f435b24d4c2c5342c4f7c0143ef358f0f425b7b8a0972dd34d9dcf94789e9c4d

Analysis

max time kernel
150s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 23:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
Size 3.7MB
Sample260731-2zwclaaa63
SHA256 f435b24d4c2c5342c4f7c0143ef358f0f425b7b8a0972dd34d9dcf94789e9c4d
MD5 f8c87a60b54c555b5bd5d18f7ad9b35b
SHA1 8c1afc0011357ab6a60a39b4ccf1698865e2b0d1
SHA512 93a49776b41cf6c47a615be914c6e8a1ff670aea3d2d966db9391054c0327c64ad852ec0807d8a7789d5a0f0f1fe7115820162ae3a58490129308fe3ee438a45
SSDEEP 98304:ZqBAjnA0XicrT3mN8Elu+GDQOQ5X3555ViyKp:HA0XicrTDElu/DQOUXp55Viy
TLSH
T110062329D79514F5E137D534C8A10207EAB17CAE4771C6CF23EA198A1F23791AE3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File created	C:\Program Files\WinRAR\Descript.ion	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File opened for modification	C:\Program Files\WinRAR\RarExtPackage.msix	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File created	C:\Program Files\WinRAR\Order.htm	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File opened for modification	C:\Program Files\WinRAR\RarExtInstaller.exe	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File created	C:\Program Files\WinRAR\Zip32.SFX	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File created	C:\Program Files\WinRAR\Rar.exe	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File created	C:\Program Files\WinRAR\RarExt.dll	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File opened for modification	C:\Program Files\WinRAR\Resources.pri	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File created	C:\Program Files\WinRAR\License.txt	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File created	C:\Program Files\WinRAR\RarFiles.lst	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File created	C:\Program Files\WinRAR\rarnew.dat	uninstall.exe
File created	C:\Program Files\WinRAR\Rar.txt	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File created	C:\Program Files\WinRAR\Resources.pri	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File created	C:\Program Files\WinRAR\WhatsNew.txt	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File opened for modification	C:\Program Files\WinRAR\UnRAR.exe	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File created	C:\Program Files\WinRAR\WinRAR.exe	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File created	C:\Program Files\WinRAR\RarExtInstaller.exe	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File created	C:\Program Files\WinRAR\RarExtPackage.msix	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File created	C:\Program Files\WinRAR\Default32.SFX	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File opened for modification	C:\Program Files\WinRAR\Default32.SFX	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File opened for modification	C:\Program Files\WinRAR\WinCon32.SFX	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File opened for modification	C:\Program Files\WinRAR\Rar.txt	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File created	C:\Program Files\WinRAR\WinCon32.SFX	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.chm	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File created	C:\Program Files\WinRAR\7zxa.dll	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File opened for modification	C:\Program Files\WinRAR\Zip32.SFX	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File created	C:\Program Files\WinRAR\Uninstall.exe	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File created	C:\Program Files\WinRAR\Default.SFX	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File opened for modification	C:\Program Files\WinRAR	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File created	C:\Program Files\WinRAR\Zip.SFX	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File opened for modification	C:\Program Files\WinRAR\Descript.ion	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240737140	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe

Executes dropped EXE 20 IoCs

pid	Process
3548	uninstall.exe
856	RarExtInstaller.exe
4668	WinRAR.exe
1864	RarExtInstaller.exe
812	WinRAR.exe
3848	RarExtInstaller.exe
944	WinRAR.exe
2924	RarExtInstaller.exe
4876	WinRAR.exe
1968	WinRAR.exe
3880	WinRAR.exe
5596	WinRAR.exe
4984	WinRAR.exe
2104	WinRAR.exe
1988	WinRAR.exe
5532	WinRAR.exe
4724	WinRAR.exe
2756	WinRAR.exe
5100	WinRAR.exe
4536	WinRAR.exe

Modifies system executable filetype association 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,1"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lha	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tgz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.txz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zipx	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.uu\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.txz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zst	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR archive"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive"	uninstall.exe

Suspicious behavior: GetForegroundWindowSpam 12 IoCs

pid	Process
4668	WinRAR.exe
944	WinRAR.exe
4876	WinRAR.exe
1968	WinRAR.exe
3880	WinRAR.exe
4984	WinRAR.exe
2104	WinRAR.exe
1988	WinRAR.exe
5532	WinRAR.exe
4724	WinRAR.exe
2756	WinRAR.exe
4536	WinRAR.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1860	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
1860	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 3548	1860	2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe	89
PID 3548 wrote to memory of 856	3548	uninstall.exe	90
PID 4668 wrote to memory of 1864	4668	WinRAR.exe	94
PID 944 wrote to memory of 2924	944	WinRAR.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_f8c87a60b54c555b5bd5d18f7ad9b35b_icedid_njrat_stealc.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Program Files\WinRAR\uninstall.exe
  "C:\Program Files\WinRAR\uninstall.exe" /setup
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Program Files\WinRAR\RarExtInstaller.exe
    "C:\Program Files\WinRAR\RarExtInstaller.exe" -install
    3⤵
    - Executes dropped EXE
    PID:856

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:4612

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Program Files\WinRAR\RarExtInstaller.exe
  "C:\Program Files\WinRAR\RarExtInstaller.exe" -install
  2⤵
  - Executes dropped EXE
  PID:1864

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:6004

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
PID:812

C:\Program Files\WinRAR\RarExtInstaller.exe
"C:\Program Files\WinRAR\RarExtInstaller.exe" /install /local
1⤵
- Executes dropped EXE
PID:3848

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:4660

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:944
- C:\Program Files\WinRAR\RarExtInstaller.exe
  "C:\Program Files\WinRAR\RarExtInstaller.exe" -install
  2⤵
  - Executes dropped EXE
  PID:2924

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:3460

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:4876

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:1500

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:1968

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:6136

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:3880

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:1400

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
PID:5596

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:5968

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:4984

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:2308

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2104

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:1604

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:1988

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:4320

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:5532

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:2296

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:4724

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:3932

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:2756

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:1124

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
PID:5100

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:4636

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:4536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Rar.exe

Path C:\Program Files\WinRAR\Rar.exe
Size 826KB
SHA256 1639bfccc19b6fdd9becffb154edca06f07d1f337cc61933273f5b30dfb91882
MD5 65e82777632b6e92eeea57cf47e93336
SHA1 5c3a29854430697ed1da3a9f89c6c427ba36fc0a
SHA512 55012d9045b41b76c6b55e14e0d11fd592e3f419f08bce56cab6f8f0702d762c32a63ae69b84b298068b8c94ca912ba4a6b27044953f3868bc23a7242451f07f
SSDEEP 12288:5xH9uySClf47ZhSelxO9mafDSvYblwkr6YFON0bGLiZ32Pjr4qf:5xduUB+Ielg9px2JN0TKr4qf
TLSH
T19F059E1A9BE801FCE0F7D674CE915917EBB7780657B1968F039449AA5F232608F39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Rar.txt

Path C:\Program Files\WinRAR\Rar.txt
Size 110KB
SHA256 626b437acc8c23be798b1f3233f5636e64245941fb931f322cd9e65cb8c56a1f
MD5 af2f59a1c3b3589c2e1506ab00b6148b
SHA1 87532b1ad6421f5ed629b4cabb096c1a23f24a33
SHA512 f6684c3f2af9801b62e2c1402a8621ada4cd5087844de7e6b36eb5e48b0d023aeab875c0d1cb3a34c7587a2a3c1af296a4a67e71312e371ac819dd00486cb5a0
SSDEEP 768:xodhu8h1SIfjcjKVbRZHwT93KEYiHSToOKyIQiVL18e5xGMm1tgD3cb+WkOPMmuB:xodhuGKKV9ZU9nSbKyIJL1ZYYsiWB5w
TLSH
T169B3C8277E8E1371257201965F1DA199E31090EF271B169538ED838C7F3A8A293F66EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RarExtInstaller.exe

Path C:\Program Files\WinRAR\RarExtInstaller.exe
Size 229KB
SHA256 091f077e4a8ffdca19430e9775b97d3b448e0c8ffdda52fb93b98268d38356f5
MD5 df0bc41ab3ae25dd01399897b6333249
SHA1 89ca2d451bd8c21f0ebec5a4f715c4936a082f65
SHA512 98a70066cd44b8c58d359f05d3688746843067f811699bd1c20a7ed2c712de9f7244f224ec367d9540d8fc4298bf85ee08002f6391d952857da6e72182dcf305
SSDEEP 3072:ORWlXxJQ2QJUz/d6EsAm8kRq/FSGXUaszUQvHXcbviDktdNTvfSW:5Xk21/ghAmONSmQvHpSdF
TLSH
T1D3347C49F2B950F6EABBD835C9664501FF3278414760EBCB27500BB59E23BE19E3A701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RarExtPackage.msix

Path C:\Program Files\WinRAR\RarExtPackage.msix
Size 23KB
SHA256 9bd99b011fc9053589e97a4845ba2951d334fa6412190cd0d5f78d6a3e4d3d3d
MD5 6334da1a18462485d8898de26dc80d38
SHA1 fdf2f2464afca02a242588fc6522c370fde8804a
SHA512 4267e6ce051419916350abdccb2b7e337be007ae2976a9d967cfbfa17d4cd349488ab392a042e92671d9355ade72d55f5ffaba5745a24e9714ed704d84bf1cc5
SSDEEP 384:pQR015ziBz4oqvhFv+qkDJm0fxPZm7SxEDHV6sZd3NszRZ88mbIJRQoK7Tks+ehm:QYzMzHshFvbkDQoZ96MsZd3yCHEJRHK6
TLSH
T1DDB2CFF2B29928ABCB6DC4328B630D242464EE401D538E50FB99353421E97371B5AB7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnRAR.exe

Path C:\Program Files\WinRAR\UnRAR.exe
Size 558KB
SHA256 806b42a2ae54eb8688841500aa70b3a3e4fcbe99059e612086cf9ccdc231b5ea
MD5 b7b03567cdb1edd613d551b9f04615b6
SHA1 8a00a3ec6929b9f5dbe07bb597150fdf12b41cab
SHA512 a90231d8ee77de4ef62f3c74a966eb52642fb34bc1e4ac0c1d6b368d9c6edb7e88d37f79340aa001517e79e829151165eeb398d19d06d23b200e9d6d100b1aa0
SSDEEP 6144:ytW53Vvm8ZvXwXkmvXZAkedjYPqDV0o92daUQfcts9re2leWpLVv/p2AJkAQ3r4t:ySm8ZvXo/pne+Sj2dpyB9FLVAA+3r4t
TLSH
T110C47C5A97E803B8E0B7D674CDA14902FB777C4947B19A8F03D449B71F236618E3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\WinRAR\Uninstall.exe
Size 413KB
SHA256 c893bab6e0159ad6a3baea054f7341dd543ac0ca446671ce07aa93e97b540dc2
MD5 3950935f79f37787312cbaceef88439c
SHA1 cac58c62f23ced8c2e075d53e7083585ab7ec674
SHA512 eab00916e65d8155afb892959b821e2ab49ba665b9d0554044c6bf59580ad772c51b1e4d5875810a8a21cffeb8a0509663c01dc8d78fabcebb10c98e79cecb15
SSDEEP 6144:F1M1lgZJyBGLRx18VFtq9V27SCrJFSO6pXLR2III+Sn5HBK7jcR0IA:HM1m5Pwtq9VSrJFggIIvS5ejcqH
TLSH
T121949C1AE7A455F9E5B7D13CC8924507EA727C558BB1C38F03910A5A2F237E09E3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WhatsNew.txt

Path C:\Program Files\WinRAR\WhatsNew.txt
Size 64KB
SHA256 aadee800c40e3437867f644057dee828e67fcc6da65004b0a981c000a4e0a58d
MD5 a1bee36438565456368f497fb69195d7
SHA1 83940cda35e775151197f08531bd445556185889
SHA512 35db801d5194fd21481203235c3a00adb60cac8c8e359c3ec06d75d8c50ab23d5cc4d4f1d55286ac9f90d1997729d3e0398994ef38714e69935c9391d055aeee
SSDEEP 768:sMiHKKDaVkJimxZ1Z41kVEbUDbwXic9p63Df3fXxuWJo4c:sJqKDakJ/xl41kVxwXicDYb3fXxuqoR
TLSH
T1015394237D9A13712AB242956E156295F31861AF370B42C4787C838C3F369A6D2F72FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.chm

Path C:\Program Files\WinRAR\WinRAR.chm
Size 320KB
SHA256 cb5edb04ac5e879243dae4f1f6d8253b8653dc6c57473bd0b3f3d23fd1861f61
MD5 b2edb6e0812a75b601019485047a17a0
SHA1 11bc174397b42e1b96f531def552d3b133a5a34f
SHA512 a09520a3ba484d55bd7efb89a7f2c409d7056ff73bbb018023de86ae2f29f5ad28703a7e9b3c77120247167c6c6bb3ccce45715198618db1bf38409f1d0e1a0e
SSDEEP 6144:A0W9Q/Hy3rKBB5k2UEiG63C0s3Vphf3rn333NWVBtKX4ngVTom6XNRLCHSz:A9iygYuV3f3j33cKo8oDfyo
TLSH
T12964121E6D9E8131E4E57E71EACC03DD2320782940C27B112D5FE9F6A5D8FED8168798
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.exe

Path C:\Program Files\WinRAR\WinRAR.exe
Size 3.2MB
SHA256 ab727aec2418a942a1adf5295efb9c676eeba39d16f7c2443e3f873fe2dfca14
MD5 51f6a6e10dcb9452f7357aa7aef19bb1
SHA1 2daa1a057f592d5e2d1446ed1fdf6cef8a0d7e9d
SHA512 99a963fd8018044e9a606179a7666a7aab86cb989ef76a3bf99d78b42f6d09802da2f40a7f0c4cc70ef6f95fffa0b0b767576e988452a5f269ca12c5dc5ad4aa
SSDEEP 49152:I7JynhJ8EhdVMw7Y9odwfDFqfFFJVgrvqzbut1wOq/eQgXUeT+uXEkjNEEBHLu:7soEC9/a+uUkjDBHLu
TLSH
T199F59E0AA7E406ACE0F7D679CED6C553D776B80D07B0A68F029098A64F772609F39713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_D96A4C3B75E862E237A6B89F58F74354

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_D96A4C3B75E862E237A6B89F58F74354
Size 727B
SHA256 6828af6c9042bcc096ff3bc55812cba642bd7ff18dd85c7d5bc3d5f4b53910de
MD5 6e364c11619f792e605df74a6cd5ccca
SHA1 b61105c296a6d632cfd2dbcca2c5ba5d4bec360d
SHA512 3e0c81dbaaa63db0ec74ea9bc631d818f36456cf9cfe1c813dae5d0bbb528aae82b7609af4064cbda0db13e212a1546bf7c2833464c0a846f33cc1b2a3e8a053
TLSH
T113019945294F8AC94E199D1C49FFD37375828260768A0997225941C5F880B597EB1331
MD5 SHA1 SHA512 TLSH

Submit Download

BA74182F76F15A9CF514DEF352303C95

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BA74182F76F15A9CF514DEF352303C95
Size 737B
SHA256 8e1136ed51666cc5b9f9b98847c67ce35ff60a6a54cf9a5734dc1e8defd26aa7
MD5 565f16a83bf23ee5027df4e567db359b
SHA1 40e1664e12edfae1b015a9f326663bc19aab0c95
SHA512 76d755b8fb556dece926a1d2f24f80f0bbfffab403edda0509ea5608471aecd0644b78cae3bfefd9a14b9bb65548efc69888ac6b87d7479c99275adc9fc99feb
TLSH
T19D0160F09410092905778D562A00C52A6C7296A4E60680AA0A11C16E3BFFF8BE6A279B
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_D96A4C3B75E862E237A6B89F58F74354

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_D96A4C3B75E862E237A6B89F58F74354
Size 404B
SHA256 f90c5343f2e5c9c69a8ac4085ad8e462d69ba1bac4fbe3f57f53f4dd50263e35
MD5 47d7aefc58ec64bfd3c505a3127e1b99
SHA1 16ff82d8316535311315d889e8448f5fa1fd99c9
SHA512 0899f3726b4c265736fb5216b840924832c524dc2ab4d525c9dc5579efdbadca965bdc45e13415515088a7089f4c8dff49f6104f5c516bd11d6be17a4c5ed62a
TLSH
T1BBE0C63822FE882CF4F5943583F7A8216B9AF2560441C2AE09809707AE20B408CD3A28
MD5 SHA1 SHA512 TLSH

Submit Download

BA74182F76F15A9CF514DEF352303C95

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BA74182F76F15A9CF514DEF352303C95
Size 248B
SHA256 03d6516220a80e0206a80950ac330e8b49336cae474c3f5f15d304964df7b4bd
MD5 d965a76fae39ae4a6eb90ad5335daef8
SHA1 8b25a91937efd45e6ec7a7335ee31ad64916f992
SHA512 b714aedaf4a5deeef43c2038f8b892e3c19b449b6dedad9c1a97a1bd9b567a3e6ff03981785ebeb0d1c23245817452f45689e774a02cb04fb4e4f059a0956ce9
TLSH
T197D0C92467AA9216F265163B9DF08A816B65BE6BB542CF090BB0024E5429F011C62A6B
MD5 SHA1 SHA512 TLSH

Submit Download

version.dat

Path C:\Users\Admin\AppData\Roaming\WinRAR\version.dat
Size 12B
SHA256 bd0dbd7b9a90899c39634b2e515078e2e8e46a502aa8bfa618f4a3765aba1a01
MD5 f486e86868bb57b202d0995d4e4b7e16
SHA1 aac6e7a15b10b8fc3d4343c00972ee7cce109828
SHA512 ad1caaa05a5fe06e767b89cf7643dc7c7aedc5fa3ae9ad1db5949aaf38b5219436b2df053169fb1ddf0249435ec917f00851f675dcfecaf038d747eb62b2789a
MD5 SHA1 SHA512

Submit Download

memory/812-123-0x0000024824E00000-0x0000024824E51000-memory.dmp

Download

memory/812-112-0x0000024824E00000-0x0000024824E51000-memory.dmp

Download

memory/944-115-0x000001F079120000-0x000001F079171000-memory.dmp

Download

memory/944-137-0x000001F079120000-0x000001F079171000-memory.dmp

Download

memory/1968-122-0x0000022B315C0000-0x0000022B31611000-memory.dmp

Download

memory/1968-140-0x0000022B315C0000-0x0000022B31611000-memory.dmp

Download

memory/1988-155-0x000002B5E7CB0000-0x000002B5E7D01000-memory.dmp

Download

memory/1988-187-0x000002B5E7CB0000-0x000002B5E7D01000-memory.dmp

Download

memory/2104-193-0x0000021C3D4F0000-0x0000021C3D541000-memory.dmp

Download

memory/2104-148-0x0000021C3D4F0000-0x0000021C3D541000-memory.dmp

Download

memory/2756-184-0x00000231AACD0000-0x00000231AAD21000-memory.dmp

Download

memory/2756-235-0x00000231AACD0000-0x00000231AAD21000-memory.dmp

Download

memory/3880-162-0x00000274B9060000-0x00000274B90B1000-memory.dmp

Download

memory/3880-128-0x00000274B9060000-0x00000274B90B1000-memory.dmp

Download

memory/4536-208-0x000001C087AA0000-0x000001C087AF1000-memory.dmp

Download

memory/4536-241-0x000001C087AA0000-0x000001C087AF1000-memory.dmp

Download

memory/4668-125-0x000001C727380000-0x000001C7273D1000-memory.dmp

Download

memory/4668-106-0x000001C727380000-0x000001C7273D1000-memory.dmp

Download

memory/4724-175-0x0000022C16450000-0x0000022C164A1000-memory.dmp

Download

memory/4724-207-0x0000022C16450000-0x0000022C164A1000-memory.dmp

Download

memory/4876-135-0x000001E2ACC00000-0x000001E2ACC51000-memory.dmp

Download

memory/4876-119-0x000001E2ACC00000-0x000001E2ACC51000-memory.dmp

Download

memory/4984-165-0x00000245757C0000-0x0000024575811000-memory.dmp

Download

memory/4984-141-0x00000245757C0000-0x0000024575811000-memory.dmp

Download

memory/5100-195-0x00000271FC060000-0x00000271FC0B1000-memory.dmp

Download

memory/5100-230-0x00000271FC060000-0x00000271FC0B1000-memory.dmp

Download

memory/5532-166-0x000002D64EDF0000-0x000002D64EE41000-memory.dmp

Download

memory/5532-198-0x000002D64EDF0000-0x000002D64EE41000-memory.dmp

Download

memory/5596-158-0x00000245F7D00000-0x00000245F7D51000-memory.dmp

Download

memory/5596-133-0x00000245F7D00000-0x00000245F7D51000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads