gh0strat | d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0

Analysis

max time kernel
150s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/04/2026, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
Size 10.3MB
Sample260418-enppcaaw4m
SHA256 d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0
MD5 ba1129638f42d801445d20c4ab2c9243
SHA1 1efd924397785bafc8021cdebdf759d95d500316
SHA512 8924080b4c76444079e2ef9ac0b3b7c666cdf3919ac355d447f29286aab41e4217eb03dd9dedea50f297c0ee7645892415bf83c3911a356d089a4d758b5fc67e
SSDEEP 196608:rKXbeO7xDSiprAHRmAyWIPbuGuibcrli8F:g7Y8rYIzrn
TLSH
T1C5B6AE02719440E9D2A68175CD568A6BDB75BD250BF142DF328C6EDA3F322D17E3B322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery gh0strat purplefox persistence ransomware rat rootkit spyware stealer trojan upx

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Family: PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Detect PurpleFox Rootkit 10 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/4308-18-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4308-15-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4308-14-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1656-24-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1656-25-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1656-33-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4716-36-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4716-51-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4716-48-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1656-23-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 11 IoCs

resource	yara_rule
behavioral2/files/0x001c00000002b491-5.dat	family_gh0strat
behavioral2/memory/4308-18-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4308-15-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4308-14-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1656-24-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1656-25-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1656-33-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4716-36-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4716-51-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4716-48-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1656-23-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Custom signature

UPX dump on OEP (original entry point) 12 IoCs

resource	yara_rule
behavioral2/memory/4308-12-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral2/memory/4308-18-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral2/memory/4308-15-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral2/memory/4308-14-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral2/memory/1656-24-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral2/memory/1656-25-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral2/memory/1656-33-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral2/memory/4716-36-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral2/memory/4716-51-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral2/memory/4716-48-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral2/memory/1656-23-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral2/memory/1656-21-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatfor.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatfor.exe

Executes dropped EXE 28 IoCs

pid	Process
4728	R.exe
4308	N.exe
1656	TXPlatfor.exe
4716	TXPlatfor.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
5556	geek64.exe
4396	alg.exe
3572	DiagnosticsHub.StandardCollector.Service.exe
3756	fxssvc.exe
5856	elevation_service.exe
2448	elevation_service.exe
3448	maintenanceservice.exe
1448	msdtc.exe
5208	OSE.EXE
5780	PerceptionSimulationService.exe
3740	perfhost.exe
4524	locator.exe
4336	SensorDataService.exe
2460	snmptrap.exe
3592	spectrum.exe
1120	ssh-agent.exe
4920	TieringEngineService.exe
244	AgentService.exe
3720	vds.exe
2004	vssvc.exe
5324	wbengine.exe
6140	WmiApSrv.exe
1016	SearchIndexer.exe

Loads dropped DLL 1 IoCs

pid	Process
4728	R.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\alg.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\vds.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File created	C:\Windows\SysWOW64\240662062.txt	R.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\709b594b8b62accd.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Windows\system32\wbengine.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Windows\system32\msiexec.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File opened for modification	C:\Windows\system32\dllhost.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Windows\system32\locator.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Windows\system32\spectrum.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Windows\system32\vssvc.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4308-12-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4308-18-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4308-15-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4308-14-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1656-24-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1656-25-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1656-33-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4716-36-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4716-51-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4716-48-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1656-23-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1656-21-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164515\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4464	4728	WerFault.exe	79
2436	4728	WerFault.exe	79

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	R.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TXPlatfor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
648	cmd.exe
5156	PING.EXE

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000136eaaa8e8cedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc8d4ca9e8cedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000749376aae8cedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000096826a9e8cedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5156	PING.EXE

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
1044	2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
1044	2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
3572	DiagnosticsHub.StandardCollector.Service.exe
3572	DiagnosticsHub.StandardCollector.Service.exe
3572	DiagnosticsHub.StandardCollector.Service.exe
3572	DiagnosticsHub.StandardCollector.Service.exe
3572	DiagnosticsHub.StandardCollector.Service.exe
3572	DiagnosticsHub.StandardCollector.Service.exe
3572	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
4716	TXPlatfor.exe
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4308	N.exe
Token: SeTakeOwnershipPrivilege	2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
Token: SeLoadDriverPrivilege	4716	TXPlatfor.exe
Token: SeAuditPrivilege	3756	fxssvc.exe
Token: SeRestorePrivilege	4920	TieringEngineService.exe
Token: SeManageVolumePrivilege	4920	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	244	AgentService.exe
Token: SeBackupPrivilege	2004	vssvc.exe
Token: SeRestorePrivilege	2004	vssvc.exe
Token: SeAuditPrivilege	2004	vssvc.exe
Token: SeBackupPrivilege	5324	wbengine.exe
Token: SeRestorePrivilege	5324	wbengine.exe
Token: SeSecurityPrivilege	5324	wbengine.exe
Token: 33	1016	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1016	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1016	SearchIndexer.exe
Token: SeDebugPrivilege	2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
Token: SeDebugPrivilege	2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
Token: SeDebugPrivilege	2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
Token: SeDebugPrivilege	2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
Token: SeDebugPrivilege	2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
Token: 33	4716	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	4716	TXPlatfor.exe
Token: SeDebugPrivilege	3572	DiagnosticsHub.StandardCollector.Service.exe
Token: 33	4716	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	4716	TXPlatfor.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1044	2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
1044	2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
5556	geek64.exe
5556	geek64.exe
5556	geek64.exe
5556	geek64.exe
5556	geek64.exe
5556	geek64.exe
5556	geek64.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 4728	1044	2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe	79
PID 1044 wrote to memory of 4308	1044	2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe	85
PID 4308 wrote to memory of 648	4308	N.exe	87
PID 1656 wrote to memory of 4716	1656	TXPlatfor.exe	88
PID 1044 wrote to memory of 2904	1044	2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe	89
PID 2904 wrote to memory of 5556	2904	HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe	90
PID 1016 wrote to memory of 5200	1016	SearchIndexer.exe	118
PID 648 wrote to memory of 5156	648	cmd.exe	119
PID 1016 wrote to memory of 1976	1016	SearchIndexer.exe	120
PID 1016 wrote to memory of 4516	1016	SearchIndexer.exe	121

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Users\Admin\AppData\Local\Temp\R.exe
  C:\Users\Admin\AppData\Local\Temp\\R.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:4728
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 232
    3⤵
    - Program crash
    PID:4464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 560
    3⤵
    - Program crash
    PID:2436
- C:\Users\Admin\AppData\Local\Temp\N.exe
  C:\Users\Admin\AppData\Local\Temp\\N.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:648
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5156
- C:\Users\Admin\AppData\Local\Temp\HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
  C:\Users\Admin\AppData\Local\Temp\HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Users\Admin\AppData\Local\Temp\geek64.exe
    C:\Users\Admin\AppData\Local\Temp\geek64.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4728 -ip 4728
1⤵
PID:1244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4728 -ip 4728
1⤵
PID:3276

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -auto
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\SysWOW64\TXPlatfor.exe
  C:\Windows\SysWOW64\TXPlatfor.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:4716

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4396

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3572

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2344

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3756

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5856

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2448

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3448

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1448

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5208

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5780

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3740

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4524

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4336

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2460

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3592

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5872

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4920

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:244

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3720

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2004

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5324

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:6140

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5200
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2704 2784 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1976
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2848 2820 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ff9b4941b5b7f841c308073895a031c3346e09a680c21f3af251ee00aae391d7
MD5 297c64e019fbd71875ac04f30f47882f
SHA1 8f9930cf32f41bf88bcf8f5eaa128fabd071bdbf
SHA512 d7287064ec744410831324b3d205704ea3b56e41065d6fd323645a594fdb34e1204f33a8189a5daecc8659db150ad376b3161ee18baedd7d49a94a1e96da0d81
SSDEEP 49152:Ib+632BuPkFKRrdE6ohmstBhuXjfS4LWxn2N/j2U4FH:i3q6HjBfj2jF
TLSH
T171D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 2873b1c50d848b5e9a184b6884b957ef6b0fe810539dfefea4bf6b198ceb5a66
MD5 4272807402e3af4de9de579edceca5de
SHA1 a30997ccad99847afc96f7d67a1ba1a78906c296
SHA512 072694176da7b181b0ae25648123625cabca6d10d5fb129d4c8056c2eda4b0696d897062f00e668c7322a7d2dcff635f159f47a1110f794e1f31c2980c253f12
SSDEEP 12288:L1XLsswWkxy2lRq2czA2JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:xXYfDtczA6dCN/j2GLl3iFSE33b9
TLSH
T1EA05F128B7E409F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 153b47a97179c0bd5a5b2ff99551ce95cf9250b385504734c6f6a599f0042af5
MD5 cd656ff201ec3bec840962f7c4c396aa
SHA1 9003acca818c15cdad7213c46a0f4d1612b7d989
SHA512 b3c828e2a1620379c9689e5e22c7b5fb2ef52152b79766883d2a9ed7043081d6d0423049bc4f2360d0f2da597e73493b4f4c9450010f9750e2c335723a47ce83
SSDEEP 24576:h0Le5ji0hmxirMpdCN/j2GLl3iFSE33b9:hPji0AcbN/j2U4FH
TLSH
T1FE35AE26F6748335D073C0B9C5D2A69AE97130855B308ACB4286D77C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 12804558e4a1259ceb703316755a4bc0e07c0fd901136f17d26e81e5dd89250f
MD5 08007809d53bf33ca603b483e1274e7d
SHA1 b0cd7aae8d139d27263d5b1584bc3a7c14bb0db5
SHA512 204b3f3780ab5da0a5ecab91b8c3569d4ec9b88cf59f887e99289189bd05c55a83fdd253b7b3b0e20dd44f9fbfd97daae7603e82ae0b41bdd3a2a3da211cb715
SSDEEP 24576:Sa7/ezSC6vUyD/aqgrvWE6q8wyuDdCN/j2GLl3iFSE33b9:1/ezSC6vUzPvxHjyXN/j2U4FH
TLSH
T15D755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 14472eeafc42468c32377c8fac0f7ab6b1942b1a274f2a56b0a3c1e192758516
MD5 a36a155979732505428bf4d75acd1b16
SHA1 1d576982364fcd9a568dd0adc99d9ad62cb0fcd6
SHA512 50f2fedbf93f5aa19fc0deee8c16b28eb8106f1c3d3ebef2acfb68253dd49687003f3c01a44a906ad15359ce6b1ce168a0706b610fb968fddf175b6ca6230cbf
SSDEEP 24576:OVbqPb88hv/l+6+dCN/j2GLl3iFSE33b9:OVO88hXl+KN/j2U4FH
TLSH
T11E559E65F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 b108a11242ffe44342790c69b0e29bb48e0bf3985a58fe39c467eb234c8a0c57
MD5 75587134eb2d42095e3a684bc14bcc56
SHA1 ca5b039631b3c871347450d656acdc8afca96bdf
SHA512 e14f8baa01f8005d8684bae18e2056be6dca8d66d8e4dabd0f041a2cdb9bb2581eada8efef451d9bbb1fe1984eeb42aec54306e044a703bf3bef7684abfe7f4e
SSDEEP 12288:YRJJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHV:YRNdCN/j2GLl3iFSE33b9
TLSH
T11AC42360DAA4B565F66F837903BD9E615200FEE8E525884786917BEF127CFE8D033063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 29bdf5d2aad73a2238c6a34aa502359e94ba1524b4fdd2382f2cbc99c6f95372
MD5 7a92b564349bc50f52d1c90f10a36eaf
SHA1 4102620490fe08b500754e972a87db95b90c28e4
SHA512 101e775bab80e5350112d576c792cf6b6569f40710589255d89b00c478ee3435212a45d109c477f839de2c529f1078cfb4d9c61bdc015d52bc9b83406947d2ea
SSDEEP 12288:neBNUbTVO86UaJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:nJIUmdCN/j2GLl3iFSE33b9
TLSH
T18F05CF3BEE28FCE2C27E8DB85791C600D76278708B6293CBD165834E9E235E45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 949f8aacb2465acdf433285c90cb19b1518c91b5dcd98cf3d2ad6e3c2349e512
MD5 97a553c3302cf6bd88dadefb0c86f1b3
SHA1 cad1d7102941f64cd7b8d1175a85288c17bac59d
SHA512 759e45b35867ff3a512db50952c744592a77e9206c3fef8758dfc1ffa66476bf2946b1e799767b5bc062616255b10672ac9484d81743c40567e950098d4afc04
SSDEEP 49152:0QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THY:0QvGAdlCEL8c/yRNw5CMj2jF
TLSH
T186267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 94fec493e8beb6ac31c000774f63da87dbd16706a3f53ad4cc53cee3690a09df
MD5 025707327b028960af7b00aa87a2867c
SHA1 9bc7f539b79d0b83c7919f49ed644bdd856eda0f
SHA512 0b46ec001a5862c5ef93fa4ab25bfe45a73a4d13462cbe7d0b32acfbc85e83a8f2022ab0a5bba8a53e00b7df5ee1eb6e319a02aa315fcea8d5e2e2ae78469942
SSDEEP 12288:cAwSfxL/2Dc34DLLmt0LDQewsAjQJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b95:BdewsAjgdCN/j2GLl3iFSE33b9
TLSH
T15E15E031FE74E036C2BF0DB61B35C716142CBA608B6119C3E3E85E9E59346D26376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 874a42aec0839e72f0936da67e8cacc7cbd90f8d608fb980c5975bc2e99d3cb0
MD5 6118a7f5b6a48fd9a33cc4c5327a3145
SHA1 6f185a26f9f0aadd2633eaa17abfd3679d77b2a6
SHA512 dbace4ee71d38090d3f35f49d28d304885fb97c985aac4bba88851b706f562e1d7933d7eb5a1ed767e7a74549a3a9f77771fa99846984aa7367cf10a3514aa4d
SSDEEP 196608:MUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHt8F:MUEtQevvqc2W1cpV2EI32t
TLSH
T143474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9ec7a3cb03489522264deb9734209afd09b452e08903070921bbdee48662fa2e
MD5 4e94388d3c0eeab406dc996f08ed9ddf
SHA1 1c128eca985c20367852c441f19f58e1584f03c3
SHA512 439b99cac603edea39f44cbec65a5ed03a8b1823de874b7d0afdd050bd9e7450329d4099b209e2ed59402f0656de728a83a4e60c693d0c9e4d5935aef0ddc62b
SSDEEP 49152:ZCbRquA/m2yL5zQfFiV+XenmE3/zLN/j2U4FH:2oqtVjnmwj2jF
TLSH
T1E7D58D1976B8C2E4D1F6C37886A2C647F37178158B3197EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 42a43e64bb85c9e712c4265748035f1f93070a72ab4a648341e852c0a4cae8c8
MD5 9edb7917e25add409db5bc2e33722eb3
SHA1 375a258ed8f3fcfd8a828bd654a5ba2e497e5183
SHA512 8585ac8e3fbb048b4efffb0f0e59c72f895f13b36f41ff3aba5d86b0e19dca43d5b1d2d7888583136596dd4a48ef7d8c321fb61914504fe36ab2b1ef147b3a76
SSDEEP 24576:fAhGLJIFoiwtA5l7S53PdCN/j2GLl3iFSE33b9:fAMyFoiq5MN/j2U4FH
TLSH
T17335AD80E7F955D4F5B3AAB899B68571EA72BCA95E31C20F1150D21F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 a5b9a2c9db13234fa54eb563283a108436e62d86dac53e88e274f22f086d8df7
MD5 06255338e6951df1b6ab184618d3b230
SHA1 6269b75ea71c9af3764a0e8bd7a2fee993473438
SHA512 841bba083eb54ded258a0c0960df6455ccf31101b4e4534d2529709b75c968971fb67140482abf1b0cef43b1d52ee8496a2c4b4601a70fb9b74f641b0ec16b76
SSDEEP 12288:Rmw5HEjsChNVBFgl0WDm+C7JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:MwuoOWMdCN/j2GLl3iFSE33b9
TLSH
T1FC05F14577E41CF9E96782398697C536F7B2BC512A21CB0F0360C69B6F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 01d697559fe70605ba9370d4ca1959328909111086a629449112be12cbcabf14
MD5 04b8a14aae30511da10808295eb27473
SHA1 393f3e8ffc70591f1b3024ce5f46b284a15c2416
SHA512 96c25f2645766f942241a96e2b78cdfb045cf0ae705a97a9e3b5b923130801fc98f603afb43591b236e623631f74c0de0147089321e7ece67ca0d0dcb58ce894
SSDEEP 12288:eBZ1IyAJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:YZuxdCN/j2GLl3iFSE33b9
TLSH
T11BE4125933E471F9E1A7823C8AF59A05D321B8A5A73243CF026146EA1F36FD59D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f3c59137df730f2d8dab7e34dcd303b5aa5076e4cda6b2c055c7d2c9ece30a06
MD5 65fd506f4c401412afdd69586158bd73
SHA1 fd05a0e7fb60c5c2d08cc9da32340a90eb192009
SHA512 28c35a2b5e08a8993839c3b0920389199501cb2d1f06222423a77cea5865cfde99448cb8e11bb8932a238a3e2f5e02969cce994ea58de1aea818865e88f4c219
SSDEEP 49152:Mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U0:DQRQyi36YOcPQLvw2gAf+PN3Lj2jF
TLSH
T1C4667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 166870e89a68991f13e2eec2b6967a483cfb8cea5f46aa29c36ae0a074394637
MD5 fe7a23719e67322aa3ab082711966826
SHA1 f0145d7028621ac3771b6578528b6989ced5a214
SHA512 b1038d31c662249f714479b359ca9b33b82685d7264753c70c33201a56286d38c8dbefac3f42998943bca6fc3d79314c42f3cad3c5c22d32b71bd5d3911e71ee
SSDEEP 49152:Lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U0:aQRQyi36YOcPQLvw2gAf+PN3Lj2jF
TLSH
T19E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0f50a5e6822ac849948157948782b37f45a7b7b400e15400642dce3c074bbb4a
MD5 ed22d0b28a6d3bbe7fcca810983eb8bf
SHA1 acdd318f356897ffc19805b2d9e44fb7e73da153
SHA512 52e2ade8d3cc9125a31869d7d8cf0736bdcd5f0c31dc55a5844b5154c28f3b743c93657712200d987e995741d1fdbb45f9a1b2b6037281941fea0666d558c894
SSDEEP 24576:nwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0hdCN/j2GLl3iFS+:P68Qg55nhheWu7PNU3/bN/j2U4FH
TLSH
T192B54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8511725A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0568c39a0de47f30aed0191f1feed82c1052520abbf92c552bc635e9e8afb97c
MD5 5b6719b0cd168db4798732c5927dc3c6
SHA1 2018b2074d46a16c58edabb2f6d7b97f0975d09c
SHA512 666acfeb178cd1efc6c10bc64a2c2005e19e6246da9b637d0234802c34c913ed2a7434dc2943e262ef867ada4f394d33ba5d24c66a9159bb65208de40e5b8ad2
SSDEEP 49152:I3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99S:ly5112gYy5azzVvL69nLKnhZyj2jF
TLSH
T106168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 04fefb6235d69dc040e6280008e8b7a027bbc2bd2dbcd68597123e5ead090900
MD5 f5b8e531e68c4eb01d3e2a4b26086868
SHA1 a4484e30118485466e0f1af7a9c01b946c153aa6
SHA512 33c0bc00163e03e13f4080c97f116a74edbd13df2cf1a1c4337b7b2fb80b33ec6e6a684dbab49928cff2e4bea231bd9e642be5bcc7e1c1da925ba32ac6c6f124
SSDEEP 49152:MB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glNN/j2U4FH:Gu6JmVxd2djj2jF
TLSH
T17CD59D13F1DA01E8D06ED178974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 95da4fdefac5a2aa58a9122da85b6e83c305d05d4954c983781ecb0371fc46a1
MD5 c56a4d68d21face4797778541417f71a
SHA1 7a839af2336072401f19564f34b96cc5f2b43c9b
SHA512 2f85155d514bd0a73fb8f41de13daaa39acf961813ecf18becba42af7c85ee9a7a1287aebda858d05e09ffc62b654be0c5062fa1918ba97fd1bcd9a9a431095b
SSDEEP 49152:o1hpsNoJpF1A6UU44CwH7R4xJN/j2U4FH:omifPbRwj2jF
TLSH
T13DB5BE13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 cbb627fd2e5aeee1bb0469dddd4a05f7a23d788b3261db024799b61c1924b25f
MD5 8cbb468b7a58d64197b80dee96551c78
SHA1 a9e8f34fc8608d214c3f41dd576c623789c203e4
SHA512 c516f798716f3ee2fe2430d4321605bb2f8d906219316602d28ae6bf30f304e7de92406110fe166faecad4e706dcd701e6bd72a4bac9171dec6dbc5b34c24ee5
SSDEEP 49152:+SuZQIY0Be2KRRVtOnks6NMHqGN/j2U4FH:Q5dKTi61+j2jF
TLSH
T138C5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5734665562fa9733ab74ecd84a048dd1d66305be17cd6c5f4f85df9426c8cd27
MD5 054ffddd152e1ae5fdc63fd46fce1d55
SHA1 53295268e536df734e9620d1bcfde45d2035bfc9
SHA512 21d227e902e1ab2ba452231560f14880424318f12e4948e97884491bc77b0f16bd57b9c73dd11f495d486c49a3efa379c85beb89762a499992b777eab5d05d5d
SSDEEP 49152:HhtSn8EApI0figngiDn0AP5wdN/j2U4FH:WX2iyph0j2jF
TLSH
T1E795BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 93007cb01d16a7ad8e7bf7ce7e94d9dc374875a19d542d4384b05de73721ed2f
MD5 83aa6a3043fcd4b370e2536595dd164c
SHA1 198bfdbef9fbc5f7caca1b484f5a237e824c3ec3
SHA512 340f26c908bc2a2ab72013058d884155b146d5307bf35e5728e94b7d1e4589cdd1468a4020f065efb73e4270571269cf1f0c9c3b33d30af49bc7523f260344bb
SSDEEP 12288:NhJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:NVdCN/j2GLl3iFSE33b9
TLSH
T114C42364E9F5B669F15BC37943A8DF519200FEE8F6264487868556EB237CFE88033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 2f2c7285e8d9ab69185a0237644ab6bf871d0821b62f4c1cc0d0d7b58a895d8d
MD5 11f6af91939dc129f4a509927acbb470
SHA1 1cfcabd636e7e16173024dbbd355daee88eb47cd
SHA512 e870c75d778c75a79338dc41efd54080be605f5b8c93459fcfc123836e774b8a65eb03d44fc7cd79530f4960c82a28ebf5a4de5987a18b0b316b518f6952b1c5
SSDEEP 12288:OMJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:OkdCN/j2GLl3iFSE33b9
TLSH
T100C42364E9F5B669F15BC37943A8DF519200FEE8F6264487868556EB237CFE88033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 5d37cc6b70b74c4574fde630b07f6aa3b13d71f58feb6b12f86144d63c5e5736
MD5 b27e1f97f5f54ce33251a6b2a4d9ca78
SHA1 15dc0663274ffb048ba4e2eeb82c008a471e6a85
SHA512 5926b6ea4146f4ec53f1741610c1cfce062f59778b3942588de459ad1e370870837eaeca1a1b6dd0afbe9190664b9610f0703fa662c241652ad7a8ac3a6ffe67
SSDEEP 24576:BCUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvASdCN/j2GLl3iFSE33b9:BCUxPTY+8Wg2lIL8lrIUJLWwUN/j2U4d
TLSH
T19165AE1DA3EC0896D0BB81358A518A16EB32782E1B32C6CF1160C37D6F67ED95E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 42043e1bc71eae1df6cc8719ab15cabaf5916daf9776f187d232300cb94ac9a3
MD5 2d7e99450743be17f03970b8768dc2bb
SHA1 6405091bc331ec9892c51bd164922b0f290716ca
SHA512 152b6ed16b467af2d4143404f424b2b6d5ef24a2d64bdc258e2c7778d57d4ccc22b3fed2f5bf4d492369f4eb85025abe0eae2b87efc2cf9969a41f991ab68f06
SSDEEP 12288:4NsfVJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ZxdCN/j2GLl3iFSE33b9
TLSH
T182E40119D2A412E8D06E9279C7558A41B3237CA493E1C3CB43C0F5BE1F7AAD49DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe

Path C:\Users\Admin\AppData\Local\Temp\HD_2026-04-18_ba1129638f42d801445d20c4ab2c9243_akira_amadey_elex_emotet_icedid_luca-stealer_njrat_remco.exe
Size 7.7MB
SHA256 204685e16518ed94499cb86c36a6f56086dbf140da0b93e169a4de5f8bc6064a
MD5 f968ef5dc7befc57acbf4951e8574f07
SHA1 ac76d093a60bc4cd612db776d2fc8ac4528a5c3b
SHA512 05357bce26dc29925194595d3d9a1f9afd0b1b370997aa4d38dcc15ac7a13e37236660a3c2a695288bb252063f910099f38185f2c993ba59373840ace1ac5db9
SSDEEP 98304:TCbAI4Z1aQ9munyWIPoIQd84vGyBl1IlbcrTLNij2jF:kAHRmAyWIPbuGuibcrli8F
TLSH
T185869D1272E840E8E1778179895A8A5FDEB5BC121B3152CF329C5B1E1F376D25E3B322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD_X.dat

Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Size 2.6MB
SHA256 c99202c85a90c48be2ae5f36c2018a292e6b3782f0f58a308c6023e4924dced3
MD5 a760f4dfd08373e93dec546d5f9f0df8
SHA1 4968dd95af3b90cf3270349150a6a4229564db14
SHA512 65817ff112881e562a9ceb06a4dfc06391bf0a2da75d73bb0314ee8626ed14093aa486762c3416633c1c73357ff2ec11de1cffbce3d63f997ed3a3b5edde7485
SSDEEP 49152:eCwsbCANnKXferL7Vwe/Gg0P+Wh3Dhs9R3ipD:Zws2ANnKXOaeOgmh3Dhs9R3ipD
TLSH
T1A9C57D43B5954972C7C84971DE67DAB39F207EBE57F306367A48FEC83A352047A22224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

N.exe

Path C:\Users\Admin\AppData\Local\Temp\N.exe
Size 377KB
SHA256 3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
MD5 4a36a48e58829c22381572b2040b6fe0
SHA1 f09d30e44ff7e3f20a5de307720f3ad148c6143b
SHA512 5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0
SSDEEP 6144:5UGp2l6zRmeVLNHfkQ2TAygOcqAJwQZgb4YtjH6/MuQafORzEOmFfMzi71o+YHL7:HclcceBKlKwAg0Mja/UafOVwbha
TLSH
T152841241FF520127C74AB0B5C9984E7F8E7A03888E650C3A7F795E4E1B603EE6923D59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

N.exe

Path C:\Users\Admin\AppData\Local\Temp\N.exe
Size 944KB
SHA256 4de315dfcf0347666407bbbf33165a1ff4469a8e4e1824576e95a14b3b32c387
MD5 9835651e93d7538aa1d26fbaa66ec915
SHA1 a411adc9968409b634eebf137ed3b1ab91d77a24
SHA512 be4788af6e10246e2f7bf4b2763e124e03ab9ff9415de378154c888aacce677b29b09658fce58f2dccd4e70708e60ff23c1a14f724bfd0054668419095c831d6
SSDEEP 24576:pcl1erdg0MCiVWhD6kJ262auCuB9flhrdGLvWwPIY:u/Gg0P+WhWBL/hbwPB
TLSH
T125252342BF02421AE7876275D994147A4DAD0FCC9D981C63BF726E0E5FB57EFAA02C04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

R.exe

Path C:\Users\Admin\AppData\Local\Temp\R.exe
Size 941KB
SHA256 bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
MD5 8dc3adf1c490211971c1e2325f1424d2
SHA1 4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
SHA512 ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d
SSDEEP 24576:N+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nH1PXw:cerL7Vw
TLSH
T105257D43E6765C93C3CC4836CC7AD27273217A5CB3F79636B180AAD7B6B52603D2065A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geek64.exe

Path C:\Users\Admin\AppData\Local\Temp\geek64.exe
Size 3.9MB
SHA256 015112af2494029eb1147a06874cec0849dca39da579793c5c09b000bd01cd08
MD5 950d3aef9da61bbe942ae38a0c8f558f
SHA1 45afc1822d48f973bfd9625a19d8b715e2b86b69
SHA512 0d3044e0d458a7f7cedd993bba30b3e15471dae12d4e3eff1d3d6665bdb80d917994df388268579af10996fb2ba868a3a401718d019a7fdc3c4199ee68e32743
SSDEEP 49152:JI+KyzNG+YyXYAj1K2ybW5KpP2u6+20orTNElYMuDfmyZjDpukVzCtB:yyBl1IlbcrTLNC
TLSH
T177167C4A72F801E8D1B7C17D89468A0BEAB2B806576097CF355C4B5A5F376E14E3F322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

240662062.txt

Path C:\Windows\SysWOW64\240662062.txt
Size 899KB
SHA256 97f69709e6ce4f8d24a4ae84e25827d64f1932dc1f41116d32e757d5975aef04
MD5 29239c4c97b49ed28c6fd34fcd2f885a
SHA1 4df943a32a6d0f01305e793fda17310518890062
SHA512 e5f770fc24fa74b674795a488f10e37fbd76da92e8a839896aa5a38bedd9479acf078b0c9f51bec66c6862ed5b43ba665b2ec12b199ccee3ec9f19772b009a36
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXb:7wqd87Vb
TLSH
T1CF152983F6B68CA3C7C90435DC7AD2B67B24761CE3F786327280E9D7B5B6251781421A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 e5353feee91aac33223aaf8c2ec114141901709de47b5d0b5b931870804b611b
MD5 aac34364008bd00ac344254c223213f7
SHA1 ce1281dfe7f805b42f37f648340dd2fd01a6ae6c
SHA512 a20ae07a63cdf6b0b6202dbf512249a36a0885d54ed561ff261f6caf84e5f4038e2ec3d03dff519bce899d6be6dac5f7d9e13d9f2ff70a02c072f89485e970da
SSDEEP 12288:tSJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHD:tOdCN/j2GLl3iFSE33b9
TLSH
T1BDD42360D6A9B655F07F837802ADDA316204FEF8EB2584C7C54117EB6238FE8D832563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 02d4cb2ba26e508bba9915a79489593ae1e82a82e4c6b38b7074dc20a7ad8968
MD5 0b46ef30b371e931950b2e537d0e4f11
SHA1 50a9a1d5cb17d5482beb19c0d20645d2dedc6912
SHA512 7fa289bc6d0b78a3b631700faa841e20ddf1565d9bb0f06923a1c14a7135b8fd46bc227f8ecf9e0c74212c687ecd71c4456ae16ebba663fea5daa9b435f59401
SSDEEP 24576:08RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCAdCN/j2GLl3iFSE33b9:9RZwQCyiHiQEaaPnMeN/j2U4FH
TLSH
T18685B01E62DC46A5E0BAD278CDA74407E6B27816573197CF0290C27D1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 676KB
SHA256 a70a1a016b8911501945bc3cc988a75c3035aed7f2c3f2fc32d534ff83488d6b
MD5 21054f87debf26e52fdf1f3e19417674
SHA1 07ab415283be2d273ec15b61630844ffd69207bf
SHA512 1b09be538d6da25ea94d4223c601800ca0ec03b68902b9fc0a548401f93b32434e1969e7df58f292adb39e9a607220c92f5832e4caffff0472e4dc642db67c44
SSDEEP 12288:+bxA1U7KCJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:+bxA1UGedCN/j2GLl3iFSE33b9
TLSH
T1BBE4022D66EC24E5F176D23D86D58605D331BC69A72187CF41C182BE0F3AFE89C36A52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 a0dff9dd4c98721c18940f6d9ecc9df594257444d12d525533eeb07c2f9544c4
MD5 63fd212f161bfc1c5c8e74282a2e009d
SHA1 73f42ed6ac23166d542b4fc48556bd580990bfec
SHA512 5e3ee123004a61a01fa098c93bb3730c2994df39f3ac80e61be9d628a693dc7f2cbfd085666aa8d5820dc765ea046d15097a0b33804e63887a6aa2eb043e5e7a
SSDEEP 24576:7jsmP0yHaqrVqHra44KDzMsrn/dCN/j2GLl3iFSE33b9:7jRP0yHfVqzlAsrnMN/j2U4FH
TLSH
T1D745AF2EF2B910F9D4AAC136454507B5FB71B82D1F209AC70170C635AF0AEE89E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 596KB
SHA256 efeacc9e4f696c77816105db3fbee151407cdb3b988906aa5da7039c12fea82f
MD5 9266f9d7e2da1f41e26bf4f1107a90e4
SHA1 c361dbd345de4c4a8650108aa4e5198289383963
SHA512 770515077abf5d1674491d8a8a02b38f24c02c4bd2c089fa51b140e7add194639ca7cc5c9379076c8e235eb222bf9242c2dc416020e2d4bcde15d9ea52b52377
SSDEEP 12288:PIJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:PodCN/j2GLl3iFSE33b9
TLSH
T170D42364E6E5B659F16BC37D03A8DA216200FEE8E73645C7858166EB137CFED8433062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 574ba74fa6a1842c9ace2c32a21f2bbd45654a03a85debd2a5600d31e230e2ac
MD5 ed904e4189ea0cb24165f04dbdbbaf67
SHA1 7e0fc109dfcfb45c10c73dbdcd59ee5de49fa4b3
SHA512 a14ab5fdcad6db51c818524286a12667f99ac38e05d967b9532b9216089288b2bca72162732759f7340e9125cf471ee92b4bd061bd8f5b696bb3210af35768e3
SSDEEP 12288:COb9A4LWO+vAYFT2JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:zpLBUT6dCN/j2GLl3iFSE33b9
TLSH
T18F25F154F7A410F9E96BC23CC5A68A16E271B89C0724D7DF03A84BA61F237E54E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 800KB
SHA256 52cc96db761090cbdd54750974f2b40e451565eaf71f9b054eabc8e6886f73be
MD5 a39e33f34ed99e6049a721aa8379cb05
SHA1 6a4a6eb19da95c5f8c3fd24e63a10a130755ee42
SHA512 305319e9dd91d038b806fb762c0fde61d0096691be82a769d47077f9708e3789903ec864d7a40e7b6efeb42c91a310ce3c0bc3e1389a55f507753cecfb05ef22
SSDEEP 12288:570VmvIYNvUyBpxJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:2rYNH7dCN/j2GLl3iFSE33b9
TLSH
T12105F22E92AD1DE4E57B917D86C28605F232B8A5571192CF01F083BE1F17EE8BC3A751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6cc0e1829f6c799291e63217032b12604473b11cbd4b90dda598f5250d42a0b4
MD5 855c20d34fd3493e737e07ce57e58879
SHA1 9d4831545b609f44a0d1f490345da3a1d5546462
SHA512 2621b638599b6729c3e1ee2430d0924ed3a7bfd17f5b89b0f0ff4ab021f936ded581e629a37de6bccfba421d125c71fbd1cae4e1c58a33deea84ddb607c19fc7
SSDEEP 24576:YnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uK2:YnXoJJYH84VVS6AmEcJas+cHBjSSKHPm
TLSH
T19D65BFADA2BC04E8D5BBC17DC5C28506F5B178615331CACF026182BA7F27AF59E35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9944d16fc0f92b30bb3a1d7842c3bd7a4ab97a90bad866fb114abe7afac60e21
MD5 dd7499b8d84c198efa9311cb1e77609c
SHA1 44e6bf228b8a2ec367d4bce2609b679933bb431a
SHA512 78ed7fd9cdc69e64ca0d1a40344dcdb01746b2567af6f66cf0b0875c39eae04150dd4eba4dbc318e3fcf0b749378d17f07a4defb1c6e1f29b27bdb3d9f1ed3d0
SSDEEP 24576:Gv7Xbxd9Tuycf8M/TYlSuxwr2PCtdCN/j2GLl3iFSE33b9:GDLL9TuJ0M/TYW2PzN/j2U4FH
TLSH
T149858D5EA3EC42D8E07BD6BD85B79146FAB2B855173081CF0291856E1F23BF0593DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 990b7752adc45a8ea98cd2da4c1c383d6692cd0aa7c5ce178becfd556590d64f
MD5 c801e9a5a7bc5d626553f219f3f031b4
SHA1 40548a0ae4d12643ba303794d4b7aaf537e5351b
SHA512 c9b4a923af685546b5945dd023ce2360a4351cdc667abd66b22880451f7cae430517c4d52bc3b16709db0d6e4f5d1417431081489e6a0222d85b966b9f2531fe
SSDEEP 24576:VegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10w6dCN/j2GLl3iFSE33b9:VngOJOmPOHhdN/j2U4FH
TLSH
T14855CF3FA7BC15D5E03EC17D8A968916F670782603355ACF016082BE5F1BEE46E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 904KB
SHA256 9f34b4901bc0b4ae39961de3db064d479cc918157c466f457cd9a445e230aeaa
MD5 16108a7a5d1145238241351bd1cb8c59
SHA1 4c35b2adfadfb4412cb3b3ae53b256723878b46e
SHA512 ce30a32fd3f5ea4bce8bb80c2231eb304e9e2993596b87e1051b83c03651276512b7be1777de9d87bdd5f5d9e5cefb69bc4acb81ebcf51bfaa16bd357bb72f71
SSDEEP 24576:1LJnJiTk3R3waE4JrOIdCN/j2GLl3iFSE33b9:1LJnJK8R304l8N/j2U4FH
TLSH
T1C515D03CD2A810E8E4B7C2B4825A5B56FF31347C2B2169CB59B4D5353B12FE0AA39F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 f2ab3518624a47ac325f20492556ea4966da27a883d6aaffae8ddc42cf9e310a
MD5 2bf15e46af6c0acc8d6f774f2c9a74b5
SHA1 69834588795c0d862671273782698fde068ccade
SHA512 44d173509bfdb49a4e7bfbf02774efbb016c044e4992a6984d3525e443bd3856f3344d245517a9742038513737b74a63a7026c35de8c9703c26028993e16e697
SSDEEP 24576:cA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6pidCN/j2GLl3iFSE33b9:b9GqCzDScAZmlvTcFg8Ph6nN/j2U4FH
TLSH
T1BC955C05F7EB5298E8B3CAF1C96694169B327C409B34F7DF0A80CA6A1E32BD1D535B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 676KB
SHA256 381020e0fbbcb359000fcdcee4023509346e5d8079fc7d52f06deebcc1e5b0d4
MD5 668f1fb31dbf75f2ca4735a8ad921322
SHA1 c98f25782ac01f567236cdb5ed70ea0190fd36c3
SHA512 fc5bf90e49a5c699da633723f64a2d388410a16de94807835da7fbc0943106ea997670798efbb10c35ad6ac67bfb2ac48dc706420d0d676bd2a579b3e2628cb3
SSDEEP 12288:glYJeXm5nkEUuEmJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:glYJeXm5jUuEKdCN/j2GLl3iFSE33b9
TLSH
T188E4126C76AC70E5E12FC27D86A58A10E330F4B4A31247DF41E0C2BE4F6AEE95D35A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 732KB
SHA256 4a43ccd226114249c4f16efb166adac07422e62ad21e61bdfc55da547a758631
MD5 3243f0a4f903249f28b5f351c1dadad6
SHA1 d760cf9ab6972f5e6bf23b7e18e6c417b57c2674
SHA512 6b288ea2bf2dc2639776cee916e721cba54bc7ba5acc59e708f91a477cb2726cca0046a1252356ebdce540853fa7ac2ddfd257731e0bba816ad3274be74e1d26
SSDEEP 12288:kwu6kyPJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:kVtyfdCN/j2GLl3iFSE33b9
TLSH
T1E6F41214A3E475A8E5BA437887B686609B30FCB4DB2146CF41D0E77F2B75BD49831B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 604KB
SHA256 c272b4f507dc5d91dcf6f04e2b9be5f3dfb219107b937b469bf72994f2d2b7bb
MD5 fd000dfc9210319942d4c43a9d8d2257
SHA1 a8579d94214a959ac477ad6cfb6af40e5f04d7e8
SHA512 7b684c37778e6954a9455fff37f2e4318c3b7021dffbbfbb2f937de85c55db6cf0382db8fc2e5ab6abb2f7920e206c04510400096f412ca528d99af703cc4dd8
SSDEEP 12288:eP2JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:q6dCN/j2GLl3iFSE33b9
TLSH
T163D42368A6B5B669E42B837C43799F215210FEF8E72144CB41D0A6FB577DFE88033852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 449eb837b5a76960038ffb8d2e420ca928c2ef333a3cd0f1fb8ce262595a40cd
MD5 dfea6cea016f7e363b0463142ba5e7c6
SHA1 b5e4bb1836e1377ca33fc5f803661b8ffddaf38b
SHA512 54bf425bd49e464f0aac3c62fae1c91bacadee424fbf1c973d2e45863656b59fbc65984f1408ab6aa5382f5b09236900240630410830e8d77a05c043835dd2e7
SSDEEP 24576:CC+TyQIu93VAumZr7jmRdCN/j2GLl3iFSE33b9:C/TfIq+YmN/j2U4FH
TLSH
T192558C1DA7E91DCAE276C675C9A34493E633B871137186CF2044C07D4A9EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 768KB
SHA256 d3b32314060aef6acb9eaea8e3ff6cabb9d1bfe11314ac1ae0f1f9c4b6cfefbd
MD5 5bcfbea4d090640e4e9c22dc1848907a
SHA1 0bbc8b4c8094291503e004abbd4773906728d500
SHA512 6da58604cb680119e3ebbedfe9aca8a1293668622535b1a6e2cc3fc5dc734cc4764e0ab9a998478a1a4cab1da8dce5cba2f66abd239ebf50dbc3caa33375d40c
SSDEEP 12288:HcyrWOstaa3kcsqJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:+LQikZWdCN/j2GLl3iFSE33b9
TLSH
T1AAF4F10EB3BA10A5E0ABC23C89954611F673B474971257CF42D0C7BE0BAB6E9BD34B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 d817d1c2355bf176475922f5137078063b8a8cde194c782974557a76b17bf00c
MD5 a927b63bf03154e0bc36d8d606be6e8d
SHA1 033a0c18c57d165e19abfbcf5c1bd81e4e51ea2f
SHA512 15f6e5db3ac10e1db539228297e1c5ad664374d9b29c9b005016a635cd5be022505f5763fa7de89a49913d985a44afabee6ab94a02e0005ea9a5d0f50f7c6022
SSDEEP 49152:2pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPsN/j2U4FH:DpC7b4+80GTkhj2jF
TLSH
T174A57C3DE2F810ADD8AAC37585461665EE71382E3F2015DB01B0C578BF1AEF19A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 48fc66f6d03a1a35f34d0f9915afdc6d97c3c18ef3c689fe0a581adc2dcb9faf
MD5 4c4a4c76f62b7a8c2f6b0defa99da62f
SHA1 045a8dda0ed25de2411ff82031c6c31e353ef030
SHA512 bd6b89763d9eed393a73192a0c21ce6a5829f69d4a64b04cffb1a276aa91d91764a1c412be5bfbd296cbaeeeb49543802f9db784be11769c73ea2277b322ee6d
SSDEEP 24576:pSAwJPE1IDAo+4Kt+l44135UQHdCN/j2GLl3iFSE33b9:pqPCIo4Kol4/Q0N/j2U4FH
TLSH
T12255B029A7F956E4E17AC7B4C663C611FB727822533163CF8290817E0F16AE89E35F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 956KB
SHA256 f6d9762586af2653b819f1bc36b8bb03f693d1b1b726515dc9431dac20421719
MD5 98e21da71fe516833497082e803ffcf9
SHA1 d663a411d47d42bccdc4e55bd63b882624e5d8c7
SHA512 e9e79afe77fee426eca81ee1d6103b0778379db61a33b5adb966e9913aaee2e3c354e580cdcf51346f4a9c9ac6a5fe20366a2129029a4d3cd44d764100af22ca
SSDEEP 12288:VSsyLCFBoPLCRyf6NQ4t3JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:1yLXPLcM94tXdCN/j2GLl3iFSE33b9
TLSH
T17225D03DE66D04E5E47AC27CC6A38906F67138AD433166CB05E0917A1F6BFF4A939B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 744KB
SHA256 b06c45d5d91406fdee57305b626ad23f416147a0114fa5c328de8981135a21fd
MD5 59822a4ca51055cd41432ca443d7a6f9
SHA1 69d18b46f2de2b3272de0c730ba1313e92725339
SHA512 c0ab11269a683f07268412493d68489f537b0e29041ba8baa6c8f87b1c37fbf5ad75eb74b7b744aed237c8391fbb3b9afc2f49fc4bfebafc5c41e12420c89689
SSDEEP 12288:W9lyvj3IkxjbBz6JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:WWv8qjpGdCN/j2GLl3iFSE33b9
TLSH
T1F2F4125DA6E47498F07A8378827686258130BDB5633589EF61C4DAFB0B39BD4C43BF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-217-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/244-215-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1016-258-0x0000000001C90000-0x0000000001CA0000-memory.dmp

Download

memory/1016-456-0x0000000000DF0000-0x0000000000E4D000-memory.dmp

Download

memory/1016-457-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1016-248-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1016-291-0x000000000A580000-0x000000000A588000-memory.dmp

Download

memory/1016-245-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1016-239-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1016-274-0x0000000001F40000-0x0000000001F50000-memory.dmp

Download

memory/1120-207-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1120-427-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1120-454-0x0000000000D50000-0x0000000000DAD000-memory.dmp

Download

memory/1120-204-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/1120-198-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/1448-214-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/1448-127-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/1656-24-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1656-21-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1656-23-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1656-33-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1656-25-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1976-486-0x0000017FC6780000-0x0000017FC6790000-memory.dmp

Download

memory/1976-484-0x0000017FC6780000-0x0000017FC6790000-memory.dmp

Download

memory/1976-476-0x0000017FC6780000-0x0000017FC6790000-memory.dmp

Download

memory/1976-479-0x0000017FC6780000-0x0000017FC6790000-memory.dmp

Download

memory/1976-488-0x0000017FC6780000-0x0000017FC6790000-memory.dmp

Download

memory/1976-473-0x0000017FC6780000-0x0000017FC6790000-memory.dmp

Download

memory/1976-474-0x0000017FC6780000-0x0000017FC6790000-memory.dmp

Download

memory/1976-483-0x0000017FC6780000-0x0000017FC6790000-memory.dmp

Download

memory/1976-487-0x0000017FC6780000-0x0000017FC6790000-memory.dmp

Download

memory/1976-477-0x0000017FC6780000-0x0000017FC6790000-memory.dmp

Download

memory/1976-475-0x0000017FC6780000-0x0000017FC6790000-memory.dmp

Download

memory/1976-482-0x0000017FC6780000-0x0000017FC6790000-memory.dmp

Download

memory/1976-485-0x0000017FC6780000-0x0000017FC6790000-memory.dmp

Download

memory/1976-481-0x0000017FC6780000-0x0000017FC6790000-memory.dmp

Download

memory/1976-480-0x0000017FC6780000-0x0000017FC6790000-memory.dmp

Download

memory/1976-478-0x0000017FC6780000-0x0000017FC6790000-memory.dmp

Download

memory/2004-446-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2004-224-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2448-94-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2448-88-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2448-96-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2448-448-0x0000000000DE0000-0x0000000000E3D000-memory.dmp

Download

memory/2448-206-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2460-365-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/2460-178-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/2904-43-0x0000000002A40000-0x0000000002AA7000-memory.dmp

Download

memory/2904-165-0x0000000000400000-0x0000000000BC1000-memory.dmp

Download

memory/2904-37-0x0000000002A40000-0x0000000002AA7000-memory.dmp

Download

memory/2904-53-0x0000000000400000-0x0000000000BC1000-memory.dmp

Download

memory/3448-124-0x0000000001530000-0x00000000016CA000-memory.dmp

Download

memory/3448-119-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3448-117-0x0000000001C50000-0x0000000001CB0000-memory.dmp

Download

memory/3448-125-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3448-122-0x0000000001C50000-0x0000000001CB0000-memory.dmp

Download

memory/3448-111-0x0000000001C50000-0x0000000001CB0000-memory.dmp

Download

memory/3572-69-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3572-445-0x0000000000C20000-0x0000000000C7D000-memory.dmp

Download

memory/3572-173-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3572-60-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/3572-66-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/3592-191-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3592-453-0x0000000000C30000-0x0000000000C8D000-memory.dmp

Download

memory/3592-185-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3592-399-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3592-194-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3720-220-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3720-442-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3740-163-0x00000000008F0000-0x0000000000957000-memory.dmp

Download

memory/3740-158-0x00000000008F0000-0x0000000000957000-memory.dmp

Download

memory/3740-227-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3740-167-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3756-107-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3756-72-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3756-105-0x0000000000770000-0x000000000090A000-memory.dmp

Download

memory/4308-14-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4308-15-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4308-18-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4308-12-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4336-247-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4336-451-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4336-174-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4396-169-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4396-56-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4524-234-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4524-170-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4716-36-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4716-48-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4716-51-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4920-210-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/4920-440-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/5200-458-0x000001A10BAF0000-0x000001A10BB4D000-memory.dmp

Download

memory/5208-131-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5208-449-0x0000000000D50000-0x0000000000DAD000-memory.dmp

Download

memory/5208-137-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5208-219-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5208-139-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5324-228-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5324-450-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5556-444-0x00000000029D0000-0x00000000029DC000-memory.dmp

Download

memory/5556-443-0x0000000000880000-0x00000000008DD000-memory.dmp

Download

memory/5780-142-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/5780-148-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/5780-151-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/5780-223-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/5780-452-0x0000000000C50000-0x0000000000CAD000-memory.dmp

Download

memory/5856-76-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5856-82-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5856-84-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5856-193-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5856-447-0x0000000000780000-0x00000000007DD000-memory.dmp

Download

memory/6140-235-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/6140-455-0x0000000140000000-0x00000001400C2000-memory.dmp

Download