f3a6bcf552ce2bb5c62be8f4b0b3b15e94d9244bb1e2272426349872eeff7b2d

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Size 1.1MB
Sample260908-syn3fsszgv
SHA256 f3a6bcf552ce2bb5c62be8f4b0b3b15e94d9244bb1e2272426349872eeff7b2d
MD5 79d1d8f0c37ac1242a8e0a977b8abdf1
SHA1 036e586bb768d4108f14ddda54b36f92f2da7627
SHA512 7ce8151096e00cbb61e6da0af1f407bf06e907d8c2d2bf20d550a108996ab0c7da46e5bdf319931b2a4d0fe386178ac7a1d76e9e104c53e6806b0cd9228aea65
SSDEEP 24576:JSxlqCWbhk1Hyw+NkDxESKpMr4NDpyOKlKofSqjjrc5xaNIBSvan:JBCoUHyw+NsxESKpMr4BpJKMuSqjjrQR
TLSH
T164357D0A23A4419DFEA7F176DA17C61BD7B1784A0376962F01A46B726F337711A2E330
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Y:	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Z:	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\E:	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\G:	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\H:	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\O:	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\U:	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\V:	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Q:	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\B:	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\I:	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\J:	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\K:	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\L:	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\M:	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\W:	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\N:	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\R:	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\S:	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\X:	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\A:	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\P:	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\wordpad.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\javaws.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 20 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2268	2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_79d1d8f0c37ac1242a8e0a977b8abdf1_agent-tesla_amadey_icedid_njrat_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

64BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
Size 295KB
SHA256 76943c9300cd7ad8b28c0b2e2cf17a8ebb7334f3c20277e533bb29131b4bc2a4
MD5 f6ebde652201a6ec3243711ede93f21a
SHA1 08a2460de7573366728926b51938dfa27e35f651
SHA512 f2c0925f6deed5d4f5fcc7bed1198d0949d0b6067cb1641b11ea71efd7c89902c1fa015ab010dc8aabff8fb8bf4ad7d4612279970141644919c55b9597e2b926
SSDEEP 6144:h+Wl+F6ElxgWT++0DW7U/Gx56WcJtqQ1Q75BGeOChef0lLzWUHpaVcT:YWl6lqy+Wlcy7taChef0lLzWUHKs
TLSH
T142549D1A37E84CF5E467C23989524A42E37178954B74D7CF5360432AAF63BE0AE3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\java.exe
Size 332KB
SHA256 e2a34d47b2d5ee08cd1972303adf4bc3f2e6eb95921f5ac002e7eb52012329ca
MD5 89fe6df0fa45b4b70e50c163c77c61a5
SHA1 9419c84aaeac9c47e43e10a9561e7db3307bbecb
SHA512 664ce99f79d1e64ef1668f9bd0b3d8258bb96ad2806b5f1e5c104df3f8941628ee6f142bdf1a2318313925aa14460a36d43baf959b5b1c7d6e1e7bdba70ebdcc
SSDEEP 6144:5vPnL4ElxgTOojkJjfpAiPNZIigtYV/PvyzH1dG:5HnLZlqTOqkJ5nUcPvyz1dG
TLSH
T10874AF95B3A00CF8EC67813EC8555905DAB27C5A0BA0C64F13B4366A5F333916D3EB6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\javaw.exe
Size 333KB
SHA256 844f66e152fe32cce97cc0a2b69a1929ff53270f36e331b4ae3914d5ce27604b
MD5 1d7d182a798396cfa866e0d94d98a7e5
SHA1 7725241548e7850b57b32ee397349b472470e87c
SHA512 da3873cf92a3991ec89a2167f49d2f4d24337397904925ffafa346e6f28b15b603041ab4dd09b15127e0a4300ed6c55e50ded963597d03bb63a87cf038a127b4
SSDEEP 6144:SpWEzElxguL/0wa0YYhsWF6F1EzFYutYPDvh99Tyr2aD:SMEolquL/0wnYYiK6QzF4PDvh9t6F
TLSH
T1E274AEA4B3A01CF4EC67423ECC658906D6B27C554BA0C75F13A8362A5F733911D3EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\javaws.exe
Size 540KB
SHA256 37405d14826520f9697df9ec6141d6a2228f452f9b317ff22ed8d97df7afd0b0
MD5 35794ffbf8ba930d8ddf5b3c65d99910
SHA1 02ec1b9f3bc337bdc8abf185e9c633d522b04a06
SHA512 178023bd55e9d6006e2efb92e31b11832740a42235e624cbf07e433d349145e7e1255e3ebb7764894bef5465616d4b9514201efc1fcd2aa971c37b54b8d1affc
SSDEEP 12288:RtOBe9lqOJWTH7lb5s/u5v91ayLbbdIvWfiOl3fGd:RQclqOWTHxgud91ayZ3iOJfy
TLSH
T1C0C47C90F3E414E4F0B79A35CD765512CA767C9A1B61CE8F02A8665A1F336D18E38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe
Size 596KB
SHA256 dae01f29cb35b8e182fb9a1a48018e9cdaaea4e51f9262cb4e71f2b8a67063e6
MD5 bd854ca8e371273da735943791e0f16e
SHA1 f6ceebfe068fab8a4a97c822922c3cce628881a1
SHA512 8cd29267b9f49c85c11d76045a8e27038704eccbd93d7bf0d1bd4e467eee6492f7d7a3137089e4a83e3e2ac57df10c17b1f553cf38f83905bf6cf6093cb456f7
SSDEEP 12288:QlqrGtUoPUGSssjLynrNS7BK+WDiMuWcB:QlqrGtUoosR4KpDiMu3
TLSH
T188D4AF41B3E846E9E06AC134CA538546EA7278860B64E7DF02E092792F37BE54F7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe
Size 6.7MB
SHA256 8a4512edcfdd6b91857479d2084053c1c59d059fbca4e1ea2531193333e7aeea
MD5 8bf0d18995d773b1e7a7351c5b3969c5
SHA1 0e7df55f04b6a6db55e5b23c04c2a3c645730f42
SHA512 f4da2961054868fe1120d8b986b946fc774afd153ed5a0ac7fc5046536f860c6f161ec5ac2a05c68538293d0362609999099b5740ac353f00eeef4d1d7d519cf
SSDEEP 98304:fl8YfTaJ1+WonCB2L4HrZt8yPIieK5M0uR7F5e7z:N8YfTaelLOIiFUpIn
TLSH
T1D5666C47E3A600A8E46ED970CF3A5521DA253C8E57B493EF129476E81A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe
Size 1.9MB
SHA256 b5bfe114c98f2001b4336040e80fc30abefe82a60c9100e9d5771f10931ebb83
MD5 fef4037843171852245b2e677a30b2f1
SHA1 3819d83b644fa2ebd43d4a532cc7ac14b9323a68
SHA512 599376f4410ac9894b8703f69bc4910a382b4af0e4630e9ca83cd1cc840d2dd0db03cf0e006ea84bbcefd70349abfa9ac308a8856960f59dbad47d024cce68f4
SSDEEP 24576:A6c5R+wr2BU22Xkv9S2lqAq2DoPHL2NLb9Ld25PTOocJuJ/cIsY6WfvcRIRPu:Bc5swrkUG9SvAqrrwpZeToMJseMR0Pu
TLSH
T1F4959C03F29941E9E06ED578C7469636E9727C890B20B6DF0290B2992E77FE45F3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe
Size 1.2MB
SHA256 6ead7c8b508fd59677389de181c84ae14704b27d470f7bcfd1bb50ba3461b847
MD5 ef73d527a98b111ecf18257bc757ed63
SHA1 da4c44fff81a62288064abba95d86c56e2a7584d
SHA512 5b2f28c9fff8a22b22c482845aa9db08eb62cc7c2877814254e2d7c427d75f8653b8a85a892ff8b251e89393cfc8a364808633320b7835865373bc7aaa2aa114
SSDEEP 24576:+d6sT77NtvJOXurehlqjV74VvpIWw+j9/uIVprS4q5mkQR:+dF/7Ntvlr7jVERpzfh7pGZxu
TLSH
T14F45AF07B6D940D8D069D574CB668132EAB2BC460B64A6DF06D0F25A1F7BEE86F3D310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe
Size 3.9MB
SHA256 9b1a7600e4dc0029af0f042dd58b51c6142e7ea798f28f688a65f72eebeebffe
MD5 dea881e8008dce845ec51f150a4e2a7c
SHA1 61c5bdaf869a650853484d3d6158c367745496a8
SHA512 7887305df2a5c277593e4c1919190c7876eb727d2c0b1276a4fef3bc0c84b33a22d715276cf062f346571f83fad4574de34e802bfebc97b00be0ccdac277c821
SSDEEP 49152:l+f+bHf/NuiLotS9HIjXp0UB+rWr0GD0AGmfuVEusJ6LNzOeL0GKVIeCjIp26If+:XAn3SmfuVlcm7fwKAl9t
TLSH
T141165903F29940D8D059C074CE5A8132EB627C8D47F562EF3694B6EA2A73AD47B3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe
Size 1.2MB
SHA256 d503f47a5de26c2b712cb66cb132fea6b13df5ae98eea15f9cfe260441f067ce
MD5 8c24a2d1a0d594c80156b26c5ccf895d
SHA1 463b1f7b47539c50a51e0331d4ebd6fee34e2eb9
SHA512 66323f50424fde2e999d301c0b635e9279ed3fe8ee2cec6c0ca06f6371782d4f2ceb2f2c0336dfaff3fa97bc8c47a5f8d0d8fcd962e25cc522a49f534c2fca80
SSDEEP 24576:Gl9qCLl4uF52X+SlqZBI6mJNQcCpb5FRKU08mIz87Jo:Gl9fLlBFfZB8JOD5bRTNjw7i
TLSH
T10F45AD07B7D941E8D029D5B4CA568532EAB27C860B24AADF06D0B3692F37EE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 1.6MB
SHA256 f9b81cca785af4ae8b3f74efb3836edd3b6bb8ca60fd7f0a73be3030a9cf13da
MD5 40abd150de070768cb46bc66602d072f
SHA1 17d3ccc5dec2fa666a54762864f6b898c7d88f19
SHA512 4c0c3d8496a383d32e016307af76f53f6dcae08ef8f7de7f8a2483cfd0785c19b29a6db416eb8408a2447afc0b66b805a61b4435ada8c7130f95f403ff190831
SSDEEP 24576:bNXvSoKzWmV0jaXRX22K1lqeqaZnorS893WBqimlkkkkkkkl0T3gAQppby:BvS1zWQ0l2LeqdrvGYLPQe
TLSH
T190758C03F68A81E5D05DC2B8CE764B35AA717C655F20A6EF0190BA253EB7AD04B3D3D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe
Size 3.4MB
SHA256 c3691ff011de9cdeb0b5ce34d9df502e808fd2baa0e9e518f1f02c9c8562300d
MD5 4f0a39223bf73da90b47790e995776e7
SHA1 33cbf0e52d64a75a03d985d71b64fda0e00cafdf
SHA512 a78448787444ebbc000de6bf4cf4293a2ff55a899138e3797582e54351c83dacb6c2022bda63cfde06c3847c6ee9adcfb94d20672eadd64aa3f4aef836a0226c
SSDEEP 49152:b07NSmdRpP0/gMdoIq8+RylOGPGNi8qUqMzAD//ulO7Udq+KqOuBk7bVnU7wF62p://qw//ul1EE4wsoO5
TLSH
T105F54803E29900D8D099C478CE4A8632EB627C8D47F562EF3690B6D52E77EE47B39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 1.4MB
SHA256 b0f6ca302cbb4e14ce241c31b23a81b16f4e675c886b585efab7e367b8683cb4
MD5 9ca57150b64ab345cd2faa8aad240cbb
SHA1 980ee1f611bff086ce42103495abc9f6add7d5f7
SHA512 a0b27c86cd6b2ec5187eb2c546fcc8f7b4bd8c0965dbebb51901f38167ad011b35c728cd8001de56ad9fc376f4d9cb74059ba67c138a7ba56923bf5ba9f0fae6
SSDEEP 24576:bQ31cOnYBzjvxXA9IIlqhFfcryZ5lXh5lQEie1qRAZicxvijoPAel:s3LYZj29WPfmcLXh5KEiSZicx6jzel
TLSH
T12B659D03B2D941E8D06DD1B8CB568536EAB17C460B34A6DF0698B2562E37FE85F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe
Size 1.2MB
SHA256 489732d9ecd861c67713879d548f78ec576b4445f1adb2630ba4ffbcf6cf0f91
MD5 a40b116fa25d0b3722d74d6dff0bfa53
SHA1 948aaf9a768ffa6807b18c4ed8c459644b8a073b
SHA512 35ced19a5d8977e6d8444404c7b177788fdd447a22ff6914657d846625f21e1ae2a1a3e5f833a5191c20103b96ce378f6699de47c64ed4cf3ffb5fa54c74a84a
SSDEEP 24576:TbpYLK/HIosAX+bblqlQhITOVxIsdqHi7HbtmxGy:Tbp02HIollQ2TOV2sdqGbQ
TLSH
T1AF45AE0BF79840D9D02AD578CA668536EAB17C420B74A6DF06D0F2592F37EE85F3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 248KB
SHA256 556a5388961dd60ea2d94b9802e071adad815d7bbbbd093a21be7802c0cc8c16
MD5 ddc3dccf390b825c0f3c7df4f12ae7e4
SHA1 7f175a704ab4b673613e3a0fcf6a545ae395d11c
SHA512 e09e16d9196d4ad862eabfa8059439b8243a5d86e184dae3b55e07734a069c72c8da66c1d99feaae949f862abed5f17677de8108458fa761b9be09e80d61cc91
SSDEEP 3072:aEGYx6KAMitqQTzDPcAwzSpgnbzZe+1CWKuR9CbOwWoY46TW8sgyhNCOV1yYwJBj:aElxgLhXD0AwzScbVeVWR/Cuoh0SSRJ
TLSH
T186446C6636FD10E6E036C1B4CAE58513F335F87613218EBF0290465ADE63660ADE7E36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 265KB
SHA256 e6af5ea9b5334a9882f337b580c03f7dc6ead17e5d0729f38d511c7612f2b0ad
MD5 36f172e7717bce701ae877a310c7683d
SHA1 bacae3a45b4db0ca4ec76f35f1c5846cb225b3c9
SHA512 2c13fcb95d3a58a6a3f2fbe2166834fad5ab79ee9aaa3beda7ae8431551be66a9e1bf0a382231bf57c667ae7c21ad7d199e0eee482b8efe4fc6475d0f2b7ed09
SSDEEP 6144:1ElxgyKBExraTpBvADQyYWoht+uoZ7h0iK:WlqyKBjzZyHo3diK
TLSH
T1B2445C6925F810E2D176C5B48BD09903F234F8B667108EFF4281875A9E23A916D7BF3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 610KB
SHA256 6a7c5b15a462ccbcadeef94e2dedd3a6cda57115d352ce0c4ac51b4ed57700a7
MD5 f22803e488cc2be1cbac721ce458b4b4
SHA1 998200be50501d762c7d2c8e9549c80088b2beb3
SHA512 b94ee1ac8ce8e3cc96214b76ab0f8ee4b0dee24c5ff5895c785f419c0c8807ccd8ce78ab7750f0f79c511dcb18194f1da10f78ac55d90162d4bc49a2b9eb199a
SSDEEP 12288:mlqYn0bJsZ9hdYHVluOSuCk9a7M15rkTrGU:mlqYn0bJEhdHk9aY3kTCU
TLSH
T1B8D4AE85B3E847E8E07BC534CA528542EA7178960F60F6DF02A0527A3F37AE55F3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
Size 7.2MB
SHA256 0342ffc2479b984395e2ecdbadfe660e851867ae4d61119b9959d4333f4d509d
MD5 09572c04eaad7184d184299e3ef39e3d
SHA1 d8091ce44a1c8b06b769a8730ca61bd113758eaa
SHA512 25eaa87cdc75ab7316be63c8d9a76f51d68b217abe3a1892c89b970c920a793809430d80db444bcf60fcb943507c9a2331b94e45ffa4ac2db0d75a9e8e863b3b
SSDEEP 98304:26CZetahq+WZ7I3QwCsJB2++fGMfOxRj2vJzRN+T6fru4:xCZetaqIAGIGZxVqzRdDT
TLSH
T140766C07E3E600A8E46ED974CF2A9521DA353C8E47B492EF169476E41A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe
Size 3.9MB
SHA256 711174c0e41ce429e6bef00bee66475412f4481be10aed077cd8ce03a9f4cd33
MD5 5c96c8a74ca31a2b21466b4e694fc075
SHA1 a80b5a02535eca85954b43ace33f4bcf57b871af
SHA512 cd96dfb4d70b1dc008a8f30068809e10c586471f815c70345beb56a98535a23454a77b09189daf699eff904c00acb2439b7437066d43dec213a8380d0aa42a87
SSDEEP 49152:afWOxXF21+lqqEgT5bmhLbKqm006NPpIupEjmVu+e6NqcXToRzvUqIzYHBigdQB+:qxUMoqhTpmCCGeNUhIUBbGob
TLSH
T1ED165A03F29900E8E05DD578CB568522EAB2BC854B35B2DF0650B7522E7BEE4AF3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.3MB
SHA256 e567d11b3bb68faaa0967ce15d718af56951e3c58ece3d075819e3f52e2178b7
MD5 d5b41d6efb369caeee11d84cbe493aa1
SHA1 683ac9fd5a100346eecb4dd96eef4f552ee2adcc
SHA512 a52d2822eb15cf40818cf0e759d32ce40723b55b69990af5d6b3dfc03f2087c42076437c33a66df20e8f87385266a68caf092f25151b255c6171b4a7d795fb64
SSDEEP 49152:ihRYVCYCTAWTnqWE6ISstBhuXjfS4LWxnU9lzl38v:FVrqYajB1/xI
TLSH
T131B57C03F2D900E8E06AD178D7469533E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 1.6MB
SHA256 50ec3c3ef6a662690c07a96c2391613c75e1bfb93ea05592459bb5aa3c7127ba
MD5 fa53d0b54c43a536b1ff443876f3bece
SHA1 0bbdffd940959aa307131f7a732ab9ac52746331
SHA512 4dbd5064bab30e055f55d9a585c970d3b4cbb47a02efd84fb8b894845d4b4642308aae0872e9c43e3cc631a3960620b8b98599bc78be0e8fdf566c91e8598375
SSDEEP 49152:Igud3WTrsTj3J0lGU1kjLKJuurVTlXrk9dBQdS:dWInLrVO0Q
TLSH
T1A8759D03F39900E8E05DD1B8C7568536EAB27C450B24A6EF0A90B6552F7BFE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.0MB
SHA256 07272427658e77ccc7ae87b52bb1a6f92a1dac6f9cac9ab549ddeed4fbefe852
MD5 e70012373ab890c867168c1f1d8cbed9
SHA1 451283bd2e707a36df544eb6f6880fbdf8a64b68
SHA512 8a06c0237f4410978135ee87be63f33243517ff83380e238435b0b4d6001efc8b8bceef82e5f7817d83379814d9536be453c49d3a563f5f79526acbc2312adbe
SSDEEP 24576:Eh/IBa68jHUokFdSpuCHle3M2UurdLlq+s7CtW7KSdHBxmRkkkkkkklQXBysWAky:EKBaVUHuHlec25rS+ZrSdHBAVfky
TLSH
T1A0959D03F6DA81E5E05DC2B8CB768B35DAB17C554F20A6DF0680BA652E77AD04B3D390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 3.5MB
SHA256 ff911e722c2c58a10104627803b730d3bfbc08e7efdbc26f784d80543e3076be
MD5 1f1c4c503a95fed530ce167c714aa18f
SHA1 b33a608e9de8aed7f93ae07bb415a6733f4da7d6
SHA512 0b587d826ca73ae28021a86fc3d9a501c25a5ffb040c5672c536c0802045abe7527caf242357b93e54fd678a8e62cbcb54733dd3f7d828099bae1c8971556522
SSDEEP 49152:6uAoRKvOfATs/bUEtjCFhvtMb6YErqHz4AkOuaRoBISCaQZCLlrrrunA:T/jqAVAOnZbA
TLSH
T163064903A29900D8D059D078CF4A9223EBA27C8D47F566EF3690B6D52A77EE47B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe
Size 1.7MB
SHA256 68c462d04065a85f7bee319a5738ad2d39f0cc088920c9150c9d4f1f00b43a14
MD5 de93c6a209a85769469f7315b3492528
SHA1 78eeb1f421e08a13dde426c2e52ddbfb0a4474a8
SHA512 de6cf5fa2db94ca44fca1f1ac73fd9e96e6d72c9a1fbf893ce9a7a90f01a0eeca2d0dc84fcfa65b0a83db037da173265488cdfe42c3422e06bea3af975e6f88e
SSDEEP 24576:b2sgMT6ygywb6KbbahJuB+3KgKMzrGj/RBb9SlqVeQuJXlPnyF4mfHU9YawsNpPb:VTjg3Ye+6gKMfk/RxxVeHX04mfHIJ+6
TLSH
T1E1858B03F2D901E9E06ED2B8C7468132EAB27C450B34A6DF0691B6562F77EE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Size 4.1MB
SHA256 fd0537fce72a3925140911e0ba7c8af3a70532983cadc441962b9581a0f3ab37
MD5 bb8d5eed5e626659ca5a20321f37cf2a
SHA1 31dd7bac63f03001f66de1cc05b5c30d4682f77f
SHA512 9a441291aa1f1a10c8e31d002180d917816761d331410b9675c30676f27eae8d0e380735a677470ab0a5778b516dc05fa304f365380a5a63c77b756116c62a81
SSDEEP 49152:DuAhuE9gysiUXHpOREYh+kL+TjEzfzExldDwUIDtaZHWRdpev2y/BamOQ:FZQwf/0d+RaANQ
TLSH
T181165903B29940D8D049D074CE5AD232AB617C8D47F162EF3690B7EA2A73AD47B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
Size 1.6MB
SHA256 4d1fcf216f0646dffb1aa9d14489f500a332242422f12e36f53ae40ed65d0b2d
MD5 ef214645fe0d58b815ea6bf36fe11cd7
SHA1 7b44f5b2f4d0046de358a51b169d1767835ed0cb
SHA512 33cdbeea468c44fb64b94f1a14b9ed027ea9880abf9763089c04c9e1f0d23ce4fc43aa82de3a45c4cdc05c78693f4bf074a542cc60b52f1139e7d303cc306273
SSDEEP 49152:67WwmGyn+0n46ytEJo9vCBo7EukU1IgVf:WWvGyRCv/1
TLSH
T186758D03F3D801E8E069D1B8C7568536E9B27C450B24A6EF0A90B6562E7BFE45F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 1.5MB
SHA256 28a19530ecb51d545c148b04c5c0210037a5735b44746621ab56ac8884bc368f
MD5 16caa3421154bc521534f15d8640ad50
SHA1 b5d12f63792115e1d720099a81b4d9d0c2dc82d1
SHA512 6dd9d8bed2f2400b800075af06ae58fc18d7d1d8cfc8b0cce17031651740947d403256a97a8d80f7ae523fc14e085d32739292f184d987708e6c0e92ec0a5a86
SSDEEP 24576:Tc2vd6GOXbdXwGYguLiis4vgMRW95ulqnGsVa4i6h27d3WlXvBnep:FvdR4d/+iis4vgMRE5nn+6h27d0Jy
TLSH
T175759D03F79900E8D05DD1B8C756853AEAB27C450B34A6EF0B90B6562E7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 329KB
SHA256 e98ad349344c54c42442ee78861c6c01397bd249372ed872542b1aeff1fbf40c
MD5 9ae068da459e66b8adca7f15085e1bf0
SHA1 4cbc14a1c8628d9aa8b218d0f63982d378952f25
SHA512 c8ee41b8bbeb9f780738b332bbe527fe24300dd6e0657c5c242002ea7a46aa020fb493ed25f350e3a55490c00c805153186ced01bd4986041ab61d1756715928
SSDEEP 6144:QXVElxgPEkXewCm5PJZkUt1H/02lRSBG/iJPsfUrcAhis2JQqh9wr:QmlqPEkXewz5BiU02lRJ2czAhis2JZ+
TLSH
T18064AE18B3E008F9ED67827CCDA18915EA73784547A0E78B03B4C6661F237D85E3EB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 671KB
SHA256 43ad79e5299a455bdf979d851c8e206bfeac307c7ca0b561eecac656ba823250
MD5 de5615ebc12d507424075c646ed56190
SHA1 b419bcce6fd8c0a81915cafbe2970d2df766b98b
SHA512 28ba850f310ef992ad6504ed9c15a6df1c23430a66fc4b2c8af7aa523d3931891bd58262d8a9c9b25f92fecbc9313885ae542a8d491414f7ca7008388cbf207e
SSDEEP 12288:rt7BIV/ARUE7szfimOoI4Dlq8rHsYPCktMYBk9Fq:JM/AeE7sXI+lq8rMOZO9Fq
TLSH
T1FBE43B16F6748735D073C0B9C5D2A68EE97230825B308ACB4286D77C7E67BE68936731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.1MB
SHA256 81751758c6b554ad0006c95af5d9447fd27cf57c279344c375453181bb5a1229
MD5 90e554deaaca029d324530853a9ee073
SHA1 32e5db7d67083ca8b0af1d3d76b29f81b2564349
SHA512 6283b8042392aeba3bbb8e8c3ac6e8a74d3f15a424a531956d6655bbfbe193a123ec8f74ce369b565491201f9da6b247b4afef8cbbcc90631cbf4bd4bed7bc25
SSDEEP 24576:spmFezSChv3Y1Oa8grvWqlqm6q8wyuIx+MgxO:tFezSChv3IhvmmHjy5xbgxO
TLSH
T16E352A25F5788323D0B2D0BAC5D7AA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 840KB
SHA256 6583a2ef8c0b6294811f5452d1e8d855c0e69591929fb5e950ece4b45b690c31
MD5 304803cfa1f7df104d381699d8f7d63f
SHA1 730e6138cec6ec0eb07ff72a21b69b0a44d23ee7
SHA512 82149e148de7576cf164d6717c7a894847b79c113e050c0789a0fdcc8b97807f27ef14fb6054c60df3c471db10e466b84932cf34d7f6e762d1ab409a1226801d
SSDEEP 12288:k528Bl23voODFjsgolgPwsE1xWyANlqDf0Im98IjDqH9Up3/UIGwq:k5Zl6ogFOuyANlq9IjDqUpw
TLSH
T1F7055B66F5748331D073C0BAC5D2AA9AEE3234424B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 350KB
SHA256 1d1f3e17a453d7563421757dc3e2418689c17db0e411837a548a7bf51580a06c
MD5 6b4e4207febbb36d914611c4f156b130
SHA1 b88f039b696fc50f57fab89a1eafdaba8b3439cf
SHA512 eaf303d68ef86a5d792dddb71f7d4d6c39d12b3b3e4ae8a49dd4e92bfb07d68e31846fc45f30b3464028a25203a6147fab79d8e6d826b7f7940ca8b1d4636737
SSDEEP 6144:jO3ElxgDBJ/GKWWBNU6ITLBi0qttclOKgU91BjqrwRQrsS1d:RlqaeBNUbTVO86UBqsRQrso
TLSH
T15D744A3BEE38FCD2C27E4DB85A918640A77274304F62A3CBE165820EDE235E55E75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.2MB
SHA256 25d4a0481857751a5cd7571fa75e0b64fa0f22556216806578476074b51fa819
MD5 72fa427299130140722b8e94f464be2a
SHA1 79dcb278015456f841edb8469262d1f38b879366
SHA512 cb97b7351e0495a53f4a85c969fc547a653a1c3c663dfbf7851e71be4687e0005acc5e1b42f4ca7fa6513b33aed7a47403ed3bfebf09a17266883096ad7d4e41
SSDEEP 49152:XCqTaPOFb5Nz/JeUkhRQ3lEiwxQ6LZdarJjBClja3QeuboscdzzhF1snikWE8NRQ:XjDzXP3odLmO01sik65CFV
TLSH
T15C265B55ABF880F5E0A7E178897AC6B2F7B678420D31EB4F0191C62F2F336905D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.3MB
SHA256 c28e3392f1e7b958e6abdb075bf7b39486c38119c2c6573bb98f24177da2eda0
MD5 5876c5dec19b2e5ce0b78651043f4667
SHA1 e332d2b9701d0daee24c3c579d95932ea81fb882
SHA512 4ebdcb3d02fc47face014158d14747e28baff92139ed305eac2c32052efeb31352646bfaa107f29356bd6207cb922eab48c7d292cf6c977681413a76e407f618
SSDEEP 24576:gA/vi6v1P2z+L5WqylqnrHCYRFiV+XenmE3Pnzc3445MLwoC:gA/vi6v1P2yL5z7nfFiV+XenmE3/zR8
TLSH
T1E7B56C0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.2MB
SHA256 d9552c8fcbbc0cbfbd144c09d9ab5f052d52f24ed3faab7738ef3b3cbc346718
MD5 5f10736645a5b84a60ef417e272eecc0
SHA1 e154a12f0b93c3b6743667f2d8a958cd95a9616c
SHA512 de6ec48790650ac52b9f60f495ca7d8c96ec3e2ee7d56553a7ac50ac698b5b094808cb47b55c5fa30613daf456aff6365189a695deb9fe2d124090051724d0d9
SSDEEP 49152:wjEfD0WqHJOPp3DJf5SUYLoDpgLjSTYlQcGeXxAaLSF259ruMHwpXMi4FqJLd233:7HRQyi36YOcPXhLvw2gAf+PN3wp
TLSH
T104666B13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 43176545604c0ff52182fe316f45165108e83044af53c29215889f0317a38ce6
MD5 d13bcb8def04cafaf58fdd9f90923747
SHA1 23e59b2231ee7106e8db2d6390471f37968b83ad
SHA512 75b53e5c8a08c808df632bfedaf7d6c2359cab945e3851a0cf911410d8f414f521180a9b928031428f69a4f550300887153b7cd3e2b42e23613c97c03a866301
SSDEEP 24576:RVvjvO2EgQmrO3FDboDILhimtAlqn7DaHGTNHu7PNU3/5W/ohL0ycG3R:zW2/Q4VWhimnneWu7PNU3/Dc8
TLSH
T1BF952733B2F600A9D44DE1769F4A972196E27C758FE0D3DB810172161BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 3.6MB
SHA256 d4e978dad63c21c609293202b50406f6c13860438861fed6e1acb0977b260a61
MD5 20e53052bf535fcec1d013f6e31bb9cd
SHA1 e0d8c633edd2b5c4ca5ffd41c52abef0de0894b2
SHA512 3510ea900e6f826b079bb7b8c6e977fd0b7b16fd0c870293063f6e20cb5b818d9cfab8127d5903982f18348c1f551825d7746505a0e16dbb32d29a6d3d56c775
SSDEEP 49152:BL0I/n0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpmN3Oh6tznm2FQ/nho2qkrkk:tUy5112gYy5azzVvdl69nLKnhZZR9
TLSH
T132066B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.4MB
SHA256 47d12e2387f33380db3e764d96d7690faaf010fcb5394ccfcfd06892f2df1857
MD5 9f28d0de576a1d8ae602f74e303114a9
SHA1 dcee39d6b8c488026926accb7a11457908953c0a
SHA512 6afc6173ae9de87f3fb2ea5781b364e7661d450c2f6f433068a963e40f2768955bc9bd9d327524cbdf1e39fed295a1260495fd19262517edeb0a76d2125370bf
SSDEEP 49152:kfbdkZIMRKcEOBr4tEG9u0bqx0z+n217aau1gljp1o:mc1JmT+xd2djPo
TLSH
T165C58D13F1D901E8D06ED578974A9233FA62BC490B34B6EF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 1.8MB
SHA256 fec33da2ce25423c26d6f818cb01a94f07756f3fad13ea2686b439db380d1f3b
MD5 5fe75bdfd034c1db17df37aed6270208
SHA1 78afc492add205a1db5c393701212cf460761adc
SHA512 f05ae8f4fdcfa9414bf1cbfa2b9a4fb33c5696de89682b9ae6240340766f7361d8a288bb577cb6c301c46112518b10aceadcb729f6727a88f8e9358f7c08e889
SSDEEP 24576:yTvujiiyxl+oMfrVzeXVuCMmIOVAhklqYUQ1zNOgLLwH7ReaQXx3r91LENclN:Niiyx4oMxo/VA7YU44CwH7R4x7zN
TLSH
T12E859D13F2D800E8D05ED17887569632EA72BC460B24B6DF0A90B7961F7BBE45B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.0MB
SHA256 251b976a91d476894505b4ef1cf7e2b545a5d1a3d5552c32f897f5ea83e3f659
MD5 f8cd2c78e4819d21b552d4524a818409
SHA1 48bcf3deb96ee55f534a9fd734fa5107faa76ac3
SHA512 399e6ad26228dcf9c80ec8a28edde296f19a842ba5dda9d2520d1aa7af82692dd555e3de6f71d0b00dc2175faf41e067b9e87fc6c308db6ef6646b1a1e5c1d27
SSDEEP 24576:4idvnnQg6ZhROwcQEmXvAYiMPa/n9FHWxFlqxR04FxGgVG2Onks6xt4bSMHnqecI:Pnd0RqQj439F20xRVtOnks6NMHqjcRR
TLSH
T15DA59D03F2E940E8E0BEE67487669236EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.2MB
SHA256 0365ef5a1d603fa733e8ba8ff8c1148fffe7dc317da0456f7f8e6c0a5fc0ccdd
MD5 de7348744cb500bc7bf8add6c31d8c8e
SHA1 0770c26458529d84ba18684d5635c186d8264e6d
SHA512 deab1510ed6a19457cdd313b800c4c9d67c91ab88e82d7d5537e2dc203a6720991d745888eae33ffcd00c78b6c085e8d630ebc5d6d75472f5e10c10a85d3d727
SSDEEP 49152:xUBMVp9ab0Lb9jLAE3dGGj8b/rEGcjesaNkYQd0XNJKcvaAcPTY6Y5ACNAY:3bXxvjaNBDlZr
TLSH
T12AF59D13F2D940D8D059D079874A9232EA72BC494B3166DF0690BB562F7BFE06B3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 8d2d16a521406a4791a542009f15d325bfc595288c1bdb5204bde2e8c0a878b1
MD5 b153d02abd982d0ad5e6c934fd2b6066
SHA1 66860527613f350ba75cd3fa5253b312548ac863
SHA512 3f19c65e98e108c8b86f02db507bf04ab2a2d3125a8a8ad780883f8437c2a709a978928eac1634a5a1ba17596aaa481de5ee15bbb4070514f135a1ba91c9bb96
SSDEEP 24576:VxHvhcnFhrE1Mnf8DyUgjRI5q2lq7i3iy9CTn0AP5+2QLGPibi:VYnfrE1y7RI587giDn0AP5wyaG
TLSH
T18875AE13F2D901E8D06ED178C7468632EA72BC160B35A6EF0A90B6551E7BBE45F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 332KB
SHA256 8509a109e48d117ceaee8d91871bcaf89a0f3c916a0fe3a3a65571fc652facf5
MD5 3c7322aac251173a14bc4511bbb37b64
SHA1 bce98b8097498e2fbb15b7094cfbc9497a3b85bb
SHA512 a5573939da467b0e677b0a3ed106db2cbcd09640468267a7e2458dc519937d0bea803ca26de2bff927179941d0d0e43f7d819daa73553287f11af921c029b54f
SSDEEP 6144:F9Pt5bElxghT7Nyqjc3voWTgiBsYV/Pvy+1ltZa6DxKW:F9t5wlqhTpyqKX+cPvy+1f3
TLSH
T13D74BFA5B3A05CF8DC67813ECC158D16D6B2BC5A07A0C65F13A836265F733905C3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 333KB
SHA256 42f7cdedbb97d785b51d8db2e19c47e515e2d621bdd03783fce80ef68606b493
MD5 4ad79607040ac53e4084334b3757b5ac
SHA1 65d7952ee553370283a1f71ff44a9cdb5f7a6833
SHA512 4e63591ce8409b6872bf1be0222ec63404f1c4c01f924036a597b3681b2b978608850f781f6fce0418a282b42f1765467ee803b3859c97898a231c79b12f01c6
SSDEEP 6144:iweMPElxgV7iAaYcqifswkdDV0zFYutYPDvhXRb6PG/RFhCN2Y:iDMslqV7iAalqiE5d2zF4PDvhXRmu5DS
TLSH
T19A74BFA4B3601CF8EC67813EC9564A16D2B27C5A0760C65F03A8366B9F333915D3EF69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 540KB
SHA256 97b2d89dea517e42470be4322ddfa9d77d820e7163ed08d7f606559b87bc6327
MD5 66be6ae4c38f99f0031fdcfba1e4367c
SHA1 f52de63ee6c7b45a0402f02d45950980612e1944
SHA512 a813e51eeec18b71a39017b3f9d452801631565e907a3a9c0e5c44648607035df3eb2078d8fb7eb48c42ea4ed9f68210d7063bfa6be154dee1372907b351562e
SSDEEP 6144:3OYsTtjUiElxgXT61z67zdsAj8PyHp1EL5tdmuVO3LbpqmHdIvpp7i1:3OZZwflqDCz67JsAjRglVYLbbdIvpp7I
TLSH
T166C46C90F3E414E8F0B79A35C8764511CA767C991B61DE8F02A8665A1F33BD18E39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
Size 332KB
SHA256 f540534a295f188d9c947068e254b70b4058f788179f252eb8ee22e911fea997
MD5 7327fe99c8d0b4d2b0b3811df85dddb5
SHA1 958038bda3b4f527a84ad57a092f311596e72353
SHA512 cf4f28e7486380c59ab9f3963cae3c4bbe4745ef9757b2fb26273ed1ec7d3741d6e6a68f142b74ed3bc5c54dbdbd618ae908f400dbf408c95bb5c20413a1d2b8
SSDEEP 6144:vOPZDFElxgPzgfoNjUkYhpHFfj2YV/PvygmfnDF8:vKZDmlqPzqoNMtacPvygUnDK
TLSH
T1CB74BF94B3905CF9EC67823EC9658916D6B27C5A07A0C65F03A436271F333911D3EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
Size 141KB
SHA256 60e8b0d18280ab83efff936439336dab494bc3c5d7a5b08692602fcad4e7c122
MD5 d04e69bc42aa029b73b8389fe7b4ed73
SHA1 ba39826b6e0e5031c333db107f0bca8d0c7f43cf
SHA512 fe702b80fb248d4228933bebe08a9c26480417d4d76b558cf72b0764e1c33dde40660603b5f40b94b1204dadc49a9f14674ebaec88a23f872f633d6cba26fc36
SSDEEP 3072:IEGYx6KAMKjlXEo43udtjZqMNbjuxWj3JZNDX5u:IElxgplw6vvhj3e
TLSH
T1D5E35B61B3EC5884F5778AB29CB48831587B7DAE9DF18D0D2294710D0A73BD19839F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
Size 333KB
SHA256 ef6b620720c55b1084a03cd71b656f8c9a36b49158b0709feb2cf0ffe6ace98a
MD5 9a4851d7aea772580591dc5ab2576de0
SHA1 d66678a8080bb1ab0e93e3afceb10c938f9b4b39
SHA512 c2427ca2f0ced5ebbf228ea3f9ca18139707163ec24918b682787ad88747ead913e731f4963aa12170420d5f935987040f278750d0441636c0db5c92d27538ae
SSDEEP 6144:wz/5XElxgJ5zIan/usUJs+yjm1NzNYutYPDvhfX9p23bJ8:wb50lqJ5zIa/uBKBjUzN4PDvhliJ8
TLSH
T1A674AE95B3A01CF8EC67417ECC655906D6B27C5A0760CA5F03A4362B5F733A10D2EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
Size 540KB
SHA256 c2f3edf6f58fded7933d3b22d7989128e694d123f0032ce7b43544269042c4bd
MD5 959455e52e4ab83bba5e59f7a4db7d5c
SHA1 3d99d0770b7c70b9508adb2a2db201f7a0e2c7c8
SHA512 63b0aabcbba112be6fb971f91c91b85b426ae8c08e2bf0f058f7890161328944125fbce1d60cd7b1eb3009b6125f10c4ff4f5031fa7612d14f7e302296643ed0
SSDEEP 12288:vBHIDtlq3q+jd3vZhJZenzLbbdIvrF4m90uTQ6xI:vpMlqa+jnhJZenzZ6Wm9HTtxI
TLSH
T1BEC47C90F3E414E4F1B3DA35C9724511DAB67C9A1B61DE8F02A8265A1F336D18E39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
Size 195KB
SHA256 ca7f26283de761d0d25b98671dd1c337b18913c8eddaf36950c79d8316c25c9e
MD5 5915d153b299f602977af333f8750149
SHA1 29ec4e332a4d947fcb9238a7e87f76c7846be517
SHA512 ee550a068d7bb43b0fecf5085fe0cfcc3963d73d6181808877d43f61568977c99219159e64e9dc03125ea4133c61073b4124259656f43a79a543a4503a2c66bf
SSDEEP 3072:vtbqxjtxJkwlbEGYx6KAMNY5DEmd/MjgvhagI/f1OFOPqxUa3UX0eUobMWXPCyeS:v0xOobElxgd5DEmdggIn1Umas0+t/T
TLSH
T14B147D4133E404D4F573DA7988A04602E7BABD521B52DFAF6395311A0E3A7E1AE3CF25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
Size 137KB
SHA256 772b98a782bcee151758cdcf8cecb0b859591a28d6e7dde21324d2860a392613
MD5 2285d1a29be209967202bc20d3e4190b
SHA1 d591f96c09bbccabc96264eec9b840096557961d
SHA512 f8901c132881c9031232277e1ed92aeef841d45aa5092e3d7f6d69b1620d4c6637cabdc55cc4981040e14d28282429834d8f55ce43493bbc79812b128c4d9863
SSDEEP 3072:2YUQb8jEGYx6KAMd28vJEisdBziuxRDBeY5FSwD6B:EQYjElxgz8qdBXeY5FSd
TLSH
T162D36A4263F91498F5B38FB5ADB089118B3AFD515961EF6E5380810E0EB9AD1DE38F31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jre-1.8\bin\java.exe
Size 332KB
SHA256 fc87c4e5737aebbbbb8ffe0c66a47b573c3163b8d516cc2f49fcdd5e58f312bd
MD5 9e9d200599a8dcd39be889e1e063be4b
SHA1 e0aa6fe922cae6608d022e9481ff7eb45c9a4b21
SHA512 11ada6a26606999ebc023a11c35923fb25d77a2192e5b715ddea3e15e8908a2734205bb2a6cecea3b3825e8c70b8b9d426dfda37c7b4af5d2a669096ba41f347
SSDEEP 6144:VCPW//ElxgbregV/jp44qdiQLIWYV/PvyxrNEhHvvgq:VWW/clqbrLV/tavcPvyxZ+Hgq
TLSH
T11374BF95B3901CF8EC67813ECD658906D6B27C5A0BA0C65F13A932265F333A11D3EFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
Size 141KB
SHA256 5d3546c73b137ce10bf7631b984a3ed312a52980a2295ea768be14d3223ef4a3
MD5 440b726e748fd69cacff7e83b1f8c525
SHA1 d4a2a83812aef69ded926bd2c8ca85e2152a2b1c
SHA512 e82d180a47ee160cb0e627ff8a242e0293a93487f8e697f5d28e452a0ed798c6a195c64d583e98a56e56c7f24f392a5da4194f93aecfaac8e656d9e969590db3
SSDEEP 3072:0EGYx6KAMKjlXEo43udtjZqMNbWwx215WoDCiPjgaxv:0Elxgplw6vvW15Lv
TLSH
T1BBE37CA1A3EC2884F5739E71ACB98921457B7C9D4EB1CE0E6291711E0DB37D08478F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
Size 333KB
SHA256 be2072e4bbfc4ef228a50d7acd939dcb84f50d30bf5b488d7388cc33854ea78f
MD5 0fc6335d906991c2fdb609d5666cfcbd
SHA1 381452eb368ad8bd3decf296a3e57610ffaf6c68
SHA512 6a25a88e24cc56c6a9de186612abc794d91cb5f8bced29883c83e0fd07ceced0072aaa9913f21bae78dcd8266fe6ff7469f1c3f5f8121d81637972809d246242
SSDEEP 6144:bRLN3ElxgeQA6jjSfXFsyoKk5Jz+dYutYPDvhxwBvIJMeNgx:b5NUlqeQA6jOfXuzKCz+d4PDvhxwGlNS
TLSH
T1BD74BFA5B3501CF8EC27817ECD55591AD2B27C5A0760CA5F03B8326A5F333A11D3DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
Size 540KB
SHA256 97ee6fbac2b1d72cb5afc456e3fecb5142896bf5f16f02e74f9f7c08b008a315
MD5 156f599e9c1b4f609317456e12827bd7
SHA1 dffc9a03b205d84e825cbac62030d12090ba0a44
SHA512 1548c315849cb5225bb9b126e1a1d08ff5dd8a7bdc56fa5cbb67b924ab713339e0a2f2b2e7591d9d64a30538d85f873f1c681e2d45d2f4f9add3f4de1767a216
SSDEEP 12288:SEO1HklqVqyej/KIwGCVwsLbbdIvWG84o2:SrGlqwye3wGCVwsZuxo2
TLSH
T14DC46B91F3E414E4F0B3CA358C768511DAB67C9A5B61CE8F02A4255A1F33AD18E78F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
Size 195KB
SHA256 1c909575fd8e8f328cbc2009fd8da628b97b3bc6582a23258d40691b5e5c6288
MD5 b11045ffe52584038eff190c93998c32
SHA1 512ef02d40beb3e37baf7ed7c6363c4038dd5fe9
SHA512 8378e780bf5ce4e8ae989db9da6a2197a2429fded8f127a729829b1e11cd8c00fd65d6b8c26c2f239cf8e61a1f4494748e12eeda6d6417c22d8d59bd7dfc7ca9
SSDEEP 3072:w+vyx2t7yVtMzEGYx6KAMNY5DEmd/MjgvhagI/f1OFOCJGx0VcFkyJDC:wG7I2zElxgd5DEmdggIn1Un3VcFkyw
TLSH
T170148D0233E804D4E473DA3998A14905E7B6BD521B61EFAF5384715A0E3A7E1DE3CE36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
Size 137KB
SHA256 630c115fd12d2a034be4445a823d8d414a67d3bfcbe3d356993bd1a846791231
MD5 fe9d13dfa0afcf7338bd4dd1fc680519
SHA1 c87538c2ce07d9e6e4833a7089ac3ee97153e3fc
SHA512 473f92ca4a74ec98320a63ec6a5e8da0ca6ff58fffd08bd407d20a339abe0d56e15f2a5d3a894ea51bc338b540970a1e0453a91caca795f722c64fe38560c24c
SSDEEP 3072:LmQb8oEGYx6KAMd28vJEisdBzYMsxtYq66KnJmcl:yQYoElxgz8qdBpxq66Wl
TLSH
T13AD37A4163F51898F1B39F3AA9B480558F3BBD626D61EF5E5280610E0E35AD1DE38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
Size 4.2MB
SHA256 d766f3d1df3f12d28479470b874172c2502bb3631457431995d2229e8a530cec
MD5 34dc95a092d719f6bb45f7da81bb4e08
SHA1 a8956c91991b67337dbb7de473b571a7d38ca2f0
SHA512 9d921303357e9e476fc48bf06545f2c45f2d6d4b26044e9ed1925e5c1fbec3be230243a5e7fcdc32d7383cfcf437bdd9fda1c2ebdeebbb07f3c7080e0c4f4ac2
SSDEEP 49152:ZPdudvmRHZK54b3tXGsJPEOA+4P3Ljd2t4qwKH2G3seugQZ9qcrhZ+rYNvES8NRW:ZPVKkjPaPLz5R+r+vS5C5
TLSH
T119265C656BF880F5E0A7E178897AC6B2F7B678420D31EB4F0191C62F2F336905D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeClickToRun.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
Size 4.2MB
SHA256 0851cbed24c7dc6cfb51cd75e3af0d9a7ef0a6e98cea5df80cb18b12ae0f85fc
MD5 2bad4fa4f58a903d18184f57879642ca
SHA1 0d43f5a5d1b04f679f38390568c71cf005f3f3db
SHA512 59a2f96670cd4a6c57d41801f137f5c4cffe84498c38cf96d9a1dc60cabd54a1da347a704339885a1f170fcadb4133c04c227356f853ecb928e64e83d52b980c
SSDEEP 49152:MBKHBseENZp6A2su9xMBN3N3g7BLoddkXzeLzNA33euRl1R4lBJLJ5AgyMJ8NRVp:MBdZzNBMVLbFoJ5/yR5CiN
TLSH
T182266B556BF880F5E0A7E178897AC6B2F7B678420D31EB4F0191CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVDllSurrogate64.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe
Size 274KB
SHA256 7b54633ded3e401c54e9d1eccbcc5d13c1ab73478bb5f7b92dcd0157dcc7969a
MD5 5856ad3cadbc1cde7f6fb6215b71e657
SHA1 f446be9d6a801f3fd33c01dd46a9b60c302d3fa3
SHA512 14fc4efb09d45b3f14098d315094078147002f157c31751db94cce7fcf1783ff4b4cdb3b408373a0bfd93c142ae1a2f827a1f99f7a0473a6065eb98f8e3c66ce
SSDEEP 6144:3597TfElxgoWGNTNYdMzATVkQNUO7q5Y99ScUW:JxglqVGNTCWsTGQ4cV
TLSH
T13954497BED38F8D1C27E5CB46791C700AB3271714B42638BE179C26E8D136E15E6AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVLP.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
Size 588KB
SHA256 53839310e9aa3d5e93684df13676273b4854e526ac977ac747d884253bae1191
MD5 c9eef16164cbd5228da549a75bae7e2b
SHA1 d86469a5432b4cc8f321e151ea09881479973926
SHA512 4f0ea72e4271a8f1dba6a7a6b80002d1b60e384abef1fd31f69a7388544100eeac8cef1b334b8071dd41e342326a571a34d337e56cb110d93d0d744f35df41d4
SSDEEP 12288:0KGE30GbSlqQEluzvNU4TEYic7oxRCRxR9Rq:P30kSlqEq/ca+lRq
TLSH
T16DD48E76EE28D8E1C27F897896928601E6717C110B61DBCBF16CD27E1E236D05E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Integrator.exe

Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
Size 6.8MB
SHA256 2a62405c59b69750fbba3c3fdf1846366f648f7bb466dc66c9e60e9ddd4c5649
MD5 f8bc30bf5e5fd663fa6ff9aa50c5b1ad
SHA1 d2f37d8978f03c85d78df5add1da603c5919d49b
SHA512 23bf1174cbce60a5d7167b343c178f773d8e2ceb4b1a9cd374055a306d2d566b99902fe30863cc9fd24b527193e1182f0ea7079bfe7480f6dfaa86ca828df0ba
SSDEEP 98304:x7H/MlXnSC2RbFB1GWFwhrrmqJjeb2vZJHx7:x7fMRf2RXUWi5SzeTHF
TLSH
T1426629596AB481ECE0AFD1748D778772F67678428E33661B0261CA1F2F33E588D19732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Mashup.Container.Loader.exe

Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe
Size 100KB
SHA256 3473748c90743b0b99ee6001361bf7506daade42461defe6acdda5ad5334d479
MD5 a4be03806147ef29957058d9cdaa577c
SHA1 b4ce0541d8b1940b131144d5b83d5b506b8432ec
SHA512 f59d1da3af868c6ef39cb319f013d184001b5c1b096a6c5ed224e2bc1043b380f888065421888e3835245103f048c2f8112345d6f91daa677404f05884eb37ea
SSDEEP 1536:0KJRcKEG4Jx6Ky/Mjo3s/eAMpldERVbkrBXbKqeEjgzsrQkf0Y/9y5:0YR9EGYx6KAMfeAcIW5fjYsrQkf6
TLSH
T1B0A3B0A27BCA09C1E52213B9A446060BFE32BC215F52F3CF5245E11E0D273E5FE75A69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IEContentService.exe

Path C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe
Size 448KB
SHA256 d5a90c87e1609567d024e399c62d99abff51ebbbb2275e51fe360fdbd0c6b2db
MD5 5e5e685880a196653cb8bdc35dc7847d
SHA1 35d895ae836891a1a393c0c8fda9bbec73ea47ce
SHA512 79212e991ee8712f761706ebb0d21637e3b1ea4635322c231d43dc311002d337cd7beafd8573dc1405a104b3b6c494950aee91fdfb1af06e4889f20848583c24
SSDEEP 6144:oZRIBxcvgj92ug1yD+7hue+zVvp6ElxgCNow5jfcbvnmwVFwelFbaxc:WRISgj9DgOe+xRXlq8RfM3+c
TLSH
T110A48D4AEBA484F5E657D178C57BC572F7B2B8890A20A7470665C76F3F33A50AD2C320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerfBoost.exe

Path C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe
Size 876KB
SHA256 46e1ec49282343427daf4388b40c8d55e140b59cb44274cd1ee6cb39c95b6ebc
MD5 96a4aea34cf8e5e2ba7ba2e49970e0c9
SHA1 024279b7fda167e11a996f914c3929310f84566e
SHA512 3d9da7558b967bf94e6ab6d676b33add7b8639778fc716e9d7f20da524317513c1e9b2338c47b06114a3a48f03e8885c6071ce1737065f96fb520190c6fde04e
SSDEEP 24576:m3hyaE/oCC8OqlqQrIsoTXpEKdUnHBt927szcULB3N1nO0/+:WWC8ODQUfTZDUnk7szcULB3N1nx+
TLSH
T108153995ABF845E9F1B3A67499B68571FAB2BC521D30D31F0160C25F1F37A808D26B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDXHelper.exe

Path C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe
Size 188KB
SHA256 65968642d833276a69c1933224ba470c238646ef015b62a5a288f165e66fe1ee
MD5 f2535564f20b55aff370a12e2e609997
SHA1 4d38fc5bc0629081380c4bbac2560d9ce0f926d9
SHA512 4159a3b4eb3ad0a4482bc1f2bfb27eb9dafe248040d5058833ed2ce59c6acfa8955338599f1ea4a60c150dc73d055e4061e3df6475c1026f245d0d42aee8a3d2
SSDEEP 3072:hJiMSC2pFNq/DAEGYx6KAMHO1Q2+zT6lZdAh3SJxfFrgrwHEDj3v1VQIUr:HS5fNq/DAElxgCHelZdGaFkrzQIUr
TLSH
T15C148D53BBD0A0F9E4539074D665EAB5F7B6F1B25D60632F52A1D20E0E333C1AE18B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoadfsb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe
Size 2.0MB
SHA256 af9ad5e69d717c63915b47903ec3648da0fd4bfc53340d6b293c1c70b2cf00fc
MD5 517e45255dd32901dbddb4ce0e100b2f
SHA1 5f2fb17ff8457d97481dbdfd7efea2954a961fc7
SHA512 9f2467d4841845ff6a8742a2d7970aa7bcc0bd80694229e930333f67ea4f4ea4ca5d23b12b0dfe8a977dca2533dd2e8c0e33355709f8df4554571fe75af6d6ec
SSDEEP 49152:nwTFCpxrQ0H602j/0dCzpa01GFT7bhllZ:SFdB1SDZ
TLSH
T17CA52946ABE8C4E5E2ABE2789975C9B5F6F2BC410D31974F2156C70F1F336604E28722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoasb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoasb.exe
Size 340KB
SHA256 05541d1f6a352a95fc9e870de69d00daecaa9656fb4663a200a401aa2cba1697
MD5 009ec6aa7e9f98a4c727f8c94c0fe696
SHA1 cdda87579ee3eb6c3dbec16c937d247f4c5fd388
SHA512 3f3d982103a58ebf3020286171d02564e523bd41fc71a1608e0e0e2e192742bebb986d0af49fb588234ff29e5ec917ef770522d86a477d36b331a8a0799e2ed8
SSDEEP 6144:eXNsElxg+w0UTMPRZQ8inaspL184jK9bhvRx9EiOwZexhxPZ2a/:eHlqWyMPRZtinaspBjK9bhvTmw4L2s
TLSH
T121745A577BA88CE1E817A1798A86C2B5F772F8504F20D30F6996C35F1F372A1AD18B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoia.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoia.exe
Size 6.0MB
SHA256 fef600d802aa9767e4106dfc1ee47309e12b9d69fd2a6e61dea61a0d20eb03c8
MD5 a3f7fe4127218459ee2f9efdafa3a945
SHA1 4452977728c92a4b01d5eaee41aeecde5570b12c
SHA512 2a8e0769254bc137a2ab26f061175a59f075c28869669a413ccb68857314ac34f70eb1b4445966bcbb8c48fc62842ff3ac7d32ad8431372e167c66b539bcfb78
SSDEEP 49152:vQg8DpQYRk2VD/pi4b1RjRQzvjgd7m1sy2K61dRjYauESYvth+VK293+XQK+P5jR:vnYpZRUw/LAV5KZCLw21ma0Sp
TLSH
T1C7564A55BBF882E4E1B7D134CAB286B6F6B2B8555D31A74F0551C31E1F33A909E28332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

officeappguardwin32.exe

Path C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe
Size 596KB
SHA256 c5b083a07326127d4f70e2a08b7f6a2eced7cd224dfa312c5532bb2ca5709874
MD5 a5949e4d28877273945c425bd3d1ec90
SHA1 6cc6e84ec0a0e25edb1d604c596ac8494469eb8b
SHA512 e81adf823bd13a3feb0352b00ebe0b40cad30bc282f37f354e2f760f15f4ec7a1e24a4eda518698ce60a6f7c21e0d43dd4501b0ef47194b7de052463de3709c6
SSDEEP 12288:PcL7CZd0gC2vtXgSgelqKcIPr0lypFpB0tPZoh:PcLeZdrFgelqvcAlcV0tRoh
TLSH
T166D43A45F7A881E2E526A1388A6685B1FA777C170F70D70B3559F32E2F33640AD29B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocolhandler.exe

Path C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe
Size 6.4MB
SHA256 aa9554aebe9182721490850f43b51a119096562c2908740f9ee2c60b6f6f377a
MD5 fe8ebc611543489392486e656a00586a
SHA1 0f596fdc4546a7939d56aafac0e33a4c27accb1e
SHA512 53de906c4db9531403c7f555e62e8459d222b67489ee8f65b5a71e917da59753c216b7804cbd601a991a4291986ea26f1c1c9d7be92daf36133e7ea27ce20125
SSDEEP 49152:KB4BsBGQU5QRxcKBmyAEjge5TMkD759U4uaFkRfY3Bh8wqCt5waTWCFmj4hwTZ6p:din9Fd8/qWcauBBZzHjN
TLSH
T194666A417BF880F4E1B7E2788A3A9675FAB278425E31AB4F0151CA1F6F776508D29331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OLicenseHeartbeat.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe
Size 2.0MB
SHA256 08886a1a1c158550a5f872a4a95298a2555131f6fa9440f93bf83a5efeca10fc
MD5 71815f1d8c62cd2e6e9d7468c8497c50
SHA1 f436cab41ef58d831d553ec54ec2f2e602e9d0b3
SHA512 7fe14802971cb2b68c6461ea85330f7ceadbb80d758ebc6926fca7d03e7499b480a9de0c944ce051161d239faa89f469b1a845b04427fc85f1afe7240790186e
SSDEEP 49152:omrOGrKEVTWWD5o3+b02GunzlYrU98xjqrAm0P:xDnDQ
TLSH
T143A528406BE881E5F5BBE7B89AB68979F9727C521C70E61F0156C60E1E33B408D39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLDumper.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe
Size 222KB
SHA256 588424cf52a7d095db111cc4dfd8d421086b624dbba781cfcda64983ff5a62fd
MD5 d1465b9d02e6e51c485db0fcb4dd8961
SHA1 d5dba77ce57b83db631d110a63e3176143c52067
SHA512 5b37d12ae61655e9b18f51be74657781c1029ad683dd74de6c5130297ceae74a5e91376e027e10b7528d19f56dba19db9bbbae918ee8227027e4d358675c6657
SSDEEP 3072:XwNR0nZiQtaEGYx6KAMgaj4+qrSVzN2Bmt+hlGfBSCZmSwy8vpBOaI9O6y:XwNReZtwElxgFaj4dizRY2fd4e9o
TLSH
T1E0246A417BF91058F8B3B6B1AFB582526673B8851B34D7DF451886692F33BE08D34722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohub32.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe
Size 2.0MB
SHA256 c1d507e51b045db702cd9ffc4661ffd6b42247ba0145c0f20e7a4072093ee6c0
MD5 d5cf666dabda09663367b70066a33e89
SHA1 967b67471636e5f8184e86ee53c6c9361ebd06b2
SHA512 b5154c8b66b396446ecb4816b38ac960b47f1b8a4d125bcbb14864c343cdcd9fa8405b8a408f568975c271ebf42e3e48a0f4ee0e7e085d9c0e7b03a3d5882265
SSDEEP 49152:DXlb36tktRtmN4ULOH+MYu8m1/p98QnUYiO:OJLOeK8mT+QnUYv
TLSH
T157A55985BBA484B0D52691B18AA6867CF7727882C9334F07318DDEDEBFE36604D59331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreporter.exe

Path C:\Program Files\Mozilla Firefox\crashreporter.exe
Size 3.5MB
SHA256 6df0eb064845278adb3738546c9db4aec699d2e05454852a8181d2c818fb5e88
MD5 99d091deb15cbe6c8164a853b7ac2bae
SHA1 9378f38e6070e205a79f4739f334e4850f56004a
SHA512 65584c15b6fc35173ca916953ff8048aa76adcc3a463411c3540066f328170b2a66d8e865740399937769724f5e50880ff750a8481bff18ca8b3a3f6fc117442
SSDEEP 49152:9ljh6HSi0rX7a8MzO28wsz3iDT4JmeDNB05FQz/hrTmXLhm6kV93nJxE:9lFFXO8b2Jg9f05Fyh3aLhm6mJxE
TLSH
T15B061842EB611DDAC025C0B482266723B761FDBD073036F74A906735AD68EE01FF9B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox.exe

Path C:\Program Files\Mozilla Firefox\firefox.exe
Size 777KB
SHA256 d2868a564a0884667fd01096e74c31b18bb093eacee77b0e57521471379fe2f7
MD5 cff96690cca526777ce667acff318505
SHA1 e1198a79f6a276cf6c5b6e71acea6248ed9fd738
SHA512 83ad9f42af8c07d77644a9880f4fe2894ed1a6341ae500a68c1998acbc451bf0dd874a3db8fb56f72fdc2e9bbd6cd7f6a75f4f0b9969fa4d3622a57d160de434
SSDEEP 24576:6zm52nu8lq4SHmlBFl4SwpemIwpelzEdJ:Km52nW4SHmlBFl4ZpeapeluJ
TLSH
T19105BF03F38516F8E48AD5B4DA46D233A5723C840B51A1DB1BE93F2A3E71AD15B7872C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
Size 329KB
SHA256 d60900bcb8096f2a42f58431bbfb9d8e66ae089ec46ec596be041e1451bd4976
MD5 2a22426add8ddeeffe1806ef93f05339
SHA1 f29b3be50d530d32047475ccbb3854fe79e2f2c4
SHA512 af943917508412467a65ff6ba5d5e3fc46463b43b3d1f6ae3cb179a97ae619ca4b22004ca9963636c0a4621891decadffb39c0eabbef47e0d54e69ef83fbd224
SSDEEP 6144:0kEElxgxC0urLw059lC/nk1V5b2lRLdw/iJPsfUrcAeJcHh1qIsY2:z9lqxC0urLj5jknk2lRO2czAeJZIG
TLSH
T13964AD2867E50CF9EDA7427CCCA18502EA327C5547A0E7CB03A4C6255F233D96E3EB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nmhproxy.exe

Path C:\Program Files\Mozilla Firefox\nmhproxy.exe
Size 654KB
SHA256 04b2207f4ec92ec0ffd3c42ddbe75e05604f2770205b4be1df2b2df2b9b08f11
MD5 052775bbc42c5799c72f54b55b87d1a7
SHA1 4a6d109134c517c4375232c79126273e65ebdad8
SHA512 0c950ecf21495c908e51a3577f68a68a2afff533be3e4753abc77f476dd6cac180b3df651c6b808ebe61972fdd364498c00baab909cf4bcd8812310d7abb9258
SSDEEP 12288:ohJKgyHUixuEl7pzwdxycZlqiDc/waheNlHvyj:cJKgsjxr79WnZlqEle
TLSH
T1ECE46D02FA97D86DD51EC478874785327933B4CD0B30AAFB62D89A353E59AE12F39704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pingsender.exe

Path C:\Program Files\Mozilla Firefox\pingsender.exe
Size 125KB
SHA256 259c68671d3fdbaaa6d5a5f5847df66d27f1727f9709975fe47df5ea00b6cfd1
MD5 aea8ab1dd6f643dbe2c9ea40dffa06ec
SHA1 aace555dedf2468ee16c7b8531b01bf9641bdaaf
SHA512 76edb87c986b232193367d563659ab271cb5e77bd25412de7d6f5eca752871eabc87a3ebe289e0c3a234459f153a262bea27b3feef3951e3053f2e223cbff8cc
SSDEEP 3072:kX1c9jLEGYx6KAMhiSh2SdWA0KG5MdBOOg3:b9jLElxgG1FdWwDOx
TLSH
T1BCC3D093992029A9C502D3F1A5F787A193253B0BD7A96FDB639087121F013D47FBE6B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plugin-container.exe

Path C:\Program Files\Mozilla Firefox\plugin-container.exe
Size 201KB
SHA256 36b26dc0e2aee0bdb6ecf26078087015d1896fbfe52ca38081f5515398796915
MD5 deeb53d6fa64540b188a4398a98c3537
SHA1 42e7cb33beb4cc22b1e086d25d44c13d3164e353
SHA512 bba134c636d51b54d6e884c320dd68e6f85ff77840e19231125f874c33cc94f9244743377757c3f41a3f05b52b0d8d799bcaec0d2f79a0d8f7829bb034a4cf95
SSDEEP 3072:A/kdqBiEEGYx6KAMSbfXWkrd3M55aPu06jP+q1XgizmSlAeprwfOZYlyhqrpvY3X:A/kdqBiEElxgdfWkenEuDD5+OX
TLSH
T10314CF03F79810E9E849D5B926D25622FBB5B1870B21B3EF268552203F25FE4BF3C654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.exe

Path C:\Program Files\Mozilla Firefox\updater.exe
Size 522KB
SHA256 0a1158ed79a848f94280352937440f2a62b43a9233e5da3b245462a25a058685
MD5 9e61e50d1c16e695cd4ec546fbe59835
SHA1 1eda11e6b20bf62a265e570f64b15be8ec32dd48
SHA512 4d653fb979b69c3c90d04e1e9ae71a90662c7aa660b685be2ecd7e82f914df7ab7129b9c3712ca027e0ceed22bd2c93941278024e12940973b0d9455c0a012de
SSDEEP 12288:zxcyqlq0XI60V6pebFbLW2ZeqrSOJAdGytax1UTpv:dcyqlq0XI63q/XJ+RcWTpv
TLSH
T130B4AF29F3900DF8F42BA278C9628511EB73FC554760A6DB22A4D6663F332D41B3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 188KB
SHA256 765cb7eed2bd63595814401a7935d24b3e8a2eb5726d5d77c41ea30807e9e913
MD5 3e52cf8dfc25b57422cf1156448326a1
SHA1 38908ebbd55fe1fe8804ce95f159949d0c8081e6
SHA512 7f2d304f1da3802bc16015c7fa4a52ca5687e3e1b6333a9b28a2dcf8b448ec84d0bcf0ae8100f3cbe62ce07bd250a28533835f1612f6a7f105d1c79e745bb584
SSDEEP 3072:u8aqS7tBEGYx6KAMjAmV8pQFq4XKF3QPxgYV0Tyl7EV/:udqS7tBElxgZmsQFqT3QYml0/
TLSH
T1A0145969D25812C4C46E1076DB669A81B7333D2587E1E3CB56C0F93D1F3A6C0ADEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2268-1-0x0000026465600000-0x0000026465605000-memory.dmp

Download

memory/2268-6-0x0000026465600000-0x0000026465605000-memory.dmp

Download

memory/2268-0-0x00007FF732F90000-0x00007FF73309B000-memory.dmp

Download

memory/2268-2-0x00000264655D0000-0x00000264655D6000-memory.dmp

Download

memory/2268-3-0x0000026465600000-0x0000026465605000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads