20af25f588b09c8988c684adb06f216bee2d0a5efb41388bb223c26c4d8ab4dc

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 03:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Size 1.6MB
Sample261017-dldzdsch24
SHA256 20af25f588b09c8988c684adb06f216bee2d0a5efb41388bb223c26c4d8ab4dc
MD5 efd49b635da9a2dd6415bf8b2f6778b6
SHA1 90e75c39dc3063ab36af36ea87676f39d2fe711b
SHA512 06e0044469fab923f3c67012dfcd91383136f2f7e620aa0fbd4b5dc17401fe7ea1a79c0be4eb7ab325bbe2cd2d0e9db03c41d0c4e833003253ca2e4e57f1448a
SSDEEP 49152:5G6AqSPyC+NltpScpzbtvpJoMQSq/jrQaS6FPGp01LY:7Sktbp++iBY
TLSH
T1DE75BF0A33A4419DFEA7F176C617C61BD6B1784A0376962F02A46B726F337711A2E331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5884	elevation_service.exe
2812	elevation_service.exe
2516	maintenanceservice.exe
5104	OSE.EXE
264	PerceptionSimulationService.exe
3156	perfhost.exe
1424	ReFsDedupSvc.exe
1244	SensorDataService.exe
5976	ssh-agent.exe
4700	AgentService.exe
5456	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ec7cff3db68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaws.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Colors	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002d560f69e45ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007180c5a9e45ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000013c78e69e45ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000f8663a6ae45ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cbc2336ae45ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000004240b6ae45ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000045036869e45ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000059947aae45ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\NotificationData	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
5884	elevation_service.exe
5884	elevation_service.exe
5884	elevation_service.exe
5884	elevation_service.exe
5884	elevation_service.exe
5884	elevation_service.exe
5884	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	4700	AgentService.exe
Token: 33	5456	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5456	SearchIndexer.exe
Token: SeBackupPrivilege	1424	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1424	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1424	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1424	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1424	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1424	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1424	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1424	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1424	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1424	ReFsDedupSvc.exe
Token: SeDebugPrivilege	5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	5884	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5076	2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5456 wrote to memory of 896	5456	SearchIndexer.exe	100
PID 5456 wrote to memory of 1664	5456	SearchIndexer.exe	101
PID 5456 wrote to memory of 1564	5456	SearchIndexer.exe	102
PID 5456 wrote to memory of 4368	5456	SearchIndexer.exe	103
PID 5456 wrote to memory of 3664	5456	SearchIndexer.exe	105
PID 5456 wrote to memory of 3768	5456	SearchIndexer.exe	106
PID 5456 wrote to memory of 1404	5456	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-16_efd49b635da9a2dd6415bf8b2f6778b6_agent-tesla_amadey_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5076

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5884

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2812

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2516

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5104

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:264

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3156

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1424

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1244

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5976

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4700

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5456
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:896
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1664
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2576 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1564
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2868 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4368
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3664
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2868 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3768
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2576 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7da207e4ae81bda5de69471941d41b68b3fd7cd767e1e45cce966977a8498e02
MD5 c7d72d0916a5c22837dbb5ee6fb29535
SHA1 c9d72ebe994ed26ab0f31caafb7463dc88f55961
SHA512 8df139f39d8daf48b8694d918df67ad10893762d047202660a4cd02b2e5335032025794df81a92f57ace61be492f40f965ae85a33126105c59a451c44ba31cf2
SSDEEP 49152:pb+632BuPkFKRrdE6ohQstBhuXjfS4LWxn+FPGp01LY:/3q6tjBV+iBY
TLSH
T1CDD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 77c79dfafed91caaef489517ab2a778754977481e3188824b6f4faa775a5ab14
MD5 43e39040c9946383557711788b529628
SHA1 d8a7ec4a8051e96eb850a3a1bb48585974c86d52
SHA512 6a740d2f59eed23d9edee6ce4d409b0ee1d8dafcb28fd56729d5e521474267230a4906d13bacde264121a77c6400e456ad7f5ec648c03156647f6ba5d2a9a937
SSDEEP 12288:G1XLsswWkxy2lRq2czACE2g35DbAaWQRigt8cjNihu73jfHh4sQNlE/JLEUPLY+m:kXYfDtczAMg3WaPRn8cjSunYN+xLYG
TLSH
T19F05022873A409F9ED67827DC8A28411EA33BC5547A0E7DB03E4A6650F337D85D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 7298e2e2e89f21e5c5b29a5d3e3ce1499b4f1af61aefacd2194cd58bbbb8a1f5
MD5 60953b5d6cb8883c20c027253e9707d9
SHA1 06c559628d3548146b3f7270826cbb9db821438e
SHA512 a02fda867e914e46115a6a0a4a761e89912f194ef4f12ca0b7d3ab47bda014b894aa12e412cef2c4b67eff6ef7196c9f30084412ac0069670534fd08a1bdb74a
SSDEEP 24576:X0Le5ji0hmxnrMng3WaPRn8cjSunYN+xLYG:XPji0AxZFPGp01LY
TLSH
T1E035AE16F6788331D073C0B9C5D2A69AED7130865B308ACB4286D77C6E67BE6C53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 921244ddd478bacf291d602aa078e548acefb7ac933fcc6df652d3e443f19174
MD5 40753b58556327b79e1d361d80c9f2bd
SHA1 a2e30aee47a545016f92f8896069c350369dd940
SHA512 a157bd2410e5f74ad1ca9bc9210f8543f470042c2ba64f039a6c642f39b68dd1684440898f3b91c6574ddd0b38de207fbe942a4621ad139a10229d8b1841a150
SSDEEP 24576:ga7/ezSC6vUyDZaqgrvWx6q8wyuVg3WaPRn8cjSunYN+xLYG:X/ezSC6vURPvMHjytFPGp01LY
TLSH
T168756C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ac1bd76335d13880420fb797de80ecbfa06f5b71d63764aa8eaa910702185480
MD5 60084d7cae218387222beda55d3cce76
SHA1 5621c6d7b1d2d263d3c3f4751934b8e9b8b32332
SHA512 7f7f48dabbdf8d06db1a8eded7c7acf4df7eddbfb540f08b49d3f5e85294337620a87988df57944c871fcfe17f2a3f484d2f911f8032e7eb59068183b1144be9
SSDEEP 24576:xVbqPb88hv/lV7gg3WaPRn8cjSunYN+xLYG:xVO88hXlVjFPGp01LY
TLSH
T1FB559E66F5748331D073C0BAC4D29A9AEE3234425B318ACB1246D76C2E77BD6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 889171e45693c4776a702e1a052f90dac37da0a77127e704432468ebb808329c
MD5 2f3f2ea6dc62aead4bf07010d5fca341
SHA1 1a8326c0a280621c424b84927b267f04a5cf301a
SHA512 a4434a7f4c480047907ffea3b8b8bc6e56e06bf227703a5ac4cf5e306fb13dd3032fa423a6b99b7879cba598d22d6d883745fa0287d0545b0403790119d246e9
SSDEEP 12288:VG5E2g35DbAaWQRigt8cjNihu73jfHh4sQNlE/JLEUPLY+FR:VGrg3WaPRn8cjSunYN+xLYG
TLSH
T1F3C4235D921D82C1FFE79E73049280B1F865DF74A8D06A67AB80F3C9407669EC4AE137
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 9dbf81ae0ae5dbe959cb7e5c8cd7f04fb6bb575e3c479ffe1201be8f8bed24dd
MD5 90b6c8a2851fcf659b4b6312ed68eba3
SHA1 5d377634ca61e0ccd221889dc857853a17279ddf
SHA512 d69890a2ae0db7b841afd7550b27bd3a488c31db819527b995a0506f813709b9b75dfdba6b440f24517316e038c857007b2937d2565c87f39d1424fc6af5c85b
SSDEEP 12288:jeBNUbTVO86UWE2g35DbAaWQRigt8cjNihu73jfHh4sQNlE/JLEUPLY+FRI:jJIUog3WaPRn8cjSunYN+xLYG
TLSH
T13805CF3BEE28ECD2C67A8DB95A918200E77278304F51A3CBD165C34ECE235E55D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d900ed1584119fb1e75337020e4ca39e83db5d5d95e4c508e35954a4401cad04
MD5 5ee5e65fc86f57be0a56c03aa06af9e6
SHA1 74581e87506e50ee7c1b66cdd361ea8cccf521eb
SHA512 9b4fef1b52d0653ab0717bf3b33d6912e363e75c7fba965e2a37b0ce1d2ebe0f1d8c835d92755d4b3b5d70ecc582fde63f86ae40bb9a9effa5baf7562dd472c0
SSDEEP 49152:zQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THM:zQvGAdlCEL8c/pRNw5Cy+iBY
TLSH
T13A267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 eaf8388b878848d4398e473b51cb7c84326c4007c12784da32224881be0732b6
MD5 d97c09c8109e20e60978f57062fff7e1
SHA1 57049bcc8330bdf418e6d60b31ea0272f927883b
SHA512 3432a65c81ad16a2b29260a8baffd7e13c2a38b48266a4dc462de112782aa4fc944fca6952fd34c88bf065c096c5680dfc91f68e47c5eb1c52f1b07f259f669f
SSDEEP 12288:WAwSfxL/2Dc3xDLLmt0LDQewsAjsE2g35DbAaWQRigt8cjNihu73jfHh4sQNlE/P:rwewsAjOg3WaPRn8cjSunYN+xLYG
TLSH
T1D715E031FA74D032D7BB0DB21B36C716547DBE204B911AC3E3E89A8D49702D26776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 281d173199ea15c76e40a399988c351693fb0951e00f3bf9aeebe13c4b69cf16
MD5 a2c4cdc5875b037a0f9127a2c709d83a
SHA1 134c0e7e0faf2dce92115567aed5f9ae4e9fed41
SHA512 2a4f9c71e00f4e30b230c7850e19e59b430f7c4725ad1167fb317f179e1f022da5b91f811f392c5a99d47870d999c9e770afeeb3d1272c6d4c25dbab345f73da
SSDEEP 196608:1UEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJH+l:1UEtQevvqc2W1cpV29I32+l
TLSH
T1DD474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 48de2d64d2f40dbd683fc1a7a014e4c2c03dd608ee5aad9529c435f59c23ec4e
MD5 1eeef6520a9c7c1034cb363e0e8fc93c
SHA1 1bad3af3a92178bea02aa9272ef7f3267deacb60
SHA512 4eed981b69b8cbe6d2a749edfd8a9027e88f49925444b69a466dd35d4d7d5d3237929aedeeb1d0f88fe13189881016eef3278c048039a6e220387ce396bbc905
SSDEEP 49152:qCbRquA/m2yL5zQfFiV+XenmE3/zJFPGp01LY:foqtVjnmu+iBY
TLSH
T129D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ab1eb66a28f030bed662e9d1dc4a79eae4b3ad403a013c5d4fb9f3cc3fc140b7
MD5 23f357386f74fb3e5d980ad7a25f23d4
SHA1 6b4e11f71ded783084ada87d611ebe222adfc6b5
SHA512 631b511aa1365570df05b47c6cebe0ec77705607a529eaac63cac5bd17744ac26e1d6c5adf5e52c43102dd4be97fe98bcd5d9f37437546b3fc3b8d9da77786be
SSDEEP 24576:PAhGLmIFoiwtA5l7S53Rg3WaPRn8cjSunYN+xLYG:PAM1Foiq5cFPGp01LY
TLSH
T1BA359D81E7F945D4F5B3AAB859B68171EA76BCA65E31D20F2250D21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 30c20564fdfa810d964fe96d668b9b33b1dbddde37a31cff55acaa3507d69982
MD5 d7b0bdd93cd9713d190d3c4e642b5464
SHA1 af84cf27f32085802be5267d379ef8ffa1a65127
SHA512 68bc62d53638c9f60af9d26818b243fb94588f817dcca5a604ee9af3bff93a07f6c9ca3bda4ac271c67c7e05872c6ab4e15fc2bd476ae16091666f5bfeed2552
SSDEEP 12288:lmw5HEjsChNOBFgl0WDm+C7E2g35DbAaWQRigt8cjNihu73jfHh4sQNlE/JLEUP0:AwuXOWqg3WaPRn8cjSunYN+xLYG
TLSH
T17D05F14A72A80CF9E9A796398593C032F7B2BC112A61D71F1760C65B5F37361AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 438455ae307856b815d4c4481b54c1067864b8ac655ffc8e14f250e7bd25793d
MD5 48082c6e955f5a479ed16192ca441cab
SHA1 22ebfa45f1abb8a15835e0eed7a79be80c18145e
SHA512 d2948fed1bfbf5ee03540d19cd3cc51582684087f2c3d6fb12be9bc83e3fa094ef7764926295341b5add70bf59457df7789669d2d63eb7f903a8ef1532f1ec1f
SSDEEP 12288:/bZ1IycE2g35DbAaWQRigt8cjNihu73jfHh4sQNlE/JLEUPLY+FRg:TZuvg3WaPRn8cjSunYN+xLYG
TLSH
T186E4129E33A851F1F6A3967988E14151E772BC6267B153CF1750A3990E33AC69C3E332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 adf542de2d1a1cfbecbf9dd76a62a1924e2b2fe4bf6dcbaeaeba4ef8d52ef5ef
MD5 04d3654d82ed2fce81e0bd484afc2fb8
SHA1 f56e50fbbdb952c58581c35d3299f5fdead814ef
SHA512 553d6c7003ed53e38122f3bd475e7a4f8662e9288c7bfc872848f317f8f551f875a570ae8300d4450a45a2913268e8ccbbb91bce8c1d9100e8032f5525ddfd5c
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23U4:FQRQyi36YOcPuLvw2gAf+PN35+iBY
TLSH
T1F2667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f43c2b8e47efba01b4d6ae79df931a2f3742cf45077fe50c903647d0c1460acd
MD5 ec01b222df937a19c5bdb4d577892c76
SHA1 bcd533f77284884f3de5a849235fedeff95f10c4
SHA512 d69f0c2f26978d6eaedec605fb6b77b3b58059053a95869292798ff21744d5942afd7b28505773264a37c64717767b29275a26536a46d67c459d65049b5de17a
SSDEEP 49152:Rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23U4:4QRQyi36YOcPuLvw2gAf+PN35+iBY
TLSH
T18C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 223f883eabc6ce34d8e67651ee3a6432e913d2887e38cd26c598b1de3829ecfc
MD5 8962dae3ecefc57cc5afb0888be00f9a
SHA1 f55bc13be04add9580792a7fdf5a36e2397f1fc6
SHA512 4a59bb406df95ca47597664f0b3141a579a899aac5e6f217ec084f331883b844f4ca280b54c7aa2bea99158f4a06fd322c4e857d3deb4d924d086ff611961126
SSDEEP 24576:OwvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0/g3WaPRn8cjSun3:468Qg55nhxeWu7PNU3/ZFPGp01LY
TLSH
T1A1B55933B2F600A9D44DE1769F46873196D27C758FE0E3DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7f9a6b717ff63ab12def44ad5ea0ea5f05d15f943b2031c7af06bcb42e32ba87
MD5 9aefd447a1a8377272cfd96a42effc03
SHA1 4d3280ee394ab1d5c0b6f1eff59e4a653ebde564
SHA512 1cd957cfdb85308a01676563a04eb00a0e2c64a8ce787081cac2b0200c25d90acb0482f46f53401cfc4beff905f95551812224828a9a573dbfa69054486d06ac
SSDEEP 49152:k3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99W:xy5112gYy5azzVvD69nLKnhZU+iBY
TLSH
T16D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7672f40d1786b4b0360131340b0137708c9aa0dff4a441609abc854e11215589
MD5 6d53bc7ad1f19be328f77b717278e8db
SHA1 7caae49629f5b402c9a80c531a992053094aa888
SHA512 cdd3c64617fd3c46c1b8ef2fbfe0aa3e06f22be52feb1eec9332ffbe4e34201518f35443fafdc23ff8f3449bc27ffeef31736007d91dfe35b87bd16cf0869ab8
SSDEEP 49152:gB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glLFPGp01LY:6u6JmQxd2dx+iBY
TLSH
T1A4D59D13F1DA01E8D06ED578974A9233F962BC490B34B6EF0A9073552A77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1d6bc55d4fa6fe4ba453d2053ce63296135f44ac2987c1661e830140af951aba
MD5 bde7ac672b544f228951affc33ddc880
SHA1 be51ecdb5979a486a2dfad9ee0b30e153b047a65
SHA512 b306e89e2733ebd89f194caac916969bbd9729716f163f0890c91f32f31caf1637671025ab6eed32e978813201d80b6de73af5b15c3ef40668f8127e78445fd9
SSDEEP 49152:Y1hpsNoJpF1A6yU44CwH7R4x/FPGp01LY:YmifPVRu+iBY
TLSH
T195B5BE13F29901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 91ebc7b9fcb2313ef7e451cfa7ee03b7436da7227fa7a90c6d16084c4679804d
MD5 860f02c3609ba16d8de93eacdee8c1ad
SHA1 14b5e220fd2771ad0c3d9e023d254b3444544a7d
SHA512 cf44f0bd441ae982dc7dcac0f5585d0b89abc1d9a87eb66918ae4ff971158caaeacfadc62cb780b51f176aac58844983e91e98074504b867b89b2db4b831835b
SSDEEP 49152:4SuZQIY0Be2KIRVtOnks6NMHqOFPGp01LY:i5dKOi61I+iBY
TLSH
T16FC5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 403e042425b21ffa53af2840cffb031cc73a41813f437d890902a8e64d41e3d7
MD5 bbbb98d07f53ebfc087cd439177ba6eb
SHA1 718972193c52f150fc4239d8f11ec4a12eedf3a2
SHA512 b8dc106b52120fe98a6769547f8c067edb41acbdfefa619958c654731bdebc0464b8d424c814ae7f1665fcd235e5c57e76439af6183f2cd465654f2cce693136
SSDEEP 49152:NhtSn8EApI0figGgiDn0AP5wbFPGp01LY:cX2i/ph6+iBY
TLSH
T11595BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 74ed9a16b1b7849b3df1d6f303e618a1f84081bdbc3a9d86f4fc2a168a6ddf34
MD5 c591b46b1932343cbdf87b3fb5c43eac
SHA1 2beaae95ce064ee5e3f228f29de40806d8a037ab
SHA512 ad53424d9b4ba976efdd90944538e8072b1b256e69fcfcc289ccfa07e450049f80adf1f21751d6427507d9c7b2fe39426a5f59f0187c5a9230957ad955f1a657
SSDEEP 12288:rxE2g35DbAaWQRigt8cjNihu73jfHh4sQNlE/JLEUPLY+FRW:rTg3WaPRn8cjSunYN+xLYG
TLSH
T16FC4235DA11E87C1FE939FB3049140B0F8659F76B8C127A7BB85F2844077A9ED4AE036
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 c0bd6cd30461b1b8ed78e36e31722c3f6d2c9f40b65c44729687ab29ea03fafe
MD5 014bdca38df05e751ff35b3896e80176
SHA1 f98770f623a4cd04ff070b1506405eca815bba7f
SHA512 b981ebffb098a8f28f9fb11901d60ff55fb5ea00722c58b484eb28eccf3b18ac460f5aa1be9b7c6dacde56384804d2615daea37a2260a4214b2c60f6d1564ff4
SSDEEP 12288:UYE2g35DbAaWQRigt8cjNihu73jfHh4sQNlE/JLEUPLY+FRx:Uig3WaPRn8cjSunYN+xLYG
TLSH
T1A9C4235D611E87C1FE839FB3049140B0F8659F76B8C127A7BB85F2848077A9ED4AE436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 a55969f0f852178462db85f4e3205b72ebbac4d1e54b26d5fcd8ee8c0a1cdaae
MD5 acad546c5afe671dd6fbb31a5a3b2e69
SHA1 bf15b20e4920c8f46b616faeb14573360d59e4e2
SHA512 e63931a67fffddf910ee30b88fd64eac9e2a1567cb490c2d57a88281fae33d7c720e1f27ff1a728b6cba86e837704ef0b8119aa50908def1caf21d23a20a0eb1
SSDEEP 12288:LuE2g35DbAaWQRigt8cjNihu73jfHh4sQNlE/JLEUPLY+FRx:Lwg3WaPRn8cjSunYN+xLYG
TLSH
T18EC4235DA11E87C1FE839FB3049140B0F8659F76B8C127A7BB85F2844077A9ED4AE436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 5514a378618138ce8a7d7ef9b5d55606b665e9c05881ecec424f42c3087b9544
MD5 de00ec44e40d8955bbfff2a10f38d33f
SHA1 603de9673b7ece009bc1c489cc74d0c2c3c6ab58
SHA512 6f330217d5934e7ccab85dcf99e0bbda6f5e6a9927c0343cf5177cc62ec2af81902f5e06e6cc5ee747fcb081a6dc6f5f7d843625cf2dd56dc4718a687b83f5a8
SSDEEP 12288:6VfE2g35DbAaWQRigt8cjNihu73jfHh4sQNlE/JLEUPLY+FRc:ig3WaPRn8cjSunYN+xLYG
TLSH
T10BD42359232D42C0FD93DBB644A28070F4B5BE75B6E167EFAB40728908727C9D87D632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 3a263d350881c461cf17d7c9a19d59a3f06244b2532f037db4ff75512f94b146
MD5 ed161bba8f35cc27ce12d622dd672154
SHA1 026b19a4eaf9df272aa1eae385ddd99d636d9ace
SHA512 19dd8157a08680985bebdf1b295f9813287fed395ce60da07565f21b6232541d62d0871546510eb3f49240d760dfd6692e174ce331d8fd72540d4f40eddfa03d
SSDEEP 12288:gHE2g35DbAaWQRigt8cjNihu73jfHh4sQNlE/JLEUPLY+FRv:gJg3WaPRn8cjSunYN+xLYG
TLSH
T13FC4235DA11E83C1FE839FB3049140B0F8659F76B8C127A7BB85F2844077A9ED4AE436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 1d332d8b054d60e491ca85ba108d9bd1afe973e9a15d68343588afe7a47fc182
MD5 8a29d8d36e6e4c3c6620dd25ab64bef2
SHA1 4e2aafadddc09fef86aeb74518f6666e2b0d313a
SHA512 25404ae5d8ee4be0916a6c9ce8d0194934e70cf4c9b58524ba20288e24ef5bd36c4fb61a5cff36e78677781294274dfaa1e879445da3367ff65642c09b5e4512
SSDEEP 12288:7EE2g35DbAaWQRigt8cjNihu73jfHh4sQNlE/JLEUPLY+FRv:72g3WaPRn8cjSunYN+xLYG
TLSH
T1CFC4235D611E87C1FE939FB3049140B0F8659F76B8C127A7BB85F2848077A9EC4AE436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 e78ba25c12e1b44933feeca19d9dc9ab70595675e0bb76a609a07a06b098429d
MD5 06547161a19b6ab7d4a9ccf1a1547936
SHA1 0b8a9c8c8334f03df801c111fedb0fee032a8052
SHA512 5c513bb9e5b1ae086e7875abbcc70dbe4cfa51ea01322b970ba116c10ad3c02eac9540ed1910aaa7d21f5e89ef39c18acfcb101ff5479605078dd84368eabab1
SSDEEP 12288:VAE2g35DbAaWQRigt8cjNihu73jfHh4sQNlE/JLEUPLY+FR3:V6g3WaPRn8cjSunYN+xLYG
TLSH
T16CC4235DA11E87C1FE939FB3049140B0E8659F76B8C067A7BB85F2C4807769ED4AE036
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 18e9056c922ebe87bf64d24787391becbf5ffb477318a5376e7eb4c651ee3c1c
MD5 025eb6c38ea204d1527f029894468e00
SHA1 fe6d87bdda86f6b48633a68e45538f311332cc1b
SHA512 dedff7dd010938e82c778665027e29b004e19c343d6c5ebb2585a1331471ea9ad1c483f3aed4f1254012aae59f1129d9cde0578f2fc157359bce15da7f075ad3
SSDEEP 12288:iiZwbNzzFEoS2cPvy4E2g35DbAaWQRigt8cjNihu73jfHh4sQNlE/JLEUPLY+FRM:FZMJzFVSOCg3WaPRn8cjSunYN+xLYG
TLSH
T19F050299B35408F4EDA3823E88518815D6B27C6A1BB0C75F17E4366B4F333A15C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 3bc3287bfa9e06af6393199a8ebf82184f63347956678a2232e953c61f2e3639
MD5 82094206810dd6fcfb4550a8eaee3dae
SHA1 bcbfbbcce8b1ed64980d608426a77235483a6ba5
SHA512 5472e11c048ca02479586a5a50fa8c9aacd1e12f4d6495f11ee2ef9b1dfe8ab366c7397909489cbbbf7f1afa74fc0578e0bdaee9b225a5fbb85baee89f4b2981
SSDEEP 12288:6FE2g35DbAaWQRigt8cjNihu73jfHh4sQNlE/JLEUPLY+FR4:6fg3WaPRn8cjSunYN+xLYG
TLSH
T116C4239D611E87C1FF939FB3049140B0E8659F76B4C167A7BB85F2884077A9EC4AE036
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 80858aaa444c0842d47eea7f7ffdbdbc83d835c493891f34b2f921eb2c673f93
MD5 33f9d60da7b51073e06d3173da17ab08
SHA1 91f3df8ee62cd8831fb808c2a21f98e67c9917c1
SHA512 f7233bda14874bb4dca2d9c36815081fa432363e930135d0301076108793c3a5870cc8f490bbf5a1a22e00fd5a61c6ac829df4dbe8335d516ba012f88364d15c
SSDEEP 12288:PpE2g35DbAaWQRigt8cjNihu73jfHh4sQNlE/JLEUPLY+FRk:Pbg3WaPRn8cjSunYN+xLYG
TLSH
T1CBC4235D611E87C1FE939FB3049140B0E8659F76B8C167A7BB85F2C84077A9EC4AE036
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 b5a69a2600c7e69262bd5854d92c923e42b5ed4b6b7a846c02237ce444253805
MD5 6957071f123119cb43939b956f8e5c2d
SHA1 b509d0e84ce7d4247679485a4f64f10fa9ab4de0
SHA512 a0760a3023431864695011f330340c91534a304377dd4d6ff560c273103f78ceb91bf21338d59e136520b01e713c7a8d9cde49251628ace31979e005b3c83a2f
SSDEEP 12288:GyPz5L8cE2g35DbAaWQRigt8cjNihu73jfHh4sQNlE/JLEUPLY+FR8:7zy+g3WaPRn8cjSunYN+xLYG
TLSH
T1CDF4120B736921F4E577923988A20511F772BC3257609BAF279063BA1E336D19D3EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 7eee638fe9f2b9fa75764c462d764ce2b8d42320e292850a3c90e76bb0e57e35
MD5 0563fa39546a7ea0a2935897af489265
SHA1 3532bffde8f493afbe4dab2d0ee44f20a15932d7
SHA512 cdd68f257680ed1f7bf3c4655c240ef9a1425cce65a93c943439ebad641e13598ccb340f02b0f72cb963363c236e8761cdf204f4269986df2ecea8482919ef5e
SSDEEP 12288:/FE2g35DbAaWQRigt8cjNihu73jfHh4sQNlE/JLEUPLY+FRa:/fg3WaPRn8cjSunYN+xLYG
TLSH
T150C4235DA11E87C1FF939FB3049140B0E8659F76B4C167A7BB85F2884077A9EC4AE036
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 7c3f64f760bc40a363287fe4b85f05f8d54cec792d09e794e5561a9b5388f68c
MD5 7c72e9bc5a42da1de13224cb751c9d40
SHA1 a6b2aee19a241a98e6771170b3475c6c06aa238e
SHA512 64e234664b70f02f39b28f578dfd610af5d5f7a3a1991fcc663ce8a984bca9e5a3562c2c745de80ec1e9a7ab21580d9eacd65529bee71abe6ed721cfee858d30
SSDEEP 12288:RFE2g35DbAaWQRigt8cjNihu73jfHh4sQNlE/JLEUPLY+FRa:Rfg3WaPRn8cjSunYN+xLYG
TLSH
T1A1C4235D612E87C1FE939FB3049140B0F8659F76B4C167A7BB85F2884077A9EC4AE036
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 1bfba34449bdb93d3afdd86794f26f8bbbb244075a3eeca2d74fdcf1bb703d30
MD5 bf33ba6445d10df9e6d5cec60a12234b
SHA1 114ac5e56a2e429b94c8ed511b13c5e158fd58f5
SHA512 d54d472a132925c75ff0e865d993b09b1ebd89e1778c7c3dd703df321cf57207549dabfaefe3a425787a2305bcc3d2658eb8df3002a3d93fef7e61a9f02b2561
SSDEEP 12288:zyPz5L8cE2g35DbAaWQRigt8cjNihu73jfHh4sQNlE/JLEUPLY+FR2:+zy+g3WaPRn8cjSunYN+xLYG
TLSH
T1D9F4120B736921F4E577923988A20511F772BC3257609BAF279063BA1E336D19D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 0eaab045a97c3d1dcb7bd9213f35300e09122b9c94cdec6adcf7dfadbb51fee4
MD5 8eade4520aa4ca045edf08663d6e955a
SHA1 7f06678960b21586ad5451f8217bc4c82eb51a42
SHA512 7b2b97dccab50e7e9a2efaba79f304e01ac471fccf5d9f849c722307f943c145b0d484fec91c3759a4946126058cfc1138c21d75e4c63d8519fd8fc286c72465
SSDEEP 24576:UTuaLl3z0zDAg3WaPRn8cjSunYN+xLYG:UTdLljIFPGp01LY
TLSH
T1170502A8B35408F4ED67863EC8518816D6B27C6A07B0C75F17E4366A4F333A15C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 0ee481cb33f26759f61a0c8a795f73f0f56c473cda65ed1b9aa776904d2118a7
MD5 4998c70c3b799e0fd7045db6af998766
SHA1 4142b68e52b67e368695802d62e572932e5b5e2a
SHA512 a836ee3e4c9a11525fafb967cc9b23494bf54807b094a4024ea57dd38ec83c14a3e2a1a793205cb4808c0af0aace27bd057d91c2e011166f783703cd4fe4f623
SSDEEP 24576:43xd9CHKy7GZ0g3WaPRn8cjSunYN+xLYG:Cxd9CHKyaRFPGp01LY
TLSH
T16C25CF90F3E810E4F0B79A3589724511DAB67C6A1B71DA8F03A4665A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 741f3cabc20ec64b9cd908d13f8d2bf8b390f132e7044b6013ed180bf85e04a7
MD5 2e78dc776be25063eca03bcce9191279
SHA1 f2f407fe109300da0d30657eae89b3d4e9cdead1
SHA512 2b44fbe8951cbfe52f3ece7280af25f5b05099cae449d0fd168d42ea22777f4293a6c30249798ff0aadd72b91966a40cf0a1a58521b6d6210a3737f65c266826
SSDEEP 12288:4OE2g35DbAaWQRigt8cjNihu73jfHh4sQNlE/JLEUPLY+FRJ:4Qg3WaPRn8cjSunYN+xLYG
TLSH
T1D5C4235DA11E87C1FE839FB3049140B0F8659F76B8C127A7BB85F2844077A9ED4AE436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 6d91e18fc8632de78f2ffd4fc634899f8c00b1fc2e2272666cdd03ef50d38532
MD5 6e973258297c9cef886a6a2ec331d114
SHA1 cefe36b0623546d6b5923e2ac043369a01e44112
SHA512 627b116aaaf03a112ab9af59d8a6aae608483397223627c712437018103d6770e7da265672d941406c47fed7ec72904fe77a0c76cf86ffc053af577606aa12f5
SSDEEP 12288:I8E2g35DbAaWQRigt8cjNihu73jfHh4sQNlE/JLEUPLY+FRR:Ieg3WaPRn8cjSunYN+xLYG
TLSH
T139C4239D612D83D1FE939FB3049240B0F8559F76B8D127A7BB85F2844077A9EC4AE036
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 3684a9c9353ee62a48800606ab92c9f0aa2cba31570034d6f59445e6e3983390
MD5 90eb546507e1a8428e599d173afeafc2
SHA1 1888ffa7d0964bab3f3e86dc8c4e053a4a987508
SHA512 0eabfbec74038a60f19b7fb2582551f73e793ed9143f30aef1787123a069f8a801004e4396edcffdcb3b5db01d2d30ce6335b9eda72f306a5810d28454270fa8
SSDEEP 12288:ajE2g35DbAaWQRigt8cjNihu73jfHh4sQNlE/JLEUPLY+FRl:aNg3WaPRn8cjSunYN+xLYG
TLSH
T1CCC4239D611E87C1FE939FB3049140B0F8659F76B4C167A7BB85F2884077A9EC4AE036
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 33eb2048c008d83d118d5687a6ce735bf2de849c45488e7cec8359229827b620
MD5 511f62d648cd1a3f98a6d98b7875fe96
SHA1 dbef3f6f364df5ca482ef8ca5fc4b0fe2ea84e94
SHA512 a772b41dc42be1575c3e518c778cb77b044a999664877fea6e636d711928c6eb4b99408a0464937ef993dcddfdd693020ef5bf964b64088e9c3fb34e32f9b84b
SSDEEP 12288:1FE2g35DbAaWQRigt8cjNihu73jfHh4sQNlE/JLEUPLY+FRX:1fg3WaPRn8cjSunYN+xLYG
TLSH
T1D0C4235D611E87C1FF939FB3049140B0E8659F76B8C167A7BB85F288407769EC4AE036
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 c20298eb0a409673a4809d43d7baee3d9c96dc33546b49f1c2f10de4f410d4ac
MD5 8311eb9b7cff341038028e18cbcade49
SHA1 934e52df4d99bb53d5fc89810fbb3dfe600b6f37
SHA512 1b4baaa1069044a2c469de2912567755fa8e4dabb32871568f9a766f5b1de7141805637a2ae64b3d0c60976c96a16ea353801cf200d37221ff5cad6de441f3dc
SSDEEP 12288:gOE2g35DbAaWQRigt8cjNihu73jfHh4sQNlE/JLEUPLY+FRL:gQg3WaPRn8cjSunYN+xLYG
TLSH
T15CC4235DA11E87C1FE839FB3049140B0F8659F76B8C167A7BB85F288407769EC4AE436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 d15a5a473c3f315a38d3ca8d73ab0dd11d3455dcac458ada0eca39de2a0d6ee6
MD5 302d7574e1e8db1d50efa26f651e9ba2
SHA1 e6a456c404f3bfab62c8e5e7a7874ec29c1bf6fe
SHA512 8188197092f72e8856a9115f3ee56de2a6b924826c76df10fb2027598d96e085a26fcf0b86742e9300776f96ae5be2cfa74018d1257f055655d519b641eb103d
SSDEEP 12288:GtE2g35DbAaWQRigt8cjNihu73jfHh4sQNlE/JLEUPLY+FRX:G3g3WaPRn8cjSunYN+xLYG
TLSH
T1FDC4235DA11E87C1FF839FB3049140B0E8699F76B4C167A7BB85F288407769EC4AE036
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 de4b73915965b9d1cb5c6b9ebbffaf8e356e273fd159e46edac7301b9b5fe363
MD5 8ff20d8cc103a0356b6042cc5ee4b505
SHA1 7031361f25dde54f06c57153e20fc32ea14fca7c
SHA512 b7a6c5138d28b77765cb8f1be41a781577fb5b3e94cc1f960376b1a730b75937fb843b43bfb7af730b0c687d1f4a0714a9d45e9168e027521678d78eff764a7a
SSDEEP 12288:KHE2g35DbAaWQRigt8cjNihu73jfHh4sQNlE/JLEUPLY+FRL:KJg3WaPRn8cjSunYN+xLYG
TLSH
T156C4235DA11E83C1FE939FB3049140B0F8659F76B8C127A7BB85F288407769ED4AE436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 519ca680178ee36bb31bec6a86543fe000ba9d7a1ac518704f5299caacd50f32
MD5 103c367b24e666ff157c77181577d467
SHA1 d2f3267b59d65780b08ad3feaab56ad448f91d95
SHA512 b039740d7d8d44b2aefb414a08923b2aed0983bc2a558c5b65bf74d3c34d14f62b851252c76b0d333474e3a86c63fe5b25e985abfe657f648f9291db65bc0990
SSDEEP 24576:BfwvOk9RX6wkyAILg3WaPRn8cjSunYN+xLYG:tMnYISFPGp01LY
TLSH
T1BF35D029EBDC44E1E1B7923C89B3460AF6B178691B71C6CF129A53AD0E33ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e7c4e6fe7f3340bfd68ce2a0bd2f9a70bd8c66601a9cb3d127692ea5279cdf8e
MD5 51111778407ec954029637e34a8542ee
SHA1 26d6733e6a17fb308568c7f5bc23b07563b0a964
SHA512 05292ca8bf725e04ed4c15514b22455ff23cecd8d4c1e9cbc31caf33bdaaa696377d15a2cbb552a6bcf692e64b846c0e4fde0f3ae10a696ac8fd5a5cd21ee379
SSDEEP 49152:IYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK07FPGp01LY:0ySzPZ+iBY
TLSH
T10B066C96A16841D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 88aa2d644d6f6f9e9623c9a189a59cb9d4b1011e1ddc903cf4d7f72b017b7271
MD5 abe7e0696d9654d5d44265daf2326081
SHA1 fda4dae5d8740e9b58eb64910931536a45f55767
SHA512 0472b9b03175ecb6f92080aa8e73f5e65d2c521a494add46cf167361b28b2006ca277e13e31c1846edcee97f29f3f751176faf1f0e3016c13584e0204ca8d11d
SSDEEP 24576:m47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYyg3WaPRn8cjSunYN+xLYG:m47JUQjairIhCnDHUPfF/LFPGp01LY
TLSH
T16765AE1DA3EC01D5E1BA927885154A5AEA71782D1F31CACF2270937D6F23ED48F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 6207340d3f14352a61394c815b972974e7d409abafb289451690ff6045b5c62b
MD5 7d032a0e02cb278be62235bf95500f48
SHA1 42f680825c3f2c15bd53235d01743519404a5a0f
SHA512 cb32b48ad15b14d34ee76815012f20744c2fd1ea95a5489d75f4ce9dc8216044e1fd3258f4cffd33a6c4b74aaf8d66279e33560b47d0d43cb7d32260042ce0b3
SSDEEP 12288:4ksfVE2g35DbAaWQRigt8cjNihu73jfHh4sQNlE/JLEUPLY+FRN:ivg3WaPRn8cjSunYN+xLYG
TLSH
T16BE4F01AD25802E4D0AEA276C7924650F3337D2597E1E3CB67C0F17E0F766949CEA623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 4f4b31cca20c2c321a716efcfea52b8f1d2a0c2eb77ce3e3da5ffd01efcd6a68
MD5 ae80a8cb22f49f8d42d33bc6aebeaa24
SHA1 ce59ba0177444d52b01bd635d5561473367fe7ac
SHA512 21074971365dfc0c21b018e06595fde98e0a39e6db4096e0125cf46d5ccf9cab1041dbfd1e1e637f24e16bd4222023d66eaa3358acd176cb38f3957c3e8d7c96
SSDEEP 6144:3IsBC2naRuTjkAjqzKJotMxA0gqA6d//ytCXrcL0eFyI1l+SvVnmorLXknGnKv4P:5ImO6d/MCXoLX5HrDe64Glc9Riv
TLSH
T1F03507017666CB8FC6A940321E32C1CCAB707D55EE05AF0773C98B3F9576659BAF2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 f53bdc960673c8d70158ccc1d77a93ac63ce1ae4a49604036024dadaada95c0b
MD5 1ea7bccb635a705a8ccd98fb23688e54
SHA1 e7eea3706fc4a64a9813c8b0afe7215402251382
SHA512 2f993a2b5635867920553bb58f82261e74c598607c89447547abcf4c0333cdfe32c024d524bcfc34fbad3c93acd77684268d0cae53237b027667ee2f740b5b96
SSDEEP 6144:qNA/4yb6uau0xVRxIWkJJsnmZ4tMxAwnwE4tMxAFlDAocqu:AOqYWkEm9P
TLSH
T10545D9816137D7CFC1BB5032072A5B8C7B64EC17B7496F26B389453AD82AB51A0F93D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 c208d94bce22c9ef8fc7cb3ca08055a0df1d7ca13ead89e4562d2b883a2c7caf
MD5 27eea254c01eb63cea3507390b84d4e6
SHA1 af4120f7de699f60ffb0d6d75a54f1743ebf421b
SHA512 0b5f92aca20aea7951638dd550032209c28586cdc70b60c23f2626e3df290da2b8747b54eed7be6e8663b690f0e821b351205b1f175af7e11f41982666e0ade3
SSDEEP 12288:uM79E2g35DbAaWQRigt8cjNihu73jfHh4sQNlE/JLEUPLY+FR:LHg3WaPRn8cjSunYN+xLYG
TLSH
T147D42369931D86C1F9B79AB104928070F41ABF756BC0A6D7BB44B3C94072AC9CCBE537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 85df587a46511755760463141f4dd71f913fca84b15c10da0203c370714503af
MD5 1303d32a6c31f6130fe173b0d1c983ca
SHA1 2a1b8e40aca5a235d30b907096173d9e8c6ab54a
SHA512 b32828ac0fdb301e158f86de6d64c37a734f69e4094eb51ee80ade4a14b7156ec0d663aeac2a28f08fb56a1a92e5c2eb31589cce002975cc4ae58ed12d291055
SSDEEP 24576:bgb6bmBIi49WNNFpg1rSvFv7bYVg3WaPRn8cjSunYN+xLYG:bgb4mBIBhGFFFPGp01LY
TLSH
T19E65AF1E22EC02F5E0F6E2B88DA64417D6B278161731D2DF1251427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 044c877b30175ff8c3a960e0712ede6853e71c95dae5e9be0fb370651033dd01
MD5 1d0cc514002060f5dbcfafaefe8b2e47
SHA1 ef8e5998c310153b4ae49b6380698ff5ff0a766a
SHA512 98b910f1a5ba1d7519858f3a842b324f669c58dc0f05bb8e9f6ef3b307b79d23dea13048ec38a8f602b2884b657368b78121c96ba24a3b457e0b4d4474ec39a0
SSDEEP 24576:CG88u8FpJqH1nzria7/mCg3WaPRn8cjSunYN+xLYG:Z7ZFPqV6a7/wFPGp01LY
TLSH
T1BF35F16573E502F0E477D13889824663F6B2B8251360EBDF07A89B550F33AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 34ba545971964a7ac1f8af46e683cf3b087e901a8faccd559f54bfb0fdeb8018
MD5 ba3bb4f61abcd0532d211d6d641e3e41
SHA1 6c5639801e398415d8d046becc5368261a207d38
SHA512 a9bd4b8db6cd66b294a84bbc0cafc11a87872bca100d62f46b035d1ab2b9c2fa4256a1636a45db51020a788f19f494fa882ca63db4ebb120499929f04f582f2f
SSDEEP 12288:EHvUrBFrEjwaQ0E2g35DbAaWQRigt8cjNihu73jfHh4sQNlE/JLEUPLY+FRp:EPUr+NQmg3WaPRn8cjSunYN+xLYG
TLSH
T15005E12F22AD18E5F677E17D85828219F771B862175192CF02D0917E4E73ED8AC3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 4d2327794b87971d3d9c65898be0bd3cc5b8ec74f01e883146010801160867a4
MD5 7fb9a9bfb4d62963827cbeeaa7350fc4
SHA1 cfc26cb75e87598af7b252b3144d7dd9e7e1a085
SHA512 c237eba7ae5920048dbf10f6a6470f38c49f5d2cc3d2b23c0848fe77d2122a14a574b784c5c28888d308f668c2140b28901f1b5ecef5bff83f06b6a9d427c026
SSDEEP 49152:iBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjBFPGp01LY:tG05lO43b8+iBY
TLSH
T1F4D5CF6E62EC11F5D1BBD17CC9C6460BEBB23825032556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6431df2bdd4c038cd38e7fce60d3d34a4e6f4e7d3784bacd7ce87e6369dc1348
MD5 9e804a545ba75ae023cade0233f9cb3f
SHA1 7dad1df7a04633618bc8db184a30d9eeb2f18654
SHA512 425f562b32a7afeec09d2070e86a5ffa4e294eddf26cb1d5a74d984928192d10647f59ac646e140887880fa8ac385fb7c949d89403eb4352e7634a0c7d0f3bf0
SSDEEP 24576:+fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnsg3WaPRn8cjSunYN+xLYG:ma5POZ3hJt2pasx2+mZFPGp01LY
TLSH
T17665AF5EA2FC01D5E5B9D17DC583861AF5B1342253319BCB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2f8aad0ad838655701d88ffa0e087d755763fa4add7275c033d138fdfa7c8045
MD5 b8b865713d03c319815ddcfaa829152a
SHA1 072b8a09dabc054aa776ce615272c2d24a175422
SHA512 d4fe48881ff41ad9b12284787c5933a96a12a2d929352ee2c5039604ecb31f1b875e0379bd4b8497d357bf89229f041ad1cab2a4f4d65a4ed442772d78823a40
SSDEEP 24576:UNcwHdjbyQ4nLC18lb/EOjowL7FkKg3WaPRn8cjSunYN+xLYG:UNc/zEOVHFQFPGp01LY
TLSH
T115857B2623E901E4F5BBE1BE89679546FA71786553308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3b590f2fca35ccd011913c405b09082742469fe66b1df8cf33a7e6c175e97eec
MD5 1dd6bff01946c13fdf26988c47bf8667
SHA1 46ec50deebdb5c88203a36bd780e44e0698a3004
SHA512 f475956137a065784a7e48256f3d1f2f7dc893f6d679d0838c7f3f5a71cad720489d0cd21150e8e5ad5ff5bd542841e74fecc48ee5c0c69e6a9b3547e3aaa9c2
SSDEEP 24576:43kNvNnaFeYhJNtmZBmYg3WaPRn8cjSunYN+xLYG:43MwBtOmvFPGp01LY
TLSH
T1AA55AF6EB6B846E4E1FEC6B58D238112F6727861173253CB5390C13E0E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 1b920c638c60340bc6c06bae8e6b6130f1c6a6cb7b9f2b5c3166d05bcb3170ac
MD5 5a462f2f3ae4bd57a800a5382b073d2c
SHA1 6aa285317aedfc73d04cbbc195a29039cccd4ced
SHA512 c2cc63624f5fd0f23130e63246880b3a129a5e7acb89e9f765d90455e9192bbe33ec0a7e924699dc0092593e3e29c7ab8ce3e6df5b06847bb2a03c4be68b8d3d
SSDEEP 24576:jD3FHshBIYQgAzg3WaPRn8cjSunYN+xLYG:jDVHeBIAAqFPGp01LY
TLSH
T10E25F17EE65C00E4E57BD2BC8A638506E67138A9032166CB12D4D1B91F7BEE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/264-293-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/264-72-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/264-64-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/264-66-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1244-106-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1244-100-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1244-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1244-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1244-312-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1244-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1424-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1424-93-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1424-327-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1424-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1424-87-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1424-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2516-49-0x00000000017A0000-0x0000000001800000-memory.dmp

Download

memory/2516-51-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2516-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2516-45-0x00000000017A0000-0x0000000001800000-memory.dmp

Download

memory/2516-39-0x00000000017A0000-0x0000000001800000-memory.dmp

Download

memory/2812-162-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2812-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2812-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2812-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3156-308-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3156-82-0x00000000007D0000-0x0000000000836000-memory.dmp

Download

memory/3156-77-0x00000000007D0000-0x0000000000836000-memory.dmp

Download

memory/3156-76-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4700-131-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4700-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4700-137-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4700-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4700-125-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/5076-7-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/5076-8-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/5076-98-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/5076-0-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/5076-1-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/5104-53-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5104-60-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5104-277-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5456-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5456-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5456-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5456-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5884-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5884-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5884-123-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5884-15-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5884-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5976-119-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5976-111-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5976-113-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5976-311-0x0000000140000000-0x000000014013E000-memory.dmp

Download