5935f25d23278fe9359162d58db84e0a72447def499c3e6d0e959579cc82762f

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
Size 1.1MB
Sample260826-e61jkasckh
SHA256 5935f25d23278fe9359162d58db84e0a72447def499c3e6d0e959579cc82762f
MD5 e7259f15fb51d35f048e681a775b9252
SHA1 11f0591dc0605b520552972e0643de15bbff9625
SHA512 2653e6304f02bf08259c34918c14349cff9638fa3d60627b2784d60730fd732cdadca5e76eda667145939898c358492bc35ecec4d4be66360230efe0bc2df9a7
SSDEEP 24576:WI0Zb/G1nyEVWUF8eS3pvAXD1pyOePKJjSqhjrc5xaNIBbvC:WzBKnyEVWy8eS3pvAXBpJeCdSqhjrQaF
TLSH
T1B3358D0A63A4419EFEA7F176D617C60BD7B1784A0376962F01A46B726F337711A2E330
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\A:	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\E:	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\H:	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\J:	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\L:	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\M:	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\R:	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\I:	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\N:	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Q:	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\T:	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\U:	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\X:	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\B:	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\G:	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\S:	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\V:	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\W:	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\K:	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\P:	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Y:	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Z:	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_101250\javaw.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_101250\java.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 20 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4420	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4420	2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_e7259f15fb51d35f048e681a775b9252_agent-tesla_amadey_icedid_njrat_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

64BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
Size 296KB
SHA256 3d4f001a5dc8cd6258e8509814c1abf2b4d0b635208b8cfaf7f4b379541f659d
MD5 b4e7dbfe1e19885cf88e7004b11e9418
SHA1 70dedeba26d22e7e15ba585e7ded823d731a6aac
SHA512 b7cb5c3ddd281df3466c10dcd13e057b66bc322aaa6fdf0ef553a78fdf9e6ff4f33eb5700c50fda5af03dd00e8652bac5e7f6394924a11acf87f4fa92edf439f
SSDEEP 6144:hUHQOiqs9jTvFtahi0fy/wx/3ecJtqQ1Y7l3nOU9uc1xJQjIit9:yHRs9FMhi0Gcyb1nOU9uc1TQ/
TLSH
T14B549D2A33D88CE5E467C2398A518542F7B178951B74D7CB57A0432AEF636E0AE3D730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_101250\java.exe
Size 333KB
SHA256 0b988d4205d1d021642cf4f4dab5fb4db71c4eefb9cd0a16b82150866805a31a
MD5 c32e73ec1a81d0bdb8af19c8406e5287
SHA1 e9ddf1c483983c442afa0490536f4b310e23162e
SHA512 61fff2f1e22b7da0fb65e5f6dce574a0a1df8f86a2eae112117c3027b508d158b4f41e74a9553021d9fddf287b5a2fd8456b7accff1c0cdfc33896355d880557
SSDEEP 6144:T1PBNRs9zMDja8/Qj5tb3+ZwnyoYV/PvyxY6Oj0c8i:TFBNRs9zMD28/QuaLcPvyxY6Oj0Y
TLSH
T1C874ADA6B3901CF4EC67813EC9259906D6B27C5A0B60C75F03B436665F333911D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_101250\javaw.exe
Size 333KB
SHA256 984f518fab7e0235f008bcf16eab0329314c4ddedf1e23a987648cc03b0d15e9
MD5 39d2885420626aa349c23cc9202afcf5
SHA1 561b140fb7f8484d94bfa688cea8af499ffcfd68
SHA512 cea80df8c3191141441ac3abb2a5b818240f409a0446012269a30255ef7e70e8975653b5e2f120be94c41552b0f23c023705ebb07d3d0ff95080d2e239528951
SSDEEP 6144:U27Kps9g1c2EBOrjKs8idVT9zfYutYPDvhH6jWP9k0Rhaht:UMKps9g1c2EcrjLLdbzf4PDvhv1nH4t
TLSH
T16374BFA5B3501CF8DD67813ECC559916D6B27C9A07A0CB5F03A4322A5F333A11D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_101250\javaws.exe
Size 540KB
SHA256 b44d301bb258ba822544183e0faa0ab08920aa54220afdaf656efc19b7ebf9e9
MD5 0e9fb825f815392b3771319d037ce370
SHA1 5260bdc479ee34e89c90f8a7d8f4c1b8864531f3
SHA512 75269d4dc1d40347d9ab6d6b57f5d06ebe3ea5d0eb6cc788fef57bc716243dfce9e7e4dbc91f32cc460e734c904e63ad8f21bdd2d9324b66e13fe55bc4f77be2
SSDEEP 12288:HDxfV+s9r1sprJqY+CBg1VLbbdIvWaemQbM:H1lsp9+CBg1VZC1cM
TLSH
T133C46C90F3E814E4F1B39A359C764511DA767C991B31DE8F02A8666A1F33AD18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe
Size 596KB
SHA256 6c9db8a5b49bb7496e05cd79fcf8ba0f4dfde0894fe01dba79946ead24dd0aac
MD5 467b3f0ac4703f6187b444b0c58479e1
SHA1 a908cf7650feb597e06c3808dd32c3d0ce89d5b7
SHA512 eb1a9bd2cf69ac1ba5129ade4e9d10d38b3bff05c610c6e0298ef060a84ee9aff588fd8f3ea28ee302c505206e744197415aecc2e5d73fb4d3b6f715adc365a7
SSDEEP 12288:Rs9gjJpzu98f3kpsoirNSQ3x+WDiVWniQdR6OM:jjJpzT3Y0xpDiQSOM
TLSH
T188D4BF41B3E846E9E06AC174CA538542EA7374560F60E7DF02E492792F37BE94F3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe
Size 6.7MB
SHA256 7d35a8d73fc3ef15ac11d108fa248c7e6a29ad1d1985a0eb58f6c57328be81a4
MD5 57d8a857645b9cd7aaccece88770c8d1
SHA1 4a537efec9290e1726f9204ebfc3a1e2aa3eb8db
SHA512 3c9a37f33ccfb8ea2fcafc68a7b62ace84c3632eef48038862839c3ef595b8ccb269387122d5b38266986e68c58c34c8d7172039fad43ee420288d1cb64f7217
SSDEEP 98304:Bl8YfTaJ1+WwhB2L4HrZtmPIieK5M0uR7F5e3TbM:38YfTaLLNIiFUpI3PM
TLSH
T11D666B47E3A600A8E46ED970CF2A5521DA353C8E57B493EF129476E81A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe
Size 1.9MB
SHA256 01a9a764067b9db535744e1c55fe4b0d57cb4b876df615ebdece2937a1dce912
MD5 8d846cd606e407f767884748067b5861
SHA1 ee89109133730af52036518c4a22086dd1dac268
SHA512 98fa862b45ab039160de0f5b283ef2bf1c0b528504548311fe6368f8de8bbee4b84f16488d8e93157c57bd331809ecbd184ed83ae5ecca14bc4c215005fe24b3
SSDEEP 24576:OKtheHO2YUl1X8AE8zVfazzrL2NLb9Ld25PTOocJuJ/cIsY6WfvVYiuxO:FtsHOJUFE8zVknwpZeToMJseGO
TLSH
T183959C03F2D941E9D06ED578C746913AE972BC890B24A6DF0290B29A2E77FE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe
Size 1.2MB
SHA256 5e427052b0713baf46321080c1d9436b3ae05040756d42eb387045e36fcc3d24
MD5 dfd728b6a019129ce717b5c9d094f410
SHA1 3b5727650d12ff0c55e9bf1841d762b51cbfd1e6
SHA512 72846e3e8776ca5670e9dc8510e29fbb224e38f0dd93f8198f386280554ba0d3c7f98f7f4a95a9f24b0bef7e90afef370c3cbdb1983bcb99eb5abe424558916b
SSDEEP 24576:ILIKi5MhvvXTXhKprjX5svLpu3K+XcMIVprSjPH+JQa:ILFWMhvvdK9jJKLca2epGjPeJH
TLSH
T14045BF07B2D941E8D069D474CB568132EAB27C460B74A6DF06D0B25A2F7BEE86F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe
Size 3.9MB
SHA256 34a0dddc4c7bb51da039c258f59dfc84b320a30dcd6ee55789086abd92c58aac
MD5 9e074bfd60eddd618377583cfa7e2e58
SHA1 82d68f67e239b8e3a0d9fd9235cc0c15a1959831
SHA512 ca65c9bdbc411deb97fd1e05379d6beece28b89872a2fa2a2431918497a9636e45ea9073fe9770e1129bb131633570cade05aabc17aebf178e93e17e33053892
SSDEEP 49152:T7Q08W7ESyaEbSc4YM0DwBIZan0GD0AGguVEusJ6LNzOeL0GKVIeCjIp26If2y/z:mjASguVlcm7fwKArEdn
TLSH
T10A165903F29940D8D059C074CE5A8132EB627C8D47F562EF3694B6EA2A73AD47B3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe
Size 1.2MB
SHA256 bee8ccce1f077c81049c58087a6efc8ae978162cc204a3ab525f39752be3163c
MD5 805db82eb7655959871f9448279070c9
SHA1 93b7a9c2f5066d55da0efbb85ba419445ad90dbb
SHA512 fcf861148215722e35c85cb5984292a137a8a68671c108356a88c1be021a90628ae8ea8082b31410500b64d66c04c885a3919b28d2c33d5475c7b20e4e35eda6
SSDEEP 24576:93JHUmeNrFPlXTSWT5nDiAj0o9O5aF08mFCWszJXIkMwYX:93J0meRF0WFnuir852NtNXK
TLSH
T1A245AE07B3D941E9D06ED5B4CB568532EAB27C820B24AADF0690B3691F37EE45F39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 1.6MB
SHA256 440637071fca6da6726e531e4af16172ba813b80b72a9c20bc5cc725e753a08b
MD5 b6d8fbef644d383b33c0036aa4862436
SHA1 8f36bba5a07b181a92c246a488f926891ce7a72b
SHA512 4473beb0c0fb166f6304a02264841443e7905d46f20683a5659d69946b09dd6cf624ce983e36e00dd528def97015cf2121720e4a5b0a8c36a32334cd0f6c73a3
SSDEEP 24576:XimL3eqzeyHd09OXgCbc/Efk9JkSxkHoUwONqlkkkkkkkl0T3gAQ/CsmzNo:Sk3eaey90Qc8ftScTvYPQ6dzNo
TLSH
T19B759C03F68A81E5D09DC278CE764B31AA717C655F20A6DF0290BA253EB7AD04B3D7D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe
Size 3.4MB
SHA256 ba9a69f8090b889dd9ff1821606375dee70cfcecaa7e3c84feede1a52697b6b9
MD5 923f6bb6635385c4715950a2fa2ecb38
SHA1 626746377b08af3eeb9e6145911112fead2a0c6b
SHA512 610cea2dc43fbb52aaa4d9bc8c1157a9d278b1b5bacef567be733550cc1cfeb6272d76630f17fb2f20f35e9b3424b32a3ded3265cfa60f5e557877abb407b84c
SSDEEP 49152:dhvZhFGJkPUqCqH8Gxtbua5RqUqMzADOulO7Udq+KqOuBk7bVnU7wF62JtYkBpVa:xFZwOul1EE4wsnDoGs
TLSH
T174F54903E29900D8D099C078CE5A9632EB627C8D47F562EF3290B6D52E77EE47B39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 1.4MB
SHA256 fb589fd9fec252bc39422c7f4721b3a829c64e6e259f1442897f2986ba8dd5ee
MD5 6aaa6b643833be370494c1bea08beb3e
SHA1 045bf5588029e580ab3ea27ad3b9512e6f87adec
SHA512 ed8c4ffc0fae480cfc29d23b9264bd08266d467e0ba38172b68d40d0f9699c7adde8e1b9f047324be3e43f9cfca9c0b896d3f97f37d71f4b6e53c9872e3e3258
SSDEEP 24576:j9upc6XuNmjlMXZybFiSt0IhE+t2hTr19se1qRAHz7oBs:puzukj0YiSy2zt29R9sSTM2
TLSH
T1DB65AD03B6D941E8E06DD0B8CB564536EAB27C460B34A6DF0698B2592E37FE85F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe
Size 1.2MB
SHA256 25b26729309ee28bcfe0438fa0db43cd799a368a67d29d89242918756b2c7079
MD5 9f3a53d1ad824517fdcbe4a8692096e9
SHA1 1dac7ade09bceefc89408b1cb3861d66b2781120
SHA512 c402ca3282d04fb9df63fe27c515b673d60f38bf98d6a6029f386dd1ecd91ac7bbd63d830d5a4dd5daeba6647fee790d070fa8dfa53c8784b5b8b22c67746e98
SSDEEP 12288:VMKuKkBSw8CocVXSdvE4rOs97e1LYuiEVRPVEt0Ns8JvSYJdnWvhzGoqwtRwPlYM:vuKkBSlCocVXGBe1U0PVu0uYHWYHak
TLSH
T10445AF07F7D840D5D06AD578CA668532EAB27C420B64A6DF06D0F25A2F77EE86F39310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 248KB
SHA256 86efc779269ca305909289da0f20ee1b854cd2c02cbb1817f505293fae6a4f40
MD5 8125efa6d1b46ea2a046a8ed185127bc
SHA1 dcd3154761a02237088b70502bb1d7eea51bc78e
SHA512 c883733be07e628f0a48346d04f891b0b302d0daa33343bfd9876555e35795de51e397f1e7ebd3727bcf95ea1dfd7ff3f8e8fafa9cc658e05f756ae6bc422620
SSDEEP 6144:as9rPEQls3nebc/xvR/Cuoh0CEOtR8dJ3xHOmXv:as9rEz3jvRogfumf
TLSH
T1B5448D6526F820E6E13681B4CFD59903F735B87317218EBF4290425ACE626909DF7F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 265KB
SHA256 1a935eeb27bdc9accbe54d657775b82f776efd7b558df7570e03b3c4e2e91265
MD5 ab7924ea585144c8e092d4c3df360a3e
SHA1 6b34cf2e290726e8f7372dd837c1ea90c25901ce
SHA512 be0d845c447ed6644b1ce68dd04fdbc72120a9a805a1b7bf1fa3ff7262b423e6e1c42a787e5dcfe850d25a0b571615d54171e570b8d92e8e6ed5ca39262c48a3
SSDEEP 6144:ns9ALbrfraQpBLu/lkYWoht+uoZen/dA0:ns9ALby22kHo3d
TLSH
T1E9445C6925FC14E3D176C1B48FD09903F274F87663208DBB4291835A5E23A916EBBE3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 610KB
SHA256 f4dd1727696fd3bb49144490f234658e82e2e72535233569bcb7db6a6fa24f2c
MD5 a45bb20332beb642e03f493c5cb4ca5a
SHA1 dcffc50f168a4049b47312e4553a4bc5be4ddb0e
SHA512 233ff22338130c640515f547d12c489d9861068ce7284f209b8918e208d50db5ef4342bfd84c50952dd18854b87ff84253c2318a20938ab6dae7f46fdba29fd0
SSDEEP 12288:Fs9ZqNgOkO09SoHVlyqSMuN96Ir15rGmqmZD:CMgOnfhNN96Q3dZD
TLSH
T135D4AF41F3E847E8E06AC134CE568546EA7178960B61E6DF02E0527E2F37AE55F3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
Size 7.2MB
SHA256 91af13b994d4f9b11b29c4beba408232baef479fc073613e22db84cca2ae7249
MD5 0ef1765c210bebef7f96b6a2ac1df3c8
SHA1 c901917d9b945c9c85c4d84ca36a0a109c6a972d
SHA512 f2af34da2cbee457e211391bec29eebe356b77569e7a03566ebb46cb8d6bbfc258ecc33b254cc6feb6ee504228fefe13ea9959f84f026890470e60aef56fc377
SSDEEP 98304:x6CZetahq+WZ2kvnwCsJB2++fGGOxRj2vJzRN+T6frM6HWAs:cCZetahk/GIGRxVqzRdDM6HWP
TLSH
T158766C47E3E600A8E06ED974CF2A9521DA353C8E47B492EF169476E41A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe
Size 3.9MB
SHA256 4209c7c396e601aed3a8db498121c38b69204c26c8304b845d63ed273654dc29
MD5 e08164cf15e1599d8e1b63d4f1b5e42f
SHA1 0093403b4906d8bab98eb71b4ae89e6b70f8e87b
SHA512 46412681f46d5cc45f8fa3a0cbee69ad41ae5b1b3671804297e64ba353eef52189060c2be264531a48a787542ec35644f37199e22ae746da317a42238ac66844
SSDEEP 49152:aufWcmIF14kTlI+MvubmhLbKqm006NPpIupEUVu+e6NqcXToRzvUqIzYHBigdQB0:aiuIo4GnvQmCChNUhIUBbdCo
TLSH
T1D6165A03F29900E8E05DD578CB568122EAB2BC854B35B2DF0650B7562E7BEE4AF3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.3MB
SHA256 be8da267621b6c5e0df62a69dba08884df5ada060fb8d63aa5080b008b71c3c7
MD5 f8b0f4188fc37ca3dbf2a5ee062fc665
SHA1 c3e7efe5d6094ef9457a8006a3336a802e746a5b
SHA512 092a59b9b3d73d866b20fd0413177079a5604ccb77e7c79b4f1a10cb34d613c267560182319554a443c90573403d747a8e34ec23b8506fd9354ad8a82537da96
SSDEEP 49152:CoWjtWpOl2w9mS/hE6tstBhuXjfS4LWxneXP7:ikg9DjBPf7
TLSH
T1D5B57C03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 1.6MB
SHA256 e0a475deb3182778edaf6af46ca5ec156c4ca67a0af58a8e1e4a74e2f688051b
MD5 7e9f4a84b4108eeebd740f592188e67c
SHA1 8979adae1a6aee7309e3cfc161c13884b6de8ab7
SHA512 2a029c1b743bb63802cfc29670ab36d2a31c8933a2c43e0d6ae26ad387274bdfa0dfaed6a1648b19fdfca54578d6f1b2cded9d7c3da3a890cab35dc43c749c02
SSDEEP 49152:tR2Eqj1CTjdf8oq5TSNJCe7TlXrk9dBwdXhT:H/qe37OS
TLSH
T1C3759D03F39900E8D05DD1B8C7568536EAB27C450B24A6EF0B90B6562E7BFE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.0MB
SHA256 6869c4cb2bc30db655bd7edcbdc43405adbe76895dbb750bd3e6213ff1ea861e
MD5 b69856eaba5b8e8ea48728b05d3b181d
SHA1 8373ed98bc1965d4aa5b4276e4c51774cdc5f1fe
SHA512 d1f5897066aef16f3728d9634c7f538f40504854359c73fa2d4dfff06c87065f7ff919b4984a44d1a6fdd572107d3c0cc0c136a0ac3149ee281f437000497a1c
SSDEEP 24576:sgu91X6OMDLDh3g/uspsYPDFAABzs7CtW7KSdHBxmRkkkkkkklQXBysWAtTWVtDF:sb1X4DxwpsYPDaAVZrSdHBAVftctDlr
TLSH
T154959D03F6DA80E5E05DC2B8CB768B35EA717C554F20A6DF0680BA652E77AD04B3D394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 3.5MB
SHA256 19690a68a943fb1a3e5fe39061a2b72512a4f526cd777a5dfc7b4a8938f08101
MD5 6aa25d2516be6fe2fb11a2901edb0e28
SHA1 a95ec930b0753bb94d0b6b1f7d38f453102bd079
SHA512 eda906267dcc758299c649ee0523197972f090844a7275b25d071ce4bbfa808bc834cefce9606a86de11751ede3025ff09c7d0f19e8176d0dadefaa5a84d298a
SSDEEP 49152:6uNABrU8JCwoCOWZ4yBdW9mb6YErlz4AkOuaRoBISCaQZCLlrrhheW3a:OYaj5vOnZ0heW3a
TLSH
T1A6064903A29900D8D059D078CF4A9223EBA27C8D47F566EF3690B6D52A77EE47B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe
Size 1.7MB
SHA256 8a5e24ec746c8d68799b2457729e1770acbcd669508bde508ca39770c146c4cf
MD5 a8a0b57d246f63fd4ab13dbf02014d80
SHA1 17aab9f35d79bcb0ee5dc581bbaf1aaf019869ab
SHA512 14d414b685a6b2a3b8c0acfd4ff7c71936af165dd496ce20a758abcf63f82e8bc2e5de0566767f17f6236eb63eefa8a162b2a24f49b84121f8fe937f1d52cf27
SSDEEP 24576:saUw4Q62n5LVH8Fq4uJtkNRXrCWZSob9KeQuJXlPnyF4mfHU9YawsN0JtFq0Z6:MQb9WgyNRXGWZSmEeHX04mfHI0JpZ6
TLSH
T1DA858B03F2D841E8E06DD2B8C7469532EAB27C450B34A6DF0691B6562F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Size 4.1MB
SHA256 0da8030761648f903d1fb2df46b34642fc16a58d1ad317d526f20cf347011dcc
MD5 be94867fdf3ea93ff1ccedc24c70b96d
SHA1 bc4f66235f39f602bad5d92fbb3d627f433b5165
SHA512 c402863fde00d1ede71a6d713a6d2df7a81f251b2b2d35e6dbf534adaae13824021d455b73d7b67575e5cc4659d9ff7247f18cee4305a42cf12966fe5153d2d4
SSDEEP 49152:DuNrnA7mNlaO3bGGgRlWZm+2+TjEpzExldDwUIDtaZHWRdpev2y/BagZE:iz7PA2d+RaAgZE
TLSH
T1AF165903F29940D8D049D074CE5A9232AB617C8D47F162EF3690B7EA2A73AD47B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
Size 1.6MB
SHA256 ec563f6427402cac349eab5cb366882246c0e885f1290a1d0385e0c661baf9f6
MD5 e0abe50086d42d950839ca285207915f
SHA1 382248796c9d6d5eb297c111884a3c78d55d7ef5
SHA512 0a804543628240ec067f1bcc737f59c79ccf5fac056a490a2ac956326c2a0452180b18c06c280e9313a12cc6bb94c803a61e3c60f84dd77ac5f2e76ba32c1adf
SSDEEP 24576:Xvs3yX60nmw5XLS89Xu/yXMR3nbBlkWBL1oaedpEukUoygGmq/SAdcvrzL:XkyXZmwRHOyXMBnll9BBo7EukU1tM
TLSH
T160758C03F3D801E8E069D1B8C7568536E9B2BC450B24A6EF0A90B6552E7BFE45F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 1.5MB
SHA256 4b48e6c2b9a8cd0bb22b48b847d06d0967a2678a1926a367c3a9c233374ef5be
MD5 f917ad245a1d47299bb5dad956d427e1
SHA1 cac33a01ebe430697cbab0f60a75eeaa990a534d
SHA512 d0f6d9e9f736a42490e724674834098c9865cd433b2241b82e80201bd8aa4218c653b603bffbff125c8da2203501b7cbe90ece7dc497e4126dbb3a6e77c70c53
SSDEEP 24576:Msj2v6KAftRSvPiJu09U8effcbgkGsVa4i6h27d3Wlql+8DCW/:j2vlSKng9U8effQ7n+6h27dBL9/
TLSH
T163759D03F39940E8E05DD1B8CB56853AE9B27C450B24A6EF0B90B6552F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 329KB
SHA256 143efbc361b50d8b3adeda55c638fcf7ab2addc41c8dfa426c2b65f360e3a957
MD5 c53ee141777420c17f4503ad60faa629
SHA1 a81795b62d28aa0692b20334816582352bb1b8c2
SHA512 fe5d5dde354d557d4b125e93a9f53c25c9262a6ff0b2ee552d1537deb27c23ae2dcb91c6d373141f7fe95b14ccaf8ec0b51d38ba8454f1510c16b227e1376a2b
SSDEEP 6144:3cFs9eZrtItAP5dNtBmf1fVv2lRpZ8/iJPsfUrcAh+WupETbjZ:32s9eZrtItA5b/mX2lRQ2czAh+WupETJ
TLSH
T1E674AE2573E40CF9DD6B827DC8A18516EA73B8950760E7CB03B485661F237D81E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 672KB
SHA256 f6e8462a33681b4b4deb9f4d9fb8f55ba3edcd96bff947bbe99422df76e71344
MD5 408894b35c8403db0039d1954f3c6479
SHA1 b6379db3c7a18851b728812f1db5a1d9eb3cd359
SHA512 e53b79a826fee256d2356f82939335153fa74d4d82233fbeef128be89f3e7bfc45b414f7cbfcc916c943a6727cbfeb8f628e12c2eb9bf6386db7f9dee4d7af7f
SSDEEP 12288:92jmJVmOuU4CIGS/0PrpXs94rHsi4Niuu9jEoz:+8mON4CIOpFrMHyjX
TLSH
T183E44B16F6748335D073C0B9C5D2A69EEA7230861B308ACB4286D77C7E677E6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.1MB
SHA256 7b6380d4c7e86fead4455a1b4a443d359ea50eef4d833c83cc395667e7ecf4d0
MD5 c986cd5a11cdc6e2bca242c2ab2b1e29
SHA1 3bf9249779c217efa0109d574b46713ad56198a2
SHA512 bd3bb55959d54ed90cc5e361dfc3dba506ef2882c50e898d994fbe80d105c2c9d7d7ccbb871fb7813dec5a4c26c88495a1a2b52163d907028504794be6227e4f
SSDEEP 12288:levakofk7EmezSCfvu2irxK05xGwXghpSy1TIPYs9qTmqCLwKzu/THZJLM5Y8:QaEJezSCfv1yMvwXgrvW+6q8wyu7PL18
TLSH
T1DA351A25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 840KB
SHA256 d18cdde0bc24214c42cc7f890c188b8c695662faaf86b0b6d80dadd27a3d0be1
MD5 051a830f69157a4f36edbc993e8362f1
SHA1 c634abc39f8c7c3b58e63082d00bbd8d328fe4e0
SHA512 231eab79685d13642e9d96af0ff1fe054ef744a26f332107a59737703be08ad62897eaf96e39ce2957a724bb26a76fb413f2644e1749bd2d3bb0a33650edc088
SSDEEP 12288:EMhOBo63vjFj61wuoyOgwsEVtWPUms9Pf0Im985dBNwekK5:EMGoWjd66GPUz5dBNiK5
TLSH
T154055C66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 350KB
SHA256 7f2f7cb0a8b0b913726016705bbf8c75f6b0a3bfd6637e0dd8390ed113ad9656
MD5 d11a14aca550e7cd0de0557c40de9454
SHA1 ec1f1d4b3658e1f32d1869d607cee2725514561b
SHA512 520775363d8e2e26ed1c118d0e664cb257cc130bd83b61cc66869ee82df5be96391bac511e45bc3a05690d8bd17d06e44736dacf5feea6007df45c28adaf0f6b
SSDEEP 6144:0Ots9fBJ/GKWWBNU6ITLBi0qttclOKgU91B+5F5JJChW8R:Zs9OeBNUbTVO86UkhJyR
TLSH
T16D74397BEE38FCD2C27A4DB8579186409B7278704B62A3CBD165C20EDE235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.3MB
SHA256 1e75afc6b4b2855e039e79de4c2bc38d147355d3a9b6b2aca5f97a70fcef292f
MD5 53690bda567c62ce76a443bed6216ddb
SHA1 fceb041ba7b8c2515692198068397640ddf49128
SHA512 32c1a76616d0aa380b30563a772600fbbf2997a0314e410fe2fdc73e5dc2bb045bf5a808955da191f569ea5b9603d66745084daed66d5df744eff3645d8b22df
SSDEEP 49152:BR54G5Mg+qfVuqhBuZLUdrGm7VpKqLqjdznAZk4VUx3meur7xB3fQ3IYBljcBu8v:zSkVi4r/PLTtKBVcf5CQB
TLSH
T1A0265B556BF880F5E0A7E178897ACAB2F7B678420D31EB4F0191C62F2F336905D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.3MB
SHA256 32a2f7131d6b258ac592d7a52e8f33478b2f77473a205512f16f00d369ccf24e
MD5 3ca5e04fae7700920ff8b16a82ff886d
SHA1 e2d2cfbc31ccfca6b2ef49d9457c1c9a5be78360
SHA512 d0f24a409796971fa5564c14260757f660d88fd6c24435f2d257df859465691077bebd5e4661df44f0de842d2aaea0cb4e672c48db877d6c39b70c836f920b59
SSDEEP 24576:/DDk26DN92z+L5WqzrHCYRFiV+XenmE3Pnzc344/cFO:/DDk26DN92yL5zzfFiV+XenmE3/zk8O
TLSH
T191B56C0976B8C1E4D1F6C77886A2C647F37178154B349BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.2MB
SHA256 27db780e70024c0f5e69c1bfbcc0eb5d795b1f20010ea1dc51dce0dfe5eb194b
MD5 714166a5b36576f6e25f82c678290075
SHA1 9d6f194b631a92b3e3dda2e42e78e10effaa6f6c
SHA512 f4e22b52dfb102eeedc9a9d20ca13c7000def72da598a2e7886bcb2d3ec5fb86ced61ae76d5564c47b271350844a8d75c3b3531b02cdee387e46c65ac3dea81d
SSDEEP 49152:djmAeZDGDx4aM0Xp3DJf5SUYLoDpgLjSTYlQcGelAaLSF259ruMHwpXMi4FqJLdP:WiRQyi36YOcPFLvw2gAf+PN3z0c
TLSH
T162666B03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 78e8495a60d77db3629f4c84b0da22a7a517986efa0197dc5c6d62e5922a9542
MD5 8d5cd37be7eada8b2648b48887558d91
SHA1 b64a3ef3b728473f518c6b0b5cd4c17a1cb28a68
SHA512 62e1bdb0b867807171688f1d28dee5d507399de8c19ef3bb71f2578bf089b1ffd840ccf3e186544f60f3742c02cd1f27239b895700fc3db8c36e366351191458
SSDEEP 24576:WSv/2rzWQXrYBRDbogOhWlK7DaHGTNHu7PNU3/5W/ohL0un0fDc43:8rCQbqWWIeWu7PNU3/D2Dl
TLSH
T1F2952833B2F600A9C44DE1769F46873196E27C718FE0D3DB8515721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 3.6MB
SHA256 8b0a080e72d47fff0d4901dcff9cb3c95d1e85dfb55a1faa9b453465a2f9e6f2
MD5 f5403e44d9e09d9cce5ab6abf70843e6
SHA1 1909ee52d612f377a6c824058301af1fc97c482a
SHA512 98aaad008bc204a7870a5a33e91e6ae49e0f2da154fb2086851452a4c874af3a23b67b9f9ce2c87756e019b9e53af1172d84f549d15412eb6be48cf40a602aa2
SSDEEP 49152:LG0mu0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbSN3Oh6tznm2FQ/nho2qkrk99e:iy5112gYy5azzVvN69nLKnhZ4Wyw
TLSH
T171067B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.4MB
SHA256 c099b18063082d6717d26a6bbf7bd11f4647594d39be4a7fd8740bf874025025
MD5 2e5c80c1ecc5a8061d32c34a1b6ea8a9
SHA1 68c14cc4a89c25d3c021aa37e19e730bf7bbe354
SHA512 58c4b527ef62733bb149a15da32ba1678d88b7e24ad1160918a62635938bf3b7eb4f235ac6c3353d72c97ad6d38b6697e4bbb5f77887d45b547f517f78e053f7
SSDEEP 49152:H1OM3ZHFxrIOBr4tEG90bqx0z+n217aau1gl+C:ZFFJmzxd2d+C
TLSH
T161C58C13F2D901E8D06ED478974A9633FA62BC490B34B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 1.8MB
SHA256 0bfed46369b965990cad241465c822f61a51c0d3b8e8a60f8df649a9708f23ba
MD5 5843e041b50be543215adf2bd551962c
SHA1 4c8ac8ba2e38d5838be7a1ee8dad769b326ea69b
SHA512 451aa68d4b3b6511e881ddfe4665a95f94203b21604af8d97e8ccb9d320a18905508d6a1e16bdeb63f35529bea92ffbce3343a25fa695d61da03b04921daff96
SSDEEP 24576:s5vt87FDUsr+ovqlzVAxuCMEVOA+hUQ1zNOgLLwH7ReaQXx35G0y9Rwh:YEFDUsaoiiVOA6U44CwH7R4x0m
TLSH
T1C3859D13F2D900E8D05DD17887569632EA61BC460B24B6DF0A90B7962F7BBE46F3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.0MB
SHA256 4ad33e830e372ea6bbe7bdbdef6d08c4fbdfa75c17ff24468725defcada3bb5d
MD5 455765a60b82cb67108c3a3e732d30be
SHA1 27b2b30e79532823a10b58bf89be87450ea42ec6
SHA512 5defdcf9fc285c1122eab79c12aaaf69a975f1e483dad378c08569585dc98dcb3e3dd4d2d3369e0ebabf9ff6bb0f2c2191984bf39ef730a7a5ed220ff47b8c16
SSDEEP 24576:NgmvDdcQ1NIkQHUXVATU5Pa/pqzHWxRR04FxGgVG2Onks6xt4bSMHnqYx1LmRLut:VdjNDQ06hqz27RVtOnks6NMHqcoLsGq
TLSH
T1F8A5AE13F2E940E8E0BED67887669236EA72BC464B34A6DF064072551E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.2MB
SHA256 ad0095178c22df7f9cd489fa557038cb8b2d72875f09b8f4d8e5b3e3542cd447
MD5 5bd164c2891c9ab225e0d8fbb64c5a7a
SHA1 eb79cd368fd2234b9b96d6071059de242f2e16dc
SHA512 22899a10f7740f92686bf653d30a5afe9351823f971734883a6c94467810188d0fe51b4439022c2b0211f5c1dbcb44d540d83ae65c037b105f5418fa53489cea
SSDEEP 49152:0W5oDurtHScjLAE3dGGj8bkEGcjesaNkYQd0XNJKcvaAcPTY6Y5AzU84:VyivjfBDlZh
TLSH
T1F8F59D13F2D940D9D059D078874AD232EA72BC494B2166DF0A90BB562F7BFE06B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 e8de4bd5951287fd56458ee2450d8c164211ee98109654904b8af1b392716728
MD5 2071a8497cc82ae60c52902ce3e700d7
SHA1 bb1d2851380706d06220fdb1bc044d9714344f2e
SHA512 737e22a6e657110bd4d2bd2c95671f9794a8a491b80eaf89641104f5108b0fcb460f67f8f4e3c99c7db494a5d81f5e09f0fb6bbd8a60bb57e861bf3f7c980fa9
SSDEEP 24576:zL9vqRe7n4UEkmnkWbyUgSLmK9jki3iy9CTn0AP5+2QLMXnHUs8:z374UEkklLmK9AgiDn0AP5wA3P8
TLSH
T16A75AE13F2D941E8D05ED079C7468632E972BC160B34A6EF0A50B6562E7BBE45F3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 333KB
SHA256 50b4ef026092839209be0fd1c20edcef8adf63dcbdd0f3fccd60ce10ea44748b
MD5 c2953806e5c88bafb4b802fd37dd4109
SHA1 f2de6440ba917ed10a491892d523bd20887959a7
SHA512 83bb6b7ee20b9f1014c84a4c1623128b72507ccd2be7c187749dfb2fd671472f1ca20f5f7b388c067dfce045613c390dc811e1507cf04bc404e41874a9999198
SSDEEP 6144:vzPs5Xs9qRIYwbju2d8wJiHYYYV/PvyIFPrO2xvr+0+d:vzs5Xs9qRpwbHItcPvyIZmd
TLSH
T1BB74BFA5B3645CF8EC67427EC8554905D6B2BC5A0BA0C65F13F4362A1F333911C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 333KB
SHA256 5efa40af9bba5161e80251f2d4091de2cfe927f583f9c3d0907bdfe54ed05834
MD5 39af2a7b16cb30ab3aba8eaaedf3cc01
SHA1 902e0554515f77dbdcc5775c630f5754601db560
SHA512 c718c13586fec404210a31a71d55939fa2fa9fe5205e055271f0769ef465280fd00bb8ca396fcbb6b303bccbaebd776cd4ef1c2423d10d093af94b0bf297076b
SSDEEP 6144:U+CY5s9KxBevffv7Rhs4nI40kz+YutYPDvh4l:UxY5s9KxBevfX7RiyIwz+4PDvh4l
TLSH
T11B74AEA4B3A018F4EC67423ECD559D05D2B27C590BA0C62F13B4365A5F373914C6EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 540KB
SHA256 eb82f26a473a78084a413815602a7e8554543e1c88cef53751b64b72f8fe847d
MD5 4028a1c62b65b239c84cb6099f2d4de0
SHA1 35856a03cdb4de75746afc49280933f3718705b7
SHA512 efb9ac0eaf7efe6f376cdc6d9783dd45f7d37bd9e22e9347e50c2cc7da894db823f6cf9685b456a1a34bcac464387b7cb4a850c7942594e6e87cfc1006c65b7a
SSDEEP 12288:Lb3MfKs91JayZ+1UdtJ2wgLbbdIvsvp8LfAl:LLiayFdtJ2wgZzvM4
TLSH
T153C47C90F3E414E8F0B79A35CD764511DA767C9A1B20DE8F12A8665A1F336D18E38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
Size 333KB
SHA256 39ed9e2d347f81c99f995db82b4698e2af12bc45ec28c48333998f818d2c52f3
MD5 63e6b5526a661454ea938e250545a467
SHA1 90d6d32369690ccbe1dedd72856daf9fa2ebffa8
SHA512 087007a9ca2a6ddd957584ed29978ffe5ac1505df5f15a12bad6b5dd5b5d639db886cf0d5757c42150bd6f80d119dcddc529540dd9f637ac0cca3b5cfa448a99
SSDEEP 6144:0WPYTxs9FvqrIHpjwNo6d0TUIeYV/PvyCZc2vnMc:0iYTxs9FvCIHp9ofcPvyCcc
TLSH
T1CD74BFA573901CF4EC67417ECD659905D6B27C5A0BB0C66F03A4362A1F733A11C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
Size 142KB
SHA256 935f6cb2ea67243f544f9a6cfc8f4fcfb6aaae95f7ef47050ffe2d014374fdf4
MD5 3009c466c68dedb8543b5fbf4fd50eec
SHA1 272853e3cbc4b4e5646a2048b2a8a56b3cd35033
SHA512 f31510418f610fda5ede7c4125ebe545197884ea2b593623c324c2a187efabeb0c09c29cfb8469e2d31be98a5d4dfba6d388a38ed4ea7ec86a764a7e195f4b4d
SSDEEP 3072:cU39ljlXEo43udtjZqMNbjux8N2cnTT0o7LR:cs99lw6vvnfnTT0o7LR
TLSH
T174E37E91F3D86880EAB79F72DC789821487B7DA94DA0CD0D1195710D4AB33E588B8F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
Size 333KB
SHA256 8a8d13a5058c66e412711cd24934857eb612e9be31764e910cef04b0960cdf68
MD5 fef90f4af65dd0480f78896c916ce857
SHA1 153c6bd2b0078290899410a4937d46a21427fe50
SHA512 86ef16c42fba270831dfc22fb110676acfb1abd5e4a5b0b37068162292334cafc2a0c230ac59ba7344cb13688dec43a88c25e515ea5e8305c6125208e1612e06
SSDEEP 6144:knggcs9kriPyLQH6vs3MyyjWzTYutYPDvhfWjLvDIZXUkS6v9Py:kggcs9kriPykH6UcyZzT4PDvhejLvk8
TLSH
T1F674AEA5B3911CF8EC67413ECD558A16D6B27C590B70C65F03B8322A5F333905C6EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
Size 540KB
SHA256 b45143aed7ce85afc50a1ffdaf0feb8357ce436f9a19aee2d254c8bf9a4e680a
MD5 c564a8cf8a9fb4c1bb7c666a09f91da7
SHA1 a5d12126de87d58fc54de4346261a409a227d0d9
SHA512 c50da8439fffa3882d70d4ce8da8454b3218f7f02653496e0074ba5e41d748a7be15aeb70bbcae1e485b371526d7adf71be113121be25437994d3dc500eefd31
SSDEEP 6144:WLY7Pk7WMs9nTFboQgnpt8vX9VHpUbzsvFuAn/LbpqmHdIvfRAgvItFMs1jF:WL6sCMs9TxoQgpt8vFM7A/LbbdIv5SpF
TLSH
T1BDC47C90F3E414E8F0B38A35C9764511DA767C9A1B21DE8F02A8665A1F33BD19D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
Size 195KB
SHA256 9a6da7a5812ed51eda93fd2b3f58ae060d65db8f05b5748b61507a23ae70ab46
MD5 88557bb28c484dd718f55fcdd4d48ee2
SHA1 e73ced7b35bbf87257dd785c5deb8eec2b28f176
SHA512 b5e1fba043a78cce7068df73d023758440609758c3d9302bf26e3de8bed6f06811c017acf2f47f1b8747e4e85fdc1fd234abfcd21eb8bc8b2325482332c21d50
SSDEEP 3072:0L+ExBtH0BbrfU396Y5DEmd/MjgvhagI/f1OFOPqxxJsvWcw7zgcQOk/pen:0ZHynfs9p5DEmdggIn1U6vWcw7FQOusn
TLSH
T1D0148D0173E80194E473DA799C604502DB777E622B22DFAF6394615A0E367E1AF7CE32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
Size 138KB
SHA256 f78d333c8f6c7363a62d2ca924db428fa0863c8676e376ff0ac3096d63071ce9
MD5 3bc811415f206d2f29fadcc9bed6fe02
SHA1 5a054227c82694b391ce28717c0200d12027fb39
SHA512 fc19dedce75099803e08fb6787356b196d49f319df7b0d4105b3bb8965b4f04d25294ba3c49eea585b39f28212bcd460acf312400a237fda859165fb18f7e095
SSDEEP 3072:BEQb8mU39K28vJEisdBziuxvFX9zBL4oFCw:iQYms9P8qdBfFPL1l
TLSH
T1F1D36A9163E81498F2B38F75A9B041158F3ABDA25E21EF5E5390510E0F7AAC0DE39F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jre-1.8\bin\java.exe
Size 333KB
SHA256 97837e43e22c911abd2adb72e4eb6a208fa2fa79552742e8527697ebb798f18f
MD5 c9b6cc9a9614b8de4682dab05d4dcb0c
SHA1 4443b2b63b5004c10923ed0043e7658cbbe4e9a2
SHA512 4507e580e19f7bd3146fd20d71cc9c0398d19d4f46bfa2e64339dd0ee6f11b96f2fb05d15faa1a92dd08e83f2bec43b39225e476d58e539e2840f17ad0b1c350
SSDEEP 6144:AGPcRRs9CZ9AEWjDedyUcPqVeYV/PvyrP5QHdwQRB8H/tG9E:AScRRs9CZCEWbyscPvyT5Q9wQRB8Hx
TLSH
T14374BF95B3900CF8EC67423ECD568955D6B27C5A07A0C65F03A4366B5F333A10D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
Size 142KB
SHA256 33951309c79f540b7123b118467cbd39f1af6643de5ac75e7cc20fd344b805e3
MD5 fc308042d033afa868060ffacac3e1ae
SHA1 67762cff1a843f940087cc0c11400ff9710e8bea
SHA512 373c72612aa13e4789bbc4d641b9beeb42e59aae835f53918d3909273d7cfb766d4995f3ea057ea3d3bf807bf71889c2be7aa172419d8dd3181602d3a29eb78f
SSDEEP 3072:iU39ljlXEo43udtjZqMNbWwx2R5Brvn/+FFD4lr9l:is99lw6vvWRDLqFD4lX
TLSH
T1E1E35B61B3DC68C4E23BDE729D74883148767CA95DB0EE1D13A4728D09723E58978F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
Size 333KB
SHA256 c5e81457d424fb86493f927189cdd14c9c570b3eafeda94b9dfbeb3e7e0a9ef4
MD5 c932fe4296284f9439229b58c2f52609
SHA1 266619a3339b4f1ad20b408be9aee3dab59a3c35
SHA512 4ebeb98fd39566a7294dc82d2c76247d56b6749591e38ace06ab970fa003539c3f187d126ccc3e29b301f1c7a4907358845ad5f0a897f51aa8cd788729fce49e
SSDEEP 6144:wD48Ms9i71czdN6mAsT99BNxzLYutYPDvh8nm5HTg:ws8Ms9i71czr6md59hzL4PDvhymRc
TLSH
T1D074BFA5B39018F8DD67823EC8558916D2B27C5A0B70CA5F03A4365B5F733A01D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
Size 540KB
SHA256 660efe3e447b3718128020c7dc7140416645e480cff7fa6b6b5ded236a7586b5
MD5 faef266ad2c3ba60ae3988d9cdfe63f8
SHA1 ee0dc0dbfd455dd2a2326cb78e1fea6a22cbbc75
SHA512 28efe266b8bb2978419369f2f3f6b07672a9a273c55c90cd2cd6fecfa3c37b7396852d931e806d232df5516593b33d6d82b95de9b1ffae3f61542c868b90842c
SSDEEP 12288:twDAwMs95cGtetAwuTRtOkwDLbbdIvWAGhE7+hX2sn5PP5T:tyzteyrRtOkwDZ3JnNP5T
TLSH
T1D9C46B90F3E414E8F1B78A35C9764511CAB67C9A1B61DE8F03A4665A1F33AD18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
Size 195KB
SHA256 5d223e4c21472638e695c92608939e522d1fb893f0e5fa67a784767821467b01
MD5 00a6e9d2b44cae49a7caecd3f2df5e1d
SHA1 dd23a125cf0418f764d6118d7812fe4dfe6a4b98
SHA512 36e2266c1356d1a6a0ea20b14a96d34c6e7b19659f322e298bfa75c83fd7e03a536b69b3ef20b39e51815457ea9e0370af8115dba7a3366407d7a1dc30075bb1
SSDEEP 3072:QtGbxltzfH2xLU396Y5DEmd/MjgvhagI/f1OFOCJGxkWYVJbElzpIRBO8+c34y4x:QIzf2Ls9p5DEmdggIn1Unr9VRYJx
TLSH
T187148D5033E804D5E473DA3988618501EB76BE521B61DFEF5391715A0E3ABE0AE3DE32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
Size 138KB
SHA256 8aab2341e88965f937c7d1a498665bdb425c01f96d9c8b3dbcae0b95ac814402
MD5 32b0cc79d9b0993387a5f3ddcb39a799
SHA1 36015406016ed8f56bc681e809447866e5078c7a
SHA512 3b65b7e209dae1f32000b979288777087347fbe1d8b7fb48e5ba5d2e44fb1ed2b18eea0c31571668ece510c0216c662239ac192890c05a59002766a3f9fb6cf3
SSDEEP 3072:UfQb80U39K28vJEisdBzYMsxqZ6aBvM3DUKImmgcw:4QY0s9P8qdBp4a63DUKIvw
TLSH
T12BD36A4163E91499F1B3CEB5ADB485548B7ABC526920EF1E5380810F0E7AEE1DE38F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
Size 4.3MB
SHA256 2d46ba25f40b82aaa6ac3152cdcdce83465506202dfc1c61e9d194e3b9aa89d3
MD5 68db6292e3f3266c23b638651da518aa
SHA1 a52fb4c74bfd3d34edb954f99308ceee09815538
SHA512 59631c65e9d8c78c3c7de13e4805649d117080a61d92668eb9a9f56564bcd293fe0bd40d6082412738a6c153aee0872a2ba0d865b21d9f5918ef835cc8d6d79b
SSDEEP 49152:aw+nEWfqmw7OCyLlfvFJNejNcLcdjIAL5TN+h35euYwNCIdz1aUf9y0x8NRV3THL:aw/mk0vqSLiWiU1yx5CPDw
TLSH
T106265B556BF880F5E0A7E178897ACAB2F7B678420D31EB5F0191C62F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeClickToRun.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
Size 4.3MB
SHA256 fa182f9fdf77a3563390a758b841f439559e545af951204d18b62a582049caff
MD5 4199f96f7bb4bfce2109a9b1a387c60d
SHA1 6e11689fc056af9d569214f32cf5419069296999
SHA512 95504b27b02d3819c429c634f75e449fc7d0b3db68798701ac27dcb8901e27f83a5555025225d9e3fb262335b4d61ac59e976a795f037d2bd8ff564612515572
SSDEEP 49152:jPRZLMWWVZhaIJhbQay+iHhHYLxdWxDHLqWQ5A53LeugwR5L8ZzPb68CIF8NRV3t:jPUVFoaE4LefObJCV5CK7V
TLSH
T1C9265B656BF880F5E0A7E178897AC6B2F7B678520D31EB4F0191C62F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVDllSurrogate64.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe
Size 275KB
SHA256 1f714d743608d83c7ebd3e45e5cd85044e83b06e688f9bb36f198c5f295ed85f
MD5 fe02cddf42650694857bcb2769f4ce6e
SHA1 b161bce774dc04304eb8edbf6e46106aefb747f9
SHA512 18f0bae111a840d09cadc7ab78154a633a91ac90780cec3d6e0e77f492540af9c1bd94b69678fde58fc1c6bba342edbc99cb787b1e1f441f65396db8df9a55eb
SSDEEP 6144:3xl97j7s93WGNTNYdMzATVkQNUO7q5GocHBzO0daBl5duPepAwQj:3xfs9mGNTCWsTGQ4ElPyA9j
TLSH
T18154397BDD38F8D1C27E4CB46B91C740AB7271709B82238BD174C26E9D136E15E6AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVLP.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
Size 588KB
SHA256 9ef53fb2c69b416db4c3635a4d664703a2b10fd01550083fe459a8b81e705185
MD5 533c04f356bf9b3838f039071b571c09
SHA1 8b267fc95904d2e2d6335256607100d30b049f23
SHA512 435b2d37cf77832d34621a3a1e758dbb5891f0aab5c24498c337454d897d1d79be7f0056edc8e423f35760dff5caf751d85bb2c2b6ecc05c36ae5e827d5b64f6
SSDEEP 6144:2FANrw/i/TezFhySwfj8es9qQoTyC7J2/U/5o4Wp4hzvNUXITiXt9Z+M47iUlfZ/:cA5ezLxes9qAhluzvNU4TEYicORGD9
TLSH
T1CBD48E76EE28E8E1C27B89789696C600E6717C110B61D7CBF16CD27E1E236D05E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Integrator.exe

Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
Size 6.8MB
SHA256 e7e2b80aec0f7f850791ba0df0de7fe9178c0c44cc7b0880ac65b12116486bed
MD5 e023299e2f9f77ab557fd049fe44e1af
SHA1 f1893b70c63e777263ae9d48f9aa2fb1b342be17
SHA512 a221aae97e6d073746af993d74b48fcfc3e2d762b7d6a1e42e80ecddba9be546e8e8ebe7c728b7a94a7579f6abc5f323237f477c0bb45118c362c6e2e24ed1ba
SSDEEP 49152:8v/AQV69L0mTceK1Zhd5dvIOpisihkB3Am+R2JAzSm9w0pEIM6+01FQ9zOB17/xT:8L4ye6XpRaKcpTFB1GWuhrrmqJjeb2/G
TLSH
T1CA6629596AB481ECE0BBD1788D778772F67678418E33661B0261CA1F2F33E588D19732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Mashup.Container.Loader.exe

Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe
Size 100KB
SHA256 5ef04843e01d9d9a4259cabdfb804becc1f04d7e84053cf84c9bc1b51f693c77
MD5 5c194e536dffc64d6af71bcd82f4204c
SHA1 68e5e86999ff242d5417d29168d9359c007b42fe
SHA512 8b78ad662be01179a73ba1a888a6091936bde9d30fb9d82aa98d2fd2ca8c40824f5dae82da2cd33aaf1cfcf148dd1f66f2c56ec43b2046ef2e918ad005a8b653
SSDEEP 1536:0Ke4vXuhi3ug8Xje/eAMpldERVuir/g0BIkm4VdX/ltJB8Ns05A9+:0f3U39neAcI8ir/gxsvdysaE+
TLSH
T149A3CF027BD888D5C1610B7490405A6FFB767E470F66A3CFE5A2C22E2F63AC19D70D91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IEContentService.exe

Path C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe
Size 449KB
SHA256 0a2a4aceba2638d2e8a91d9262441a025ff8e4e76486b9abdfc44e84d24a98f2
MD5 f555061b88c91a4ffd10f7217b75db11
SHA1 753562f24083241b4c1461fccd7425d4463d0953
SHA512 5804e8cdb27ac98c5933735b1f0241e8405eb43aa6d018a6a37f6029730fc5b50eeab668370de648700ea69cdb7bb49d12be6af252b6a16d9bb261657efe63bb
SSDEEP 6144:wj1cw4dSTG7JuguaOK46be+yR9qCs9GLoM5jfcbvnmwVFwel+gwviV:c1ciTG7ggPe+uECs9qRfM3kmV
TLSH
T102A48D4AEB9454F5D257A238C57BC671F7B2B88D0A20674B16A5C26F3F33A607D2C720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerfBoost.exe

Path C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe
Size 877KB
SHA256 7d852445ce2d2bf9a07d4101eb077e81beda4634238439f3c28d8d2405077050
MD5 5ec44447936702c0d61f85383424edb1
SHA1 a02718b230f9e8e4058c4715a838b84affe4e3d2
SHA512 2a78a185b3728d164c1965a8c446298534e75950b2f523fff84a5f5835f4c5de70c6e8185e4cacf7447cc7160372561e62b4fd53461cde3e78bcc9bf1ec882fd
SSDEEP 24576:fcpDhf44UNi4b2MWpvpEKdUnHBt9Ibsf/L:E+Ni4KBpRDUnibsf/L
TLSH
T126153995ABF845E9F1B3A67499B68572FAB2BC521D30D31F0160C25F1E37A808D26733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDXHelper.exe

Path C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe
Size 189KB
SHA256 153ccbe8859aa65f7872561a42d78a923bf6f5bf7d2d4e22d35effbf454fc165
MD5 9501ae3adc63a722a5d0e919b00ca20c
SHA1 f3007f8a7a0ad87bebca31747608563a4de9ab2b
SHA512 3b76fcbbd15f308cc2b25da58942932e878b349dc6c416b5d8102b2d4afc3cb989feca3d9b547b1678e21964c1cd559c9cf77cb42fa6cc6a8c6acaecca3e40c8
SSDEEP 3072:V43SC+ptNq/DGU39GT1Q2+zT6lZdAh3SJxfFrgrwHvI7NOQkQW0kF+IFfU:kSBfNq/DGs9G6elZdGaFkrOIpLktU
TLSH
T1A7149E4677D4A0EAE803D174D9A9FAB1FBB6B1B15D20636F1251C24E0E3B7D0BE18721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoadfsb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe
Size 2.0MB
SHA256 dac513a0709ec2436ad19dc4323814b0df5646d2c43dd3d9d4ce764da3eeda05
MD5 a18e171b984649043d1262ef7acbd94c
SHA1 28c8f66a936b2eda42aa5051cc52135cdcadf7f7
SHA512 806a8873bb833be29faaa0ad3a457d05985e057ef9a08f5907c33ddb214632eae269e2e2a23f55ffc2d19366b995739bf05f7007867d2843997fc86dec3d079c
SSDEEP 49152:CBty1jHJLC1rVA5/XYX5V01GFT7bhldTp:oyn8D5
TLSH
T109A52946ABE8C4E5E2AAE2789975C9B5F6F2BC510D31974F2156C70F1F336604E38322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoasb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoasb.exe
Size 341KB
SHA256 4cc97721da2204a312cd2f1f85c8e5efada5d0d991803221c4b34466a2e01d46
MD5 f19d16a6ae153733eeb520ee19d4e1a7
SHA1 36460eb81d53e7fcca1b4ab95345356cacfbc0b6
SHA512 7ad6f715132d5774ff9ecfdd14a53fc18fa03ffbaad2c724f9c7dd73d04159d7b9be2059fffef9b04304b2c1012c7f63c3e9f6fd23275c38d1adb00410f0348d
SSDEEP 6144:jxZxNFs9SAYUmAPRZb8dPaspzsuXO09bhvRx9EiOwZexh7CfC3A:jxZRs9KDAPRZodPaspRO09bhvTmw4U
TLSH
T1E17449577BA48CE1D817A1B88986D2B5FBB3F8614F21C30F6952C32F2E37661AD18711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoia.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoia.exe
Size 6.0MB
SHA256 b2d7c8054cc4e035bb859f52aeeec41f062c53948cd916a1930771fa5c087d85
MD5 f6e9cf1d700cf180c73d107df9749896
SHA1 44cea097737b050c290a1c95f6d1eb4c44b49a37
SHA512 54d8ef86214cf94dab24d753a8d32f2a6667c69b60d4cf9fe813df0be0c0c52a389a20e5d71542d28ecb4c5160a51253c5a543f47b74e004575da355526ec4b4
SSDEEP 49152:2vrioDYSiEy+xWahqCQqfu3y8Z+1NqyxHbx5o38ENr+tEAMK293+XQK+P5jGSUAl:2XHI2mYyqM5KZCLw21maFB
TLSH
T177564A55BBF982E4E1B7D134CAB285B6FAB2B8555D31A74F0551C30E1F33A909E28332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

officeappguardwin32.exe

Path C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe
Size 596KB
SHA256 4074321ae6e40c074e747778668ef465e031fa0748601ced1da8c728c925e0b1
MD5 6134290f926775a6b11d5c402ec672c5
SHA1 e6214b5b5b390902c1bb2c4be5db27f94f03d700
SHA512 b7923a7495607e2f9b12bb2d86c86dc7bbbe97c4080f371c0399d21913e92ef9c44d1e9146e9ae36177cd168a5f68a11d2a84640ee0935fc6d2273bbc3903150
SSDEEP 12288:H/0kL3dHgn0vtwgJ2Zs91cIPr0lypFpk8:H/023dNl2rcAlcJ
TLSH
T1D2D44A41F7A881E2E566A1348A6685B1FA77BC131F30D70B7559F32E2F33640AD29B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocolhandler.exe

Path C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe
Size 6.4MB
SHA256 b680d6bc3a447984f549793236556f8560dcd599c1470e8761cbf91e76c4da91
MD5 3c0545b17d92502b1d609941e73f9f92
SHA1 10c9bf43c899120433aa184a093dc201c82558db
SHA512 d1b991a6317695b9babd330f8ce1d7ecc2ceb0d2f527f3aca42fc1969239494077099cf7193f5821f34fc54122ea1051f5a46ec74228c10417f460a9ab735e73
SSDEEP 49152:1dTWFnGQl1ns8NFKBk2hbjTnmIs04BhXl4l51aE1UUmFCQKm+8Dau3iFByd55LC+:+Jjy1SCc73Fis7xzHjQxC
TLSH
T1CD666B417BF880F4E1B7E2788A3A9A75FA7278425E31AB4F0151CA1F6F776508D29331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OLicenseHeartbeat.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe
Size 2.0MB
SHA256 5bb777e8623fb4d3d219e3c67d295cc29429b5d3519090d3bbc259dd9a9f918e
MD5 915a57bb646582c5e8ddc7797f48d41a
SHA1 e74923893af54bb1b1bb00359c195bee9dffc89b
SHA512 2c4b285015787857a4022ffac5f609003ea61af7d0fcea8648dbe6edae69780a6c370562e4e1f54971b3e7254b1b16906795df96cc937b3463e346c966675b48
SSDEEP 49152:U8lHWGV2rHM3tylxg1TOC+kDEIPYrU98xjqrAOt:VPVB
TLSH
T1DCA527416BE881E5F5BBE7B89AB68979F9727C521C70E60F0156C60E1E33B408D39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLDumper.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe
Size 222KB
SHA256 eeca7fe3b175cbbfb3b8250d60401a045ba23a124ca11d2ad9d04efd219dfcb6
MD5 d2e4fac267ba4446e1ba1da85adbb659
SHA1 01c99add76567e3c3ec2397f284616c5d887a9d0
SHA512 160ff7705869a64db7dbd1980fc88d92c3f9ad100f6022ddcb7ed1cf447fdf6962f10c8841a0178e3ca66f7bc685e31b3a6b0f27748643b97e88ea20266a6ee5
SSDEEP 3072:XcbRlsBF2tKU39Zaj4+qrSVzN2Bmt+hlqrynaBUn8:XcbRaBYIs9Zaj4dizVJb
TLSH
T198244A40B7F9244CF4B3ABB09EB582626A7779996B31D7DF0508815A2F73BD08D34722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohub32.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe
Size 2.0MB
SHA256 4fa60c2e968a44d7242add8ce3c3129e07432070a948e2baa223398e5b35b13d
MD5 e748daa7ab732c23a44692e038bfcd60
SHA1 96bd63f00a8adb6d4c7832bf1f8991d83afca1ef
SHA512 441e1f7f91a85600fdf0f8d623aa051eaf1b1b6f892c91f885be9bc5021080bae62ae4fc272b0c84b391747ce020af5b1de25247b080cfe2e156e9c1caa340f2
SSDEEP 24576:tcjyv7FZjYGgReasswdI/9gcDM52A2NBH3NRLOQMqFVwQPtA8QXMb4FgwPqe0Pj8:tcjyv71Ilzx4ULOH+MYu8m1/p9j
TLSH
T1E8A55985BBA484B0D526A1B189A6867CF7727882C9334F07318DDEDEBFE36604D59331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreporter.exe

Path C:\Program Files\Mozilla Firefox\crashreporter.exe
Size 3.5MB
SHA256 21c9f621367286e2bda2ae7561d9253aa2d817b568b127c76f252c4de8310b5b
MD5 3e541a6c565eb8e8f148d8f6834afa63
SHA1 8496ce91afdd37541a4d14ff3f0ba21207224fd0
SHA512 65d1b8504dddf009460bfef8656fcaf5824e5496641916d723f24d162981e09890ef100aca4050b9129a8a5944b7313187e35f6237c89193fe697b95b87e0a85
SSDEEP 49152:Ljalw/uhcWkQSyEO28wsz3iDT4JmeDNB05FQz/zTmXLhm6kV9d94:Ljb/WNS62Jg9f05FyfaLhm6Yy
TLSH
T10D061742EB615DDAC025C0B483266723B760FDBD073036F74A906735AD68EE01FF9A99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox.exe

Path C:\Program Files\Mozilla Firefox\firefox.exe
Size 777KB
SHA256 343a2aa4d03edd01ef46e38dc887293840b2120510cd4a2550e9aa95f6da0993
MD5 e69e29908c044334dedac942b334064d
SHA1 5ae15be74d4f914dbd1fc741e3161072efb8663d
SHA512 3f558ae6e6cf58924c766224e330c190148fd12e60619c97a82b5d0bb6637e347a4a7531ec92de929ec1e737b39f3a5052c3f22caca3c901c631f09312d5927c
SSDEEP 24576:yyBvNesCf3EkP+ed4SwpemIwpelzEqbrHl:TBvNesU3EkP+ed4ZpeapelTbh
TLSH
T13405BF03F38516F8E48AE5789A42D533A5723C840B51A1DB1BED3F2A3E71AD11B7876C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
Size 329KB
SHA256 162b715a328297da0ba12f725bec5efc7a20b2a0eacd23035c5775d49f3ee643
MD5 7c5cfb160b6f5f14e882828eab3d2d48
SHA1 5a80ef864f7a76c7cac83ab873733aa07c4c603b
SHA512 2f20c9945d9da98265774652fba8cb2733d6138f864c42d0666b24d137094d77717add1d692f0a795db444de96e25aaae3745c6cb52e0a2620b889d2c4566574
SSDEEP 6144:LXs9fewj7IP15qOCaUk12Ij2lRJb+/iJPsfUrcA9ayq7kz6/r:rs9fewj7It5vpUY2lRk2czAkP7SU
TLSH
T1A774BF2577E00CF9ED6B427CCCA18911EA73785247A0EBCB03A485665F133D85E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nmhproxy.exe

Path C:\Program Files\Mozilla Firefox\nmhproxy.exe
Size 654KB
SHA256 87be1ebbf5856346eeaa5f4ae2d48b423d0c011e2b3126ef82649848100b8ed0
MD5 c41b78c7fdfea307051050d293a9e23d
SHA1 7739a21996075362888f186e6587ced0c4ebd9eb
SHA512 d176321d5bff0b091d67299c8dc7a2b109e3a3455eadd860d1c91463c2a54fe8305dd51f205da3627b5651fff8e13c9f4e3046668e1336963853c04adbf0fac1
SSDEEP 12288:m9/vkcjuRzbcAHnwMxyBQs9Pwc/waheNJEmTr:m/vFyRMAHrOuhP
TLSH
T173E47D02FA97D4ADD51EC078864786327933B4CD0B31AAFB33985A353D5AAE12F39714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pingsender.exe

Path C:\Program Files\Mozilla Firefox\pingsender.exe
Size 126KB
SHA256 89f03f00982f4151b9c4658417e27496c2b1f05260e9cc051b536990309ab3fa
MD5 d79e727e350850668e97941d24f8e2e3
SHA1 ffcdf6e96287534bd871f412af8dc4a3e76564a0
SHA512 51f2e05ad08cbc8a22bea5934f6badb469a7fe3e6c60a2dcc17041a8f05daeab90ab3504c74e83219e87baf38062129439a634574de2d57fd226a7d06e4e2133
SSDEEP 1536:LX8AFq9pjLvXuhi3ug8XjqMiFZSRn6dhSdWA7gmsDvCr3uk2Sywe3SrEnrh:LX1F4jKU39bPSh2SdWADsjM3u4Gl
TLSH
T129C3AF42DF00696AC522C1F8E4EB551283B679985F3536DBE35893122F016E46FBF3E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plugin-container.exe

Path C:\Program Files\Mozilla Firefox\plugin-container.exe
Size 202KB
SHA256 db184a4e17c85110871f4456946cf80554c563871288fd28697b3936a160d0b4
MD5 b9cd7bf10a360b4ec902001c81e8210e
SHA1 5c71da5a60f4e01567632527882b2759eeef0841
SHA512 06a46f811337c2f345cde89b8bc422121d31add3b1eccd08e44bc02a7e568c78649e6ffbb26ad7269a5d8c7cbecc5e5d69bf439212dda477ba395b8df3af18d4
SSDEEP 3072:RakHqYmiU39WPO5Wr7BTBmmaPu06jpg9Zxr3/+2Zwv9blEN8L3F:RakHqYmis9I0WrPPEuDFgvdPTYWm
TLSH
T16314BF13B78D10E8D446E27867D25232D7B170CA0B21A7DF3AA8A1217F64FD8BE3D255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.exe

Path C:\Program Files\Mozilla Firefox\updater.exe
Size 523KB
SHA256 45aa6364a8954307091eb16aeb447f13c3be6e707286a87b11e5b718dd52f14e
MD5 4af5555be90840ec458ed15638c633f0
SHA1 0e02f6159e8afca9662356c502957e3eddae6215
SHA512 7aa1fbd41b7148bcab43e9e9c8e482f937da1c57310ff15e46013ea72ceba3980df745aedf9c8ebea67d60fd8ce0cfd1fb408539b803f44d81f2e3a2e6c83430
SSDEEP 12288:qNlGq0vs9ipWW3BROmpbwPgt2ZeyrSOJAdGy0g0DpLAdz:ElGq0HpWW372YSJ+RZ0NMz
TLSH
T1DEB4AF29F7A01DF8F42BA234C8A64511E672FC550710AADB62A4D6663F333D81E3FB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 188KB
SHA256 30a704d5df34050cb04eedbdbe56d487330824b849394cb7d1cd8b8af45e368a
MD5 535e65c08c94c3c3a167380984815006
SHA1 9530490475187902df1ccd84b78394dd358de2d3
SHA512 69b96ca430e29835fd8408676992cc6088aabf8db72e70e7ba263f429ec449e3db0a21896e568c60ccbb5c6928ac17fdd98c886790b4967fbee8451444a54834
SSDEEP 3072:ohwOLQVUyrU39ms1V8pQFq4XKF3QPYcvwCSp10m+JMh:oCOLQVfrs9V1sQFqT3Q1bSs0
TLSH
T17D145B59D29802D4D0AE527AC7AA8681B7373D6087E1D3CB56D0F53E1F322906EF9B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4420-1-0x000001F955150000-0x000001F955155000-memory.dmp

Download

memory/4420-6-0x000001F955150000-0x000001F955155000-memory.dmp

Download

memory/4420-4-0x000001F955150000-0x000001F955155000-memory.dmp

Download

memory/4420-2-0x00007FF67A070000-0x00007FF67A17B000-memory.dmp

Download

memory/4420-3-0x000001F955150000-0x000001F955155000-memory.dmp

Download

memory/4420-0-0x000001F955120000-0x000001F955127000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads