265c0d6fe2f63dd10fcddb9b1534ab7bac8caf7ea4b94922c026591716603dd6

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
Size 1.6MB
Sample260415-tyysbsf161
SHA256 265c0d6fe2f63dd10fcddb9b1534ab7bac8caf7ea4b94922c026591716603dd6
MD5 a6e6383af365c19cc00419c366e2f91e
SHA1 c78e3c2af1c538b1ac70593b5c5c5b7732c7f321
SHA512 5f66210aa4a8fd58a698afd452e1eea298413b3caea17a07ca943e1f56e0fb7695cd58b47bfae7658a9172395f8281809f922b7c7055d0d56df77ffc46c73ca5
SSDEEP 49152:bG6AqSPyC+NltpScpzbtvpJoMQSq/jrQaSDB+kn3Hnx:JSktbpD+k
TLSH
T11175B00A33A4419DFEA7F176D617C60BD6B1784A0376962F02A46F726F337711A2E321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5888	alg.exe
1124	DiagnosticsHub.StandardCollector.Service.exe
3192	fxssvc.exe
5452	elevation_service.exe
3160	elevation_service.exe
5692	maintenanceservice.exe
5128	msdtc.exe
3404	OSE.EXE
1532	PerceptionSimulationService.exe
5632	perfhost.exe
4036	locator.exe
4152	SensorDataService.exe
5940	snmptrap.exe
3236	spectrum.exe
5328	ssh-agent.exe
1224	TieringEngineService.exe
3376	AgentService.exe
5292	vds.exe
5596	vssvc.exe
4492	wbengine.exe
4568	WmiApSrv.exe
4068	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b7c9d8198b62accd.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164515\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164515\javaw.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e4550a97f9ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000067cee196f9ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000063b70c97f9ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008bef6497f9ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\Registry\User\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\NotificationData	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
1124	DiagnosticsHub.StandardCollector.Service.exe
1124	DiagnosticsHub.StandardCollector.Service.exe
1124	DiagnosticsHub.StandardCollector.Service.exe
1124	DiagnosticsHub.StandardCollector.Service.exe
1124	DiagnosticsHub.StandardCollector.Service.exe
1124	DiagnosticsHub.StandardCollector.Service.exe
1124	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
Token: SeAuditPrivilege	3192	fxssvc.exe
Token: SeRestorePrivilege	1224	TieringEngineService.exe
Token: SeManageVolumePrivilege	1224	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3376	AgentService.exe
Token: SeBackupPrivilege	5596	vssvc.exe
Token: SeRestorePrivilege	5596	vssvc.exe
Token: SeAuditPrivilege	5596	vssvc.exe
Token: SeBackupPrivilege	4492	wbengine.exe
Token: SeRestorePrivilege	4492	wbengine.exe
Token: SeSecurityPrivilege	4492	wbengine.exe
Token: 33	4068	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4068	SearchIndexer.exe
Token: SeDebugPrivilege	4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	1124	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4288	2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 4940	4068	SearchIndexer.exe	104
PID 4068 wrote to memory of 2040	4068	SearchIndexer.exe	105
PID 4068 wrote to memory of 1168	4068	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_a6e6383af365c19cc00419c366e2f91e_agent-tesla_amadey_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4288

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5888

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1124

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3596

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3192

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5452

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3160

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5692

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5128

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3404

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1532

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5632

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4036

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4152

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5940

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2284

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5328

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1224

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3376

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5292

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5596

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4492

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4568

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4940
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2784 2800 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2040
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2836 2832 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9bb710d9c1ceab528a329f0abf2fd1a70a5af9482ed9964668f2d8ab1a88a64a
MD5 27db71d56c8b9caaf2f7b160f8f4ed6c
SHA1 a6bf489da4769f3de04528b1a4f427f1ca87ed2a
SHA512 713f0ab3686cebb312b4df0f806dd517d9ca63b738e5a6ae01b922155439377f10013fe26752d4c690d0b89366522b3ac26f35ddfe66cb6ee3d907a9c720d801
SSDEEP 49152:Pb+632BuPkFKRrdE6ohQstBhuXjfS4LWxngB+kn3Hnx:N3q6tjBr+k
TLSH
T16DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 12c15d2faebba7f7ef1fe90c0723ad6d7f9c2237444031e6b79c83ba758ebc0e
MD5 165ce134846068a8941797932dd50f19
SHA1 70c7f0e4141b7fd7319969f45915dade0b66466b
SHA512 1e7dceb24f714c31e4535102195596efcee1daed7268e269b5236a75464ad7f8c55663386fac7edcc4f7335f834092feb09e295deefe23ba37da7934eb28dab5
SSDEEP 12288:R1XLsswWkxy2lRq2czAdLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:fXYfDtczACNyBo4kx929bL3Hnx
TLSH
T12065012967D409F9ED6B9278C8A28511DA33BC4547A0E7CB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 12810f77e76cd5b425b21e49c05f456a459803eaafee4bcaf8686f69c9d2c5be
MD5 1e89b6c25f59ff42a2339cb3264ece43
SHA1 20ae8e83f83480b89214563ef70c1823d2adb283
SHA512 d32a56547564dd69efe274970357238bc164ce3560a00fe4aad24b913bc9a6e8649688e2e8dcc6647b18393ee5db375422ad02ee8dbf856efc2befb56f54d2df
SSDEEP 12288:8XZNYVLeyUji0h90ZD0wxpyZIVuKrHsYLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:s0Le5ji0hmxxrMHNyBo4kx929bL3Hnx
TLSH
T1A8859E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d76a6f2a69d94571555e78e91459bb84f6c8a7cb35348d4fc8baaf4fef958b4a
MD5 b08e832226a669af044ef750b5f7f304
SHA1 c37439f332f996fae9752c0a9074535f5c56ffb6
SHA512 4c6905437b3ed1652eb89bc8085ab55e7bbb6a89d6493cfcfd687f35aba3a84108bce8cebc9c1bc3bdb0d951cdc706ffcebe056f437b448186bf0b2b04d8dacb
SSDEEP 24576:Sa7/ezSC6vUyDZaqgrvWx6q8wyuNNyBo4kx929bL3Hnx:1/ezSC6vURPvMHjy7B+kn3Hnx
TLSH
T17F755C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 cf0cf3b0996d4b2402e3fecacb89c59f931f7039a9e82464552d6251d9955026
MD5 b58820f2ef1ec7f3b15d9205f97e1480
SHA1 9024580ad987eab0ee739d00d0aa395f370dd303
SHA512 867dd0df93b63807f40de0d7870370a77f04ae15f41c61faeee5b08fc4eadb438a58021a690aff200761b97c525eba55f183fff1013e0caea253823fed5aa57c
SSDEEP 12288:zVJjBq33vb5O8M+l1D0hwsEBoW/l84Zf0Im98JLDAptNyvUgXZ32dT4ePc7N29CD:zVbqPb88hv/lV7WNyBo4kx929bL3Hnx
TLSH
T110559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 bc774d9343d202f338e334caebec85e660e86113b126799631f3a992a489b94e
MD5 e2eb76b073bfef80c9f0e7ab7d424985
SHA1 f4897002062ba1cf1da6498225ef9663c38d2fac
SHA512 c65422acfc64581be9d8313fb06cc9a42874165b4133bd904f10c7b0410b53f6c2c3a2f02ff89dd056280a877c5887408f73ce63d3db49ab793af31602307b2c
SSDEEP 12288:GZULDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:GZLNyBo4kx929bL3Hnx
TLSH
T1684523125B0C627AFBBD3E70785E8459CC35BC890D95DB94DF62ACBB48BC992DB21103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 60b4f982fef4980bb788b4f621c0566201a36c7c7252abafe20835e622d3a3de
MD5 e38e4024487b9157e300c1f3acf3d229
SHA1 3ed6727bb6cb5cc2bbf1d2d16efe22d76e6e623a
SHA512 361079ecb8d55fdc99fbb985adc97d2fcc9dabf8fe308144d3eb05cf8cf751e7d8554665657dcf1235199df14f8371ee4c29805560b153209c27790bf1056b49
SSDEEP 12288:neBNUbTVO86UxLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:nJIUONyBo4kx929bL3Hnx
TLSH
T11D65CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3e2ac1d2614501d48658eab17275091000d8eccf30b0aa7a1c5ee5576aca532e
MD5 df3f341046f757940e91129b40fcc148
SHA1 a422ce959251b789422c1fd633222c80108b3e23
SHA512 08b849329a19ce03a8ed76e311c3dc64b98b911b54c03f52c49436f8917f1c12d86a0e8e6d9db6e7e9622c444225faeb945bd0f75afa0a43c9476e841a807dfd
SSDEEP 49152:TQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THD:TQvGAdlCEL8c/pRNw5CS+k
TLSH
T13E266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 6eaff5967d9296f73e2d6d94e3e01aa95b0b35d6ca80ac39acebff4358ad19f4
MD5 402b586d64956da5eec669320e165006
SHA1 9e70ca900112e00a73d8f68a53632c535e6193ab
SHA512 d98594f3f24d064cc579a70295de206a3f5fb16b168a2731b4da3abc010cbc546333f327e4d941d75914c752812896b1dc2380d7a67770207320bf404942d6b2
SSDEEP 12288:yAwSfxL/2Dc3vDLLmt0LDQewsAjnLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxB:3yewsAjcNyBo4kx929bL3Hnx
TLSH
T1F475E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6e03afd9f48f49f2e6441852c03683b4e8ad5113590450469b1aab4ccd4fe5b6
MD5 5c780d65dbe2d1ac69c53f6f9af192e8
SHA1 c3ff77f660e8214824a4ab191f328cfb2fc2c044
SHA512 e364a86e4b3dcdbf1fd849422cfb32d2446cca96b7dd9eccdfbb9a1f6278c475f1405bfb062bd1d332b960405c4a078789a86aaae4534d774c5e8e2ab5a8e11c
SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHp+k:bUEtQevvqc2W1cpV29I32p
TLSH
T1C5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f5104fffe5f5f5a2918b63bd7327c161f89b07f60a4a34153fa78cbe73a38a67
MD5 c2b2fefabcdc059e1fa8a29a4388ba41
SHA1 59a9698bd741c7e05a95de844b0768ca51155e36
SHA512 6e7b17b0683af4d143d30947c04a912300a47b43430150ab8d6b7171e696d570a151c95f1d43eacd035f77642ef26ddee938e744fe2fe646d6ed25335334f766
SSDEEP 49152:9CbRquA/m2yL5zLfFiV+XenmE3/znB+kn3Hnx:6oq2VjnmO+k
TLSH
T12ED58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f0cba69d759ae842465da523c2a76845f44125dbe6f5e5e7b0773179a01ebf0a
MD5 ca5b3f19014a27478281909123a313f3
SHA1 d051e8e1d1a056e6cba44197d50ca9cc7c293b3a
SHA512 2aa1ec331006955c724dfe9033f8b1699efaac23944b3a4ce7804372fd9f06b1ca286c3fea134ee9fa2be429b326da211f15ac16d49d3f58d60bd4b176e65bba
SSDEEP 24576:GAhGLmIFoiwtA5l7S53JNyBo4kx929bL3Hnx:GAM1Foiq5eB+kn3Hnx
TLSH
T1A535AE81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 742c9e5b011f0352767a629ba33373ec0e5807a1a10f12c6cb6e4b7b5f83c24b
MD5 439a23a52385d1297b83e48c392903d9
SHA1 d18dc09fc9aaabde575acbc7a089861c1296ff7a
SHA512 9d8acc4ca94c011ddbe071fe44b7b0869d7a1f6a1dd77b59808eb62d72b17807df2d2ee0b3a5ede2d18c524dd874a7218f2addc7e5283b895c5c1f31ec3e72d5
SSDEEP 12288:imw5HEjsChNEBFgl0WDm+CeLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:7wuJOWYNyBo4kx929bL3Hnx
TLSH
T1F465F10677A81CF9F96756388547C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 63187c06f047c78afe3b258320b797c7a3838c29ce617ac3afe9532719537a78
MD5 ad8c75288794967f3d99dfc415f3b66e
SHA1 8ad7be971562337f8a7a2118c1256b281046d3f3
SHA512 ea8077173c6a513852228288ead833cda259664b9fa25eb2f820c34ff259ddefc19454db974e804b63885508b2bb9c424041b2dc31ebd93f1d6522c883525398
SSDEEP 12288:ChZ1Iy3LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:AZufNyBo4kx929bL3Hnx
TLSH
T190551216239831FAF2AB2678D8E58544CB32BC461B7183CF5A2146BA1F77ED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d132050eecdb00d93b77613aa0477a9078cc55e762930fd6a18788ed23b76fe3
MD5 80faaaec13904458bad695b9faa2ca7f
SHA1 3bb025233937c50c03714c2e1ed443d3a693e9cf
SHA512 64d48b7b5e4abe8a7821903c74488e12cdddff26e690335fbde665b3bbf3824463c7052bb8a5508ab936b15bcb3662125f079a4571ed771cc0d5d23d773d1cf7
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23U/:HQRQyi36YOcPuLvw2gAf+PN3/+k
TLSH
T197666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 65c7943e3c24989b4e1b750acb692d0c908bd4ebcb8019ee5e5c86b02e933384
MD5 36d5eb2d3d28a4c9e1946cb9b98e498f
SHA1 d6927c0ad199f3cdc0a56f0f275506b0c5181962
SHA512 f1217edbccf1f3f2f3f647c3cf063e02c94ff5473277afa4ec0f9f22d7dfc0685e77987ab0c1d5cf148a53b58b5d98268b5dc415c1567eb1a68ed4886926b6df
SSDEEP 49152:Cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23U/:hQRQyi36YOcPuLvw2gAf+PN3/+k
TLSH
T192666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 19e6e3368f712dc9fc0182919d6d103d56b642cdd6aa7b88aceb6c1eb6ac8421
MD5 b807a1fe4c744019403796dbd48aef2d
SHA1 f1a89de41c6cf705a76dc2f43a51b21784996b29
SHA512 36ae195edad637b850582e5bdf04107ec1f871eb55550595e1651a88c01cddb2a89d41a94546e5124004e00f75529128487c583dfe6a39c4d2765b29234db215
SSDEEP 24576:ZwvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0vNyBo4kx929bL3R:F68Qg55nhxeWu7PNU3/3B+kn3Hnx
TLSH
T133B55933B2F600A9C44DE1769F4A873196E17C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c483f75b499d3b493ac8bc11fee91ae129efaeb6f899003eb288f10e663b160f
MD5 2db39f528b1a85563be928ff629b7ace
SHA1 0b0f76d16c64a391d1d1cc17dfbb2e0e80158e2e
SHA512 3e0ea0c92373db59b9f4938d941edf4bc7a77c5ce9dd7c474dbbf159e5034969574a5e2967db53b37e232787737ed6d278d6c0ff85ef7dae81733b0c2d32af6b
SSDEEP 49152:g3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99V:Ny5112gYy5azzVvD69nLKnhZ4+k
TLSH
T161167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 30ced8f7f1800158ba329ef3b6cae795586bd53e3aeb3e20b9cd58ce8cafa71c
MD5 07642b127bd5291fd1f3c760b4b461b7
SHA1 c91cb212d58a3a7120661092b8c43001164fb2ac
SHA512 53e3e8645e5b0f9d85cf0019d14015347971b57aa2bce4d744bc2575231c6a4d77873a290c956c967d4289c8f0ab7b7103793945712353cf44185d4f69be44b2
SSDEEP 49152:OB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glxB+kn3Hnx:cu6JmQxd2d3+k
TLSH
T13CD59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c0477e7be63ea268f727a85d3d6e9138fa628eb54e511e6c87855d07e56cbf2a
MD5 1cdc786e67783cd3c597b7f481524203
SHA1 9f9aa45350e765cf9efdcf93cec172a71f02d04f
SHA512 757e4e1d7e8fd7a0ab33887774a7b564113c233bd279c015eb1974814aa51c6fdae0757f44519d06138d1462d2921b409b7fd4982548fe8dae1050c734e448e7
SSDEEP 49152:a1hpsNoJpF1A6yU44CwH7R4xFB+kn3Hnx:amifPVRO+k
TLSH
T174B5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f577af72c7523f63ce9279589512ea4632138df72ef86dde06511b17953141e0
MD5 6ccc6de5b4f379f16fe6750e4999c571
SHA1 bdc1a4c3570059b114e60dbe3188c747b882f853
SHA512 ebb7d5c44bef2606320419982274f6a9ece1be7c42d1473c52773e249b19784ff7aaade51d23336a39d7aac051f9635a0ede214aa5b42f6fd3ac7fa40d994ea0
SSDEEP 49152:4SuZQIY0Be2KIRVtOnks6NMHqwB+kn3Hnx:i5dKOi61M+k
TLSH
T16DC5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2985eafac5ab8a9af6d2183ce7b56ba54ad683190ff7165945b3f7ef482ca6a7
MD5 2c145a4aa9a579166801ca37c4b1d1dd
SHA1 d0106c6e8d7afff83d33aa897495fe97cde9a663
SHA512 af62308586615e28d338d493cb0155f09e2677a903cc11a6fb43fcbc58917ee15ddef41f82679235d2f0d0e0df2503fbf3a535e611c23e03364ae8dbccb4cbee
SSDEEP 49152:0htSn8EApI0figGgiDn0AP5wBB+kn3Hnx:VX2i/ph6+k
TLSH
T10D95BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e301265135d65b5aa0392e02c33109b7468f7ffac0d0d0173e272a6f18dd854f
MD5 c04f0327eb4ef133ee02618ecc9e4e33
SHA1 dbd05f6d33db610c17c73ce46a55286d6c52e528
SHA512 c07f93c71c95190f1285e1f8a156e1566f7f48112fb43a5703bdee108c26c2ec2bd54a5ade8d4c0ff05ce3ebf4f15543122f5336cd7b3c51108afa8aa7e014da
SSDEEP 12288:vcLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:vDNyBo4kx929bL3Hnx
TLSH
T10F4523125A0C627AF76D3FB0A44A8458CC34BC8F1E9593D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 4715d4c7853a51cebb5ae1d67dd4cceb7c4acf3c313ab81a0eab7e2153c8759d
MD5 86c0e33c3adc9161d39f121e37f64f96
SHA1 06f40ae325137b7b761dc0c3f699cd1baab926c1
SHA512 6b18aece5ebea77d225a57bf49c08f852645ea743fc6e54f2bb6770a2cc7c08ea851fd47c8ee81854376aae9c1644681c00b63c93bdd694c14fac73148406fd4
SSDEEP 12288:ITLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:IANyBo4kx929bL3Hnx
TLSH
T18D4523125A0C227AF76D3FB0644A8498CC34BC8F1E9597D8EF67987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 31531b85c9d5693fea5612d128d495ba3623484ab90bad9f7ccd895f0deb8216
MD5 767939516923d4dd25a3ff45970e7634
SHA1 1e55e2e4d08b7ddb4f3a790eb7afa300a467d26a
SHA512 9d9c851054165aacd1531d2f3cee9874fb784664ba7a7a6397c53fd79d1207a15928ecbf4cc203068d045ec0447bc829f8012e6ed8e09ae98b670718b3a3fcad
SSDEEP 12288:45LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:4mNyBo4kx929bL3Hnx
TLSH
T1CF4523125A0C227AF76D3FB0644A8498CC34BC8F1E9593D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 fc3c340cf20603656b8abc4495678e2f045fa7bc6d0d260934767236c21fc91c
MD5 c94ad7dd872fdfbcf3bad4ba7b07674e
SHA1 88402dc1b0600f4270530f93966325c216ce3d95
SHA512 8bb532b4732b720cb199889a7cfd1f893fb82089e6a5ede18468ba3bb579fcb5e1be92b0f6df2046a911f3f52599cc57305e6fb1ab23b2801d163f81fe2b5649
SSDEEP 12288:aViLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:gNyBo4kx929bL3Hnx
TLSH
T12A4523026B5C12BAFA7E7BB0D8568054C835BC8A5B7197DFDF12487B0DB9BA15E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 43e68f2255e661b1f9686cfe61ded8cdc534b39824475b5ec731556625eeed41
MD5 de2ff93cc15dee8f8945a9babe8b7216
SHA1 4f5eba5ca473f2a8eaaddb4cb1643714c508368e
SHA512 350895c051ba224a1595084f7892016455c0f24ec9624a570b62464bdbc512419a8cf962f7bb522ca9524067a6c4b76573313fda8872325977b69724651106fa
SSDEEP 12288:46LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:4RNyBo4kx929bL3Hnx
TLSH
T14A4523125A0C227AF76D3FB0644A8598CC34BC8F1E9593D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 f0817f00b45393b27952a5949091a62c81bd8f11a723d2ec75a5cc7e8c0e2ae2
MD5 7034736787ccc0db17e583b5749aaf49
SHA1 85df051020ac02a3e78301a49d105bc21353e2ab
SHA512 ed0c2b8673071dd0941993b2a5033c0f677b95648fd9a342c1a112a8521c3cd968cc6689712596866d1b5b7a6d233d51b7f8122595f1e4c46c9331edbdede5d1
SSDEEP 12288:DPLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:D0NyBo4kx929bL3Hnx
TLSH
T1AA4523125A0C227AF76D3FB068498498CC34BC8F1E9597D8EF27987759FCEA25B10147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 878d1028f7aa440784aa240f0f2d5cc97696de00b4eda213b9048e43c304e21b
MD5 eccb7610a863f67f9a2c22efd5879fbc
SHA1 ee7cc602d9c8c93c28aa288609537e497743046e
SHA512 4561e12faa1282740cfa5a48dcd57ec05e72bb3cc1fb590fcd3ee15eb69b151ec21484c16382ed6b8a58ca18cd77fa28a62f97c0cb60ad9596e6c53415111e37
SSDEEP 12288:crLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:coNyBo4kx929bL3Hnx
TLSH
T1464523125A0C237AF76D3EB068498498CC34BC8F1E9597D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 873ceffe27af0f22061ba4673e4081049b905fa9055bc57bd432a4e7926c3031
MD5 eca2959f4a2fd937352d36d7746e7fea
SHA1 5ba8bb187d8f405f7e8ea709da95867ad322295e
SHA512 b2e9d567700a17ba099a6227e9824602ced899512746b4ba177ea54208a94f7c641ef138babdcc2fe489ec0c5f9b7a29b392b289115f69dafec61efe3f61cd53
SSDEEP 12288:ZiZwbrzzFEoS2cPvyzLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:cZM/zFVSOgNyBo4kx929bL3Hnx
TLSH
T16D650195B39418F8EC67823DC8158906C6B2BC4A0BA0C65F07B4367B5F773A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 c05e2ab1f292b7f44008e06147851ea5ac58c668a1c8b5d13ac7ae78cb102ac4
MD5 aa34c1a44a353d43ba0556e4803958ea
SHA1 59ed9a05e1ae973e5b16baf80125c696ea1f7558
SHA512 95cbe4fb8795f8261ed44c5ced249e54f14a79263658892d51e60c46bfd3f4ca4ef0ad2c039eebfe716ee9a2d3fb70941d157dbf9dd8039451acad7e6c9a1f4b
SSDEEP 12288:WwLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:WPNyBo4kx929bL3Hnx
TLSH
T12B4523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a39836ceef3607dbaffafc3e9cd68fc91d23a855286e241fdb1832770d7a2d3d
MD5 b37d19adf1e2944cdcadd276786b461d
SHA1 a90dafcfed7b74609931dd06a8320d9630998c6d
SHA512 b412ad044b03cc11eb8cfe77e8f31c0bc797bd0f2100ec0c841c76237fe25f46a8cffe9d9953343521a8602abc29d925c379f95db0d8504fb8469a6ebf90d0ea
SSDEEP 12288:4kLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:47NyBo4kx929bL3Hnx
TLSH
T1494523135A0C227AF76D3EB0654A8598CC34BC8F1E9593D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 3c9be0e54e68ef1c9734570f239af622aab7e5f318bd04862109489790d22427
MD5 ba85c99c9e8f1bd0bb1c7e2f06c35d36
SHA1 a35fa4377b51c49dd96d45106da3b519fe88b5e3
SHA512 c8e9e2bde0cfab8b1f9c3df8a0a7c821e51fc4e9283acfb65848de477d01d86b3e16d50674af279c527b943850e910e6a41ac08300577643f763ec9fb2e36337
SSDEEP 12288:YyPz5L83LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:5zyMNyBo4kx929bL3Hnx
TLSH
T1A555120777A831F9E17A6234C8960A01E771BC360B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 cbebe077b45e22f41e14a180c9210d4ae17ac68a59a597809771cff2b3c74e65
MD5 ab64fbdc5a91fb30776b47f0358c438b
SHA1 95022f0e8e08c9542847f9a5781fbb71e954d7f5
SHA512 67ebdd403ba22d486e34915446b8ea32659ab2ab172c7155509456fbc5f94721bf86ce5ca83ed57e135cd6608c6c4e8f4e081a4054ae9770e94cac5b9de0b596
SSDEEP 12288:IwLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:IPNyBo4kx929bL3Hnx
TLSH
T1EC4523125A0C227AF76D3EB0644A8598CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 dc6b4ddf2beb8c7696d3cfa4dbc2f22b733f9a59f20314359bc062b8f180e81f
MD5 cd0a980329a08c70878cdee10dff6386
SHA1 46ffde1e5e6c9cea6c9aa13472eeca6f6da90bb4
SHA512 217e465db5b0736ce0232c5aeccb89ca1adcc1cd7cdfc1386970cf2e3c218d8d680fd9de61b432d78db58088ac2a2f40b583aa81e73c67d753f7b420ac4d30d3
SSDEEP 12288:awLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:aPNyBo4kx929bL3Hnx
TLSH
T10D4523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 44063a438b29711c1b28212214332da752e400f6b327234891fc1a3fd6f813e5
MD5 9e6cf1d5b0769a60d4e83d66b97cf690
SHA1 3c2b5c98a03639379a77d9590fd652707d213acb
SHA512 6345478bf235b220c04d7b83b2750328bf8b2b04e881675cb1e28452d9d8b9a3e5374b2ae4b014e38f179b92603b2ab5635b267e9333c332d6cfbbee41a31695
SSDEEP 24576:3CUkpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAKNyBo4kx929bL3Hnx:3CUMPTY+8Wg2lIL8lrIUJLWwGB+kn3Hx
TLSH
T14065AE1EA3DC089AD4BB813489518A06EB327C2E1B22D6CF2160C77D6F67ED55E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 046539166d2baf7b7c1d6309ed9cae7ed57d3347bdbae38f09a4ebfade33d2fd
MD5 e8c866d7a4a6ca879c2aeda9937877ef
SHA1 6fcb6760c39532f293e4fd2ce86d1ebfb33bebec
SHA512 2584534e993f8771f73ed51e7b7799509d0a3c8271579633854845d217de38658af17834408c1986c6857ebe4e9e0b622c96097204483129d9027a2b4c40a4ce
SSDEEP 12288:A2sfgLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:wfNyBo4kx929bL3Hnx
TLSH
T15355F00AD25812E8D16E2274CB468A40F7337C5A47E1D3CB97D0F87E1F7AA915EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 4258073211d7ed6251b5a43af57f2bd30488237b19c9ece7482a974be61061f3
MD5 7ddeb53424e83a1c7a416b6ef9df533b
SHA1 3146a85d62f56087448006096b32f402369413c8
SHA512 17e4a7f4d995d685fbadc0e32806a4f5c93f79318a1f5459adefa506e144028c77146aa260e184c9b0456d38189920345adb51d0a4968fca007f4c32b5d24890
SSDEEP 12288:ZZLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ZGNyBo4kx929bL3Hnx
TLSH
T11C452312974C623AF67D3FB0645EC024C839BC890F55D6DBEE1258BA59BCED29E30607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 4260936fbadd7105e12d21525a9d2feb56ad12898a171bb533550088118f9ea4
MD5 25029dc6cae3ae2c9836e4a59de3cabe
SHA1 bf7b33f5ffcb480f8a43f662823ec1252d531aa0
SHA512 2f419e26d1a181d36c1324f7b2085f623e83589b2e81368f2ada78f4e7caddd38affcb5f1853932208999231857c4479f54e4ffa83056efcd9218d5dc76e58c0
SSDEEP 24576:J8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTC8NyBo4kx929bL3Hnx:WRZwQCyiHiQEaaPnMIB+kn3Hnx
TLSH
T1DB85AF1E62DC42A5E0BAD278CDA74407E6B27816473197CF1291C27D1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 96804ccba8371bd61006e724109ffd596ecd997334017a21973fd2bc57ef801d
MD5 619b6ce0553da4e3dec11c3436bd6cff
SHA1 a46cf55fa247772a517850ed09a88ab3a9a671d9
SHA512 620efc329270e9a1af3d84a96d0bd013a93eaa88c4b32e61f1bcb45feb968cf994412017c7a473a81f782d4233109e11f620aae266b18a25647a2c8485678f4a
SSDEEP 12288:ZbxA1U7KpLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ZbxA1UG2NyBo4kx929bL3Hnx
TLSH
T14655122E569C20F5F67AB63898C68105C731BC0A1B2193EF6592C27E0F3BEE55D35B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 72689e720c72dda6c22d1cf55a66d544adf56167428aeb24d39505fef40ce605
MD5 a25400b1675acf4eccfc42c4fda105fa
SHA1 e5375eb2b5b760fd2f39ad14bd5716352c74d0a5
SHA512 c0d8165b1b60391829575ce31a87dfc10272867e3d765e74572887bc6683c3058f02b4b09e29a3b2b0c8de42c56dfbcdbc3a897c79201ffa8373721dc6d5ba20
SSDEEP 24576:0jsmP0yHaqrVqHra44KDzMsrnZNyBo4kx929bL3Hnx:0jRP0yHfVqzlAsrneB+kn3Hnx
TLSH
T1DF45AF2EF2B910B9D4AAD136454507B5EB71B82D1F209BC70170C635AF0AEE89F35F4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 6edbf7dd4ea99b03446e13c4ae32fe1e6ca9f60f678614a723907f0d7aa4bd11
MD5 a19d37f93f4ce29f9e06fec00a3592fb
SHA1 6b9d977564b9b947eee57b7e256d2075c78ac061
SHA512 9f8f715bf1ce85b5a832ba68baa0cb7158fbc4410c8050beb23096903c408f8c3104c1b4e46e157f5f20f47e6d2abb189362b94c6ffa35b8cf328b57bd8768c1
SSDEEP 12288:7vLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:7UNyBo4kx929bL3Hnx
TLSH
T102452312560C627AFA7D3FB0644A8454C834BC4A1FA597DBEE6698B749BCEE34F31103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 42f7149c187e0a2b8dbc7f6d59e2c58970d7afdc819119b42596777fb5d22c6f
MD5 b382944fbece21039c920e931b12e82a
SHA1 71a1d407569db26041548fc659d225476a111e02
SHA512 89b011da1d402c071a1ccbfbc8ce06703cbb117da74d227dba9697dce6a2370d43f100c668e1f220236606ea1b81ab34d266be5025dc4672d71da249cb0d994a
SSDEEP 12288:sObzA4LWO+vAYFTdLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:RHLBUTCNyBo4kx929bL3Hnx
TLSH
T188750115F79800F9E97B923CC8A68916D672B84D0764E7DF03A84A661F637E24F3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 ef089bfeaf521fb4b0402cfe0dc44695e8c68b130c56e3c5bf386e7eaa577d60
MD5 174c9916e313c6dcec88468df4e3e915
SHA1 55988dc50cab60a2595e3355353312d4e2da6b2c
SHA512 de39c50a912e63d612287ece2ea537f4f05accff84bed90fca5e9f5e24c6aca94a0912700aa1d571dc6a9be188b433cf053c104dd4f2b8fe8e092d22596f769b
SSDEEP 12288:i70VmcIYNvUyBpMLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:TgYNH1NyBo4kx929bL3Hnx
TLSH
T18265F12F52AC19E5E53FA1798AC38209F572B856171193CF05B0C27E0E27EE9BD3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0d56aa29709b071036d08b66223631fb8a4c112818d3ff45064efe8c1c438a5c
MD5 123ac5fa228f6ef94e37dd4163154352
SHA1 8d9c97b50ca1d976cf01dbe29524595e959bd1a1
SHA512 1e1deeb430e7180e81d4f6e6fbd326202112a29c6f5f4ccdaab9ee93e6b9c70612672cf2ea5c7dd25b377f40a9c7269b61712cc8e423d20db0954228100bbce9
SSDEEP 24576:MnXoJjNYH84VVSNAApoEOS66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKp:MnXoJJYH84VVS6AmEvJas+cHBjSSKHP5
TLSH
T19065BF6EA2BC04E8D5BBD17CC5C24506F5B178661331CACF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 bea0647defe01be582de969fbc741335b09c0d4cab3cc316efb619c3a43b0a1c
MD5 72a20d2a2510cf40cb42011c91c3b7ae
SHA1 a1cbff9578b253e449ee2bfa30aee09d611c363a
SHA512 7b00b707abdd9c24a7b6ea2b1b2b40646aa29a0a2238acc9ea97cecb963d946c4e076f42c47e3186e4c8fb64808d2ef0ea8f1664ba3cf443b2eb10f1c4c1c967
SSDEEP 24576:av7Xbxd9Tuycf8M/TYlSuxwr2PCrNyBo4kx929bL3Hnx:aDLL9TuJ0M/TYW2PPB+kn3Hnx
TLSH
T19D858D1EA3EC42D8E4BBDABD85A79146FAB2B855173081CF0251856E1F23BF05D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 c736aa17ba0eafa5eb9f3b067b32051b778124bacefdc72df8d88003685e437a
MD5 de404f6878539a8bbb4aa50758f31131
SHA1 c7238eecad648aba4a5d70771f2a94c4cfb223c6
SHA512 4c1a444e9addc9a5cffa7f48756a1b009af3324ba1fd86e68d5dce82837f0cb3c71652d97ccfa5bb97c2e7c2182b96b740c9249adfb3e10bece40891341e597b
SSDEEP 24576:wegJgpwJOmPOHWAKJ8ZguIGyPsxr5Vin10wCNyBo4kx929bL3Hnx:wngOJOmPOHEBB+kn3Hnx
TLSH
T17455CF3FA7BC15D5E03ED17D8A978816F6B1782603255ACF0560827E5F2BEE42E39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 1d72b382514a5b6a8098284e9fa30c06ab8947f6a3a457726427a4e6f1c1f6c3
MD5 53abd73d89dc5fef859cf63ed805cbe5
SHA1 b0db01f203a5eaf9471341d1e6d48b2d02763efc
SHA512 7e3222a72ecca66ed86292abf0055da08f0faf2d71e4cd4f9c05950730915dff7a0859c4c302d5aa61555e34eecfc926c4684f44e0528032d7a171163a9d49a1
SSDEEP 24576:3LJnJiTk3R3waE4JrO0NyBo4kx929bL3Hnx:3LJnJK8R304lOB+kn3Hnx
TLSH
T14C75D02DD2A810E8E4B7D2B4815A1656FF31386D2F2169CB59B4D4353F12FE0AA39F09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 7f74abe5790a3ea8445bc341d5eae8bea01b9fa85384970b5c455e47b5ccef93
MD5 60ab0ba5078dc6eb798655cf9e3d6cea
SHA1 1edee15fb983c359397c55e9548332afac83d0ed
SHA512 45edf1f0f62c6e19ea960a7757507887c896af2693c6d107a95eacaeacc6de93a5705642ea2f1635695acc3b49ff69dd7601237b5c5ea5a456e27ce265a89162
SSDEEP 49152:Z9GqCzDScAZmlvTcFg8Ph6LB+kn3HnxK:VK+kk
TLSH
T141955C05F7EA5298F8B3CAF1C96694159A327C409B34F7EF4A80C97A1E32BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 68cf840144ef2e119f60f86f82cf70227b7ee8fe291088482e8a6c0cb946e638
MD5 04906befdd4e5609d17a8f291559d30c
SHA1 69a0109549c603b79ad30115d554a86241760765
SHA512 3170d9b23a6e83525223dfd5dbda2f73d1510b3f136b04e793c6f7a344cde1f3cd36f78657cd34f51d462c01465986dc7819c7d955604d4dc8ef447d8d1e0e9f
SSDEEP 12288:NlYJeXm5nkEUuEtLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:NlYJeXm5jUuEyNyBo4kx929bL3Hnx
TLSH
T17D55121E365C31F5F23E657898928504C731F8A6175163FF96E0C4BA4FBAEE21E38A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 ca96cc39f47bb28946f01faa3d596ea4dbaf73cbcde65f068dcde0d0c6c04088
MD5 5ca1e729a65706efa7177bb6e95eeb75
SHA1 370d70c65d465548fa7fba951229939cdc3d8621
SHA512 d8fad211bc49a0d18e5e1031712273fdc76f931da378054d779b5c3ce8d93af54f49600627b92e8276d06ab0637a7806bd1c7961b55ff7d1e821c87b870ed6c7
SSDEEP 12288:3Ou6kySLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:3Dty5NyBo4kx929bL3Hnx
TLSH
T12E552301639861B9FABD2A74D9638194CD34BC154F2093DF95A1EA3F1E7ABD1AD30B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 fe354a6ff4178fefa54b03dce50a75eeab06c06d0acbfdce2e7d51ace3557acd
MD5 eede46cbdae3fe5d4e079fa105443bb3
SHA1 60387196d8f1852d83f9f867c6cb0064afade6e9
SHA512 580c4527ce2d2039c4885f25f7a3db0a7bcc210304b27cecc5062f22d73e6c2028e874b828bfca57bd65942da3c86812376ffa126b425d475f1e12582f7d3bc0
SSDEEP 12288:QPdLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:QCNyBo4kx929bL3Hnx
TLSH
T147452316561C327AFA3D3EB0641A4454C834BC491F51A6EFEEA2D8778AFDAD35E30903
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 54954664a806d747099faa10b2ba51f6089ca4516a7f9ba7b62bf70143748a91
MD5 ff4a1649c6bb69132fdc4ab8944bd04d
SHA1 5645e16c52579c47b03202888b693962160b9ea6
SHA512 9eacd2426bd28ee747ce56defbb8aec63b2c1613fdea4d98dde2d98d47047f51d0cfd202eca7a29b1f2079c32354d6910433af8f75725a6fbf4df67a83b0d613
SSDEEP 24576:SC+TyQIu93VAumZr7jm/NyBo4kx929bL3Hnx:S/TfIq+YQB+kn3Hnx
TLSH
T1FF558C1DA7E91DCAE2B6C675C8A34493E933B872137186CF2044C07D499EEE9AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 cccc4ed56de74eca6f4d4b533203d2397c7fda1e0a8737a94cd188ca0dc25b77
MD5 665dafacf83f8f8b63d807bb80356947
SHA1 a12e64a50a46ccd7bceaa1d3a8ce6874f6588b53
SHA512 677d82f793c55ce9adea165a5ba30f7c46c189edfbcbd320370e3574e98bc3f211bb6dd33965da4f4cc29404349d9ee27ff1c12bc6e22d6d7bcf18e846aef8ad
SSDEEP 12288:AcyrWOstaa3kcshLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:VLQikZeNyBo4kx929bL3Hnx
TLSH
T1C365F10FB36E10A5E1AB923C88854115FA737875071263DF46A0C77E4FAB5EA7D38B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 b488d6520ccc693a22de24a44fd15034db87c6d9b9a3cb00a42b4117c1888459
MD5 4df2a7edc26663adaf8588536e1e8ae3
SHA1 512874020187bbf4ad396ebd3a102260357773b9
SHA512 a8b302400dd1b767e275f2874fd38ba440654c9d432321fb73f30c3d78ffe45ea761c56c9f60b938006725ce5362a289e96e620437d448792a9385e9e1e548d1
SSDEEP 49152:9pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAP+B+kn3Hnx:+pC7b4+80GTkl+k
TLSH
T149A57C3DE2B810ADD8AAC775C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 258733d114e523d1bc804603214715879c7a4da3fbfa35a31d1ecb5d6f61eed5
MD5 ef8104227ff23305f8acc94d17b50194
SHA1 9a3d86dbdabe1e5a09a17b09666bcacdec5c442a
SHA512 19d830b1eea129cf6e421c87686214b6591f1158044206d7da77b0d885a3c6f93a27c07800227e6ba51f1c7d930612a319532eee61301ed3e617207bf0cc8e5a
SSDEEP 24576:ASAwJPE1IDAo+4Kt+l4413kUQxNyBo4kx929bL3Hnx:AqPCIo4Kol4WQmB+kn3Hnx
TLSH
T1E855BF2AA7F956F5E17ACBB4D663C501FB727822133163CF9290813E0E169E85E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 7cfd4a3f61d4aff8b95bb2d1365e60d7e574a08fa29385450d2149f33695a15d
MD5 eb4da315a85d0532e5cbf7a157a2ac9f
SHA1 398b6bc91909f279ecae5f80c94eadb4bc392307
SHA512 38a813e146b3bf9361ae29663ebe9128dd8f085c0256c4d39415a1b2f778b7a60db43c2f6d670e7591d938e35308f321d1353b0b445305b0eed1f3be1dd3587a
SSDEEP 12288:ISsyLCFBoPLCRyj6NQ4tqLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVo8:QyLXPLcQ94thNyBo4kx929bL3Hnx
TLSH
T13075E03ED66C04F5E47AC27CD6A38906F6723C9D033166CB59A0947A1F6BFE46939B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 1dfbcab1037a6d6beade50e1bd6360d240b67e526bf3c814de92adb8ba71f554
MD5 c59ebd6709edee3089adfe7f6db54220
SHA1 1c71eee7b276917c9299951ab840c130e5ad2725
SHA512 830ed53d99020cda217a423fcd9daf17027eb63d69fbaceebd60f074c6aa2d4b7f12d3caa5e2e3468dbdf0493ea2ec970f13a1f4b48ac099479a61331846ec80
SSDEEP 12288:y9lyvj3IkxjbBzRLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:yWv8qjpuNyBo4kx929bL3Hnx
TLSH
T10265220E569830A8F57D2770E5268124C431BC771764AAFFB5D5D8BB4B38AD18A3EF02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1124-17-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/1124-27-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/1124-18-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/1124-113-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/1224-374-0x0000000140000000-0x0000000140181000-memory.dmp

Download

memory/1224-150-0x0000000140000000-0x0000000140181000-memory.dmp

Download

memory/1532-164-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1532-96-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1532-87-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/1532-93-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/2040-424-0x00000236F7370000-0x00000236F7380000-memory.dmp

Download

memory/2040-401-0x00000236F7370000-0x00000236F7380000-memory.dmp

Download

memory/2040-416-0x00000236F7370000-0x00000236F7380000-memory.dmp

Download

memory/2040-410-0x00000236F7370000-0x00000236F7380000-memory.dmp

Download

memory/2040-408-0x00000236F7370000-0x00000236F7380000-memory.dmp

Download

memory/2040-409-0x00000236F7370000-0x00000236F7380000-memory.dmp

Download

memory/2040-407-0x00000236F7370000-0x00000236F7380000-memory.dmp

Download

memory/2040-406-0x00000236F7370000-0x00000236F7380000-memory.dmp

Download

memory/2040-405-0x00000236F7370000-0x00000236F7380000-memory.dmp

Download

memory/2040-398-0x00000236F7370000-0x00000236F7380000-memory.dmp

Download

memory/2040-399-0x00000236F7370000-0x00000236F7380000-memory.dmp

Download

memory/2040-400-0x00000236F7370000-0x00000236F7380000-memory.dmp

Download

memory/2040-402-0x00000236F7370000-0x00000236F7380000-memory.dmp

Download

memory/2040-404-0x00000236F7370000-0x00000236F7380000-memory.dmp

Download

memory/2040-403-0x00000236F7370000-0x00000236F7380000-memory.dmp

Download

memory/2040-397-0x00000236F7370000-0x00000236F7380000-memory.dmp

Download

memory/2040-396-0x00000236F7370000-0x00000236F7380000-memory.dmp

Download

memory/2040-395-0x00000236F7370000-0x00000236F7380000-memory.dmp

Download

memory/2040-392-0x00000236F7370000-0x00000236F7380000-memory.dmp

Download

memory/2040-393-0x00000236F7370000-0x00000236F7380000-memory.dmp

Download

memory/2040-419-0x00000236F7370000-0x00000236F7380000-memory.dmp

Download

memory/2040-394-0x00000236F7370000-0x00000236F7380000-memory.dmp

Download

memory/2040-423-0x00000236F7370000-0x00000236F7380000-memory.dmp

Download

memory/2040-411-0x00000236F7370000-0x00000236F7380000-memory.dmp

Download

memory/2040-412-0x00000236F7370000-0x00000236F7380000-memory.dmp

Download

memory/2040-413-0x00000236F7370000-0x00000236F7380000-memory.dmp

Download

memory/2040-414-0x00000236F7370000-0x00000236F7380000-memory.dmp

Download

memory/2040-415-0x00000236F7370000-0x00000236F7380000-memory.dmp

Download

memory/2040-417-0x00000236F7370000-0x00000236F7380000-memory.dmp

Download

memory/2040-418-0x00000236F7370000-0x00000236F7380000-memory.dmp

Download

memory/2040-420-0x00000236F7370000-0x00000236F7380000-memory.dmp

Download

memory/2040-389-0x00000236F7370000-0x00000236F7380000-memory.dmp

Download

memory/2040-390-0x00000236F7370000-0x00000236F7380000-memory.dmp

Download

memory/2040-391-0x00000236F7370000-0x00000236F7380000-memory.dmp

Download

memory/3160-50-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3160-44-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3160-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3160-146-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3192-70-0x0000000000790000-0x000000000093C000-memory.dmp

Download

memory/3192-72-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3192-30-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3236-124-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3236-132-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3236-130-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3236-266-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3376-155-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3376-157-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3376-156-0x00000000006A0000-0x000000000084C000-memory.dmp

Download

memory/3404-81-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/3404-75-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/3404-85-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/3404-160-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/4036-114-0x0000000140000000-0x0000000140134000-memory.dmp

Download

memory/4036-173-0x0000000140000000-0x0000000140134000-memory.dmp

Download

memory/4068-192-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/4068-421-0x000000000B9F0000-0x000000000B9F8000-memory.dmp

Download

memory/4068-383-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4068-176-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4068-182-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4068-224-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/4068-208-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/4068-185-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4152-118-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4152-184-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4152-378-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4288-84-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/4288-2-0x0000000002EE0000-0x0000000002F40000-memory.dmp

Download

memory/4288-376-0x0000000001520000-0x0000000001640000-memory.dmp

Download

memory/4288-9-0x0000000002EE0000-0x0000000002F40000-memory.dmp

Download

memory/4288-0-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/4492-169-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4492-380-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4568-174-0x0000000140000000-0x0000000140160000-memory.dmp

Download

memory/4568-382-0x0000000140000000-0x0000000140160000-memory.dmp

Download

memory/5128-73-0x0000000140000000-0x0000000140158000-memory.dmp

Download

memory/5128-379-0x0000000000730000-0x00000000008DC000-memory.dmp

Download

memory/5292-161-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5292-381-0x0000000000690000-0x00000000007B0000-memory.dmp

Download

memory/5292-375-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5328-137-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5328-148-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/5328-143-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5328-359-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/5452-39-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5452-121-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5452-33-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5452-43-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5596-377-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5596-165-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5632-101-0x00000000008C0000-0x0000000000927000-memory.dmp

Download

memory/5632-107-0x00000000008C0000-0x0000000000927000-memory.dmp

Download

memory/5632-110-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/5632-168-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/5692-147-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/5692-71-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/5692-61-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5692-65-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5692-55-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5888-106-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/5888-14-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/5940-122-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5940-227-0x0000000140000000-0x0000000140136000-memory.dmp

Download