7f2b6b1fc5eaee606d880a300d117306e4fe7d1b1ea8a7c5f1e688090c3b4f65

Analysis

max time kernel
149s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 16:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
Size 1.1MB
Sample260809-t3hlxavthz
SHA256 7f2b6b1fc5eaee606d880a300d117306e4fe7d1b1ea8a7c5f1e688090c3b4f65
MD5 75759c95ccd04f70df0d98917869a14d
SHA1 e00a1ef42839a0c50ee06531ed96db2ca7742530
SHA512 6302a51e6f05c287171bf99e7f6aa40f984d09259a824de09cca7377bdec6afce6c89b87ab23a3c8bcd4c8efcb326ee39ee776631369eab6507c62a9271e373d
SSDEEP 24576:YyzdblqVF13y7GzHycGSYpLuqqVpyOfmKNjSq3jrc5xaNIBXrQS8Q:YurYn3y7GzScGSYpLuqqpJfP1Sq3jrQL
TLSH
T1CC358E4A23A4419EFEA7F076D617C60BD7B1784A0376962F01A46B726F337711A2E331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\L:	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\O:	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\S:	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Y:	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\A:	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\B:	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\E:	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\J:	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\M:	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\R:	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\T:	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\U:	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\H:	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\I:	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\P:	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Q:	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\V:	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\X:	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\K:	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\N:	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\W:	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Z:	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\setup_wm.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.54\cookie_exporter.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{E3C293D9-92A2-430F-A573-2511CDB7A4F8}\MicrosoftEdge_X64_139.0.3405.125.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4416	2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_75759c95ccd04f70df0d98917869a14d_agent-tesla_amadey_icedid_njrat_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

64BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
Size 296KB
SHA256 98d72dc12b6d943b6632b8a5a155c021c3d9fc6e5ad2097dc6ae60e60faf0a9e
MD5 78bf16cc4f4e1cc66ab22fcdc9d75ffd
SHA1 2c41a8f9503ec44305cc582db11e4429331ed554
SHA512 4eaa1a2675ff3d32ac4b0e22667577f7caadeefea0bd43a52adb02197a47513c84ea8b6d74b7d63ad0abe080b767612a1b93034ed828c89f591b9d9a5316e1c5
SSDEEP 6144:hgIpKCs9rTY0UtrvU/gxViycJtqQ1f87xuNwcpEQThZTF8/DXXHNn:6Its91grXcyCgnNn
TLSH
T142548D1A73D84CF5E467D23989928556F2B138851B30D7DF6760032AAF636E0BE3DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86218\java.exe
Size 333KB
SHA256 e9fef84e90c24cc928fc3deb3cde6b2defa0aa7cb7992eb40b7dae2c53dd86d3
MD5 7aa6c988b6606097ce1dd8cc8b059f00
SHA1 81176e21751792af8ba99ea4732f5159ffd7f65a
SHA512 4c66d1617df4fbbcc3afa2a15892203067df890b2e4d4e5405512df7372aeedde8f52c995f36b4c51a52f8e667dbd1c4e2397e278ad3bec5aaeae74d5f39ec0c
SSDEEP 6144:/4PN0es9isUZjPjpUF5zT1qpSYV/Pvy74w5HHtXE:/kN0es9iswjP2wQcPvykw5HH+
TLSH
T13C74BF95B39018F8EC67813ECD558D15D6B27C5A0BA0CA5F43B8326A5F333911C3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86218\javaw.exe
Size 333KB
SHA256 da470ba5f44ef0fce303fe55ac2487916496941f60790067df0048a8038ee69c
MD5 9c9d0637d500151528657c0c157a18c7
SHA1 62cdfcb1e9c816ed0d184bbdd1ac2b6072b2f870
SHA512 8e23aef498b82992fde8c24c59e5f447ecf78258e31a9babb2de8962aac6ae44470f21f1f023b67c603dbc18671e99a6da286a0ba0fd52cf5505abb89f74c979
SSDEEP 6144:geI+Ms9IQzLQtqsPVs74Nwi9zyYutYPDvhGcTMUkxbdTft:gL+Ms9IQzLQAsP+UNrzy4PDvhGldTft
TLSH
T17C74AEA8B3A04CF9ED67813ACD155906D6B27C5A0B60CA5F13F432666F333506C3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86218\javaws.exe
Size 540KB
SHA256 c7f33158323f4403ab36ae9119bba6443eaf2ec7faff9c17d796de8acf3c6f69
MD5 e40f82e9801917a45f29d0b798bf0658
SHA1 75fc48b28302a3015825adc1e049cfd06616b3bc
SHA512 8efa6903d3c3104b591724756f9c266307127518dcb7bbe13589f9638fa0d9076056b82bbd5903e3a88cd3c85a83f8e62ffeb6400b63b8fe0ec5246a88e872f9
SSDEEP 12288:zHZ6mBs9UCSkLx8P8WxKJ/LbbdIvWU49yXN:z5wSkk8WxKJ/Z3y9
TLSH
T108C47C90F3E414E8F0B79A35CD764511CAB67C9A5B21DE8F02A8651A1F33AD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe
Size 596KB
SHA256 d16add693d2ccf51f8a2e4168c018e2c8919f06ba0e3246a9f5a50275de7cbb9
MD5 231426dd7390ece0469f10f254d710d4
SHA1 1ffcd4a1a2f6c69bffd4dfa375e9da3536616c3d
SHA512 e694736c1515e529c8f413695b10ce0a16ea6880db20963fd44b9341f74994432d01e369ad651f682d12284c7c2aab3d5cd8f1448e393d720f4ef673b74fc99b
SSDEEP 12288:os9Z9GzKcTw3q+o8FDrNSYwzS+WDivCLpg:d9GzKzqOMSpDivCe
TLSH
T132D4BF40B3E846E9E06AC174CA578542EA7278960F70E7DF01E492792F37BE95F3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe
Size 6.7MB
SHA256 ae224d108afaf00c7f6d62765b86972bfeca2ba66d0193cdbf69bdc35d27839e
MD5 2871bd552e97a06eb7bdee807bb0fdde
SHA1 960fdeab1c6703cbb6bd3381361c4a4a3a8648d4
SHA512 27edbf7c9a217d9e8acc6d91fe7dcf38f312ac16d0218d007ab1a5e16a781a6ff4efc83003ccdcd945ed5f04b293bdb1df567a2bf36402177a1608cfe257803b
SSDEEP 98304:nl8YfTaJ1+WrDB2L4HrZtZPIieK5M0uR7F5egr:l8YfTauLIIiFUpIW
TLSH
T16D666C47E3A600A8E46EC970CF295521DA353C8E57B593EF129476E81A32FD87B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe
Size 1.9MB
SHA256 3de28ebbb1e76c37b702585d095e287663a241a0ffbf8e2b0f9d1b24b9c53070
MD5 c4839697db3d02fc1be34eabe8031ff1
SHA1 8db8488be3e0143b3e8504ec325e7e321bb3ba99
SHA512 dc05dfe741cb8f4b04d853f721b2723abfeb6fb39e7b17843010a18870476253f38f476916c926b2e6efb34bd94cf3b5bb5f67f2efe64e128d3d47d96219ada6
SSDEEP 24576:Vx/e84vjusjU8vXpOqM8kdAOcQL2NLb9Ld25PTOocJuJ/cIsY6WfvZkNvq:ze1vju8U3qM8kKqwpZeToMJsepkhq
TLSH
T17E959C03F6D940E9E06ED578C7469136E972BC890B20B6DF0690B2992E77EE45F3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe
Size 1.2MB
SHA256 e1e1b16388529a55dc9ecb136594bcde0a05a49873414a2694978a315dd83b95
MD5 0be22a59d3af186b809873cbf771134d
SHA1 3f84e690a249d69f088407ddc0cd4713e41593e6
SHA512 e1bbec1a2970536768596ae3212932af83e175cca4ae137265d189099c095a9940ae9cc928e1191efff8d0ad1ae1c34c509b6ebaa7f5bc3ae349fd18d0b166a6
SSDEEP 24576:my0k7TH4Pv6CXyUEJVk/Pfju+HakJ8lIVprSxNOQsV:myLPH4Pv+BJWH7t6GDpGet
TLSH
T14F45AF07B3D841D9D029D5B4CA568232EAB27C860B64A6DF06D0F25A2F77EE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe
Size 3.9MB
SHA256 a906d536ee2dbcb9202811ea66b953d319fd4cdd08e52967fb0078d4518e6b6b
MD5 7545b9c16bd90532367c01c46cbdde5a
SHA1 f1bc519dce71827ee8520e55932f1c72732e615e
SHA512 e16aa825dc3a414c5ffa739cbdc38b100b17b27673e846890e46ba2dd35f5276b27f12a79ba9e129d3fa931c254ef9053ee6da6c07a2050eda54db489cbf112e
SSDEEP 49152:yoy2kLt21K+y+ySbTbrPu1eDzS0GD0AGZuVEusJ6LNzOeL0GKVIeCjIp26If2y/G:1d8SZuVlcm7fwKAzn
TLSH
T174165A03F29940D8D059C074CE5A8132EB627C8D47F562EF3694B6EA2A73AD47B3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe
Size 1.2MB
SHA256 56ad8ce2ade738497fc956a5ad7e9683da6bbc4021e694799f37a838b4c68ca7
MD5 32fc5d502b214ed030c238d8954a6b61
SHA1 2d2ad8205e703051916235919e67dd496e5631d1
SHA512 17eb0eb1eccd39e30d0722093792ccc8730b36e25b93b6cd4708fe32c29748f7c3ecfff44576a12da5f4e328f772def1e4a08727ae24e97f0906326a29268813
SSDEEP 24576:nECveZ2gaF8zXHYEhRYj9Ak5Eu+49I08m4tbi8A:nECWZNaF7E/Y5l6R4KN9O8A
TLSH
T17445AD0BB7D901E9D02ED5B4CB568135EAB27C820B64AAEF06D0B2591F37EE45F39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 1.6MB
SHA256 5eb2acf7c54e837427adf686e36ca679b47470c66c6aedadb3427601337402ca
MD5 9767fcfae7a30c39cc7e6f07f022666a
SHA1 8b9570a4c5c9daffb60757b257dc8391c78f1007
SHA512 d0aa84e38b4781527deaeae51119125b36420711c3320e1690754766b59d16d437d8c9b4ce3b984e9dafc296f3efc74a376404925a298f437489b58a5f5e78b2
SSDEEP 24576:pkan9foqC/40zRXsrX7KOWlNTRgbEa2bKoFvlkkkkkkkl0T3gAQ2npBoc:Zn9gqCg0K7tW9grGXxPQMboc
TLSH
T113758C03F68A81A5D09DC2B8CE764B31EA717C655F2096DF0290BA253EB7AD04B3D7D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe
Size 3.4MB
SHA256 69979e014b6891a7a70b74ef6b8d4f51771e6d1393d7aee8d114401b913f3d5b
MD5 b33c6964d486605ca3ef800465c9ff11
SHA1 fe578fe37a256ffcf7a2d95626feebafeef90348
SHA512 fa9734e7744fdae5354fa1166b01b8281f525559f31fcddbc0d4838d1d426e1e50b2ed0500fd301fa59443a2fe86de5ea86c43e6afe4dd9bc223ce1af65efb6b
SSDEEP 49152:Kghm04YhfbKOi5qHiCNAOwGFIH49UqMzADUulO7Udq+KqOuBk7bVnU7wF62JtYVo:d3xywUul1EE4wsC1/oP
TLSH
T1C1F54803E29900D9D199C078CE4A9632EB627C8D47F562EF3290B6D52E77EE47B39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 1.4MB
SHA256 7377649a190da6f411f596233d7b6168eb0bde7b2e87a266f1e9eadf2192ace5
MD5 653951391ae5692e55c4fce6865fc223
SHA1 f7922aefed6f72b04cda53a6127918987e2a44b3
SHA512 7ebacc96a5c1adea563b82269b2add02bd920e8ed2498a8db447e9a9b715aa1e0a7a645558fbf52084ca4d2c6d21167624efad0abfcf68fb4d064782805ea1b2
SSDEEP 24576:wAxZcGp8K1PjFAX2i7kS/9XHl+gAfq57ge1qRANI+c:JxlNRjzbSF3wgAfy7gSRc
TLSH
T113659D03B2D941E8D06DD178CB564536EAB27C860B34A6DF0698B25A2E37FE45F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe
Size 1.2MB
SHA256 e887e57c6976e03037c3ef56109107618ca3f0fc40c6a61487d17f715912e615
MD5 f94bd6dd4c24200b75c0f562abb6dbee
SHA1 e1d540befa99ab020c4a1f164561cfdb2c39ec6e
SHA512 6d777a0b25c90c5e3d2314c7229099f226675bfd5b80de7cf248f47b9489be56ad92e62092d89ed566f8d3c7288f7961c4ed8da1ad5bbb8c91473d6b31ad82ba
SSDEEP 24576:ymgMmkpWvoq0XUYbI3quV+1bbIhquH5jm8yiL3kG+V:Pg96WvoTbequVubbIB5vLFW
TLSH
T1D245AF07B79840E5D06AD578CB668532EAB27C520B24A6DF06D0F2592F37EE45F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.54\BHO\ie_to_edge_stub.exe
Size 613KB
SHA256 dc8465a9faccc76a693be09e27ba249ed913dd14b8f237c12281cc97e7f98f13
MD5 6393a182789f13c8650dae3d4ba033fe
SHA1 d76e972d083d9872458907279c59107980cba3ba
SHA512 fcb7e3c3904a852f6927e78dbe95a1281eb58512e4de03cbac19eb2912b91c4f1b037ea0f0a6a45e2576659e1829c27e1d1cc47e69271a16dcee0c5e106ed69f
SSDEEP 12288:0wawTs91HGdmnXLS70V5gP50x7ZZpc3+nOnU+uMgRbwdyyoLs:0wawcGdmXL+0igZZpE9nU9HMoLs
TLSH
T12ED4AF41B2E847E8E0BAC1348E52C546EF7178960F65E6DF02A0527A2F376E54E7F321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.54\elevated_tracing_service.exe
Size 5.2MB
SHA256 8fd696921603bc7d6ed5fee6cc0b7f391726270df6bff55d67b1bda4879fcbb9
MD5 2b99cfc9e80f97f78c3dfdf2423e1c0d
SHA1 9442b18b5ce37f2def33ce269693f8af423cab8f
SHA512 d9367afe48066c00b623569474f2b869a3327f361437ec71b2c2908d47341e5881d92e916a52fadaccbd6f97e1c66c866763fd351ffb2622f88a785cd7f0d3d4
SSDEEP 49152:yxUcJMiQHdjw7GpA5/THV0tb5n9dZNdCSM3Hc+wYqXBMLcSdk9YiIi7QLeDiOu4e:PZBD4aJkne8crIah2351VTH
TLSH
T150467C03F19A01D9C05ED1B98B4A9232EAA2BC450B35B6DF1A5177112F76FE4AF3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.54\elevation_service.exe
Size 3.8MB
SHA256 f1e417aec63f8e6c0149c09b38a864903967f49ed7f87692eba9c3bf45eacfba
MD5 05797301fb6ba408d9a953d56b0ca7c4
SHA1 223daa5b78eedc1b61cb6f4453ee2eea0b6a1dc5
SHA512 9d2e15433d9cd317509a5079d6ba3fc5d28351fd0f5b7c1d3cd3340f74e39f0b134c6ab0bf5b1f34e3b47eb7a565b02131679f24af817bf8bc1976ac9f794967
SSDEEP 49152:5LbVrguohZ/Z1ilVpyKfCjU2XqoO6M6X6KpVT6jIOgDy1jMeO7Xu3fs48U7dhIL3:pxk3ntlE6Lp4MFEdyL3
TLSH
T1D5068D07F5DA51DAC05DD1B9870A8232FAA1BC864B35B2DF0B9076112E76EE49F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 248KB
SHA256 c2321551ea779542050f1b90812913ad0d34625e1f4e03c17caaa54696974b3b
MD5 b153067641ac9703c2bfc7dc15dabffa
SHA1 9be4d6f7149cff78706ce9efbf1b49568f437a09
SHA512 ce6018429e1c4842999f35427fb25feb024999ac45097f8f5a804c07a5f6492be7a341461c6448106bd697ef13931cc3e87b9ace3e70bd4026c2a89e644cacb2
SSDEEP 3072:FU39W/hQTfoo3E/6IgnbGeFS1UaKuR9CbOwWoY46TW8sgyhNCOVAGUBcJeeRUZ:Fs9W+zp3E/6Fb7FjaR/Cuoh05Bmev
TLSH
T1CC447D6936F810E7D076C1B48AE59903F334F87617208DBF4290426ADE63A519DEBF36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 265KB
SHA256 fcd270cdd846b081795b96d5b80d6544ace277fc951fb9e64b04f5105a177077
MD5 1bd8dbd704e25b8f91da1de245fba76c
SHA1 5a9438c4eb2a6eecafb686541155384e37def711
SHA512 b57050f3a6899c00d54552385661857c351182636459361af2442a67710450aed1fcb5258d36e28f9cc72ba409476a37d589d6d6eb9e45678d30a99a22d686bd
SSDEEP 3072:ZgU39pfJ8tDyraWpBrQZ7OkdcOctoSGwaZoY46OeR8HvjERubw5nZFRsJLrYgyQ5:6s9pxUDyraWpB8Za5OYWoht+uoZA15
TLSH
T173445B6925F814E2E176C1B48FD09903F631F872A3208DFF4291479A9E13A916D7BF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 610KB
SHA256 7fb571c1f1657bd34f0d32d6a412521876a99bbff14c491922e62618803f91ea
MD5 a3d705073c6c119ec74e13f7c336e95a
SHA1 065080c09dff88e8b1c6f253dabd48f5ffae40f0
SHA512 f0046156df47403eb4d2c9fe045cf3de7c84bc661daded2417d9dca4b4f3110ca55620a16d159ca93ca82eff7c1eacfe8f7959543cfcbfad9bd1387f20910cf5
SSDEEP 12288:Vs9WjHUwzsqMjHVlouSoyi9ggg15rBxJ7EH+Hk:RjHUO0EZi9gH3Bv7EH+k
TLSH
T186D4AE81F3D847E9E07AC534CA528542EAB178960B60F6DF02E0527A2F37AE55F3E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
Size 7.2MB
SHA256 705fb5354b27677f9a802361cbc1b203395dab07476ccb5dcdc1a4f3a00b29cb
MD5 3b607947d7f26b5da8d1ba8902e9db7f
SHA1 86ffa2cf08e261514f09cf95642791e081808ea6
SHA512 e7a2b162cc5af3d4240cd2ec511c39a5e4bd16011cec624fd460d99441ae6dea899bde33289c4a88e3a11dde56dec99091746d1883b930925a5e800e27a277a2
SSDEEP 98304:46CZetahq+WZoHWwCsJB2++fGPOxRj2vJzRN+T6frD+:LCZeta12GIGWxVqzRdDD+
TLSH
T1C8766C07E3E600A8E46EC974CF2A9521DA353C8E47B492EF169476E51A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe
Size 3.9MB
SHA256 9032701eef5be658c0b6a84f422a725c9756ed3c38f51066a4cc2e235faa7759
MD5 2e2dab617a49412f075bc48ed88310f5
SHA1 69a3c31809eb15c2060e9e3ab04f523939ff283b
SHA512 616d9cbf996516c188d554c30e770895284fa5f2b597157f00c9e985641739f3c036aa831675528c12dd0032c2905d50ceca7cb3b24c1ccf62bc109cf4999ee1
SSDEEP 49152:LJ432iwTcYMexVw9bmhLbKqm006NPpIupEaVu+e6NqcXToRzvUqIzYHBigdQBa2z:e2JjjXwVmCC7NUhIUBb6ug
TLSH
T1EA165A03F29900E8E05DD578C7568622EAB2BC850B35B2DF0650B7562E7BEE4AF3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.3MB
SHA256 07fd1ce86a840089ea7fab7e41f53d061c3f029c79f614ca63441af3e8b72c82
MD5 248b09a3bf76dbb8d0034a0e1977bfd5
SHA1 82be99bd252685037f601ac844ae6b931659fe23
SHA512 dea3b7481b6e78e854b081a2c53deabcfaf6413f5d03fbf9038fe747733fbb04f4295e1db3a67af7fc7a4b061aa6b93e2bd47a1a6858a0da67f38057b873e8d6
SSDEEP 49152:5QadW3RYsFOEJSB8E6kstBhuXjfS4LWxnhZSmJ:rsmgYjBKJJ
TLSH
T10BB58C03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 1.6MB
SHA256 2d2eb60bcd56d0645081accac5953ff19c6914c8f54e62ec3ed245efe91d7a44
MD5 284e435490990320f88498c1925e2d0b
SHA1 32323b1783876cc5ab1ec91340c854ebbdc72794
SHA512 cb75fb1019db1df8229204be52440a55259124166a3c9799c193cfbdec1c9cc943533832dc2e6f635cc743f0da9176109d391f3739ce5f74e9d438db7ee76b39
SSDEEP 49152:6ZQO8evqTjYmP6wEzs7yqVMSTlXrk9dBk:y3/YaSOo
TLSH
T102759D03F39940E8D05DD1B8C7568936EAB27C450B34A6EF0A90B6552E3BFE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.0MB
SHA256 07fd723aca15a26e4ab9166f2a59ac36b48de5e998b67f434a1b7c90f2e028ef
MD5 c9487377ea3d9f24b3e5ff83f57a0945
SHA1 dacf1bb3fb02acf260f56354709ddc0a75390520
SHA512 556aa448990bef6d09d86db7a563e3e8368a3b064bfe05a42098eba0ffc392b2b704be816afc765fd4f338266679c5031fc630c1cdcbde0f07b09f36d749d3d3
SSDEEP 24576:1Zvw++6QrPzFoPqFku6z+16pwlZiT4s7CtW7KSdHBxmRkkkkkkklQXBysWA1jP7:1m++hPz/0z+1IwniMZrSdHBAVf1jT
TLSH
T120958D03F6DA80E5E05DC2B8CB768B35DA717C554F20A6DF0680BA652EB7AD04B3D394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 3.5MB
SHA256 6e78b694773372b63343016c7f003ec2ee0a3f5ab9e49003f7abd14fd95480ef
MD5 da4acb1a26c47e2714c768d5f8556841
SHA1 0c3633e3f3bd610f4e39a080accccf18f5141b8f
SHA512 d83c4eaf8d4de0ba999af78ed97fdac3bd751419be56920e9fd827db48fc15b93cacee311087eb865ff8d10aeea5557ffd8b82be24fa728f1bf574fc9d6f7f6e
SSDEEP 49152:6u+lgxWxDRpJL7UoVRgGqmn/1b6YErpz4AkOuaRoBISCaQZCLlrr4a2F:ABrtrtjOnZI2F
TLSH
T1F8064903A29900D8D059D078CF4A9223EBA27C8D47F566EF3690B6D52A77EE47B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe
Size 1.7MB
SHA256 d650270bcaeaed76aeeba75049020963eba90010fde266849c2ce24b2936abe0
MD5 d6c31d1e7c65a23bdc3b3c1b6250969d
SHA1 67b906eb9869fdc1e104f6bee2f9ed00ef05a681
SHA512 519a0ca32b85cda210d805cd0306ed570a4e08735e7c70569ec50a66720fe7ef3c26b3092025a03180650f0221ab7049518c393ea52d7d6fc1699a05155da0f2
SSDEEP 24576:ssmsqq6eSgennLIbuzebi4kzFipmsPb9oeQuJXlPnyF4mfHU9YawsN5ZA+2Mr2:2qXwj2i4kpipmsDCeHX04mfHI0+2MC
TLSH
T191858B03F2D941E8E06DD2B8C7468532EAB27C450B34A6DF0691B6562F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Size 4.1MB
SHA256 0c68b8084cd827cae2bbdea04c65ff36c01be4f8b6db3a887c39cb8802e484f6
MD5 4c57b2c017291a2dc9f1c0577b01d393
SHA1 0b4c5f7efb836f5b40d17c04546b70725d7182b2
SHA512 c1089f9626a0bf5b9b6946ce43013eee058b2d38fd040fec316dba497dfd0eb0430a9645694974c740ae413901014d1e73da5c50c792054fac5b62fb76c4cd77
SSDEEP 49152:DuZTojdKBAzaCZgOjPS3iA+TjE0zExldDwUIDtaZHWRdpev2y/BaZo:iaEPf5d+RaAZo
TLSH
T1E3165903B29940D8D049D074CE5AD232AB617C8D47F162EF3690B7EA2A73AD47B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
Size 1.6MB
SHA256 4b02a87d89c10ad1044a483098290db472de9b8ce8222f137d2d018fee6c9730
MD5 340ecad5b221f50a956d4f1c688d14d8
SHA1 0d6be5603a33f910c4c05e393aac716c4fc7af65
SHA512 e0abe27147ebdb5ea4b00ef5e21bffb7919380b5b10c393eb9afe02cb92db59954c70cc00d56b699524c3bcc871f7428a7c6f36a8e51a3d7b429eb46363f6f73
SSDEEP 49152:ILnYJJSuaJiLjMn959QBo7EukU1NqQ3E9:GYJJYFBTq+M
TLSH
T136759D03F3D801E8E06AD1B8CB568936E9B17C450B24AAEF0A90B6551F77FE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 1.5MB
SHA256 f7d354f9c2785f74d2f9ec4ad46fffbb180b4a29b87e2a9fab1e0b1aaf1f3b8f
MD5 b0130f9699b1847cd74b7ad939ead129
SHA1 df622d16151f681fa3ac609bb38b0e551144097b
SHA512 b7391e331305f4c7c43f4cc99c3012c3b6e2ed434e80b11ef6c0e91938f3d91a349d51dba00c735fd55909bbbb0057c13a5c69ad71535c2dab9c8cea7c37f3b1
SSDEEP 24576:xvseN6PXHMLEu7tfuYKnV2Vl2nxvGsVa4i6h27d3WlsNwLuPtW0z8:CeN8Xho5KnV2VlmNn+6h27djdw
TLSH
T1F3759D03F39940E8D05DD1B8CB56853AEAB27C450B24A6EF0B90B6552F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 329KB
SHA256 a6dba4c77a000c5cc684df31bcc600d24b565cc133e98c087bfaa2e7e1052c7a
MD5 8b545fd62d34822b9ae662eb03186e7a
SHA1 39ad1166d9767f6b5ae6630457160a2254dcd26f
SHA512 97ca89d3f5ba1985bf5ca79cd16dbd9ef612b10286cbedf3e789f13a6bcca3fa03ed6248efcb2330dec738f424906169f168e64f486298ab958f0ab15bef8880
SSDEEP 6144:HWs9fScZ7pP85KQhMi+1+Z+2lRNZj/iJPsfUrcAYwRGz/:2s9fScZ7pE5dCiK2lRX2czAYwa/
TLSH
T1F874AE25B3E009F9ECA7827DCCA18516EA73B8514760E7CB03B486661F137D86E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 672KB
SHA256 b9c253e7936a2fe4d79cca0e58bc8e4eb36158b5d72446521679d6fb0d8e6d2e
MD5 8ff1f4677644d279d0d207810c1e1a1b
SHA1 d37f1d527a0efe30486094b804c5e2574bff742d
SHA512 5a6147d673a9d1c3783e72a836280a1b6aed6269e6c6de3778492cb9bd282036496805624c3282679ff077699db3f8f5a1e5841cc38999e18b4e14aadfc1dd95
SSDEEP 12288:BenP8yV3gBUzIEo8TkqPfEs9vrHs8TUDHM:q53gOzIElfHrM8OM
TLSH
T10FE43A16F6788335D073C0B9C5D2A68AED7130865B308ACB4286D77C7F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.1MB
SHA256 4cc5f8a162882f62e37b54887e65d9bfd83a846fe5f6593106703659e19f5198
MD5 57c195784afe3d602a8231009eeee06a
SHA1 4c301bb4206126d87adbeda233af5a38ffa168a4
SHA512 0a471e9d3e657f43e79f5858378b3c39e0c5210f6564392c57dfe7b1ad000e2d65ec2c864aa814fed554eb117dc42ba8eeb4441ba68f478d4b5d3e64cfd0ce21
SSDEEP 12288:l+vKc6sDguWezSC1vOMgmrKOx+gffghpSy1TIP0s9pTmqCLwKzu/wTZfWY:QK3HezSC1vr1+affgrvWh6q8wyuItWY
TLSH
T14F351A15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 840KB
SHA256 f407fa0a2b97c77c3a35d0fda1197b246bff9d7b49a34bc1e13b98d8ed088ba9
MD5 c10554df3cab1d07bfc1f62dae73ca40
SHA1 e5260d54207ffc4c14bfa755e067862b6294d6ea
SHA512 cf84ad9c9bd69309a1039d69309931565df0687101a393c2f76eec4c98255440d9d4bb238b20fa54dd571aaaef1ebb99de9ec9d745cc346a9ac2645681e27265
SSDEEP 12288:UMPqBsJ3vh3/SGgBcssLwsELfWfa/s9Af0Im98sFgkhmpQdJtD:UMYslhPSDCfaD6HhmpQdD
TLSH
T1D9054B66F5748331D073C0BAC5D3AA9AEE3234424B318ACB1246D76C2E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 350KB
SHA256 de5d4cbc8c5a8ae883f3849ed669624abd74c5cb9cf9110d087ef4f0291f2870
MD5 e6163e97db80bad1f526a64e95081c8d
SHA1 c068247fe930ab3665038ba02463b80ec36e8bb0
SHA512 71e53d9b33190bb860285acb1a5f80ea8d6400c1be689ddf6079573fd6a74493ebb69a0384793546290ae718ed6537ae2684ee72fb7ec4a6281d0be09cbaae19
SSDEEP 6144:YOZs9qBJ/GKWWBNU6ITLBi0qttclOKgU91B+ajNX/ntMMuRU51:Rs9feBNUbTVO86UpX/tY41
TLSH
T13174397BEE28FCD2C67E4DB85B918600A77274714F52A3CBE165820ECE235D05E79C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.3MB
SHA256 dc7e45ef367594059367f4ce3c0ab9d1f48f8bec782553d95325be2a2fc73236
MD5 5695bbe12eb81c663a4227273e3f61bc
SHA1 a49144d3bfaaa5ab67b1c271bc72b42d5ec8255c
SHA512 1a8174a8fa200ef86a84106d274b37c00bcaa7a86e4bca2b96d6088a17ed3a599233a8d99d240d43170513cf8601e1d35a0ac89ac4a85d8907ea0db4ae6195fb
SSDEEP 49152:p6swGLVMFWBGy86BR1uQ/iTt7fLMdQd5fbLcRZ6em3leuFJxEAvZuE/tSP9+8NRr:p6/WMUuHbLFtZ/sPD5CO7Ae
TLSH
T142265B656BF880F5E1A7E178897AC6B2F7B678420D31EB4F0191C62F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.3MB
SHA256 509d764cd124fd15a4ed17c76c4fc426866f132d6954a3d5a72c2df9f0d1105a
MD5 66b88554b44d6303245c5e4570d20f15
SHA1 f4881e9ec058b6b941eedc621168a9dfe4b685da
SHA512 1449b77249ee4e99b8c4b82827ca927282c274c2292b995f966cdc3e883c83f884bf242cf58fbad5b8ce1b67c35625b657d4ca622782140001fa8df4db86e865
SSDEEP 24576:fPVqyqXXr2z+L5WqVrHCYRFiV+XenmE3Pnzc344MjS8T:fPVqyqXXr2yL5zVfFiV+XenmE3/zh
TLSH
T1CEB56C0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.2MB
SHA256 a1ed9516a2ac2259b04c5d24983666a9851292fe9fe761e8a069d78c4cbc99be
MD5 3c27d74ae2521613894012a0a87acd75
SHA1 4997c9c486342f79f4679619b004f67f39ff2c58
SHA512 576d32ef5cdab2fb49b98a3778a40058731a6edc69a4c988fde3ca718f08eb330b8de9f895fb77ba2600605454f2c2ce70fbee9bfc3421a1254827c6c60608a1
SSDEEP 49152:ujyYfvEmj4xKZp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23g:yLRQyi36YOcPbLvw2gAf+PN35zoW
TLSH
T1FB666B13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 ca1f211d306e8cbbdfc0e59701bb9099fb58a868aec65ecfa7d7fb7efcd97ab1
MD5 c9719a5a77134d37bf52f85a5c77e3e9
SHA1 bbeeca22b647ecb8b2de9fe8ead1334b7c527830
SHA512 7f3d69fea9f945995087d87e30c32970067bafb34bf346b859c4be7ed72c07ee2873b3d4af1ebc588d435b17dc212d85a380f31379ed8d1aa58c14dd4863dec4
SSDEEP 24576:mhvPcLhlQZr1OKDboBIahHHg7DaHGTNHu7PNU3/5W/ohL0FyVT:BL7Q1YbhHAeWu7PNU3/wyh
TLSH
T1F0952733B2F600A9D44DE1769F4A873196D27C758FE0D3DB8111721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 3.6MB
SHA256 8c3ea02ce979868965defa248c0212cab06bf015b6795397a8bf47585c541f46
MD5 787b0393270c305352c8a9acd8af56db
SHA1 32ec520d38664cc45aafc3f29cad43756346cf06
SHA512 0dc8b03cad9b709d125858ae7cbb45b5abff8b19ea9df1d496d20dcf318daf665c51ad0d78c4e0794b66326bc04e19a33e9b551400f52b815804b2770f85480d
SSDEEP 49152:hj4HLs0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbqN3Oh6tznm2FQ/nho2qkrk9b:ay5112gYy5azzVvl69nLKnhZ/A0LK
TLSH
T12D067B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.4MB
SHA256 27d76cc23da5c69c39607817942d4eb16fd0e78228c64aceee1f19e92bea067a
MD5 ec1c7192c537aa248a86173d0d69daff
SHA1 d6a5c5513f238fb51e0b03c0acf089af4e970733
SHA512 b9144d8fe7fb53710b66dcc674bf00a56931d27068d331df115fc46bc3d56c9645dfc25f477962fb8a88be96bd32ab176f006533db0298940bc7053eb103bf24
SSDEEP 49152:2dyBpxZUOK+TfOBr4tEGd0bqx0z+n217aau1gl/FYUH:SOK9Jmfxd2d/BH
TLSH
T152C58C13F2DA01E8D05ED478974A9233FA62BC494B34B6EF0A9073552A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 1.8MB
SHA256 65fbbf2daf66cb21af7a053594f320fc75bfc57294be9b1a44b5521918f625ef
MD5 4fc6cfbcf9c6261846795370b7a2a63c
SHA1 4d07ff67db845c39555d5a4a46f5bad2091f1218
SHA512 9f3f65ed6dea130d3e6ff50eb9d9934e7d40fda88fa07077e78cb0d80d73f2e5ca008f3cde552bf08c362a35ed24af87d575f2df3081086b8f2b71c91e74f1ea
SSDEEP 24576:itvWo3BQxqX+olE5zo8puCMUM+ACtUQ1zNOgLLwH7ReaQXx3Pd9lQtn:7kBQxquo+VM+AmU44CwH7R4xDatn
TLSH
T1D5859D13F2D801E8D05ED17887569632EA62BC460B24B6DF0A90B7961F7BBE45F3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.0MB
SHA256 6e077c65a69d4ae5389cfcbdd9fcec0567d66478349b2a208d5217854d193e19
MD5 e9227116063e3e46c0644c30e64e4596
SHA1 c28e3798cd959d99f3c0f0cfca3befbacbb87396
SHA512 cac3519e0d309f944f7d7575f30b8102c234d2acfff41795fc23a3a49dcf804cd771934904517c11b4cecb1eeca0a54711602b8be9a70c921f861b561cc8c4b8
SSDEEP 24576:b2sv3/PHHjMSQ6eGdADbkPa/tyaHWxHR04FxGgVG2Onks6xt4bSMHnqVb+uo5gw3:PHnjpQ1xvya2JRVtOnks6NMHqVbRqxJd
TLSH
T119A59D13F2E940E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.2MB
SHA256 5a5eac601428fba4d9800fe2ff495bd3bd8a083874950d6ce2304a9387c34d30
MD5 34d46f53cde498ca6c442d2e58ba56ad
SHA1 3ec38caf7763916f79ebabb24a13f245ad005684
SHA512 1188115a61c0cc60d54dab358b61d047e1d6c33c09bd8942711dba22a64b74ce8aa7e2ea980804fed9795df7212c6e46c27763b8dd3a0f9a8514538ca22d0328
SSDEEP 49152:OEywtD5HYp2jLAE3dGGj8bLEGcjesaNkYQd0XNJKcvaAcPTY6Y5AhbLU8i:HaEvjSBDlZGb4x
TLSH
T11EF59D13F2D940D9D059C079874A9232EA72BC494B3166DF0A90BB562F7BFE06B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 84b4a796e28a0b60d62cfdea4aef29c7c1ec063c42586ee89b9c1c3705f84b0b
MD5 032c1880e9923b9c8145644af58ef5c4
SHA1 258880d0828f3c1bd6391fe50f930c4db5f339e2
SHA512 d31991f9542912ad3ce8083933bdaf34578caa86c7efc9719d04f91fe76e8aaf309e9938a8582a905bbdf8bd5a8d9410622499cb551c2b6deedff8306e9b0c42
SSDEEP 24576:li2vAOuWWAlEWunyPMyUgTxsWCvi3iy9CTn0AP5+2QLIPOH0:lSbWllEWs0xsWMgiDn0AP5wUGU
TLSH
T14575AE13F2D940E8D06ED179C7468632E972BC160B38AAEF0A50B6551E7BBE45F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 333KB
SHA256 8744557abc64e61a63a3ed59238e343e1ee314509a15bf0bde209e78816d6f31
MD5 b2e0dbc5ed7532b7ef83b0c799657c9c
SHA1 334cd28988e3069cdb044a340056a83d540d49f8
SHA512 713364be968048caf206d25428470faacdde0b0f74d0e89990cfdcbffb180927c57e2151b02ed6b8d669fba968219e6912aa421e3071390aa5174c0d91538974
SSDEEP 6144:CAPl0hs9fGl9Hfj7dlXKXvx8CYV/PvybYwkN:Ccl0hs9fG3Hf8pXcPvybYN
TLSH
T1BB74AEA1B39018FCEC6B413E8C564915D6B27C5A4760CA5F13B8366A5F333911C3EBBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 333KB
SHA256 cd688071993c313c9bb813ed94bb1b28165db854f09def73e227de23a1e3f345
MD5 f62c1dbc827c653f015a0662492cceba
SHA1 3fb610f538da596d564f6e424a5fcef6cfa1b426
SHA512 13b029f96dc4adc3895f39bc03b70d477069d91b8a55d450ed01353505ca0175855892dbaf19dbec4ba1660cc78e7aebbdc7e72d223edcc9d223ff8f9f816699
SSDEEP 6144:izML4zs98xatjZSs3ys1V/r66zBYutYPDvhPtV4OpzZyUGexS:iIL4zs98xatjss3Tz/VzB4PDvh1+glNQ
TLSH
T19774AEA5B3505CF8EC77423ECC658916D6B27C5A0B60C65F13A836665F333901C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 540KB
SHA256 0a28eabd9943724ad1b53b3e0538b25f89a5ed0f3c1a6362b4e70af223284661
MD5 8c96658797ae7217b8e71baf77b666d3
SHA1 dbd7fdfdc1d7d3b3bef453cc412c222bab20c877
SHA512 d4c3e08829e225f60d2220d100232bfde3bedbc7193a88152308c67cae9fb9905110b17b1ff5a3a934cca325a26de4b24eee269d6433d7b1ff185cb29f60f98d
SSDEEP 12288:2b3uD6s9Wqm9XtePVmcJCZNLbbdIvfyZN9/:2Dim9XOmcJCZNZQkN1
TLSH
T1BFC47C90F3E814E4F1B38A358D764511DA767C9A1B21DE8F02A8665A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
Size 333KB
SHA256 3b79239443dfd7cdfe2c63c986a7fa4a7ff0f02ea939a7aab5dcc058c5b320a7
MD5 515fa4f960c12ecf88489f944d03a2ea
SHA1 38c06c6b544d45be002d87f1e9695bec7581a247
SHA512 00db1eac9ccd1b8d58fa52c727b909b75e8544e4d45e6ecd2494921292e59ec902f4d9fb98ecea2d50d864befde6b38f088229650cfbf0e89795b4d1265ccd46
SSDEEP 6144:h0PbzGs9Dyh5NXzj+dqSYmMtvqYV/Pvy9TNAvF:h4bzGs9Dy9XzssicPvyBNAt
TLSH
T15374AFA4B3901CF9DC67823EC9658919D6B27C550BB0C65F07A8322A1F733911D3EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
Size 142KB
SHA256 0929ed806d5aa392ed94b5aa97f9c71530e94bcc13bd4f90dfdc5d8d7be4d62a
MD5 3a4d7c8d85eadc8d46d72cc62d5cc3d2
SHA1 69eb77f698f6d070f616d619ff59f647a3af523e
SHA512 356759b7269515ae3efe05fb1fa0c4f89f9c04cabd40ed02ca938bc8a2f789a1221e2000e0e2a15a390fdee375044d0ca7d26471d7ce94b37c35a1b9060cc3f8
SSDEEP 3072:IU39ojlXEo43udtjZqMNbjuxL1KbGd+LMGa:Is9olw6vvw1gNLba
TLSH
T1FFE37CE1F3E89480F977AA71987A8D234977BD8A89B1DD1D2250350D0DB73E08479F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
Size 333KB
SHA256 220d06e25aedc6ce87323dac28c028cead075a0e7de4f73e966304c6e0a6cd6f
MD5 1598ff70444d4e8452f573a81f42c78a
SHA1 31becf0312e77ee34c4803ce03e4b16dcd536345
SHA512 de9eae89a8919e2f09538cf8c8e3e9fed48b274c45ca0a0d719142f209ec2a1b29c3f67a5fbf962d3bb42f27f6240e0d196daa4701d62c13d32aa1c2bffb440c
SSDEEP 6144:5Jvgps9tnoRZCpNSssqvvUYYz1YutYPDvhfHiQAnq2Vi:55gps9tnoRZaNSB8v4z14PDvhviNnxVi
TLSH
T16674BFA5B3501CF9ED67813EC8558D06D6F27C5A0B60CA1F03A4326B5F333911D6EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
Size 540KB
SHA256 08d46de677283fe1b07796ba7d4294576485c13fc0bbd2fca4a0f4d1a6b10e5e
MD5 3f1d16134d476ac85b469f73aa50b375
SHA1 a4e2d9bae3bf3843f7f17fea22c1bbd6e6de7612
SHA512 add8122cb6360f6f489e8bf903dee857dd453642714d31ad7400bb752c19070354517e13958fcf2892439ac43cb7195ca57e44caa4fc27c00c711cecf675494f
SSDEEP 12288:cEExyPs9n5Tto0LUkHEfQ/LbbdIvfGi4wh:cpTTtokHEfQ/ZOGpwh
TLSH
T1DFC47C90F3E414E8F1B79A358D768511DA767C9A1B21DE8F02A8625A1F337D18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
Size 195KB
SHA256 58c6245ae84e8c53b814a6e9f8a5b75183772e64aa6a3984eebd1f5d04c6d241
MD5 73d8c56bbde8c41733b8385b764a5c05
SHA1 b6b316aa327791e8e4af169ac51dc862d4e3bf81
SHA512 aae32be1de2fa76111e18f75d864134eaa7b2b0c354c94e44f4ca7f4290d2a2991dadfc4383e18a85490d23f93ebcbc50340d2818c68b1aa78536935d4ac6aef
SSDEEP 3072:whkhxStirQcIMU39DY5DEmd/MjgvhagI/f1OFOPqx0dVxMmJiK1G:wDiMdMs9E5DEmdggIn1UqdVxMlQG
TLSH
T1DE147E4077E80498E877EA3598658812EBFA7D911B51EF9F4381311A0F377E19E78E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
Size 138KB
SHA256 213597564d34fa0b4e2233c180dbe306ab95f6226c13908ad83e41ca6524da89
MD5 b4e2d5079feca3cbdc854f1d8dc4aa58
SHA1 ed54c7ca6515d31c12f390bc97ba78fff67aeaff
SHA512 7fc98380b804903a10c7baf1332a8d5d8ff82bd9e14a4470bbd8738030b29bafe5b08a752a138234f9c0be921886188b3b99ba71d338861cc58905238ef8075f
SSDEEP 3072:pSQb86U39/28vJEisdBziux6eqrQqxVqHPEhTg:sQY6s9O8qdBKNQaFg
TLSH
T15FD36A1163F81895F1738F79AAB082198F3ABD519E20EF5E9240114F0F79AD19E39F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jre-1.8\bin\java.exe
Size 333KB
SHA256 e5e4e049e5bc86bd33d458cfe71af0b8ad0fd15ec1baf73848c70c6708c84b3b
MD5 dd0a6784d3e3e0a05d163babab4b7ca6
SHA1 5753a35790d1d3869d1c7d6b6ec31069d6738fc5
SHA512 cfe5cf50331037ff22c90184254274fc2317d112dbabb20cc9a240f4ae649f6533474e70b6e05e79095403b8fbcc9b7135cedc4b63eaad520306117c3b97dbb0
SSDEEP 6144:bgP5Txs9yt2o5ej+ITqvNpehQYV/PvyZtLXVXK+raEe:b85Txs9yt35eMIacPvyZdVa8al
TLSH
T1CD74AFA5B3941CF4EC67413ECD254D06D6B27C590BA0C65F03A8362A5F733A11D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
Size 142KB
SHA256 3bf02d3f6aaf748f393131a2024ae20a4e1f854ae2850bc6e31cf56681d0ad81
MD5 cbe9d6308e5ee2c2d0d3e10cb8e6e8ab
SHA1 1e86534819cb575b588f4b24934200bfcbfb40c8
SHA512 76bfa5a414d348fee4ccfecb52445167afd802c6ad6fc1ca8b51c183caec70b86bdcf6ee01dd2ef0d1f5cf6952f9d521637ec1da80ca0061b9d860f8713d1904
SSDEEP 3072:8U39ojlXEo43udtjZqMNbWwx2jGFi47twDs6vg0SO:8s9olw6vvWOiqopIU
TLSH
T162E38DA1A3E868C4F2779F726CB48C21497BBDAD4EA0CE0E52A5710D09B37D05539F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
Size 333KB
SHA256 f09059158bb7fec73bd12996370c44367ea5c3d221bfc8c362fd306fed367a4a
MD5 c009178676a14cc3dc2597098bf23c7f
SHA1 6d1e01bec90b20004b8e45f5cb64f77b20a40969
SHA512 6f50d2fa408e02f22a52bd646a3f15f16b52ed18b775c28a7d4fc022a1edc549abf5561f9c35a6842d4485764a334695f6b0c0450c3b3b17b29c13bf3d75b40c
SSDEEP 6144:Bx8x6s9NXviBy+S5psveo8tEztYutYPDvhQSmQWE2Ovl:Bix6s9NXviBpS5qmozzt4PDvhQSmQW4l
TLSH
T1FA74BFA5B3901CF8DD6B413ECC61991AD2B27C5A0B60C65F17B836265F333910D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
Size 540KB
SHA256 2b58b618afa9b4a7908cfa893d629561fbd2983cd68b957f9bc33d388ac9847f
MD5 a82603cd6be698c93165a34bbd678a52
SHA1 1219e02fcf561cddad98fb24e79e0e26c6efd07a
SHA512 5382c07a0ed9715e3d703a06c29d62623b1cca9ff23ee646e29cc45e17bbbb63a214275c7e58781bb98db6d64a837f0e3a48ab03e4bf76da4832f317aad147bf
SSDEEP 12288:vyPIYTs9mjg2z11nYlWDZsGLbbdIvWxqOuF2WrdftYhanG/:voVg2h2lWDZsGZInF2Wrdft4b
TLSH
T127C46C90F3E414E4F0B79A358D764512CAB67C9A1B61DE8F02A8261A1F337D19D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
Size 195KB
SHA256 9c7c5df2791c886e955f3b438e0eaee45da098b977ca263e1c88212cc373465b
MD5 3168382cb953cb96883cd1b7311870e9
SHA1 3725836fcfcbcc66aae373428bf7dae2abb130c6
SHA512 a7882f2fb82369339022f361800dea8dbfab906c03eef021ae58ea4d58224bbe310b795feee72a6850bd350f43b2d6cb378aa64d22e77cc2392b97d161ecf7bc
SSDEEP 3072:vFzYxqta3IbqiU39DY5DEmd/MjgvhagI/f1OFOCJGxsh3KwzXUTbg:vXaY2is9E5DEmdggIn1Unfh3Pybg
TLSH
T19C147C4133A810D8E477EEB998604941E6B6BE6217519FEF53C5302A4E767E0EE3CF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
Size 138KB
SHA256 31284f14244d3b6a025319c2e538ad2ee8db46e1087a908f4825d986329a1e24
MD5 01d698e0dcddb4775f22ade0c7768cbc
SHA1 8c33e6c8c598ad40cb8a192306acce3222748bf7
SHA512 65b84c57008492b5d4a88183a6d86aeb67a41ef34b29a8d72689b8dc355efe4a87d46d447f52f6c3aaff86d860e94f225d7c4f7fbd56c9a2e6f4ff524251ba3b
SSDEEP 3072:85Qb8pU39/28vJEisdBzYMsx9Ww6nB6NROQeOso3P5e:eQYps9O8qdBpus6NROQeOso3xe
TLSH
T16CD36B1163F81899F1738B75A9B441109F7AFE616E61EF5E5380414F0E3AAD0AE38F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
Size 4.3MB
SHA256 a0c66a72d60fe22656c0fa57b386ce09407c27afe6037bea8b813a6352950973
MD5 4a6204cdfe03e50e7f4536744eb9e93e
SHA1 26d8a335cff5032e446993553d9919110a106643
SHA512 dab14b3f999d0651372bcad2cc4fdccdbcb4957a43083913155905928b0a958f35b77be86f320c5417df9ca82b501145dfddea98e269a18ce608e7f064db2765
SSDEEP 49152:suZUWy03RZ8SQLdYQy+Mkl+ymaLUdJdompDUYU3Ieu/irb2WOjDUHwA3s08NRV3H:suHRZQw+T/LX/LHL345CoWi
TLSH
T175265B656BF880F5E1A7E178897ACAB2F7B678420D31EB4F0191C61F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeClickToRun.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
Size 4.3MB
SHA256 ada9cc80948925724ae24c44ae7e227840f3ef31fe185b38b8aed1203644dc84
MD5 14cb069cdc09f73cbf533469c0d21a38
SHA1 70b6063e2d7a05c123cb40ba306a61677979194e
SHA512 150ab95e57c71c611abdda78f270b572c0ceaf16f769ca281b0077e3953df5933af0a440d6f6ce7e433b528418e64e6fb816481fb90be59e5996d80731b09fba
SSDEEP 49152:5qHiDUji26we3VIJ1w0X9XlNJraLXdNBlx6vv2X3EeuKPzz70LxKsNORivN8NRVl:50P6x30/+LPRENoiG5C6
TLSH
T199265C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0191C62F2F336905D29726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVDllSurrogate64.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe
Size 275KB
SHA256 51580cbaad27bb6a3e41b4642861813ed7a4c66a89ef6bf06ae7621519d890ba
MD5 3cce4c69895f1fa80cad2d1dadcd31ee
SHA1 98f5da2e1828999c7bf51a918629be2c3dfbdba2
SHA512 cf7259639b13742325faf7e68fc5826001d8fbf693b1a2a0c06d19642ba2cedb4a9053b318666dc9f0aee8324781c9765ab94cd4f9f21fbf7c2622929ab63c6f
SSDEEP 6144:3V97Fos9DWGNTNYdMzATVkQNUO7q58iTiQDlstuo5ce/hS:lxKs9qGNTCWsTGQ4VTHDlguo5Lw
TLSH
T15254497BDD38F8D1C27E5CB56790C700AB71B1714B42238BE175C26D8E136E16E6AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVLP.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
Size 588KB
SHA256 8b5f98e02c275e75b99ed1b5272d646fda147bfd06f8075fb994910fef46c8df
MD5 9bc1bf820948841af4370b2645b596c7
SHA1 547e2f73c6fffdd2e725850e9d31ea25265823cf
SHA512 1017f2e3051639d15708829a035d96bc52bfcd2c2718babec0182d01e7a29d4ce6917e0246b197e014f965e75c6ec106457a0470127988c48b7872323e5e97b4
SSDEEP 12288:h9gkSckws9eVluzvNU4TEYiceBGOvybnt0rj+F:EkSdNq/ceBGOvybK+F
TLSH
T155D48D76EE28D8E1C27B89789692C601E6723C510B61D7CBF16CD27E1E236D05E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Integrator.exe

Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
Size 6.8MB
SHA256 31a3d3c71c4cbd357ed3ed11bda4a99d29cf0547321afad932e50fdfe8a7bf22
MD5 60706a82905879cb6d0a1d8d7336e903
SHA1 14b6aa8a8022b4292369b2d9acb66bad280b0e89
SHA512 08818205f05e3f29668d3fc90ec9f510566973736a00385d290d6ba6b1550a2181592d119d07ce419078e804e5b3d306afadb6b1f03aa5be627fbc00db578835
SSDEEP 49152:iq1aR9/vUxE/NeMvM2+YD/GITMmd33Kv5Kpq26Hon9FuNtOLPG2eQ9zOB17/xYtl:ifNt/M4VeKxz2FB1GW2hrrmqJjeb2mg
TLSH
T1376629596AB481ECE0AFD1748D778772F67678428E33661B0261CA1F2F33E588D19732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Mashup.Container.Loader.exe

Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe
Size 100KB
SHA256 05eb21b9b0f53cce1e666cb703a994a2abc424892da0b97087c71e6268dc19e8
MD5 3105a352bb4fec2b9fcb039e321182ca
SHA1 c2ce3aef7fe4b621e9e89895094e0f54904c4966
SHA512 c07ef822eb7089c0c030bc5ffb3799a89086e77408ab2efae72ba3d715db789193302f64bd4231adc9168c02b55ddbe4a1e8a0cea2c24e3cdb9f51d90df17995
SSDEEP 1536:0K1YnvXuhi3ugnXjS/eAMpldERVBe6S36i/U+NCTDIyzpPXrm1p:0oY2U39weAcIHPic+NCTDIyzpPK/
TLSH
T140A3CF8327AE8481E65006B8C4D64A4AF835FD500F36DBCF4A75C25E2DB37D9AEB1606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IEContentService.exe

Path C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe
Size 449KB
SHA256 1a390e106d6a3a34798a71c1d3c90decf5aba7d451679983b8309ce2fdab91d9
MD5 b97153404a51f210efafa250643199fe
SHA1 4cf56d09c303d729e7a13fc569ff9f30cf7fd55a
SHA512 c43eeb0eb7c490fa4964a547aaa78d850c59ce4047c3c2faf2f34ab7f9952eacd663232dc0d830d54a0d735093f177d2b6c6c2d6a02b36014f2cfb22d42ef05e
SSDEEP 6144:LTaeD9GAlgEZug1AqIy4He+lX51Js9lvoo5jfcbvnmwVFwelcomAB:faetlgEwgoe+5vJs9zRfM3j
TLSH
T194A48E4AEB9098F5D657A2788977D671F7B2B88D0A20670B4665C26F3F33B607D1C320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerfBoost.exe

Path C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe
Size 877KB
SHA256 67fb7dbbc38ae5b5acd56c41ba72da908d58fe067b590b09015c1897d30fb508
MD5 b40a70696b4973734f2695b6a9b397a6
SHA1 d40df94a64a2ef4463b9f87e59dd6c3551031f74
SHA512 b1669b485623dc1fc762b30ffb25529b87e7b0cbbfa532f61b864bad5b4b90e2a1896fb95cd518d1780c54ea26e8476541265c6e2548e7d71d2a9611ba677254
SSDEEP 12288:7sKuhTo8ljcI0ws96I6my0Ldq2VLHbvpEeZob4UnV5BMw9d0V87:wKuhTo8ljcIkyiEALjpEKdUnHBt997
TLSH
T15F153995ABF845E9F1B7A67499768472FAB2BC521D30D31F01A0C25F1F37A808D26732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDXHelper.exe

Path C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe
Size 189KB
SHA256 43c8772cd51d929ce1932185ce688831a75bb6a8f7bf65831f3375452772c546
MD5 2270e34dd21758aee9f34c6851cde674
SHA1 a8a251a1759146299747fb06630fd199d0654c38
SHA512 d519ac4019d57161cc58f455a2ca43d5d8e67a7352b5c818234c2a2cc64427f443b73c33b4e9882f872fa674909446d7cbd53351309ebeaf27aec288fb883ef3
SSDEEP 3072:/aWSCdp3Nq/DaU39lh1Q2+zT6lZdAh3SJxfFrgrwHsHBxBBKy:BSq5Nq/Das9lAelZdGaFkrzHV
TLSH
T1AF149E527BA8A0FAE4128434D5AA96B5F7F6F2B11D30636F4765C20E0F737827E18721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoadfsb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe
Size 2.0MB
SHA256 fab6ea3bf3e0d7e69f5983cfabc37299f3fc8dde655845a8c25ad8eee3a4a6e0
MD5 93243cfb8ea50643e04bfb45583161c7
SHA1 e09cf666d417a55666370818d013d853fd08a143
SHA512 582f40008feadd010e3c3452d08c2f2a4d7214e97fd077cbeaaff168578b6620363f963d7a41ea5d7ce5d813a214625da67a02bbacaea5e6a081ec2b71581625
SSDEEP 49152:o3VZCj/i6A07Q4y/cHwoSv01GFT7bhl83:oZAAP6
TLSH
T1DFA52946ABE8C4E5E2ABE2789975C9B5F6F2BC510D31974F2156C70F1F336604E28322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoasb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoasb.exe
Size 341KB
SHA256 5ab4637a040a264e8d0c846077eeb485a5b8417b41f63d5d85dac69c1656c46c
MD5 25aa351aacdfb23d27b295d21d1bae1e
SHA1 0117208d8ea874692babbc75018199f185e93600
SHA512 74395140113ff1a8b61d8f68712685790c157c9621a4b385273387ffd6ac6daf72a38c343c5c6004fbf5d876a3056b48d22fac73f3cdb8fded29730ddf534f7c
SSDEEP 6144:kuNXs94H+UYyPRZ+8xcjaspsAP9Vw9bhvRx9EiOwZexhhLj:k0s99hyPRZPujaspNVw9bhvTmw45j
TLSH
T1C07449577BA88CE1D917A1758A86C2B5F7B3F8604F21C30F6952C36E2F37261AE18711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoia.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoia.exe
Size 6.0MB
SHA256 4b8939dfc15c4d2305957f4256f304ab78adc7fd088f8ffc324e26830e59e529
MD5 76dd4de7b1eb96d6a0df6de5efe5eeb0
SHA1 94bc0c02f4b6f87bc55bb7e9281ee744521276f5
SHA512 a62d1a94759753f07bef9e30ff9648893e9de03394a04acb1d94df086cf9c608ddb4fb1f41e7209eaece85737b5800aee35907b3f7e536cdb4318c64331f5f43
SSDEEP 49152:FjKuNrWXeNV5SRNmSU2QRtK5m3jTpkNTYCSpEX6CE5bNtVIbK293+XQK+P5jGSUg:FhJZJo3Csb5KZCLw21ma3
TLSH
T19A564A55BBF982E4E1B7D134CAB285B6FAB2B8555D31A74F0551C30E1F33A909E28332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

officeappguardwin32.exe

Path C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe
Size 596KB
SHA256 c0743565e4757ffb38b89c73e26ed734fc4638d646151b7283d2eef385b33db3
MD5 55a12af1dd894629cc1d7d8f6f6bd1de
SHA1 2b075aaa1039e6833929da3c174987a5be8bee48
SHA512 e3cb522e61ea4b9e62ef63b9af76280bd18de8dd5db5caa42ea9953ffaa74904cebd7ee9406dc6660e3ccf38d9926db08703a1362b9173f2f257c0b4807d900c
SSDEEP 12288:d4Ly60UHg6Zvtbgynns9OcIPr0lypFpBF:d4LN0Unln4cAlcn
TLSH
T124D43A41F7A881E2E567A1348A668570FA7BBC170F70D60B7559F32E2F33640AD29B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocolhandler.exe

Path C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe
Size 6.4MB
SHA256 064b21bf5942b45dd5773a93e35dcfab5742681caaa559f3aefc1b355a33df8f
MD5 4904d9ff66e97d60be7717140ae0bca6
SHA1 9ad10e2cd61047320d3098536ce3d1da7d448e6d
SHA512 0a4ea39719e710a9d3673a875363b4225bd18096a9e070a5d959289e893e21146152c684c296c0b5a2b90f268344c50b4c459678d5904a90d9abda9fe0b40db4
SSDEEP 49152:G5EmOpGQvpynkwKB/19bjbhd03s5kFb54KM3oTV8JR1ULmZe4JanH4FfI4c2NTBo:S4II3TU0SH6BAPLzHjQ/Wv
TLSH
T173665A417BF880F4E1B7E2788A3A9675FAB278425E31AB4F0151CA1F6F776508D29331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OLicenseHeartbeat.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe
Size 2.0MB
SHA256 ddbd39e43644adfb52242e162e0c154e8a75a4068c87a537b85cf77d9cbc533d
MD5 10a28c74bbf0fc6160d8d158dea2af53
SHA1 9174a789cb37bf72ce531ce4e738b4b651ee7756
SHA512 f0af37f32c75c90a35ce00e673e0fb80d3b0dff519d10658fbb0c31d5e961b550fd6dce7f0d2fd8e617ad2115fccc4741b4188a0750b6acb8afc36aedbe555a8
SSDEEP 49152:dNVBG13sVMl0WBqzxqe/pk9zYrU98xjqrAT:DBWU
TLSH
T13BA528416BE881E5F5BBE7B89AB68979F9727C521C70E60F0156C60E1E33B408D39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLDumper.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe
Size 222KB
SHA256 796a32869a1613a88640c36e3bd2feae6feaa9792a36bff7ffd2781e4611650f
MD5 ee1b55a01a236063d9e9ff743f8f60f2
SHA1 58ee7b790a7d6d48b83c19e20d96e7797405316a
SHA512 9b30f7fc22806c703bed43e83e60485e8b4ab70030654b8acd3728806a02ecaeff8047f450e7a3d1877437d56cb9b32a364db1b7e838744b48c447a4ad14bbe3
SSDEEP 3072:XQUR1iLN4twU39Waj4+qrSVzN2Bmt+hluaDmw4Tppq1ylrwRm+:XQURcLmOs9Waj4dizzaS5ppq1ylgm+
TLSH
T18D245A40B7F92058F5B3AAB09EB582526A77B8956B31E7DF0118C1692F73BD0CD34722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohub32.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe
Size 2.0MB
SHA256 29623a56dec72987802aac09e9caf3b5204b7e2e3393e6168c40ea301b24186a
MD5 5557eea08589f8b64b887a87b980cf16
SHA1 86a73e8a7a84c20c4a7494e7b500eeda3081ad27
SHA512 d808016a62849d045a7578c98eebbea45b3627ac7a58429e5a6f8873ca3b748010cd36465fd6d35c958733f36502741d15db1193a35a6d22eb20b419267b55b3
SSDEEP 24576:1EDr/LFWTYGgRxassOWRgT80eDM52A2NBH3NRLOTshFVwQP6FJ0UFb4FgwPqe0Pm:1EDr/LOgQCV4ULOH+MYu8m1/p9Zu+d
TLSH
T184A55985BBA484B0D526A1B189A6867CF7727882C9334F07318DDEDEBFE36604D59331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreporter.exe

Path C:\Program Files\Mozilla Firefox\crashreporter.exe
Size 3.5MB
SHA256 ff82aedfdaa9c3bbec47442a94c650787ac1552317fe78f4d4cbe9e7fbd451f8
MD5 673fcfbbac4840c5983fad1a52639a41
SHA1 707b1c56fdf5219f940b35379cdbff2c16a40b79
SHA512 b7af8cdd8a77ce1935e78a9915d303019722f28a530fc6140d269e4a4b23bcbf6374d9ef3675f83405dc2cab93bb29061213270c70100f980b9f1d1806e6055b
SSDEEP 49152:U9YkQtQzF4CFsWmqBO28wsz3iDT4JmeDNB05FQz/hTmXLhm6kV9HTfU:U9WU4CmxP2Jg9f05FyJaLhm6QTfU
TLSH
T14E061842EB611DDAC029C07482266723B761FDBD073036F74A906735AD68EE01FF9B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox.exe

Path C:\Program Files\Mozilla Firefox\firefox.exe
Size 777KB
SHA256 da7cfdc74096fc933654efe4233de2f0bc3a6b1394f6885ba9cb6162a08395b1
MD5 3c7da1f0ee39d71cabacae015ac2d4b8
SHA1 bd354d08832d7fd4404e35c7e8ffe6f131fcb0c1
SHA512 7cd5265739e4c79020201399996a163005d5f49420f53c59a46fb40adb84aa6000e5bd9deb19f33c9755d79af851b98454f0b698bcbd1441e4abd8246cc288d5
SSDEEP 12288:TM+dpqF0KEOggJXnJovg/8s9MfjMAIEegbz36LW9zwHJem7OzwHJe0Ihf7EVlQGY:TMCkFqgMfj9IfeT4SwpemIwpelzE5Qn
TLSH
T13805BF03F38516B8E48AE5789A42D533A5723C840B51A1DB1BF93F2A3E31AD11B7D76C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
Size 329KB
SHA256 3ff662d2c12379ef82a417eb8465803aa42178e323b669d9c9c5d8c45b9c42f7
MD5 594598546beac2f52ecd0000647d2693
SHA1 4b5767b7c33ceb42f7e281b05680e66e268be1c7
SHA512 6e3277336baf246892a85ef44f3f41d6bfb1f4d1b5a33d11c5319cc8edf6723ea24b790fdcd5f3e16a57b1134a8349bc6b636a85057fc13ebbe3b132c485577f
SSDEEP 6144:Wts9kfWEeWTZ5VAf1HC10Mw2lRwbN/iJPsfUrcAbRrQGlDk8:os9kfWEeWt52tH32lRa2czAlQGi8
TLSH
T1AD74AE25B3E008F9EDA7827DC8A18512EB73BC514760E79B03E486661F237D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nmhproxy.exe

Path C:\Program Files\Mozilla Firefox\nmhproxy.exe
Size 654KB
SHA256 c901353742311f3375d1f04cca59fb4b06c020069f3869fcfed87ca29b423b20
MD5 1e42821dc956f445c239ee802730a935
SHA1 8256278678bbef4a10d53343aca64162882d50ac
SHA512 09db9ed8d55057dec2fc4c4b7a5cd522d3a4f13f2c23fb93befa9231a27eba748fa15cb33bbfb8c83cddad39264d9682f15cc5e57c91914774952f8e438b4b5d
SSDEEP 12288:GgZ2WTd91Tz3Iux2mw7PyQes9uDc/waheNvwH6Nef:rZ2qfHzxhCfWvwUef
TLSH
T195E47E02FA97D4ADD51EC478864786327933B4CD0B30AAFB23986A357D19AE12F3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pingsender.exe

Path C:\Program Files\Mozilla Firefox\pingsender.exe
Size 126KB
SHA256 ab8a8309872f9e3c807f185206c91ec0178ef5efcac3c3e3544b4ebbf062aee4
MD5 98f0b1cfbdccb32aa26a4505fdeca143
SHA1 cea35b91eabc04a8979084bc6c8aec8f776df959
SHA512 351d1295063f63054c3d372c27f986a2569be203d27d9e0b997cf1d69c2be7f108e9c053958e8971d2343ca2bebfde2e1fd7e9b1db1c79556dcf72baea32eda1
SSDEEP 1536:BXQN+E0vjsvXuhi3ugnXjC5ildSRn6dhSdWA7gp2whkN7Vhr1ReOJ4iPKzi3+NTf:BXo+tjbU39+YSh2SdWAK2wepjgzc+NL
TLSH
T129C3C043923430AAC555C2F1B5DFA92353767A895B7663DBA398D2142F083D02F7A3EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plugin-container.exe

Path C:\Program Files\Mozilla Firefox\plugin-container.exe
Size 202KB
SHA256 d3bf313ec4612e95f2eae49a9feb9b4bc7d05792454ef8e26b89fac7cd78e1df
MD5 6211e3c1fc2b4ceda74b4f6d9a5fe4dd
SHA1 7fbf8677393e61f427ece0abe77aca2efbbc20f1
SHA512 da791add7ed188f3a7d6e541bc6ec7780eeabd7c433ad43663b10708adb9431b3fb7b16f2e343560aa85642b03d7ac2b6bf537aefe83f46a79572649ca412201
SSDEEP 6144:X8kRqsT1s9fsWamYEuDBVPYfxXG+J5lst5:zcsps9NxYDPYfxWact5
TLSH
T19F14BF23B64D40E5E48AC274A7C59223A7B179860B21B7DF23A416613F56FE4BF3C391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.exe

Path C:\Program Files\Mozilla Firefox\updater.exe
Size 523KB
SHA256 c2c2253baa971683684652a91eaa4b005ce53ecc0d1275326c9d5ca927c63017
MD5 14a6e7c9f7e6bd1cbc319b99a901812b
SHA1 35c9471bc8f8e96486649bdbdf2eb39c1357f969
SHA512 49ef30faf0ad0bf41f042a3fd090cdb962a921f72bc0c0332ccbe04c54be3b78e09c124ae7b4b36b38e938d2eb877ad03b52da631db2101fab487b99c1fffd7a
SSDEEP 12288:0FNPU3zs9//aowdgu7bGLxZ2Zen+SOJAdGyTvyW:iVU3i/ao62VyJ+R7
TLSH
T157B4BF1AF3900DF8F467A278C8A28511E673FC554760A6DB6294D6662F333D81B3F750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 188KB
SHA256 771dc8d5be7ac546f5868e10979c7c42bfba3e2d26fd51c82ec414e6ef6287db
MD5 d06a7959300c09968a5b3f79a11cfae5
SHA1 a246e5a493ab967fefb96ad3b00d5c1fbd924616
SHA512 9e5ba4cb9817d501b3811232e38f0f9007d211ed5a3e77bce3ecff7114f7ecb82a8fba7209014a8b275df1a526f80f40711f381684e95dd3c88caa97f3846f6c
SSDEEP 3072:p7rUfLCTU3956/V8pQFq4XKF3QP1DLlMkLlce68i:pPUfLCTs9I/sQFqT3QbNsF
TLSH
T1B3145A29D25842C4D06E1235CB658A46B7337CA183E1E3CBA2D0F57E1F37690AEE9753
MD5 SHA1 SHA512 SSDEEP TLSH

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads