f111505d88fd0cdb6792dfac675a83a5487866eafb083d03a9511692781d6157

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 05:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
Size 1.1MB
Sample260910-gn4jlsfg64
SHA256 f111505d88fd0cdb6792dfac675a83a5487866eafb083d03a9511692781d6157
MD5 49fd7a630c83206a3a9c9d3f78c5ceb1
SHA1 3f796c3862f586c37dd47135909c7223d77bd456
SHA512 4940b77344d33c40ba26d2158363c9505e32174bfa28dd553abe7fa5da438928d62aefff95b7faf147fd7e858c3c843449aa33bad290ee4a029f58ae10e5dc11
SSDEEP 24576:gC97bzL11yHC5BMJUS5p66kQXpyOleKbNSqUjrc5xaNIBR3wk+mwM4PREIHK:gArp1yHC56JUS5p66kapJlXhSqUjrQao
TLSH
T101357D0A33A4419EFEA7F076D617C60BD6B1784A0376962F01A46B766F337711A2E331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\G:	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\T:	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\U:	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\V:	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Z:	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\H:	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\I:	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\M:	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\J:	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\L:	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\N:	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\O:	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Q:	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\S:	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\X:	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\K:	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\P:	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\R:	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\W:	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\Y:	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\A:	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened (read-only)	\??\B:	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Time.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2476	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2476	2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_49fd7a630c83206a3a9c9d3f78c5ceb1_agent-tesla_amadey_icedid_njrat_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

64BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
Size 296KB
SHA256 bc4248ade0f4ee5aefccaaf61a92081d0e705813cf6c2c9af600be3c96435464
MD5 ed0d378ce6335455cca3f325d661522c
SHA1 aef3b161eb641dd5a27c51b08ac1c9ddfa6303f6
SHA512 feb9d561f65e695555f5ebcf648a326e109c2969c5c02531ecb255c6ab87937e3d9ac4101e49bc87e248d0fe5366332ddcb9ca0318641bf7a927355b8cbefd1f
SSDEEP 6144:huF09Us9bQUTVuj//URK/SxRTVcJtqQ1GVhbcP:QF/s9Iz/W5cy53C
TLSH
T1CB54AE1A73D84CF5E467C17989A18542F7B138854B61D7CF2764432AEF63AE0AE3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_101250\java.exe
Size 333KB
SHA256 d8be57bff24fcd9658259bdf8f78a1760f538ba264a9774e14e2f51b1aba57ee
MD5 f5e6d62eaac6e5251dd74f76a7da9b9f
SHA1 361ca66848a7870f8c3f3e5ff657e9a86126bb10
SHA512 da0cc57da5b072605ddc240e708310b2c1198c9c13ae469c1280ba8927d6491fa9db0dfe940492ca533de60491f525b3b2ded908aaa8c536a562f14c1be82cb8
SSDEEP 6144:2hPz3xs9P/PkhPjEbuDOKAqz5YV/Pvy36hkeb2:2Zz3xs9P/shPPzdcPvyJeq
TLSH
T14474BEA5B3901CF8EC67423ECD658915D6B27C590B60C65F03A8326B5F733A11C3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_101250\javaw.exe
Size 333KB
SHA256 49632b5853a44e594690b51791a1847204f8be1c76ec87d3e0641110b830a564
MD5 1f40d9435afa02e8e80208698d34960f
SHA1 4071e057084c9c97091a9be9139045aa6d169d84
SHA512 8696acc20fb8d69d4d25f13e53f67deba4c09406ab24b47a5bbac12e89d93117e690809a7b38352bf989fbffa24426a39ad962c430d2a490d0cbfdd3663bd06d
SSDEEP 6144:vooY/s9T8fx7Zs3qBspS6UYWzOYutYPDvhGM1Fai:v1Y/s9T8fx7C3qCg6OzO4PDvhHWi
TLSH
T17374BFA5B3904CF8DC67827DCC268905D6B27C5A07A0C65F03B8322A5F373915D7EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_101250\javaws.exe
Size 540KB
SHA256 11ad47fe0e0a99531ffa48dcc094a667d15b9786406df202ad3527844dce9135
MD5 fc643e30d7e4d651cbc6230a87008589
SHA1 426a0ee481a75cde7a031d0645d991c30fea8d03
SHA512 4c372b11349bff9b3d417c2abb7409c75fe3637a2a0177944f0964cf0c5ac8a9e42e61994b61f7770e6b5c7b274f6a44f1c07c06aa3ce84a5f14b3dc1ad200b3
SSDEEP 12288:rt3TGWs9yw5kRRrDPCZIsqLbbdIvWD/WShewDO:r9U5k7PCZIsqZ7/lFO
TLSH
T165C46C90F3E414E8F0B39A358D754511DAB67C9A1B31DA8F02A8665A1F33BD18D38F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe
Size 596KB
SHA256 3c22336a48c8fbef2eeb35d435a3d3b6a97d4d42f849744ebf21c9fef288a7e8
MD5 7765da2dceecbda2f8b35df4a2b40985
SHA1 b831057f40a3b1feb16e3a70514646ca2d99c1d2
SHA512 279cbc4dfac17a52ebd04fc44f44c73fc4e4d2e7522ff93d8a55479a1cc3bb96b5dc07003d73c18d921459c45b55c1b97502fd4040d29de5602ebb11f42abdc5
SSDEEP 12288:uFs9dov0h6PA7t78aQ3rNSzqWo+WDiByUP:hov0hNtk3WopDiByUP
TLSH
T1F3D4AF41B3D846E9E06AC134CA538542EA7378960B24E7DF02E4927D2F37BE55F3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe
Size 6.7MB
SHA256 38985d4b6d9a1852257603bf5ec916a9bc4d3d8b4863f2c6386f6f055505e167
MD5 f101b5eee6a12930bae90aa461c80df2
SHA1 db24ced30171f1a359381bd5221e3e0e56063aad
SHA512 cf9a13d688a8d3b87c8d58a993006311a64468b0f139260b761eb430888009823999498235565c6bb14710bd0459cf5399dfdfc263aff3a3e5bb3922ebec6a55
SSDEEP 98304:Kl8YfTaJ1+WW3B2L4HrZtPPIieK5M0uR7F5ej:a8YfTafLyIiFUpIj
TLSH
T155666C47E3A600A8E46EC974CF2A5521DA353C8E57B493EF129476E81A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe
Size 1.9MB
SHA256 e31e4af4b79e39086051971089eb9d6e9b5844683a45f681df05c83677bfb4ee
MD5 a5c11b330a02de459bac623b07aa8721
SHA1 99b12d34f4f3795e9c1da95fe3976af84b9dc52d
SHA512 7426f1c20ccdba253a865d3f8f2e810070d27f633f4262bd47a5e470677f48c4ab19a103ef5ea90f202b2005c1c001e5586a4aa216e55b3aa511ded5c94c48a5
SSDEEP 24576:IZ2m9ubbAbUr5XxkSyGQxjKnIEL2NLb9Ld25PTOocJuJ/cIsY6Wfvd0T0a:y2mgbbsUXyGQxTGwpZeToMJseOYa
TLSH
T11B959D03F2D941E9D06ED578C7469136E9B2BC890B24B6DF0290B2952E77EE85F3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe
Size 1.2MB
SHA256 4297d7c3d83f13523eeab1998dd41eafc94f3fb0e4ecfe1881cfdecf36442e5f
MD5 a069b05ca75dd54685b95e25457c26c8
SHA1 376dd2355ea496057a40dfed14003db3c82683ff
SHA512 e731abaf5851e288554923f9a172aa488b2de2d983634f4ea010b4e0180dbbafd81053e4f7b594c9cd30fe4799f45fa9834442a8c4ac855161f552cf24533de2
SSDEEP 24576:MrMVibAZgZvg6X4ebr0JQsngIH1x1cQIVprSFUc4zgUlF/Z:MrakAZgZvy4rEdnBVjupG6LlBZ
TLSH
T1EB45AE07B2D901E8D029D578CA668532EAB27C460B74A6DF06D0F25A1F7BEE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe
Size 3.9MB
SHA256 d51780825ef51bfd780c679d844aeed7ab5433aac971c88a273be7e33c4e6a24
MD5 212793222aeabd2e0facf23bec197794
SHA1 05e9af6928aec8c1eba3e721fafbba79907892c7
SHA512 77220189196073073b556e54f4bc3e6a7ec9a3ec1555513df8c0a4b6c908843a3be384fd6ed2a22fa675dddb79ff63aa16bffd2449466ebc594a82e93d0b1ad4
SSDEEP 49152:eT4ZO2a5DkBHsSw8sitQv7FteKru0GD0AGbuVEusJ6LNzOeL0GKVIeCjIp26If2g:JntQuSbuVlcm7fwKAs
TLSH
T174165A03F29940D8D149C074CE5A8132EB627C8D47F562EF3694B6EA2A73AD47B3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe
Size 1.2MB
SHA256 0093f113bfc764ea8e167d4fcf08f74ff77597c630fd6e4158bb07e7d473d108
MD5 a814bc4aa637ea48d3152912a68ef1ad
SHA1 ac33a64f70a950f8780672933d1a35b25c858301
SHA512 66e84aba694712ebf3cf83464c8c381cac15a40901b88c7909eafb693ec76fb457d485f605639980860f4417a26f0be75b5b8027bd0c62a1341c7ab70487a839
SSDEEP 24576:deYcQOaDFO9XKr27zDY7sYHPD2Gwe08m6I8ZJmY:deYjOSFH2PDKpvaGLNhjEY
TLSH
T14745AE07B7D941E8D029D5B8CB568536EAB27C420B24AAEF06D0B3592F37EE45F39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 1.6MB
SHA256 4c68939cd5a91b68ddb8656d5ac0959e1395942153608ce17b4dbaed57ee3050
MD5 87339d773fae681174f27676121f9cdd
SHA1 30fa2058258269ce801642c34e1a9726e8044ad3
SHA512 b3f145bb51fc26cd8b2066f1e6b0e9f824a64aeeb268fe12eddca31bd8ef6f1aa461fa726cbaec820141d92a4668e821109e5dc1a59185b93230089200625dc7
SSDEEP 24576:jvoAPRGsJnispL0eRX6Ps6i5hIyuCdm+GHAd//Xlkkkkkkkl0T3gAQUP2m6R2:D9PR5Jn7L0C6WhJdGgZ/PQUeR2
TLSH
T10A759C03FA8A81E5D09DC1B8CE764B31AA717C655F20A6DF0190BA253EB7AD44F393D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe
Size 3.4MB
SHA256 4ecbd360bf90e28742f7f8b2dd6f2cf54b997edb052a8f71fa98a57cfb11e9da
MD5 7a9453038b0211b9021e4b1762bb10fa
SHA1 417eb1c8a0f38c05e8c3c0bb080234f3b7952eee
SHA512 f2b154a4b245b3399e1ab711d4c12922dec30d3028a506219d1b0fa6601a1413a6cea333a7238f80f4f300f4613067c8dabe92748647e8a3ce7eed5074506881
SSDEEP 49152:fmAJ0aHHljGhhNqTL449FusN3+DHqUqMzADFulO7Udq+KqOuBk7bVnU7wF62JtY/:2kklwFul1EE4wsCr
TLSH
T150F54803E29900D8D099C078CE5A9632EB627C8D47F562EF3290B6D52E77EE47B39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 1.4MB
SHA256 054097f30974159cc21aba7e847e8650b8798cb96935dbaada81830c6703987e
MD5 9f750890e9e01c3ed5a2617f6b28a1bc
SHA1 2eea6735253cbb061cd61b4a4d70cca9bc4a39ad
SHA512 8dc9f3c13cd16558a8336a29c6c4465763b0762f3b6a6fe0905ae7b46ceeec3c6620ac783c8df96a443242ed799b8834202d45f1d9f1c6c9a7eb10a594797cbc
SSDEEP 24576:BUUWNc6AAp3j1hXgmNQx8F+MUFMuViKaVte1qRACd9fmI:uUWsAtjcJx0NYMuVitVtSCrfmI
TLSH
T1A7659D03B2D941E8E06DD478CB564536EAB27C860B34A6DF0698B6492E37FE45F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe
Size 1.2MB
SHA256 5c6aaac3a8cb0c321dcd41bd927f732fc971e67f8aa326fa0f4d133b324d8e4b
MD5 acccdd2d029bb9f5b7a35b966c9c24be
SHA1 a25ffb53a88dabd274bd58d66a7ef815f767169c
SHA512 f78ab1858e0d30fb6fee6be0f0f0bfa809e252affecc46ce6f6dd281b557a5790437fb9646ba64b36387b7effc10597616323db71565cae4d69b790f94c7c40d
SSDEEP 24576:HhWCThM+ohkXQCk0DNO7VRsqOH6kH6pUEjlFvm:HhTVM+oFf0RO7V6qOHx6ljnvm
TLSH
T14B45AE0BB7D940D8D029D578CA568532EAB27C460B34A6DF0691F2592F37EE85F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 248KB
SHA256 e6edd95e0aa74f105eed432472a0360cf2a52c8973fadb5789d8d15b5a010ade
MD5 7aca9f83a4ae8a991629f6b6ab14a6c1
SHA1 bd5bf9467d985cadcf777f420f73e4801452a2b9
SHA512 33ece2616e2049c1c02ff4233476fc15e6e435b6a52ce97eeaf7adf290f76404c0f99a64e53ad01a3f925bc69e1a35cfa13506f1eabbc8239d7540497b9d838c
SSDEEP 3072:OU392sGQTEh3aOku4gnbEHg816qKuR9CbOwWoY46TW8sgyhNCOVfvDYBhvfqJ5hJ:Os92eAhaOkuVbIgHqR/Cuoh0LBk+v6
TLSH
T12D447D6536F810F6E03790B48ED59502F335B8B217218D7F4394426ADE63A60ADEBF36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 265KB
SHA256 51c60b17052b3310398b9190a05d5202839795c8e2d9df1c3d1cd35f9ea05b80
MD5 037f8001e956627c3c1e0d3b282db0d2
SHA1 06e92b64d032b066199ca6d7627b7e308c4c9b8a
SHA512 11ac8a88fca7f11169b024192cee3e6ba31ff5a6a87c7253cff060428ed4079020f5cb78697899d7940a9456b723b3e625dee2ee23ff4c9c18de0281efff5ef1
SSDEEP 6144:Qs9NPYW5rawpBDn6tFYWoht+uoZ5znqkl:Qs9NPYJWmFHo3Wznqkl
TLSH
T1C0445C6926F810E3D576D1B48FD49903F231F8B663208DBF429183568E23A916D6BF3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 610KB
SHA256 1802aa00f75cf72eea89f5cc607af788ee378c291409ca26cb97344f3ba64527
MD5 b7e8aed9e8a050e3a9789d19139c8ab4
SHA1 87082397624341af608e179ad31b2042642c26fc
SHA512 f6a487f626599e312ca8b99a77f140836f2a64b41ab1536d569ce64c640f8ce39fe182e9ef4ce8265b45df6bcbb5e289162604dad61d47abc6272b667088fa48
SSDEEP 12288:Ts9ZuslyxxXjPeHVlSUS/tD9ZO615rnpPh/FX3ecm:0BlyfbzJD9Zv3nxh/FnK
TLSH
T1D0D4AF81F3E847E8E07AC534CE568546EA7178950F60E6DF02A0527A2F37AE55F3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
Size 7.2MB
SHA256 4762b0439078f7f13372ff2da5f3fc5351b18184beaceeb303a5346891e27c4e
MD5 251f29172b3fa26749d738827da1f6f5
SHA1 5070fd2d97c8d86a6cfdccf0a7d8532868f623b4
SHA512 e4c86a0c195ac468739486d52cead2891b79c904105b84fce0638fecd42c43f4dfc2509ab50ad062839496496ce0b4b46ba3aae6ef5ee7310030c79409257649
SSDEEP 98304:66CZetahq+WZhVPNJwCsJB2++fGrOxRj2vJzRN+T6frzf:FCZetayfGIGSxVqzRdDD
TLSH
T1B7766C07E3E600A8E46ED974CF2A9521DA353C8E47B492EF169476E41A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe
Size 3.9MB
SHA256 18f57cd6e6595cab60b316b2b3f0142f350339ac1f4e5f9aa07e960c33d72d3b
MD5 ff2c1a40821bb0044750b36c5ef859e3
SHA1 98c09b232eb23a9aa7c27b97f44dbacc0331bca8
SHA512 85a9363621a176429713361569c8d355f6eb7b2479be3d0600d6da040db89b2dc3c1dc024d7b15330c0006571f15e9c3459a16e35570fdbde0d951ff2d740138
SSDEEP 49152:wWhrfGQL+Om84tX39SbmhLbKqm006NPpIupEnVu+e6NqcXToRzvUqIzYHBigdQBo:pf1Ad19cmCCGNUhIUBbJ
TLSH
T15A165A03F29900E8E05DD578C7568122EAB2BC854B35B2DF0650B7562E7BEE8AF3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.3MB
SHA256 29c48163b2adf0ca5767b5814fe11738969c92ec21e323f97a27c9338f0c872e
MD5 08763aa840458003956c4868cfbffb81
SHA1 eee9b705dd45ff42d710addcdb5ee4ce2ee06249
SHA512 283c8f1aa3cc8741b00a9807f749d2a9be082704dab2a5e59be5d7817479e4ce5d487728eadf9e2d31a55db77948e881615468fbab93e3a05737388a548377c2
SSDEEP 49152:VPU77arDXUbrOk+7E6rstBhuXjfS4LWxnJsx:5saftVjB+sx
TLSH
T114B58C03F2D900E9E06AD178D7469533E9A2BC890B34B6DF0780B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 1.6MB
SHA256 7c23ed1a3493351d82f5b10299229fa7f5836b399711af529ea9eb10125b4741
MD5 84303983665b18aa602dc2380fc8eb7a
SHA1 906ab5c2d9ade7cea65d201d312290842823b0b7
SHA512 b9b0e5ea0e18cedc0364dd7338b2ec3e1b8e0504dc41b4f55b1d6271369276216c359670eddf5f7749507d965370f0a086358da97156e783f2cb2e3c4f8298dd
SSDEEP 49152:e6zOwI6QLTjMhEUNmbyPf9/AtTlXrk9dBxfp:eoj8E4tOlfp
TLSH
T177759D03F3D940E8D069D1B8C7568936EAB27C450B24A6EF0B90B6552E3BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.0MB
SHA256 7ce1fd23b68ef8dcd0bcf9989e4723981a0e1f68545e84f52fcf97a78ef10f5a
MD5 e4206ce0f88571959c37b3b200e9e3e4
SHA1 1ccf702784022b540f5329d7d83426465525e61b
SHA512 42f2c3a915047594e25685c3b8971be024ed08844d214840a45997e27a358c2a97eeb39eaf6e7fb55404abc9a0782ba0c93a89a2986d667b4e307862147da282
SSDEEP 24576:Oi1ddy6wzytpo7AkuADQN4bj3DUkGTs7CtW7KSdHBxmRkkkkkkklQXBysWAHZAVB:OOdydyunQN4bjzUkSZrSdHBAVfHoeI
TLSH
T17E958D03F6DA80E5E05DC2B8CB768B35EA717C554F20A6DF0680BA652E77AD04B3D394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 3.5MB
SHA256 85c8cd6e68b4b9481c86e25d25d336f426c249e12334e7cac62338d2887483a1
MD5 46c2ec27a2477eb32aa3ad9f3c3dcfa0
SHA1 7660f0a0e2c5bc1628add6ad2a3009c90c3a6300
SHA512 abd0be54e05469425a290bdfbdf5bafbff0b617565a87ea39be130163082f3350d19fd581d25d9b189a2e266113d613ca050e088af684dab0dd4906d294acb81
SSDEEP 49152:6uPNgZx9PGzcbSbjiQTneuFYob6YEr/z4AkOuaRoBISCaQZCLlrrlwCh:pOIdjXNOnZCwCh
TLSH
T1DF064903A29900D8D059D078CF4A9223EBA27C8D47F566EF3690B6D52A77EE47B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe
Size 1.7MB
SHA256 5df1fadc55bbc6e045df63c63055771dd4e2a66f9161ad1d91340ab6482eef29
MD5 af3bb347a48abe7466fc2128982dff73
SHA1 33684d4cbf17ee103fb60be24a0074b6380fb3a0
SHA512 260b022713e13e5a9e9089748c5cfbefe0605b7cc83094ab5a603c3f8b0aa95d95cbc20a13c6192b612922b9edb3eb734a52837664a12b8d0c9ee550a5b6b947
SSDEEP 24576:10+vtBz6T4A6qkOL3uOJXNTcFmBcorkb9JeQuJXlPnyF4mfHU9YawsNw5yOP:pzCrVNNTcFCcoraneHX04mfHIwcE
TLSH
T10D858B03F2D841E8E06DD2B8C7469532EAB27C450B34A6DF0691B2562F7BEE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Size 4.1MB
SHA256 fe7c580240c603383d90c5fbda250a4d698d772f6996a1e79a9eb88521cfbdea
MD5 3e34d5bb3c7490aaab430dd49f6b4a04
SHA1 eaf914820047566664c1e968b96b2b183a3ffe81
SHA512 c95263dce3dceacc030096c61369508c7d1b2460084475d891e2f9b73ba3163414878c2ae1db02b6d2380269cc989d56dcbf467653f7ec64bf67392a94538b74
SSDEEP 49152:DueLqufieuW81mRguIstBITm+TjEizExldDwUIDtaZHWRdpev2y/BaVDw:oJYtJTd+RaAm
TLSH
T1B8165903B29940D8D049D074CE5AD232AB617C8D47F162EF3690B7EA2A73AD47B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
Size 1.6MB
SHA256 58c3b99d792cda00f76b476a40695d19d27d9294f0b2c28bf7981c60523e481d
MD5 7f95cc025fe8e0fc847ff917433e063b
SHA1 bf037f9f97dce9dde50f8b021cc1252d6b689645
SHA512 4b4d7b224156325417c055cfa3896da54582a842a0719114f72e99769a914acf1fab715510c5b7a41c6103f9bace961405ee358f46b8723ae160289440f90ee1
SSDEEP 24576:jobtxhU6UM9Q+ptRzswuKRRYquDbkkikW0L1oaedpEukUoygGmq/S/kwbx67:jybU9wQC7pRRYVDLi90Bo7EukU1ex67
TLSH
T1B8759D03F3D900E8E069D1B8C7568536E9B27C450B24AAEF0A90B6552E7BFE45F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 1.5MB
SHA256 1221a26c6f42f054ac5937befa5d38b0ca283e0b00aa324d969cdfd0c429ea62
MD5 c32d2770dd485b60b1f3990e18d2e80e
SHA1 542e3e734db75bda58a24b518292e01f9a122a26
SHA512 44561fd65ca805a12d512c31268988eb6498b541b05374adabbf2dacce03f4edeccb283a65ee6153e87e1c01bed5166f0a081eede4d09aeb885ec3c5c00e49f9
SSDEEP 24576:EZGa46Uo1Pv1gF5fuNKHRaygkmiDcGsVa4i6h27d3WldsjjeIj:ja4zsFoYKHRayghycn+6h27ddfe+
TLSH
T14A759D03F39940E8E05DD1B8C756893AEAB27C450B24A6EF0B90B6552F77EE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 329KB
SHA256 2c2e32e8208e650f52778e5e8d34dfae39d084ce5cd68f48a192b4d1b36e2da0
MD5 81d6b197610e25448d3db28797008692
SHA1 f0bb150f6b589ac74e3b57af7578c0d6be0aec73
SHA512 0fe7e620eac235cb4be990d8a1bf5f50199ab5d1d91657b1d7d985e38c500aba755539fc8f3c089fe648c67ac481642929324e3d9dd7210304922c817f9a0468
SSDEEP 6144:KEW3s9cGp9ATjp5B8eFUN1qLl2lRTBM/iJPsfUrcA3Sbjn/TE7/T3o:os9cGp9ATd5eSUK2lR62czAqbTE34
TLSH
T10574AE2477E009F9EDAB8278CCA18516EA737C554760E7CB03A486651F233D85E3E7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 672KB
SHA256 84e639ee1ef3dfac862739df3a41f641832326c5016252b3e15337ddea27fba6
MD5 ebd2dbbe7093c473c86cf1a7cb589476
SHA1 75e924c5060295f2a6e3feba0b534cd9714835e0
SHA512 46217a41d6bb8d3f5a653ec929c593197ee4b9c272c9453a412e7e243131e3fcf5dd7a92378ea7dd96bec7c70dd991d1c5381e7257cf4a548ca5a6df80ab9300
SSDEEP 12288:HnUqJVvBWUPEJZ7LU7lE6s9hrHssuevB7fG2g:0AvBFPEJYEnrMPMfS
TLSH
T18DE44B16F6748731D073C0B9C5D2A68AED7130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.1MB
SHA256 7b2e0e395387dd8dbaf917f68a9ba4fef5c69658a77dda2ce78cece758eaffef
MD5 df3189b8a5aca9e603176c7d0a2a3aae
SHA1 685f47fd703a7c98010d8e5f7726c869b305bc34
SHA512 578026de6ecb16cba65d7887e506b67d141384e091351a323deb2a55f72b0e78978d5a9aacc0374fbe48bfb5546efdef01f43f41a2ac8bbc6a7f0900dd9d23b0
SSDEEP 24576:Q7JYezSCZvSvbiirxgrvWG6q8wyus8o2QSBQ:8YezSCZvSvZIvrHjy5t2rBQ
TLSH
T114351A25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 840KB
SHA256 f52896cf8cfaec40b2723406a533fc45fda1ec3ae94f15ace2690ad3b50c5c23
MD5 82576792ec4232cf82b0df501c403dd2
SHA1 b3eed26ea806ac10fe0551ca09f90a8fa42cb37a
SHA512 825c91ad6f476637cc5e2726ad9bf3b5c133554b2e22e2c8e5ce519d89d8eb5087d63400f6b2265e1483ab56b35bf1a3f76e54e85aaea70e34af0ace8aeb3f56
SSDEEP 12288:4H4HBJ73vTqZgvyz7j5JwsEY3W6zos9uf0Im98dwxfSxLIgmIiXf4Pyg/K/8/m:4H8JLTugJH6zayxfSxLIgmIAQC/D
TLSH
T1CA055B66F5B48331D073C0BAC5D2AA9AEE3234424B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 350KB
SHA256 b3f8b79ef0a8f1386dc0f0610793d600debf4bcc4ca71dd69e3b4c77b67433dd
MD5 496ee04109ea2cf1bd2e746e5d6798b1
SHA1 37d3b3514370aa5ef4d6d496209a135888f03339
SHA512 64fe08f31d1df57204d1d692f8299b90ccc86d62c247ac494042b26c351385dabae42406af6f250ebabc9daeb38eea122f929fb84741ca2718ff08f6b04e2927
SSDEEP 6144:lOIs94BJ/GKWWBNU6ITLBi0qttclOKgU91B049GU/g97MKq:3s9JeBNUbTVO86UK+g97Zq
TLSH
T19874293BEE28FCD2C27E9DB856918600977278708F61A3C7E164C20EDE235D55E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.3MB
SHA256 0002aa50303c1b32e70f061a77cd7877cb5e705a1b809c6710549e6f90c88efb
MD5 6d9f5b4ca733a9f8b30c6439c4b8b803
SHA1 f4eb94d53c97ded11423bf6ee1fa0f5ec65cd9bd
SHA512 7bb5548ac4ae0c4fbb599bc68b2452cebf0db773d9ac0881544a51cc57f86429fd1c6c28b4f4e65f50579ae478553941535b639f64a156d3ac5169b5d3c004b8
SSDEEP 49152:2aKP8l0P9dbMeltI0l4+LSsYwLHd28I8L+gcv3neuBX4Ow55sybwwY7k8NRV3THn:2a69nrl1rLEu9brY/5CtkCK
TLSH
T130265B556BF880F5E0A7E178897ACAB2F7B678420D31EB4F0191C62F2F336905D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.3MB
SHA256 02e0b2a7d9c8be3cad5b49cef9d5f11e5f2ea6f2358ef6f8994adac457dda946
MD5 87649cb3b602f46149bd56e663327c88
SHA1 3575bdaa8bca3099339bfa333d9f51e9309468b9
SHA512 5fc7695f1c7a9dd3fa0cfcef89cfcc70b5481d5bb9a2b799126f57a693d05dc5356fb429283034baa7ad0fd9f99ddab0d74e26e9b0cf44aec6bdbf89f0597fe3
SSDEEP 24576:vTL7hda632z+L5Wq+rHCYRFiV+XenmE3Pnzc344d0IPn/:vTL7hda632yL5z+fFiV+XenmE3/zEH/
TLSH
T1E6B56C1976B8C1E4D1F6C77886A2C647F37178154B30ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.2MB
SHA256 c3b54eab7a81d8f8eac3e3f2018628618aecf4cefa59be10f174e21058b013b2
MD5 65afa78a3bc214b8b41fed0591904d95
SHA1 0017810ae9022129522065d29913e53cc0d7a95a
SHA512 ef868b06a95213fbd3e2c73e19f0b054f791d14ac1ef52074bfac7ffe7a3a5d8a8414371d79266e6a5cd152dc8acc32810b804efcd99067b0c78e1ba2a793045
SSDEEP 49152:6jInN3RCW17xp3DJf5SUYLoDpgLjSTYlQcGeCAaLSF259ruMHwpXMi4FqJLd23UU:H7RQyi36YOcPmLvw2gAf+PN3c
TLSH
T1B8666B13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 9f3ee7ce8cd0f96b55d1179a393f77c4a6cd5a447f87bc58a8d11558d6c7d4bc
MD5 e9c89b5ccfd925c177ee083b7becc917
SHA1 4bad78145be7243467efa3588e0ae58f209d56b6
SHA512 e32e4dd1c8ed652af2e4dae14f72073f7811be2462692e02a8852a45808636bea5b2bb6d81bb249cfcb4913684db5d9d87c30e6dfe3ea893735ff10df76b2aac
SSDEEP 24576:+VvoRs+65Q/rBBaDboH9BJiA7DaHGTNHu7PNU3/5W/ohL0Fg5hr+wVh:3sH5Qz/XJ3eWu7PNU3/Cg5dVh
TLSH
T1FB952733B2F600A9D44DE1769F4A873196E27C718FE0D3DB851572061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 3.6MB
SHA256 16c8cc49db1314a67a827e2e13cf51a5216d4d2498e2c3eb3128e13a59e3368e
MD5 c4c36569d4e4dfd5c047689865807573
SHA1 2ef2a30ecdf4a6bc559a74375fa6df2ae79f6339
SHA512 907f1329144e744c5a4657477cb982ad1cecd873bd77df15f975f0d13ab1d4cc6a257e197730edde6c14f64e0578529359d7c5610741c9817ab8e304496d871e
SSDEEP 49152:3pC05y0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbDN3Oh6tznm2FQ/nho2qkrk9B:3Dy5112gYy5azzVv469nLKnhZ8
TLSH
T14B066B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.4MB
SHA256 d52b6585a71944cc66ec0deddec7439737af383f2087a2961bed60b369441085
MD5 cf8a007996532c14b1a8484fa1183af5
SHA1 a0140d2f6889f822650e14c989447b301d3e6a6c
SHA512 eb88f99d8215eaada51e053872f499ce63139e441ceb169b2bab42a2f257a38aa051df091b9c6895ab8051ab3b63050e78e01413d85116f6d7d2db4ba97ab3ea
SSDEEP 49152:tOQ1uZOqta7OBr4tEG80bqx0z+n217aau1glbyNN:3qXJmSxd2dbIN
TLSH
T18DC58D13F1DA01E8D06ED478974A9233FA62BC490B35B6EF0A9072552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 1.8MB
SHA256 ce8f541e8ec9d3c0c13eed5ba552fb5c97bd9b1773d68b911c77406b3641688b
MD5 e5e351824d5c3208cadc93c14884951c
SHA1 ccec9258e8dca9e24c7c5734f62e99d4dd2259d3
SHA512 8f03004d2de6afb7cd9d80995350e13b6629a3963b0b3828957c1da00248ee834879e892f7eafe11ce70981984aea6e80598e8d3d8224045eec53d862b2e7fac
SSDEEP 24576:/MSvRtseu+Vc+oOxrzt4/uCMFkZAkqUQ1zNOgLLwH7ReaQXx32WPROl9+uikti:/9eeu+VFo4NkZArU44CwH7R4xnN7
TLSH
T1B785AD13F2D801E8D06ED17887569632EA72BC460B24A6DF0690B7961F7BEE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.0MB
SHA256 f21f8d0fba812ecaea287c0b321932abcd45e8d4292ec0c166a06c864562a002
MD5 6a0fb81d987c722775e1c3aedac2f171
SHA1 5f5a7737206324102bf517c17f8fbd4d7923e0a2
SHA512 8b1b0897cff656ed20f4bf62969e7cea4f6eb898a6204585a4d0fa33f66146a46f823b042f62bb4190dddda64ef25162c7f19c7f7d48add61f5e443ea6df176a
SSDEEP 24576:cu0vhc7zBcgPQb+8wAsaBPa/DqWHWxqR04FxGgVG2Onks6xt4bSMHnqBuG1r9v0v:4CBHQiAmqW24RVtOnks6NMHq0QI
TLSH
T19CA5AE03F2E941E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.2MB
SHA256 90029abd8efb262ba92c09d6867c34c3e988b856db36279c7939128bc95b9027
MD5 9005f22e3c9d3774d5231f85f2a959f8
SHA1 3f23a7a3f7224395b9b083c786fc9e13ccac10dc
SHA512 0981cb64bb54029aecad541821969ddd40389cda0f6d463b9510efedd1c4c3216e5e8cd1782f1227eb08dcfa5641e17f80918c637790bc6513f8da2459b2cb99
SSDEEP 49152:R17AqOVSwI2e/ujLAE3dGGj8bKEGcjesaNkYQd0XNJKcvaAcPTY6Y5ATVl:BfkvjJBDlZM
TLSH
T181F59D13F2D940D9D059D078874AD232EA72BC494B2166DF0690BB562FBBFE06B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 3620c45607b5c4dcf84159723f4e0d85d444bd083839ca955905a64b83492242
MD5 d6cccb7bedd2ba81ceff6c05adb6cf86
SHA1 6bd1dac762703f3455bb5f43e093049a75ca8bd8
SHA512 363f87bee481402c9a4eb7de057d14058b77f278d2412d6ee4ad75de3a55a39ceb405be7b02703c46c776e6fa08eebd8937027ec15df3f1af5cf8c833ce75322
SSDEEP 24576:U3YvwkesZ8AEKsnAyNyUgcynQki3iy9CTn0AP5+2QLo4eHfr7Rk4:UP1sGAEKSVynxgiDn0AP5wKdZ
TLSH
T14475AE13F2D901E8D06ED178C7568632E972BC150B28B6EF0A90B6561E7BBE45F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 333KB
SHA256 faf32f177294f8a68d33f62442d3c1697ce68c6abc7770b54cfe6ab2242ff4fc
MD5 0f724d4f2b93b03277c4e2f61ba680e3
SHA1 b600af1fcf74212227227593efa8808c5c48eaad
SHA512 d7f9f74ee032c2f09733e51655505bc4e9583a7e71cae836135e780a823e75f6bb3a58a3909663ed065eead345e346d5cd45b15c821d672770dcdf63f331b7a8
SSDEEP 6144:ZfPojus9FtsZh5jZtCQuHmmkwYV/PvyNUeXpu:Z3ojus9Ftch5wd5cPvyNhI
TLSH
T15774BFA4B3905CF8EC67423ECC55491AD6B2BC550BA0C65F03B836665F373A01C3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 333KB
SHA256 5af4d52e605785f293a7c778aff9fdae997512b702cc6e10857e40cc05148d7f
MD5 302d1d4f2ccaa1c44ae2b9626528f7dd
SHA1 9b2c38d8acf066de6ced2ea7c269aaae9fffa2fa
SHA512 49daabf345a581718c322d6b9db450020f742deb08f58971ad24e07efc02ebbde0b4ddafed82238694fccc51c1f2fac0a642022a094ee3b36e94eeab1cf30244
SSDEEP 6144:XAocus9xGOCx+KYipsg8/528HzxYutYPDvhEG/2JMci5Fjx:XJcus9xGOCxlYiqgu5tzx4PDvhE0RJ5H
TLSH
T1FF74BFA5B3501CF8ED67813EC9158906D6B27C5A0B70CA5F13A836275F733901D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 540KB
SHA256 c9142cbf08b3d4485fa3a2f04a4f054b82526437ac601280bb663cdb54415d41
MD5 8a2d7d457666ca2567ffc2c1d1571ba5
SHA1 25db8625ffaa8df012f32341bb235a673cc9c2d3
SHA512 4ae8087fb10a69f646612bf12f4e7ef929d3444e2f7d9aa4edb28ae27012edf9bd2e93e6a81e9c589219f4a7770f6d6028ca1eab12b18c627f91948f0a636d69
SSDEEP 12288:QeFb03s9TI5Ei6j+qbe4mjLbbdIvGPgWbCZ6:QS+5Eqqbe4mjZFh
TLSH
T138C47C90F3E414E8F1B38A35CD768511DA767C595B60DE8F02A8265A1F33AD18E39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
Size 333KB
SHA256 34b3665f66426e118cffc43e40553f5c50c1a0f3af942bc6eb9e853e92c6b87a
MD5 fd32c892cb46dcb6c75dc38de524d2c3
SHA1 f7e2caf558d815d2b3bb58be62813a33bdd9e685
SHA512 75dea3d66492591aa1864f8c6bed812d01d9d020fc08960913b68a48e524d38b19169bba19898434f6f9b7f9502461169d41b7ebb7b1961d34b851dda2576c84
SSDEEP 6144:IZPpD0s9za1yMKsSjcyWekjxNRvYV/Pvyetlkd:IhpD0s9za1yLsSc7JcPvys2d
TLSH
T1CD74BFA5B3A01CF5EC67427ECC554906D6B27C690760C65F03A8362A5F733A10D3EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
Size 142KB
SHA256 78175cdc5273cb7f1cb46714e7ebc253acfaa595f84249436dd98bdf715482a7
MD5 be9cf7dc0fecc82c096d9114ca68d831
SHA1 5a5b5c14a0755f5be7ce47ffa84736dc1fcf07cc
SHA512 bf3e531a3cf60830dca00fbc4230c5eb2fc9235dd81f29472554cd9088e998b13a455374361fd4ff719413434e8f221fbf1b40c0b645010e3626ca6bcae7bf22
SSDEEP 3072:OU392jlXEo43udtjZqMNbjuxprL9rqv/U:Os9ilw6vvW39u/U
TLSH
T13EE37CA1A3D8A884F6B38F7298B58C20587B7DAD8DB0CE0E5295710D0A737D5547CF3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
Size 333KB
SHA256 75ad9a44b29fa7087b070c938b19146731885f22b554e6555829aad8f2ed6ecc
MD5 4e24da96323e443121d8e73019453456
SHA1 5eb70087e938238e72d8b5ea14b0e255263278a6
SHA512 1b19187f913b3656eea92ef1d9afac9f2c33febeda81ea683924a981d7e5f07044279fdbb91b7f1d8509da8f6c3589c8b8bb48db6759916392c3de1940479f5d
SSDEEP 6144:h4SJvs9x1f9qbFGNjLsbAiUM1ziYutYPDvhfGP:hnJvs9x1f9qhGNUsidzi4PDvheP
TLSH
T15E74BFA4B3601CF5ED67823DC8658A16D6B27C5A0760C65F03A4362B5F333A11D3EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
Size 540KB
SHA256 9d74545e29f6d29cb514982206d98f5434e2c2cab517b769a1eff15302b2c9ad
MD5 77bd885ab2a40a88977915d3dc01d1a8
SHA1 f87b30b3cffa7bb21ae86cfbc7ac362f73deed11
SHA512 cb00a645fbf6a12570b83d2477ca0d6653b51ce90d9f8ef13ef865e7ad9e698049b88a9dcd16b6f4741f87c2f1a29a90464961eb22c1a50959507f9ec5107390
SSDEEP 12288:8iyD4hs9A492mZ308WfDfdLbbdIvvIoiUUdM:8FZ92D8WfDfdZFpDdM
TLSH
T10FC46B90F3E410E8F1B79A35CD764511DA767C5A1B21DA8F02A8661A1F33BD18E39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
Size 195KB
SHA256 4f0265e3e909d2a81ef273ee9d050159a03419036009ea63f9f0df70ddc56b8f
MD5 5c7708d9ac9f157d7021944b2364a351
SHA1 86ec9e39f1f669795ce293e615ebfcff6225079e
SHA512 9ca53b8cbe0c951ebdbab420c41c47e6ea3eff62403a59d9a207f51ede31c00503d2519227c1fd18444c83697e0d1d296bb5f38c810aad82a56778dc65e96d3c
SSDEEP 3072:qJ7dxUt7pD/lvU39ZY5DEmd/MjgvhagI/f1OFOPqxyEdXZuMgqu+hT:qw7pNvs925DEmdggIn1UUuJuMhThT
TLSH
T13E148C0133E800E4E473DA7988A08501E6B6BD511B61EFEF9395316A0E7A7E19E3DF71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
Size 138KB
SHA256 7c5ca57fa396c436fc69eeca07ef19e663bb4e6951b0d39ce71cef554f7e494e
MD5 1487dc314c7e67b0859b90cc2f464ce5
SHA1 3e1df0046bc94f165f796a943dbdef06cb576e83
SHA512 a34f41a35c89a37ab4cb708fb12af0a28a3a8d47e2a61c58e3aef474ac2eed76bc167a3dc483d881eb1c3a2674fb4ec74116052a19485c670bffefca817fa4b1
SSDEEP 3072:WDQb8fU39B28vJEisdBziuxTypRM/5dzhTkAn2+iq1hqp:KQYfs9A8qdBezM/5dzyp
TLSH
T147D36A5163E51898F0B39FB869B04528CF7ABDA15A25EF5E9380410E0F7AAD1DE34F34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jre-1.8\bin\java.exe
Size 333KB
SHA256 b0275b399124f169d5a09c42561cb7ee427b743c9ccf68578222c30657ae0404
MD5 f87a4bce14e3ca2c1b783be9b4b88cef
SHA1 94b3ad16833c0cab9edc27c271e041a19d988faa
SHA512 129ef283e9efbd8b9ac773eca1a34525705a14ecb41d8f9b9d881848766be728f0dc8f174e6a103f5bc923802805f7bdf5b02da56bc52ed0f3d3b702b61d1ab2
SSDEEP 6144:CRPOkbs9gFb8gZjkzRk6wjFxoYV/PvyRrY5LSwJ5vz9:CJOkbs9gFogZDpacPvyRrcSwJT
TLSH
T10A74AE99B39048FADC67823EC9559D41C6B2BC594760C65F03B8326B4F733910D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
Size 142KB
SHA256 21b98a62e5f35805b90e4995a3f439ec7c2306530b7d51d70157d2c4da4542ed
MD5 5213f462e5af7af12da3930a4da4aca7
SHA1 bf5597baf622460f3fa1232babbb5b017767e7b1
SHA512 5a24ccd24659c512e90a68d041f4b030b96c25132e2db555b0791551c86f4977f8eb02a6443eaed2ed27512378cec3e535938da013682a6583fd201c706c448f
SSDEEP 3072:XU392jlXEo43udtjZqMNbWwx255W5fpbFit0+ZTA6WzOV0R0:Xs9ilw6vvW/W1TQ0+9AJzxR0
TLSH
T16AE38DB1A3EC6880F6779E7198B98C2148773DED9EB0CE0D5294710D09B27D09479F7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
Size 333KB
SHA256 b2027b9572cad7caa04e77ef54d7d793e997b50b49c8a86674a232ff8f780ca1
MD5 66399a6c2c268e5695f7e62ac10c11b6
SHA1 495709b48973d9d163b51100996379046f1369a8
SHA512 3fd07878a99a9bf00cb5aa32160812fed9f9873e65802fd2848298c4ff0971916fa45b41a9a2cc85dd53d64f90841e10d3597fe3459176544d195a3350c0a1d6
SSDEEP 6144:qW4ybs9vf4W1sd4oWs/ZSJ8OzuYutYPDvhAGlzJGdP+:qXybs9vf4W184ovhStzu4PDvhznGdW
TLSH
T12774BF95B3500CF8ED67813ECD558906D6B2BC5A0BA0C65F13B4362A9F733901D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
Size 540KB
SHA256 c62158dfa6a85b54f90389be8a2ce14ef5284e6d066baed47d4a27ccb478712c
MD5 b83672bf85c7a7036fb8d8959c2f1aca
SHA1 9db683f528b893fe3180bcc48a238d75990e3b48
SHA512 85e05a5e9d7038de06cdb78fbe0e798b027b8c4d79c845d89c42024db4789899db31c8d48880cf8467033fef43700b9af4c2274464620454fff7c16c313492b0
SSDEEP 12288:lcpgp+s9qbNF32MwCsyKdLLbbdIvWaDmDi5VSY0UZ:lczNF8CsyKdLZUF
TLSH
T1DCC46B90F3E414E8F0B79A358D765511DA767C9A1B30DE8F02A8265A1F33AD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
Size 195KB
SHA256 6d8cb5ed17d446e63d497a565b96c60a5550e6be6a9035f8363e5b5627863fef
MD5 2faa0c0b278c80a1342428969e281aa8
SHA1 a90139ce65c98eb76e3cbf21020400707a7ea0c9
SHA512 157c42d3071475dab9c7e3ccfbcade0424d24d668c4740f06f3bd306743bf4cfb2b93f9350d3997137435f8f1f3c08a7bfbd13136177190f9a2c3f52661518ad
SSDEEP 3072:QgroxytQYmMn7U39ZY5DEmd/MjgvhagI/f1OFOCJGxdL5RIFy+s//3GEqifLG8NA:QqQdC7s925DEmdggIn1UnmKA5efQLGr
TLSH
T1C7148C4133E50494F473DA3588614541E7B6BE661BA1EFEF6385305A0F3AAE1AE3CE31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
Size 138KB
SHA256 65992c083f3e6237bdf28826d5879dce62b828238d161756cfbfaad341cade55
MD5 b7234afde3aaa78c4e9ddda411eba645
SHA1 bb74d512f647ac60d97efbe5b82da53397d58d48
SHA512 b7dbe3af12499b1be5ebfc4d4acec751b5121b3943f34dc4e9851e44d5c47c621007f01b520edd10784037e261b568006864ccd6f382982858fc71be5d9c780a
SSDEEP 3072:7xaQb8mU39B28vJEisdBzYMsxZEySGftGL6:cQYms9A8qdBpveftGL6
TLSH
T1A1D37B8163E90899F473CF75A8B440158F3ABEA25961EF5E6240514E0FB9EC1DE38F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
Size 4.3MB
SHA256 72e32a4fadf8dab1bfd7e00a895c99a9ca054828f3a6c547dc1f6200838819e3
MD5 03ab899e30a14b22a6146c37100dcebf
SHA1 20d293637c96183ef2a2fb452aeec267eeb79cbc
SHA512 55ece89d011a137f0fc7e9eca6b21464bab80a18dd4b9b71734effcc1ed5400fdc336fff37d4eb5020099d43c34a02973dfcc1baf2049578c06ac6f253b4a63b
SSDEEP 49152:Jak4S2gNazVDYyZeRkMfVZE87L0de3z+ICQUJ3oeuYBJ7fGCaEpp0UZH8NRV3TH4:JaAaO7kbALL+fpiUa5CuNz8V
TLSH
T1B5265B656BF880F5E1A7E138897AC9B2F7B678420D31EB4F0191C62F2F336905D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeClickToRun.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
Size 4.3MB
SHA256 61a457c24bc0093b611040c04a544f348f837a24c01e1f6864e9fa9de4d3b770
MD5 0152447dacce17fb663795261f10bd2a
SHA1 6714b633a0b35c560c0067070dbb1cb88d7afef4
SHA512 ca73a80f652a0009aa087b35c19beb954e01a555ac28b308c0fc1660e58a9f13711d63dcff138e37220485bb73b78c97877d27c6cc448b8c894f4ff4e0adfc51
SSDEEP 49152:1nulaw0Azygv/1Yiv635oltTuwL0drDR4clC7y3Ceu/he6Qns47pD+XRn8NRV3T1:1n0zPT6qpLa3vpSXi5Cvy
TLSH
T120265B65ABF880F5E0A7E178897AC5B2F7B678420D31EB4F0191C62F2F336905D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVDllSurrogate64.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe
Size 275KB
SHA256 513012da6e7c5f4c7a3d78de720a564efdde5a106aa3045c7269de7d3be3d873
MD5 3889e7a0935430f23b443b0af9a02c64
SHA1 857ab34f7bd0a52030f0a8a0fee62d3eac627a91
SHA512 dfee915cd0a2f959363103c07fc79d6d051f6cfa93b46dfed778ae8d7aec1ac321a815a64af6595199981fcbe494ee7b75d9e840df0118d969a6d94dbe6d8ba1
SSDEEP 6144:3E971qs9YWGNTNYdMzATVkQNUO7q5cF2S3zHtM:Uxss9FGNTCWsTGQ4a2S37tM
TLSH
T19E54387BDD38F8D2C37E5CB46BA0C700AB7160714B52638BE179C26D8D136E15E6AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVLP.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
Size 588KB
SHA256 14fdc3a4c46ee0f64347098a4a8d3fcd471796650c236370fab32f8abf895651
MD5 1da26210cb7c14fd80c122359aa2888f
SHA1 d234e6ceb4a5d3a590167f4eb7a0f892d98b0744
SHA512 6f5e85b07529daa0a16659ce28f09de292eb1d10b986c2f04b1633dbcfceb35fcc27c161c4ff9e0365745d01badb5166c45337c51ccd5c9134811813978722d3
SSDEEP 6144:3RSwVwVQYTCoZFZywfjQ/s9/kTyC7Jd/Uino4Wp4hzvNUXITiXt9Z+M47iUlfZtg:BSLCoQR/s9fBluzvNU4TEYicvMIWr
TLSH
T1EDD47D7AEE28DCE1C27B49B856968601E6713C110B61D7CBF26CD27E1E236D05E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Integrator.exe

Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
Size 6.8MB
SHA256 15f69013b246bc51b294a75865325f1cf054966967abb0e075c197e99ddc863c
MD5 ecba2cd92e4a76e63b527606b31f6b77
SHA1 e7a92e7b741e982f7e6d73ee7561d0253cee6f19
SHA512 0a4c636bfdae013ba80cec2e546bd7df3f1d22c29b8a989bbdcdc7493042c167b2262f887508ac146d62a4cadf7c44003894f7f1dc07e2548ed287ca0dcb4fec
SSDEEP 49152:pkM1qoj5elbiAtRpkRdWvxMQX9k41XJBqcJ6x2ibD398WLTzKG5xUQ9zOB17/xY2:FdQLtTDZvCLTMFB1GWKhrrmqJjeb2sL
TLSH
T1866629596AB481ECE0AFD1748D778772F67678428E33661B0261CA1F2F33E588D19732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Mashup.Container.Loader.exe

Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe
Size 100KB
SHA256 fac5e31e9ddb7b160a5d99a68b848a8ba1e997b7409ebe92cec415de25cd1482
MD5 d48d9a9b456d21716f88e04715e7ceb0
SHA1 6847a333cf51c1dbdac0d58c234a9540ac1ae1df
SHA512 8b43f5338decdec41f5c85f526f0b31f7aa7f534c79ab88416cbb46aacb1b8bf56198630a80fe12dc3b8d83cf3f3247eed95824ca9d83eb66de0e4950ea9eaf2
SSDEEP 1536:0Ki7vXuhi3ugRXj3/eAMpldERVToFxGyvSD1/AgwuWcqu:0DaU39BeAcI+n7vSBYPcqu
TLSH
T19AA3BF8B369549D3C32702B52A2185C79637BEA12F81779F9321C70F1F177C8A632366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IEContentService.exe

Path C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe
Size 449KB
SHA256 e2994193845601a76b13d593f9e5b3440ca3e5119f9728cbaf2e43e7e4583d27
MD5 baf3b4cab997182915133ba26e279e26
SHA1 787a54d0b822515cb02575665664861c89d7abcb
SHA512 fed55ea7804de34a11638966119c3fc324b4b1e7729b8b924170cb5b3a5ef28db3b3bf18a596797c3a69529f504a838f75ef8dfa771a6572e04bb1f428584df1
SSDEEP 6144:dKQIyHK38dIpugq4Yup6Ue+idjfss9b0ou5jfcbvnmwVFwelX6:AQI58dIAgze+qLss9ORfM3p6
TLSH
T19DA48E4AEB9484F5D657A178C57BC671F7B2B8890E20674B06A5C76F3F33A60AD2C310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerfBoost.exe

Path C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe
Size 877KB
SHA256 260d995c10ff6518ada64d5a1bb3acd2c4053c7fb93e6b8bad203285197f3777
MD5 8bff080825014daea69b4dcc145a5693
SHA1 2b55b6ba90408db86b2f84fc248ca8715e7f8950
SHA512 e2760c520082305900936d97ebfb8c233b59d7d0d649f626f9fb2976740eec2da3fb0c7fc6a13f3f108a1a5477f07cd962f088ad7570fe48b3630a80c1f0e8a6
SSDEEP 24576:RRb77vHiE8Mc/0jZtRpEKdUnHBt9LP4n/Zyl:rR8McMNt7DUn9P4n/Zyl
TLSH
T187153895ABF845E9F1B3A67499B68571FAB2BC521D30D31F0260C25F1F37A808D25B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDXHelper.exe

Path C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe
Size 189KB
SHA256 3a5dc4cc2dda3bdb271d41edc1a968ec2b1c22509477ea1ae3f784ff6f51db8f
MD5 f243fd9b17db2be5c9b51ad5646cfc8b
SHA1 caa43e93d0798b6c900ca682abc06a70e8835652
SHA512 0034ee05cab8a6cc8e68e0c3eb49a30680a03e40baa2058266e90cc0e46332d393ea816fd9a6abe85ad79af4905b28cf95f31aa53a776fe7a10fa1d3f16ed478
SSDEEP 3072:viISCfpJNq/DLU39bH1Q2+zT6lZdAh3SJxfFrgrwHixOyBs:HSAfNq/DLs9bWelZdGaFkr7OOs
TLSH
T15A149D037B94A0EAE453D278E569EAB6F7B6F1B11D20636F5260C21E1E333D17D18B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoadfsb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe
Size 2.0MB
SHA256 be5e6259132d7896fca3f262c7774e4433e5ea77d801e3936f09fd66fcf2cc9c
MD5 de8fc64d043479c6f4abd1e1f6c91f9c
SHA1 a34ce0cf47aaa51bab53458af1bf6f63b5a639f5
SHA512 7eafdb49bfc3a488944b6bc7ce034fde72705754040ed683538c59069b771c95d7b16a7e6479d5340cdbc2b837e40d08457439c883fd7e6e32c3c7eef69196fc
SSDEEP 49152:PLIuGVEMmWOXWF2U/dHDDh01GFT7bhlMHT:8uGdVZKz
TLSH
T1ABA52946ABE8C4E5E2ABE2789975CAB5F6F2B8414D31974F2156C70F1F336604E38321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoasb.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoasb.exe
Size 341KB
SHA256 66748ec6c02c130d658a7d84d02c4f4105600225802b0f9cf1207e56261197fa
MD5 b80bfdfc50853014898b4d187aee6c21
SHA1 9b978a1667f7f7b0a78a1297dc823f4e415f35f4
SHA512 5379d60a84e9947bd2292e01fd2df39551df719e1e582daf0c3c05be9a766864156563da6b2b2c3ccd6ab7c87b46956bd9bab18f5b6a9a2f1b5930311608d126
SSDEEP 6144:MLdNZs9qgFUuFPRZN8BdaspjcOS4R9bhvRx9EiOwZexhJbx:mhs9brFPRZmBdaspU4R9bhvTmw4Nx
TLSH
T1D9744A577B688CE1D917A1788986C2B5FB72F8614F21D30F6992C32F2F37261AD28711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoia.exe

Path C:\Program Files\Microsoft Office\root\Office16\msoia.exe
Size 6.0MB
SHA256 23c231f5b5c8d8a15737fabd14401612f7fafc30adb0745784d5c1ac9179d8de
MD5 bb8b7cd0b7cfba7e7dc4519b086068bd
SHA1 5534bb9e1b5bafe449f30e27877c5efe5c555ceb
SHA512 78e313731bb13056a6cf21cf64e60e3d66671df4fa944d2701f28f0410cfa1ddfb6a5425c2851010389bc99ea39ea9077f6633bbbd2b02bf0ba0a3bda74ac348
SSDEEP 49152:YFR9WWLCDMcUwNtip1Qess6VdXYVAMwuHR/D6hKdOaEYm5tMBaK293+XQK+P5jG9:YdAkoOZmka5KZCLw21maj+QY
TLSH
T120564A55BBF982E4E1B7D134CA7285B6FAB2B8555D31A74F0561C30E1F33A909E28332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

officeappguardwin32.exe

Path C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe
Size 596KB
SHA256 082cbe81f3c597fbb02c48aa3a9ba194a4a6262322d51128e7826c31508aa0ee
MD5 39c20531631437fb0033b89bd98d10d8
SHA1 4cc91f75818ac7864d458f3ff167d939af7cdd01
SHA512 94a94a726a338a1fef895e5b110e789d2189530f85880c6fecadeeea1f9926735570609c208648fc4b57b74345a9cc580ef7c22d16b651702d311fbb0169d4ee
SSDEEP 12288:DUBshzfgg+/vt7guVCs9RcIPr0lypFpm06H:DUBYzf2NVMcAlcN+
TLSH
T10DD43A41F7A881E2E566A5348A668570FAB7BC170F30D70B7559F32E2F33640AD29B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocolhandler.exe

Path C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe
Size 6.4MB
SHA256 ecf534584ea767b00d6fa9150006294629439e4d9990c36212bd90055ba10036
MD5 50403d5931f1fc7a084883c4946679e1
SHA1 96bcd1abe1502a5479c07aeac75003df1132ea9c
SHA512 7532f77c9e256b76c62a5e439a70fcfeeb7b1e144940fddb2c9ae7ba4da56abaccfff6ce68d196eeabc8e05d95900e70a20c1f511cce3a93d532cefaa86ee6e2
SSDEEP 49152:2iujrjVGQs56cA1KBArWijd59cLB3T+1H4wzVVQcWWIJGLdrVgdaS8iFNA4wADBW:5xyfVEGMD86/S07zHju
TLSH
T142666A417BF880F4E1B7E2788A3A9675FAB278425E31AB4F0151CA1F6F776508D29331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OLicenseHeartbeat.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe
Size 2.0MB
SHA256 58980660553d319a3b1d6d403a84d2142aec8d2fd24c83fbd8cf00891c7337d3
MD5 e802f37e881fdc070af37243c4cbf9a0
SHA1 184aa2f911bbd82623104105780e0ad3283bb755
SHA512 a5900008c74ddf6a779c3b23d0f8476221038880f8263f8bd3f9d92b19e75e86560044613cfe6a5cab7d28cc097fd9ae8a11d9495fd5906cca481396eb8583c7
SSDEEP 49152:A9CqGStSqBKKXXRVNEfqPsqmYrU98xjqrATJW:G9IIW
TLSH
T19BA528416BE881E5F5BBE7B89AB68979F9727C521C30E60F0156C60E1E73B408D39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLDumper.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe
Size 222KB
SHA256 96aa6613c69ca46d15ccac45a5bc9e346e298c6793b2cbf2004a6a3161e6c8cd
MD5 11df7e087278cddf2f1e597da45b18c1
SHA1 15521420d6ec3dda0a39430233d9742b4a93b90d
SHA512 d7794efc8133da9e5ed17067ac83105e2bcaf17fbb55e4969ba20216bf102ebb9969a0ad9117998775d8ebc89bd6ecb77321c56a74a62d9af6ea2e931ef4c4ac
SSDEEP 6144:XKHR/5GYs90aj4dizjErUnBpexUnELdEqCHtaYV:XKx/51s9uCBoYV
TLSH
T1AE245B4077F91059F4B3BAB09EB681526A77B8952B31E7DF4218865A2F33BD08D34723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohub32.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe
Size 2.0MB
SHA256 9dacfe3812c4e8e5102b17a72bf1419bb80b9f75352035f7295acd4b062fb5b1
MD5 4d359222134da0d04ac954d9b29df003
SHA1 e92831c3a90494d1dc66e634951247168a8f7f73
SHA512 a6b8e02dd167d63090c1544e7e13316e3b2adf8ec493fb17c0dbf428d16c15f046504920b7ae78e50659b9919d24845bbc72bccad72dc5b51a354b3b7158f76c
SSDEEP 24576:w1fGSgFQVYGgRGasseAN8M6TDM52A2NBH3NRLOM9kFVwQPmNOEfOb4FgwPqe0Pj2:w1fGSgrNx2w4ULOH+MYu8m1/p9x
TLSH
T1CEA55985BBA484B0D526A1B189A6867CF7727882C9334F47318DDEDEBFE36604D59330
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreporter.exe

Path C:\Program Files\Mozilla Firefox\crashreporter.exe
Size 3.5MB
SHA256 214fe50f1f6c2606eccc7bb6858cca3604202a4d159e2d8fb23c833d1c6846fe
MD5 f48f0fbdf52d0d156e055126b0f2b28b
SHA1 4a1049ad99da977b1c59725c606c918a1d43e6a7
SHA512 e4525a7a71191356dcdcf2d5fcccaddf934935eaf274d050660ce983fef500af9044e27b59150104d2bb3b63c07fa22e6d251603a96d7f05f700e247a973c181
SSDEEP 49152:ebED2bIU/983ufWO28wsz3iDT4JmeDNB05FQz/PTmXLhm6kV9i9SmA:eb4899quD2Jg9f05FybaLhm6dSmA
TLSH
T13B062842EB611DDAC025C0B482266723B760FDBD073036F74A906735AD68EE05FF9B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox.exe

Path C:\Program Files\Mozilla Firefox\firefox.exe
Size 777KB
SHA256 5131a89c683d9c29227d11a5ab38ffe5e15485a322b989bf5d2b586c1cd96378
MD5 1992f6d31f9f3a7df52aadb52c26cf94
SHA1 b78f77b06e2ce8014a5a40e1eedb08542039b3aa
SHA512 462c453352a1486eb1ebb80551d90c6fafc11662e7d0aacc4e1dd4a626e564463b69bbc8d150a824ae9e9ce7249847405cb477e9f3312550c25d7d41876fc496
SSDEEP 12288:rQFpSnCGQEOggJXnJoivlWs9YBJ002xNfZC36LW9zwHJem7OzwHJe0Ihf7EDj8y7:rQrKCT9qBJh2/RC4SwpemIwpelzEDgy7
TLSH
T1F405AF03F38516B8E08AD5789A46D233A5723C840B5161CB1BF93F2A3E71AD16B7D76C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
Size 329KB
SHA256 49926288fe293b67d369d15728a8ba4de01d9d4c668e12caba48c9ace9c6b6fe
MD5 b3aacaf3d7063098d3b45936c9eefa65
SHA1 df79c80dfed7264afc19b73409856111e98b9749
SHA512 b78da19188f6320858b1966b91b279f26d373b9a8d56eb6d93f727635f4b077d457ef8bd0c7b7dec98fd61bbec18afd7923fc453b0048886a0d42ee38436211c
SSDEEP 6144:KOs9YS3oQpkZf5B6xMKb1vPx2lRNio/iJPsfUrcAyVTfX5UI7PLuswaGt7eUpoz0:Ls9YS3oQaV5cmKn2lR72czAyLUyPistE
TLSH
T13B74AE2577F508F9EDA7827DC8A19407EA7378958760E7CB02B486660F133D81D3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nmhproxy.exe

Path C:\Program Files\Mozilla Firefox\nmhproxy.exe
Size 654KB
SHA256 76c7bac86388e234021d424342a5a458a4e9cfe509bc1e0664b0d83180e2399a
MD5 4ea05eaf7f029ffb4521c82fb2dcf5b4
SHA1 2b2a2fac624811042e54772a8d123150f55e296e
SHA512 0996555a7f37da7d34e99dbae47439bee57c9ef7449f0da7f712f42e5e191d38b52c4fec7b1729b9883d4fc29791d61d479f1969e001c11d9086c29d7be0905e
SSDEEP 12288:uqinKsy+Qa3X9QynwnayNks9EJc/waheN3NAIEUdEnU:linXFQo9TnzesqBnU
TLSH
T1DEE46D12FA97D86DD51EC478864B85367933B4CD0B30AAFB63D85A353D1AAE12F38704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pingsender.exe

Path C:\Program Files\Mozilla Firefox\pingsender.exe
Size 126KB
SHA256 4a6680015385c6ef19c1dd7e18bfbbf94dc28c4c8d3d41ba8e2a9a41723101bb
MD5 86f42f0879e97dca903ea4136ca7f09d
SHA1 a88ec2c4934d4b44683898b0c6dd6fc7b14017d2
SHA512 fb13ff111c4a4ef896d3fa2db9dad9f297ec7cee2403edbcdae652302fd506bc93d0c92bffb5a48df7073b851155bfa62201e2737478d0ad09cb17b1f6c6d11d
SSDEEP 3072:rXSI3j/U39CySh2SdWAar2if7/HFZPgTiDs9wJjWLnR:P3j/s9ClFdw/2R
TLSH
T1B7C3B05257145467C296C3F0A0F71863A72A75498F2F23CB6291CA1A2F4B2C52FFB7E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plugin-container.exe

Path C:\Program Files\Mozilla Firefox\plugin-container.exe
Size 202KB
SHA256 9a3080a3df753eb8e19460df7bc5bf0830aa5244a00b3b1949762ea0eca39124
MD5 45bd457b68001662183a0cba36c7c6ab
SHA1 2e8c01099d0bd9b119c9dadfb22e7ddac07f5bba
SHA512 758af50114048e56ce0b4a8ab26a29fd58fcc0b07b1c7ad7484283646dd54997e1d2f4d5a149bec6afe86a30ee3bcc8e6ddaf25afcaa9b6fcb18b331fafbeb92
SSDEEP 3072:xYkkqfkibU3939/3WqYuGbaLaPu06jVweQnyh7Rr+PUCTOq:xYkkq8ibs9tfWqUqEuDm9yh7MPFCq
TLSH
T1D314BF13F74C20E5E085D2B5ABD25A21BBB178C60B24E7DF169955203F52BE0BF3D2A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.exe

Path C:\Program Files\Mozilla Firefox\updater.exe
Size 523KB
SHA256 a470b872f63e4ca8e174468521c4c30d9d9fbb7b5ee5d8424faafde7a8b0e520
MD5 1b6e90c262d67fff16b0ef8d12b19142
SHA1 8b1cbbf5b3c8afe6c5d65aa7e3c92bbc3b788c10
SHA512 3c460bfffb94836dfdaaedd73a60a62d4e3bccdb317d472fc5a44a834571873bf6839f684631c323cfe16aee8b54e8a309684413dc9239af1a4be8febeeec527
SSDEEP 12288:lG5E4GTs9/cBkpu0/xb578d2ZesrSOJAdGyAuSZhj:05E4GGcBkHLYUJ+RAuSf
TLSH
T1DAB4AF29F3500DF8F42BA278C9928512A673FC5507609BEB62A4D6663F333D45A3FB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 188KB
SHA256 87ad9c1facc6c4fc88e9964e3d287dda292c646b1c9d32db5a92fc0de3acdab2
MD5 7b565361adc06b005df1478c7367e483
SHA1 c7cc28708917e51d78a1ca13ba8f2130389f7090
SHA512 1c55afeccee0f2389eb4b212adf390bfa2c3c5e8880cebf45d25fbc9d179ac840c1853551fd44d9070dd436ab7f11cf68421ea7c88d974d7746f217a18346ad5
SSDEEP 3072:HhBC1+FxU39tk6V8pQFq4XKF3QPf1bP0Xt1URTPTg8AkUa:HjC1+Fxs9i6sQFqT3QHpUt1URTPTSkUa
TLSH
T162147B59D29842D8D06E2135C7959A42B3777C6283E0E3CB92C0F63E1F3A6D45EE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2476-3-0x00000217106A0000-0x00000217106A5000-memory.dmp

Download

memory/2476-4-0x00000217106A0000-0x00000217106A5000-memory.dmp

Download

memory/2476-6-0x00000217106A0000-0x00000217106A5000-memory.dmp

Download

memory/2476-1-0x00000217106A0000-0x00000217106A5000-memory.dmp

Download

memory/2476-0-0x0000021710670000-0x0000021710677000-memory.dmp

Download

memory/2476-2-0x00007FF7A5480000-0x00007FF7A558B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads