea7ccedf3b5a7c801660357668bb756cffccf89917c46da2ad052dffeb1caa51df2f4d5ec04f4f429c6
SSDEEP 3072:8A7tSC8pWNq/DCU39Xx1Q2+zT6lZdAh3SJxfFrgrwHV6K1x+E9VrsHrGfavfW:nSz4Nq/DCs9XwelZdGaFkrG3+WVrsHrC
TLSH
T109149D573BD4E0FAE503D174D9699AB6E7B6F1B25D20236F1261C24E0E33382BE19B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoadfsb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe
Size 2.0MB
SHA256 76bc6b717a2387ead3ef54c1fd5685f16141b2a8a905c4aa6da3f2a491def8cb
MD5 d5d912c757d4fcc605508a84e7ce0fba
SHA1 ab873d9ce225fdb9338d1ebe846ec1d933b23740
SHA512 3b102c547f51ab3b7abf762a231bcb447f6735d78725ae62c3d5b1a727ef084ee284d2eb3647b35788440e9eaccbc284624f11776584c4ab265beee8709f8fb1
SSDEEP 24576:Rc/P43lQ1/CqFlV6ujWjRX9uGT/+2wdqfpbH/PTsaR010dFT7bK7+6mlvKppOu:RQPxCKlJjWjRXkC/uaPTh01GFT7bhlw
TLSH
T18EA52946ABE8C4E5E2ABE2789975C9B5F6F2B8510D31974F2156C70F1F336604E38322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoasb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoasb.exe
Size 341KB
SHA256 173d7c10adfc5bddd3bff470dda0f9b88d5953a7c8f4f4d137d60a474928fe5c
MD5 88819263151c96e3c725502572648b3d
SHA1 fd849af2a14a4716486279995ee90cef0783e315
SHA512 91d300b00f10d66808ae1ad8864b0964321a9397f7f82d24eca564b8c45456e7f7df7e3a580e8707d2487f4ca2dbce36e398ba36b1742a33d0dfc2a9c9683554
SSDEEP 6144:DeiNBs91l+ULDPRZa84dasp+ebZR19bhvRx9EiOwZexhEIXAqdQ:Dts92SDPRZz4daspBR19bhvTmw4EAAqe
TLSH
T138744A577BB88CE1D917A1788986D2B6FBB3F8604F21D30F2952C35E2E37261AD18711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoia.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoia.exe
Size 6.0MB
SHA256 b474821d6d974a854b43fb995bc0f2cb518495e8e22aaad0c4ec4c7b26da5738
MD5 0ef0f7a7d3fac5771f881265b81aa75e
SHA1 5d57e1dbbfe2a17ce0fd3eaf4b61cdde1c4c74b9
SHA512 725d140027d97ed04e0556c87515cddaefcdf162e3b44d3f955629bc6e0ef159a0365b4398ee85303900ca7a2701476b56e3e6fdbf54636b536c0e0963fc9aaf
SSDEEP 49152:LtUb2A0amgVMuyHeifb+Qpl2ngh3DkvITkhHpyQOkEmvNtCunK293+XQK+P5jGSM:LqUTxdYMCn5KZCLw21magj
TLSH
T173564A557BF882E5E1BBD134CAB285B6FAB2B8555D31A74F0551C30E1F33A909E28332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

officeappguardwin32.exe

Path C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe
Size 596KB
SHA256 e68524ad39b2e1a60f6f38a48f790e0755054e885c92cd5ffd66e985bb54ccf3
MD5 9923417b90812b6d65caaeea21ccf09f
SHA1 b885f4e20304f244b7b6f1329b2d454e48338334
SHA512 57f3aa20d84f7f6622829c0168d93201095e27ecf42cb8a511ae74d76a63699b83ed48411cf5643daa6c2381e62102e2b391b6b3c7c54aba68873aa1854f82d2
SSDEEP 12288:Yh7xQtLMgbyvtvgnN2s93cIPr0lypFpPndpWcPfPRkNu5II4:Yh7WtL8kNucAlcE
TLSH
T1CCD44A41F7A881E2E166A5348A6681B0FA77BC570F30D70B7559F32E2F33650AD29B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocolhandler.exe

Path C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe
Size 6.4MB
SHA256 97819a6e328316ac8484a7b1f1b097ef9de356db1bcf4469709088f038515cb2
MD5 6d61267138cc9d843c1abad34cbfd26d
SHA1 f637643d698e4611f00d2a01023478cef17ba6bd
SHA512 609a4b2a8b3d79ca43e068b808cc9c4fa702005d2f18254056bc8828fda59294cc44477c968ebb6246602543cafaea669ca67fd42f034e324bd62ec9c5537c34
SSDEEP 49152:+V/E3VGQN4thh1KBFJvQjQysn4LUxjP14WhW0t8F2U4rF+HboewaEjTF/KirDOgh:yw5tW05r1jV154WzHjCSd
TLSH
T15B665A416BF880F4F1B7E2788A3A9675FAB278425E31AB4F0151CA1F6F776508D29331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OLicenseHeartbeat.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe
Size 2.0MB
SHA256 68cbc648e0e47dd733681c734de70f249f1b36f86d2a78b00b5aa293cbe02981
MD5 54c40ab30604bfda7f679beb533d80ee
SHA1 d3b1e54f771f5953fac18a186c6e33eea77cd576
SHA512 9d7e28dbe2bd81bda9a3bd6c3fdec255c9dc56f6511096db5fbfe7520ad1f01c0617a4ad48e30d9d7535cc9d5cc78b0115963d7b54133ed00f51544b544cb426
SSDEEP 49152:cVNbGRcMLh2mO/xCXygrKLNLYrU98xjqrAC1yo:PzSTyo
TLSH
T1E5A527506BE881E5F5BBE7B89AB68979F9727C521C30E61F0156C60E1E33B408D39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLDumper.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe
Size 222KB
SHA256 3c0235aac2e8b0879d802d26ed53131ee29fd3f082f02ad75131c2f24a998691
MD5 d9f6991d1a6c14246251a7a2603ccb94
SHA1 f1bf7b344cae30fa96790e526ad8a3b9be532041
SHA512 ac53c246775f7aad2acd3b279f5c515f48a3c7e25cf8a9191229236f1e07e3794016d7a4a0aba5e4ee40028e87cbb973c2f21b4631e93f4471daf78647c2983b
SSDEEP 3072:XftR8R3vctHU39Qaj4+qrSVzN2Bmt+hlB9R/geQcpAMZ3B6+iZ:XftR43E5s9Qaj4diz8LYips+iZ
TLSH
T1FF24390177FA1068F5B3BAB49EB151526A33B9951B34D7FF0428812A2F33BD58D34B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohub32.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe
Size 2.0MB
SHA256 d90760d99fd84cbed0b2182c9ab3890b8e8a90631ca2176466c22807bc1b3d71
MD5 2c90edd82965b3af49b3f759ecc4c2e5
SHA1 95d5f45e55ead1476fcbbdc9cc0ca4899dbcaf9a
SHA512 4518283d443a4735866f1191fb6ce9867e549de959345a13d52659e293ba6562a95e3c29a2d4989350e52526ea457083e0a933de61d28af42be2bbc8573f80b0
SSDEEP 24576:bQB3cWFvLYGgRAassI30aXIhQDM52A2NBH3NRLOAygTFVwQPFNyO2bb4FgwPqe0d:bQB3cWz0AIyE4ULOH+MYu8m1/p9i
TLSH
T199A55985BBA484B0D526A1718AB6867CF772788289334F07318DDEDEBFE36604D59331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreporter.exe

Path C:\Program Files\Mozilla Firefox\crashreporter.exe
Size 3.5MB
SHA256 b3ab3f90b44b0e9797432afbbd36395da7ed7df44dd16ba70027f35d04789360
MD5 e71504a49176b3967246f0ddc40baed7
SHA1 9cb5e3a841474b1c4803976e9bda6424b028ce7b
SHA512 af43269375b268966ac580927e77f75e163fa5bd1fb977119c24cb81b572da4b1bb007a6bc15fefa7a8f0e0d1e641d0041fe4243133880ae92772fbdb242f2d4
SSDEEP 49152:lKKRJ7TDK4d4GyGO28wsz3iDT4JmeDNB05FQz/7TmXLhm6kV9Zpek:lK0A4+GY2Jg9f05FynaLhm6GpB
TLSH
T153061842EB611DDAC025C0B482266723B761FDBD073036F74A906735AD68EE01FF9B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox.exe

Path C:\Program Files\Mozilla Firefox\firefox.exe
Size 777KB
SHA256 e32064223c27a4647a4b40404daf14c60d58c439c8c6832d454c1dcc2c0eea94
MD5 27a8871e2666be634544ba5adddc334e
SHA1 428d013fbd17047e9af97d21ebdbe76ed0a303dc
SHA512 1bff10b6b70bcb15da45ef3df121edaf277efb6aff010180b0b48cc0366e32162bff5b512e5479bbb1ba81553ee57a3825932a06339e8db230cc77701bbe61aa
SSDEEP 24576:5QxpV1Mybj6o/Amm4SwpemIwpelzES/ES9w/:yxpV1MIj6o/Amm4ZpeapelTESi/
TLSH
T11905BF03F38516F8E08AD5789A52D233A5723C840B50A1DB1BE93F2B3E71AD15B7976C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
Size 329KB
SHA256 beec3be44a63a58a34567c250bd12d9ea97bbb002881d408fb58754bae83ffe9
MD5 6f989c138bf1cd089209d7eb2d58d391
SHA1 9d058c31aaa243ecad9119edb78bb62b5cdaa01c
SHA512 f9916da441f312aa0b5227be381ee3f076450460a88d9db5e7657d419522c93f443e9088ec0ba61a152d6f80c17940e21243d875e000421aa04c504583990dd4
SSDEEP 6144:/3Mfs99Dfkpw0o5QUc2CE1WuX2lRVrW/iJPsfUrcANNTmhD5v:/Is99Dfkpwj5rbCG2lRw2czANNTmhDV
TLSH
T10B749E2477E408F9EDA7827D8CA24502EB7378554760E78B03F4956A1F237E81E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nmhproxy.exe

Path C:\Program Files\Mozilla Firefox\nmhproxy.exe
Size 654KB
SHA256 0b65be224ea58aaff25b7039dbe5f7351dc6bb77630fa5f96afce9690de4b782
MD5 abc6eb4478f749c912580cee964a5a65
SHA1 120e3c897792eb312df155a92a346d705260c054
SHA512 1300de35363cc8451562a15ab4ab4dcd251516c1b0c8fc2e496254b556480c2d8d584f90631c92ab850719ec222462d37d4e653d427630aa7ff4fe8fadf96808
SSDEEP 12288:FEYrm0E/YqLh2iWIwnJyfos98+c/waheNqiIJqSLVdENi:JrmZgqQiXIYLDAqSLV4i
TLSH
T11DE46D02FA9BD4ADD51EC074874785327933B4CD0B31AAFB22989A353D5AAE12F3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pingsender.exe

Path C:\Program Files\Mozilla Firefox\pingsender.exe
Size 126KB
SHA256 bb6a7b26057172cb966fc8ed690e7d146850963cf0d7e642aef88f83f195e69d
MD5 d0ca5c6ca1ee9e9c77f7f1465ea34f14
SHA1 735d45c37871776295d06ecfe52af6964a5bd0a7
SHA512 0f7a1a2844b9d023b9b3ba89e6fb63c776fc7e6287a3895aa7c498da7718842f2eb499ad3449b539bf0e05d57ec7870cc663c06000b35b14a5e77e84d323004c
SSDEEP 1536:DX1qFhIEjVvXuhi3ugVXjFViHr/SRn6dhSdWA7ggBMKcqmi3amkVeFWaOyhmD80P:DXYFdjwU39v+rSh2SdWAJTKVcOyk/P
TLSH
T158C3C0536A21AC96C400C6F4F4E76626A77A3E548F651BC793A887071F603D0AFBD3E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plugin-container.exe

Path C:\Program Files\Mozilla Firefox\plugin-container.exe
Size 202KB
SHA256 1869afb510e722d2f21b3207d1e08ca80d211948518508673cdf5b19614c9a1e
MD5 136e86a1c4078cd4a419e9310b764260
SHA1 0a1fb5092f5648bdaab0cae4c79f7a183d90cb62
SHA512 35b93fb19055cf93afd0d0207b95c006cd89cc5fa92460a50cf9dcdacce9733f2e95f0860d7b351f47507660576c8b1e7dbb9c994e5648aa94827e882d44417c
SSDEEP 3072:DFkgq0l+U39BvqbWcv8W5eyaPu06j0fQ+K0r7uoe0Z6BD28vn:DFkgq0l+s9NGWcrnEuD4Q+1yoe0E68/
TLSH
T1C314CF17FB8800E5E896D27877C2522197F178860B20B7DF269C65212F5AEE87F3D394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.exe

Path C:\Program Files\Mozilla Firefox\updater.exe
Size 523KB
SHA256 52329c5e66f96e8a3bdda6345e103999628628aac0bc7f9ff7d478836442977e
MD5 a985468cebedda774b2dd5e051f83365
SHA1 58539f4e4ff91c638ff39b2e8d6faddd2367a87f
SHA512 8c9d7b0fb412208bee9aafa81f5134cf0bdd6b773aad41d625bc5a090a087722c52991a20d6e48cd8890b33365e657654b28c2cf192da55cf2bf06b98506db4b
SSDEEP 12288:pDgdHs9pWAcIJyPNb82jB2ZeaUSOJAdGySn+3kF7Pa7:RgdMWAclqwLJ+R30F74
TLSH
T104B4B019F3900DF8F82BA278C8928511AA73FC55476097DB62A4D6663F332D42B3FB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 188KB
SHA256 18b2b5e6ea4dba168805366e7ea4c9d603003bded9524644d0a0599ebcb54e09
MD5 0704fdda1fc3d6e414de7ec747284914
SHA1 3e57e212522dfeaeaa1d54214cad9888831142ab
SHA512 9e6e6909e8464560d37bf3f203ad55494c3fad1cb484c8f3ba9057b90d02f067909e5fab752be2ceaf9febb3afa46a36e67243a09a39ac8c3f2c72d953e83458
SSDEEP 3072:KPJxRAltpMU39JU0V8pQFq4XKF3QPHZ2htgQMp0z:KhxRAltpMs9W0sQFqT3QRjXG
TLSH
T1E4146A69D25811C9C06E6175C7A99A41BB333C6187E0E3CBA2D0F67E0F322C4ADE9753
MD5 SHA1 SHA512 SSDEEP TLSH

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads