5ef54b7fafb832dd8ee1b73e6ce65633dd93c743a0b2dab03a0b4a5fac8badef

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/09/2026, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_339e4b344334c45d90db5ed9e6c0c895_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 74.6MB
Sample260909-epaltabl2x
SHA256 5ef54b7fafb832dd8ee1b73e6ce65633dd93c743a0b2dab03a0b4a5fac8badef
MD5 339e4b344334c45d90db5ed9e6c0c895
SHA1 e3c5cdd1eede45f695a2422eba1027a0d8946b91
SHA512 c59a9bbd2b9c430fd0e9d3aa0d3d41645c35ecdb8ba506a93b86735f46f872be7c8763202d1ce8d890fca5276b9bbc07a62827168ece79f86362c9c304103fe4
SSDEEP 1572864:FHR0llQBpS56IdU0zPyLirZBLyOlGqjj6BziZy2+92Z3:FHR6lkfIdzPy29fG06Bay2+9o3
TLSH
T118083305C2D9E07DF9BB91B0888A4B44C6F17D14D728AB474B65BBD36FB38C05E39A12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution exploit persistence privilege_escalation

Malware Config

Signatures

Possible privilege escalation attempt 4 IoCs

exploit

pid	Process
3768	takeown.exe
2724	icacls.exe
1504	takeown.exe
1448	icacls.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	2026-09-07_339e4b344334c45d90db5ed9e6c0c895_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	GameExplorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	RegFiles.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 6 IoCs

pid	Process
4140	GameExplorer.exe
1784	RegFiles.exe
4816	PowerRun.exe
100	PowerRun.exe
3896	PowerRun.exe
2868	Setup.exe

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2724	icacls.exe
1504	takeown.exe
1448	icacls.exe
3768	takeown.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\gameux.dll	Robocopy.exe
File opened for modification	C:\Windows\System32\Migration\	Robocopy.exe
File created	C:\Windows\System32\Migration\gameuxmig.dll	Robocopy.exe
File opened for modification	C:\Windows\SysWOW64\	Robocopy.exe
File opened for modification	C:\Windows\SysWOW64\migration\	Robocopy.exe
File created	C:\Windows\SysWOW64\migration\gameuxmig.dll	Robocopy.exe
File opened for modification	C:\Windows\System32\	Robocopy.exe
File opened for modification	C:\Windows\System32\en-us\	Robocopy.exe
File created	C:\Windows\System32\en-us\gameux.dll.mui	Robocopy.exe
File opened for modification	C:\Windows\SysWOW64\gameux.dll	Robocopy.exe
File created	C:\Windows\SysWOW64\en-us\gameux.dll.mui	Robocopy.exe
File opened for modification	C:\Windows\System32\GameUXLegacyGDFs.dll	Robocopy.exe
File created	C:\Windows\System32\GameUXLegacyGDFs.dll	Robocopy.exe
File opened for modification	C:\Windows\SysWOW64\en-us\gameux.dll.mui	Robocopy.exe
File opened for modification	C:\Windows\SysWOW64\migration\gameuxmig.dll	Robocopy.exe
File opened for modification	C:\Windows\System32\en-us\gameux.dll.mui	Robocopy.exe
File opened for modification	C:\Windows\System32\Migration\gameuxmig.dll	Robocopy.exe
File opened for modification	C:\Windows\SysWOW64\en-us\	Robocopy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1264	cmd.exe
2484	cmd.exe
1888	cmd.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	PowerRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	PowerRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PowerRun.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{06EEE695-542D-46F6-AEAB-FA2F1B2102D3}\InprocServer32\ThreadingModel = "Both"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{709E2729-F883-441e-A877-ED3CEFC975E6}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED228FDF-9EA8-4870-83b1-96b02CFE0D52}\DefaultIcon	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2e7583c7-7eba-4a1a-8468-d03d28477e6f}\InProcServer32\ = "%SystemRoot%\\System32\\migration\\gameuxmig.dll"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9A5EA990-3034-4D6F-9128-01F3C61022BC}\InprocServer32\ = "C:\\Windows\\System32\\gameux.dll"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2e7583c7-7eba-4a1a-8468-d03d28477e6f}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED228FDF-9EA8-4870-83b1-96b02CFE0D52}\System.AppUserModel.ID = "Microsoft.Windows.GamesExplorer"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED228FDF-9EA8-4870-83b1-96b02CFE0D52}\ = "Games Explorer"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F382DA49-9148-4a22-AF78-C378DFC32D02}\InprocServer32\ThreadingModel = "Both"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E7B2FB72-D728-49B3-A5F2-18EBF5F1349E}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DBC85A2C-C0DC-4961-B6E2-D28B62C11AD4}\InprocServer32	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DBC85A2C-C0DC-4961-B6E2-D28B62C11AD4}\InprocServer32\ThreadingModel = "Apartment"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED228FDF-9EA8-4870-83b1-96b02CFE0D52}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F382DA49-9148-4a22-AF78-C378DFC32D02}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F382DA49-9148-4a22-AF78-C378DFC32D02}\InprocServer32\ = "C:\\Windows\\System32\\gameux.dll"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9A5EA990-3034-4D6F-9128-01F3C61022BC}\ = "GameExplorer Class"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DBC85A2C-C0DC-4961-B6E2-D28B62C11AD4}\ = "GameStatistics Class"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED228FDF-9EA8-4870-83b1-96b02CFE0D52}\System.AppUserModel.RelaunchCommand = "%SystemRoot%\\explorer.exe shell:::{ED228FDF-9EA8-4870-83b1-96b02CFE0D52}"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED228FDF-9EA8-4870-83b1-96b02CFE0D52}\System.AppUserModel.RelaunchDisplayNameResource = "@%SystemRoot%\\system32\\shell32.dll,-30579"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2e7583c7-7eba-4a1a-8468-d03d28477e6f}\InProcServer32\ = "%SystemRoot%\\System32\\migration\\gameuxmig.dll"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6C5CFCDA-1F1A-4c9e-8D65-94771169D0B9}\ = "GameDetails Class"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6C5CFCDA-1F1A-4c9e-8D65-94771169D0B9}\InprocServer32	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F382DA49-9148-4a22-AF78-C378DFC32D02}\ = "MS_InstalledGameProv Class"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED228FDF-9EA8-4870-83b1-96b02CFE0D52}\InprocServer32\ = "C:\\Windows\\System32\\gameux.dll"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA22F5B1-E06F-4A2B-94FC-21E87FE53781}\InprocServer32	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{06EEE695-542D-46F6-AEAB-FA2F1B2102D3}\InprocServer32	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06EEE695-542D-46F6-AEAB-FA2F1B2102D3}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{709E2729-F883-441e-A877-ED3CEFC975E6}\InprocServer32\ = "C:\\Windows\\SysWOW64\\gameux.dll"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED228FDF-9EA8-4870-83b1-96b02CFE0D52}\ShellFolder	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED228FDF-9EA8-4870-83b1-96b02CFE0D52}\DefaultIcon	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6C5CFCDA-1F1A-4c9e-8D65-94771169D0B9}\InprocServer32	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{709E2729-F883-441e-A877-ED3CEFC975E6}\AppID = "{E10F6C3A-F1AE-4adc-AA9D-2FE65525666E}"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED228FDF-9EA8-4870-83b1-96b02CFE0D52}	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED228FDF-9EA8-4870-83b1-96b02CFE0D52}\ShellFolder\FolderValueFlags = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E7B2FB72-D728-49B3-A5F2-18EBF5F1349E}\InProcServer32	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6C5CFCDA-1F1A-4c9e-8D65-94771169D0B9}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA22F5B1-E06F-4A2B-94FC-21E87FE53781}\InprocServer32\ = "C:\\Windows\\SysWOW64\\gameux.dll"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9A5EA990-3034-4D6F-9128-01F3C61022BC}\InprocServer32	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED228FDF-9EA8-4870-83b1-96b02CFE0D52}\LocalizedString = "@%SystemRoot%\\system32\\shell32.dll,-30579"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED228FDF-9EA8-4870-83b1-96b02CFE0D52}\System.AppUserModel.ID = "Microsoft.Windows.GamesExplorer"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F382DA49-9148-4a22-AF78-C378DFC32D02}\InprocServer32	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DBC85A2C-C0DC-4961-B6E2-D28B62C11AD4}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{06EEE695-542D-46F6-AEAB-FA2F1B2102D3}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9A5EA990-3034-4D6F-9128-01F3C61022BC}\InprocServer32\ThreadingModel = "Both"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{06EEE695-542D-46F6-AEAB-FA2F1B2102D3}\ = "GameCleanupHandler Class"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06EEE695-542D-46F6-AEAB-FA2F1B2102D3}\InprocServer32\ = "C:\\Windows\\SysWOW64\\gameux.dll"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9A5EA990-3034-4D6F-9128-01F3C61022BC}\Programmable	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E7B2FB72-D728-49B3-A5F2-18EBF5F1349E}\InProcServer32\ = "C:\\Windows\\SysWOW64\\gameux.dll"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E7B2FB72-D728-49B3-A5F2-18EBF5F1349E}\InProcServer32\ThreadingModel = "Both"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6C5CFCDA-1F1A-4c9e-8D65-94771169D0B9}\InprocServer32\ = "C:\\Windows\\System32\\gameux.dll"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{709E2729-F883-441e-A877-ED3CEFC975E6}\InprocServer32\ThreadingModel = "Apartment"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9A5EA990-3034-4D6F-9128-01F3C61022BC}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED228FDF-9EA8-4870-83b1-96b02CFE0D52}\DefaultIcon\ = "C:\\Windows\\SysWOW64\\imageres.dll,-14"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{709E2729-F883-441e-A877-ED3CEFC975E6}\InprocServer32\ThreadingModel = "Apartment"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DBC85A2C-C0DC-4961-B6E2-D28B62C11AD4}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06EEE695-542D-46F6-AEAB-FA2F1B2102D3}\ = "GameCleanupHandler Class"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA22F5B1-E06F-4A2B-94FC-21E87FE53781}\ = "GameUpdateTask Class"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED228FDF-9EA8-4870-83b1-96b02CFE0D52}\ = "Games Explorer"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED228FDF-9EA8-4870-83b1-96b02CFE0D52}\InprocServer32\ = "C:\\Windows\\SysWOW64\\gameux.dll"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED228FDF-9EA8-4870-83b1-96b02CFE0D52}\InprocServer32\ThreadingModel = "Apartment"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{06EEE695-542D-46F6-AEAB-FA2F1B2102D3}\InprocServer32\ = "C:\\Windows\\System32\\gameux.dll"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6C5CFCDA-1F1A-4c9e-8D65-94771169D0B9}\ = "GameDetails Class"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9A5EA990-3034-4D6F-9128-01F3C61022BC}\InprocServer32\ = "C:\\Windows\\SysWOW64\\gameux.dll"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED228FDF-9EA8-4870-83b1-96b02CFE0D52}\LocalizedString = "@%SystemRoot%\\system32\\shell32.dll,-30579"	reg.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4816	PowerRun.exe
4816	PowerRun.exe
4816	PowerRun.exe
4816	PowerRun.exe
100	PowerRun.exe
100	PowerRun.exe
100	PowerRun.exe
100	PowerRun.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3768	takeown.exe
Token: SeTakeOwnershipPrivilege	1504	takeown.exe
Token: SeBackupPrivilege	1632	Robocopy.exe
Token: SeRestorePrivilege	1632	Robocopy.exe
Token: SeSecurityPrivilege	1632	Robocopy.exe
Token: SeTakeOwnershipPrivilege	1632	Robocopy.exe
Token: SeBackupPrivilege	564	Robocopy.exe
Token: SeRestorePrivilege	564	Robocopy.exe
Token: SeSecurityPrivilege	564	Robocopy.exe
Token: SeTakeOwnershipPrivilege	564	Robocopy.exe
Token: SeDebugPrivilege	4816	PowerRun.exe
Token: SeAssignPrimaryTokenPrivilege	4816	PowerRun.exe
Token: SeIncreaseQuotaPrivilege	4816	PowerRun.exe
Token: 0	4816	PowerRun.exe
Token: SeDebugPrivilege	100	PowerRun.exe
Token: SeAssignPrimaryTokenPrivilege	100	PowerRun.exe
Token: SeIncreaseQuotaPrivilege	100	PowerRun.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 4140	1516	2026-09-07_339e4b344334c45d90db5ed9e6c0c895_cryptbot_icedid_luca-stealer_njrat_stealc.exe	87
PID 4140 wrote to memory of 1264	4140	GameExplorer.exe	89
PID 1264 wrote to memory of 3768	1264	cmd.exe	92
PID 1264 wrote to memory of 2724	1264	cmd.exe	96
PID 1264 wrote to memory of 1504	1264	cmd.exe	104
PID 1264 wrote to memory of 1448	1264	cmd.exe	105
PID 1264 wrote to memory of 1632	1264	cmd.exe	106
PID 1264 wrote to memory of 564	1264	cmd.exe	107
PID 1516 wrote to memory of 1784	1516	2026-09-07_339e4b344334c45d90db5ed9e6c0c895_cryptbot_icedid_luca-stealer_njrat_stealc.exe	108
PID 1784 wrote to memory of 2484	1784	RegFiles.exe	110
PID 2484 wrote to memory of 4816	2484	cmd.exe	112
PID 3896 wrote to memory of 1888	3896	PowerRun.exe	116
PID 1888 wrote to memory of 1100	1888	cmd.exe	118
PID 1888 wrote to memory of 1532	1888	cmd.exe	119
PID 1888 wrote to memory of 160	1888	cmd.exe	120
PID 1888 wrote to memory of 2760	1888	cmd.exe	121
PID 1888 wrote to memory of 3900	1888	cmd.exe	122
PID 1888 wrote to memory of 176	1888	cmd.exe	123
PID 1888 wrote to memory of 3028	1888	cmd.exe	124
PID 1888 wrote to memory of 420	1888	cmd.exe	125
PID 1888 wrote to memory of 4432	1888	cmd.exe	126
PID 1888 wrote to memory of 1928	1888	cmd.exe	127
PID 1888 wrote to memory of 5012	1888	cmd.exe	128
PID 1888 wrote to memory of 3292	1888	cmd.exe	129
PID 1888 wrote to memory of 872	1888	cmd.exe	130
PID 1888 wrote to memory of 4756	1888	cmd.exe	131
PID 1888 wrote to memory of 3304	1888	cmd.exe	132
PID 1888 wrote to memory of 3348	1888	cmd.exe	133
PID 1888 wrote to memory of 2124	1888	cmd.exe	134
PID 1888 wrote to memory of 4744	1888	cmd.exe	135
PID 1888 wrote to memory of 1032	1888	cmd.exe	136
PID 1888 wrote to memory of 2216	1888	cmd.exe	137
PID 1888 wrote to memory of 4180	1888	cmd.exe	138
PID 1888 wrote to memory of 416	1888	cmd.exe	139
PID 1888 wrote to memory of 756	1888	cmd.exe	140
PID 1888 wrote to memory of 2724	1888	cmd.exe	141
PID 1888 wrote to memory of 1132	1888	cmd.exe	142
PID 1888 wrote to memory of 1768	1888	cmd.exe	143
PID 1888 wrote to memory of 3056	1888	cmd.exe	144
PID 1516 wrote to memory of 2868	1516	2026-09-07_339e4b344334c45d90db5ed9e6c0c895_cryptbot_icedid_luca-stealer_njrat_stealc.exe	145

C:\Users\Admin\AppData\Local\Temp\2026-09-07_339e4b344334c45d90db5ed9e6c0c895_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_339e4b344334c45d90db5ed9e6c0c895_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\GameExplorer.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\GameExplorer.exe" /S
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX1\Copy.bat" /S"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1264
  - - C:\Windows\system32\takeown.exe
      takeown /F "C:\Windows\System32" /R /D Y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:3768
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32" /grant Administrators:F /T /C
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2724
  - - C:\Windows\system32\takeown.exe
      takeown /F "C:\Windows\SysWOW64" /R /D Y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:1504
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\SysWOW64" /grant Administrators:F /T /C
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1448
  - - C:\Windows\system32\Robocopy.exe
      robocopy "C:\Users\Admin\AppData\Local\Temp\RarSFX1\System32" "C:\Windows\System32" /E /IS /IT /R:0 /W:0
      4⤵
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      PID:1632
  - - C:\Windows\system32\Robocopy.exe
      robocopy "C:\Users\Admin\AppData\Local\Temp\RarSFX1\SysWOW64" "C:\Windows\SysWOW64" /E /IS /IT /R:0 /W:0
      4⤵
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      PID:564
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\RegFiles.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\RegFiles.exe" /S
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\Delete.bat" /S"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2484
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\PowerRun.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\PowerRun.exe" /S "C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\Task.bat"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\PowerRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\PowerRun.exe" /S "C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\Task.bat"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:100
      - C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\PowerRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\PowerRun.exe" /TI/ /S "C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\Task.bat"
        6⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:3896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\Task.bat" "
        7⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1888
        
        C:\Windows\system32\reg.exe
        
        reg import "C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\1.reg"
        8⤵
        Modifies registry class
        
        PID:1100
        
        C:\Windows\system32\reg.exe
        
        reg import "C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\10.reg"
        8⤵
        Modifies registry class
        
        PID:1532
        
        C:\Windows\system32\reg.exe
        
        reg import "C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\11.reg"
        8⤵
        Modifies registry class
        
        PID:160
        
        C:\Windows\system32\reg.exe
        
        reg import "C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\12.reg"
        8⤵
        Modifies registry class
        
        PID:2760
        
        C:\Windows\system32\reg.exe
        
        reg import "C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\13.reg"
        8⤵
        Modifies registry class
        
        PID:3900
        
        C:\Windows\system32\reg.exe
        
        reg import "C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\14.reg"
        8⤵
        Modifies registry class
        
        PID:176
        
        C:\Windows\system32\reg.exe
        
        reg import "C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\15.reg"
        8⤵
        Modifies registry class
        
        PID:3028
        
        C:\Windows\system32\reg.exe
        
        reg import "C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\16.reg"
        8⤵
        Modifies registry class
        
        PID:420
        
        C:\Windows\system32\reg.exe
        
        reg import "C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\17.reg"
        8⤵
        Modifies registry class
        
        PID:4432
        
        C:\Windows\system32\reg.exe
        
        reg import "C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\18.reg"
        8⤵
        Modifies registry class
        
        PID:1928
        
        C:\Windows\system32\reg.exe
        
        reg import "C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\19.reg"
        8⤵
        Modifies registry class
        
        PID:5012
        
        C:\Windows\system32\reg.exe
        
        reg import "C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\2.reg"
        8⤵
        Modifies registry class
        
        PID:3292
        
        C:\Windows\system32\reg.exe
        
        reg import "C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\20.reg"
        8⤵
        
        PID:872
        
        C:\Windows\system32\reg.exe
        
        reg import "C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\21.reg"
        8⤵
        
        PID:4756
        
        C:\Windows\system32\reg.exe
        
        reg import "C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\22.reg"
        8⤵
        
        PID:3304
        
        C:\Windows\system32\reg.exe
        
        reg import "C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\23.reg"
        8⤵
        
        PID:3348
        
        C:\Windows\system32\reg.exe
        
        reg import "C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\24.reg"
        8⤵
        
        PID:2124
        
        C:\Windows\system32\reg.exe
        
        reg import "C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\25.reg"
        8⤵
        
        PID:4744
        
        C:\Windows\system32\reg.exe
        
        reg import "C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\26.reg"
        8⤵
        
        PID:1032
        
        C:\Windows\system32\reg.exe
        
        reg import "C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\27.reg"
        8⤵
        
        PID:2216
        
        C:\Windows\system32\reg.exe
        
        reg import "C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\3.reg"
        8⤵
        Modifies registry class
        
        PID:4180
        
        C:\Windows\system32\reg.exe
        
        reg import "C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\4.reg"
        8⤵
        Modifies registry class
        
        PID:416
        
        C:\Windows\system32\reg.exe
        
        reg import "C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\5.reg"
        8⤵
        Modifies registry class
        
        PID:756
        
        C:\Windows\system32\reg.exe
        
        reg import "C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\6.reg"
        8⤵
        Modifies registry class
        
        PID:2724
        
        C:\Windows\system32\reg.exe
        
        reg import "C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\7.reg"
        8⤵
        Modifies registry class
        
        PID:1132
        
        C:\Windows\system32\reg.exe
        
        reg import "C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\8.reg"
        8⤵
        Modifies registry class
        
        PID:1768
        
        C:\Windows\system32\reg.exe
        
        reg import "C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\9.reg"
        8⤵
        Modifies registry class
        
        PID:3056
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe" /S
  2⤵
  - Executes dropped EXE
  PID:2868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GameExplorer.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\GameExplorer.exe
Size 1.7MB
SHA256 ce1c8575fa852d4e4ce52c6f13dcc6ef4cd6cb436908b9a95ef45d2b1752a46a
MD5 76e3699dbbecccc659fa7e1c3e3e258c
SHA1 27f0e35a4da92067fbee96c56c5fd6211ae2fb9f
SHA512 f5367ee351e5d8f11fa7eaacd5309fafeb7faac8a00b5d422ab824351bd226acac852b5a22f9e8bd4d21f6e44d9098614caea2931c6ed4e1c281f8d904036a5a
SSDEEP 49152:rKA5/fBjU7vc5zo0ku0pAq7PniGsBCxQkn9vgAXe/TH:rKAy7c5/orfQknXqTH
TLSH
T1C6850149D7E445F8E0B3E1B4CD464A02EB767C4D47B1DB8F13A499A61F232A09D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegFiles.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\RegFiles.exe
Size 931KB
SHA256 69cec21ebf45738d59b6022f39f792dae23d7e7ce9491cde6dfa10f893c86f35
MD5 b1116b6b7232f618539473499c9742fd
SHA1 b209d6689f910f75036a9b22044310a79b21655b
SHA512 b69458be7ddd33381070eccb46afbc3edc8b489ac0336c2b9d6a3570ead17209dd1e8b22f7a54a2b542de5aa04117ee6f5affbb5b98d5cef9a949a6994a3b9b1
SSDEEP 24576:Xb2+CvRSEHiRkTJrpz6wYrk+O6nVX/tGdw:L2hvRhHukN0wYrHvtx
TLSH
T1CB15E119E7E405FCE0B7E578CD978912EB367C494371E6DF03A0A9A61F232909D39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\1.reg
Size 572B
SHA256 fb35dec7b8d7b497b4f0b6931fff14c43ebae1f672e5e0bf5420e2467fea0852
MD5 8de5580d0fda94b1cf6e03c7dec40539
SHA1 94d390d35ed01208e6f994d4466797281804c83f
SHA512 0487a13e87b60ad39c99490b7f68454036c3eb97b2017ec814fbb336a132e18d2e7f9b904d374993d2219ec0a3996cfe6f8fdb63c3b16398f2083b33aec041d3
TLSH
T10FF0962B23E86006F3B7A6C15FF5DC715751FA921826DBAD02C11A0D49E09106612BBF
MD5 SHA1 SHA512 TLSH

Submit Download

10.reg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\10.reg
Size 576B
SHA256 2ba2a9aaf1789c84a34cc4303767a6c62729827c740cd5c8a1fdf116c55cea11
MD5 b2a221cde12e6edd90c6385584bd300d
SHA1 1529ca47537ccd8318ad6141eb8b083214811c9e
SHA512 d634a472a4754f4832ac8f34d087e3c0abf2845476bd3fcdc0d8e6692574c05da49455cc72e27db1c9b0a2d89b277baa1b1ec0772431b3b6d58d13bf6a95d8a0
TLSH
T1DBF02B6E27E82006B2B3E5E0EBA458B55322F9A61D26DEAF14D0550D04E1902B013FFB
MD5 SHA1 SHA512 TLSH

Submit Download

11.reg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\11.reg
Size 620B
SHA256 fded92fb93ad2167fc1a88c525950dbd5eb3a19fe84fa97e058215960baeb965
MD5 76685a39b8ab348c4819fe5c152ea1ff
SHA1 e1661489deb3a505e4f13bb3d6b2c0d5a9d396f7
SHA512 3daf7a9d029f049e4bc370c8bcff34c290b17c0b887f90cc5fb157d040bf3a9fbfc94e4e8bdd56cf8bd58a3f07cb9a9d8aa1baa1c81b40ddf76db1d002c4b298
TLSH
T1A5F0CD1B52E8100AF3B3F6805FF5DC715355F9A21816DBAD41C11A0949D09106611BBB
MD5 SHA1 SHA512 TLSH

Submit Download

12.reg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\12.reg
Size 1KB
SHA256 6cbbf3fb0c06b736cb3f6cfc757378072b6b5ad4401beff53a14ad5b32005c9a
MD5 0048253d1ac1379ef6ae9be09f573626
SHA1 23ed43c06317b2314405f7da47ac10335caa4de3
SHA512 613044375fda10c7b3739c5d85e4f524fe7e7adcc961e53bb8bc2ea2dbc7dff71def6d8d63bde5d5ef32e312db4b1d77e733e39ebfd6ea34d17defcc6535e7f9
TLSH
T12121C27ED7D2240AA2726E50CFF34463F6567493342ECD4E00C2170908D2B56A9F177E
MD5 SHA1 SHA512 TLSH

Submit Download

13.reg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\13.reg
Size 616B
SHA256 0254d37d6abadd3280f46a4607c4fa34fbbcc9cc2e62938ea8ba72dbe6f728d6
MD5 8abf8e167d5957cc78e56a39332c11db
SHA1 6f6eab97d1dbfa8b1afe739317b1c784630f38b7
SHA512 a340fe0c2c21038a7b901d2fbf1f78eb41fe9b96cae0e38e5f8c39dad5a20b6f9dc636274663f2493738e24ae41e7dbbec99ce817460697f577ea777869a7aeb
TLSH
T11FF0FC662BF8111AF3727BC2AFF19860E711F5B52816DAED0481550A09F0D114952FEF
MD5 SHA1 SHA512 TLSH

Submit Download

14.reg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\14.reg
Size 734B
SHA256 8bff27da60afa35add0b905fa528d19ff16235fb882b43e0ec0d20b3992b1b9d
MD5 f95eaa540860619a4ac0a2f91b1af99b
SHA1 66ea205b9b0c62cf9fb3f20824277b09b9df216a
SHA512 e81ec7f93cb7792c3e36b4afa7b2198dae1fab7759cdca4d27354c926764a5068ab3aafc0afa7e306e711baf1811fa38113e10bcf89592a0c7d39d06c7173e08
TLSH
T15B01202A16F8110DF3B6B6C0EFF5D920E765B9F118568E8F00D15E0D08D1A116592FBF
MD5 SHA1 SHA512 TLSH

Submit Download

15.reg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\15.reg
Size 794B
SHA256 411bd8203eab3292ed1ec619b5327f0a718316ddc1431f9994f0dee3b3eaf5d0
MD5 497476f1575601e9f11e503030ec97b4
SHA1 8a72a51454914794b6006ed5c5d0cde1b316455c
SHA512 0423517452e5f4b18819e5c351e0d641a12189a627eb302114e430628771383f3f5d3b8df991005d8112cd137d35b29b1dd99111f2a57749d3eeff6a8144c64e
TLSH
T10301F95A56F4105AB363B6C17FF2AC739725F5F22856DD5F00C2170A02D06411112BBF
MD5 SHA1 SHA512 TLSH

Submit Download

16.reg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\16.reg
Size 612B
SHA256 c7809b174775e5ed5b2e68267b177924864f081939c14d9bc1da9924a4035a5e
MD5 48d30fcd636ad992468222708f034a28
SHA1 965c47132f14e2ed2c654232ffb970b10a28bedf
SHA512 7d2f055a286c72cbd782410a3a16ab76be33984d139341bd33ad65d434490989633323cfce99b1515c2ddd40b40c284b6b85d1b7526ef6f85acfb2a2c365cefd
TLSH
T119F0C87E62F01009B3F3F9C1AEF5A8709715B5751C45CABF40C6550A05D1201A6A3BBF
MD5 SHA1 SHA512 TLSH

Submit Download

17.reg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\17.reg
Size 622B
SHA256 32ba9b864c0d012f863a7de34c333b9a88a5b1df291e4effee37342a26c6de66
MD5 0a853583bebbbe2333efa1da0ac93ed2
SHA1 d3e6a918decd967ae6d180b6872a825ffc0ae6ba
SHA512 fbbe5fa44439edc98ebc64d1f0ce2c2c36a7c95c12bf0135d1d7a21a9a4e61104ad54bfc6d7af7c25af6400c24bac9d1966b8731a402f55242e8da0f004e1515
TLSH
T1BEF0220B13D8104EF3B2A9C09BF268B1A311F9FA2C46DDAE04D1560E06E5E01A520EFF
MD5 SHA1 SHA512 TLSH

Submit Download

18.reg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\18.reg
Size 602B
SHA256 985915abe5c9aebf95fbd202b9533e411adaa39039451b118092d6d412639d66
MD5 badf49687c16ebfc807349fe1c3f9b4b
SHA1 26855e1676d97da38e8427184851df4299db8877
SHA512 ade42fca98652f387319c31f16cd95b2d58b8c93f94fe42a3c5fed6034c5718e4217e90278a4eb5aa285764156d2c9f4d62be313a5e2e16fa04bf34d15c88023
TLSH
T149F0F62E12F4210AF3B1F581EEF59870C722B5E21C179EBE00C1590E8AE56456593FBF
MD5 SHA1 SHA512 TLSH

Submit Download

19.reg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\19.reg
Size 2KB
SHA256 3546d35ee3b010e86c3934a85410752e0c740597886d2e54069d650c79e98d38
MD5 529febfad8ff8235b36fa00dc1eb7773
SHA1 5a6270a81aef049738bb067012fc23343f156cdc
SHA512 37f84eaa4a19cd993bcbdea342c4f452f4183bedb0fa51b8a8e243c79eab1f8cea7349a03fb2115f676009916e878ffed518ff2b830b039898f6a1a9bf535cb9
TLSH
T16E51391AE7F82149A372ED41FFF29463D76A7462381ECE8E05C05B0A04D2E01B422F7B
MD5 SHA1 SHA512 TLSH

Submit Download

2.reg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\2.reg
Size 1KB
SHA256 de1957a256cce754c57ea1b1cee00fc9c5a9e555195d28202f35c643dafbed54
MD5 a0986b973375bde254a407916aad0db6
SHA1 631512532a90b400b499380c9bdb0eda233e5934
SHA512 e43a6c7109e297672647ebe47295cb131efe06b814229d8b07d4417f25ab1303df7da0b65414e7617910756b71646b36d267e44c28c35ffdbfaa5469c264dda4
TLSH
T17611C47ED7D2255AA2726E50CFE34463F6567843382ECD4E00C2270908E2B56A9F177E
MD5 SHA1 SHA512 TLSH

Submit Download

20.reg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\20.reg
Size 426B
SHA256 c76dda88c9fd35dbb034d9d1c4924fb508afa528874c64ec9c7d8a2eefadaefb
MD5 758f387657210fc85373072b18ac5623
SHA1 ca1e78f0495ac1dfddcd21f5b0a4edc62617bae4
SHA512 5fbb9c5c4035cec11c87ad59e9614d5c68634bfd313720ed4fae442b61453ce0f7a8a54a93f9337a753d7e938720cd593d7a9a2208168ba032f0e84946fa4b1a
TLSH
T18CE0E5012BF81409B3B38E409FF595968723B8942C29C88E0184020E04E2A42D421B7B
MD5 SHA1 SHA512 TLSH

Submit Download

21.reg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\21.reg
Size 586B
SHA256 ed0b2a31ba366ebb83d37dfd1a9124c3803657ee456dcaf9a522222b15a439fe
MD5 d0f14cca308ed3e4530f9cc695e7e374
SHA1 07097c32083d9f076c0819de5cbe26df67bbf14b
SHA512 f283a29e2813d03bba8a5b20a6848e4d95318341cc6714ee510d122bc5ec833aaf149f139c9314c902c91d19d7577513981d4f0cec07ecbf418f77a208ac5e64
TLSH
T1CDF0241217FA2005F3F39B818EF0E9A75732B9462D29C8DD12C01B0E08F0A10E532BBB
MD5 SHA1 SHA512 TLSH

Submit Download

22.reg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\22.reg
Size 598B
SHA256 c98e30657eb32a7df3fcba1e97af12cd34f4b15ec4d1fb8f764d84aeb17efc75
MD5 ba5e51d756864ce57e8b954e2a0144b2
SHA1 1546de12611396114a1d705829e6205099dd4d63
SHA512 82950a469e00cd242308f6daca1ae34695b491fc383735acfcd196d83d766b32f5933a28893287b6d5ffe1560fc7a5db5674a3b2c7f9e0cdc29eec34380189d4
TLSH
T11BF0F01217FA2005F3F39A818EF0D5A35B32B94A2D29D89D12C01B0D48F0A10E832BBB
MD5 SHA1 SHA512 TLSH

Submit Download

23.reg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\23.reg
Size 590B
SHA256 e7fac21546b8cba3765f64b04db1ed176477c93e60a270a623f93ab1bcf6cef1
MD5 2a0f77f2805d3022590f473ad2d84c63
SHA1 ed2abb990a43e9eb18356bc9e3766ed7730fcb2a
SHA512 28ec0ad20f42605f17f17832d9dfee6935a954d28c5728f13b3e3036c7985add4606b47588fc5da6aa09e0a5912613ae9a512d76ceb26ac271b11b28a5088fdd
TLSH
T1F6F0F01217FA2006F3F39A819EF4D9A35732BA562929C8AD11C41B4D08F0A10A422BBB
MD5 SHA1 SHA512 TLSH

Submit Download

24.reg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\24.reg
Size 450B
SHA256 016adac42518b206807cccef9baed5866e876459b54ad92263435ae659866b10
MD5 223064007b52b884397dd5b92b923e73
SHA1 fa63be447d6d961e187860f607af028ce717d7c8
SHA512 e17d6fbc7ef1ad4351e4e90b1b2418ee4bfd36c3d27e7a054072903b6e7549216b3ff054cdf9f7bdf40e81be583440e88310084bae1720e7c40cc4d34d609931
TLSH
T1C2F0A0056BF81509B3B38E409EF595A68726B8A52829C88E0194020E08A2A92D421B7B
MD5 SHA1 SHA512 TLSH

Submit Download

25.reg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\25.reg
Size 610B
SHA256 9978d0b45340f569ded2d8db8d18c67d8ebc3df5002cc2c4fdef72d0a54e1f66
MD5 a05d74dd8326abd3d9e86309d7480607
SHA1 26144e2bda218227893d665e226d212474f794cf
SHA512 9ac81cda614f4e34a3605968384cf0ff3db9c3548d32489dcccf9e6a50f3e8c1d7a0acc1e3901bb0b7a4b6ee0ed20dca324a610fe9bbd7560eef36c75ca4474b
TLSH
T165F0F61207F62009F3F39B809EF0E5675732B9562D2588DD11C40B0E08F0650D522BB7
MD5 SHA1 SHA512 TLSH

Submit Download

26.reg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\26.reg
Size 622B
SHA256 7b4d0536cd8e87061e1235660891d9fa95ec9f1aff2a5142ec5bfc90e6c8d225
MD5 44d1c5884e3d315d808a0eb762dc226f
SHA1 b0cb3db77313277a00f064596736a32602e95b7e
SHA512 10bef7d191d2a918ee82f79bf1f22e2a77d8a87e3cad3be9137e8efeeb540efa29e2951476d0f354785776af64efaed7d46e489a595dbc0419f1a9a7a7d5902b
TLSH
T125F0F61207FA2109F3F39B809EF1D5675B32B9562D25D89D11C40B0D48F0A50E932BF7
MD5 SHA1 SHA512 TLSH

Submit Download

27.reg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\27.reg
Size 614B
SHA256 e65089496cdb125c11afc6d942312eddbfa9cdc4c7f290bba625fcbeaffba1d5
MD5 0ffe8cb2d27f26a4bdc2d1da92c5c802
SHA1 0cdb2946053dbbfad5c10b2592acce7fa7fc0078
SHA512 02989989d34244474d905cc8d27f24f675577c1f2ae4b696c9a7e143d0c5c67710d103eb14d973f0a54dd7c8042d12109ff50823f08a2a1d7fdd0546bcdde2e6
TLSH
T1F0F0F61217F62006F3F39B809EF0D5675736B9552925C89D11C40B0D0CF06509522BB7
MD5 SHA1 SHA512 TLSH

Submit Download

3.reg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\3.reg
Size 568B
SHA256 fdd20d7eb4825b186feec8cb4e2cfff79625efc3a93e3054b5a7b3290f14b3b4
MD5 deadf966eaf555bac733d854d93a4c08
SHA1 50cfc8b61e57ecff716eb32325fbcb3f47125c2a
SHA512 6052230ff1c34590834706c6c790f96b6bad072e4e3edbe03e8ce7cb9d7d72ca65df7b9de89c47eaaf053f21bc30714a6b67b6d594d561e7bc6362c6b42c675f
TLSH
T117F0BB662BF82115F2732EC29FF598619711F5B52C26DAED0481590E09F0D114562EBF
MD5 SHA1 SHA512 TLSH

Submit Download

4.reg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\4.reg
Size 686B
SHA256 57a6b2da1ab04e89c495a742ac1ad69f6e2cd954acd4d1723eb5da8f75a7a3d4
MD5 14ee58efa4c4cdb2c5e7910a207c2984
SHA1 779bb36b156b9253e2869965c808343301d6374e
SHA512 117478cac12b1a60cc0e37a229884c2e62731cda7089b109a63400ec9c5965967b21a93ecbacf4ebc28c93515efd71f1b520b81e8798fdcc387ff89a2b3daeda
TLSH
T14D01FE2A26F82109F2B6AAC0DFA5D911E751BDF118168F9F00C15D4D04E0E116593EBF
MD5 SHA1 SHA512 TLSH

Submit Download

5.reg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\5.reg
Size 722B
SHA256 9714db68d1185f085d562995109793f2be90ad1e9d2121db785ba4bcdc23c828
MD5 1277f295d22fb8c566c2992da87a3c4b
SHA1 43a9c12e84934ae4c90d6d640c277866252cb21d
SHA512 2f79b556bf62ac3e523d88b35ffe92b98075ea3e79d748aefd10e3ce58a53c38ae079534c5e28e3643645413b4a2800c75c590920517d3d1183ba3eb442b5b5d
TLSH
T1C001F75A26E42059B333B6D27FF1ACB39752E6E21D1ADE9F00C2174E02E06012122F7F
MD5 SHA1 SHA512 TLSH

Submit Download

6.reg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\6.reg
Size 564B
SHA256 028895e4fdba5c72fc044a41724ddc10b857d745945b253d0738fd5b019eeee9
MD5 d25ffc4e6a2646f830a0baf68444058b
SHA1 ca07f52f5cf4acc0752e35d82cfdc9a247b2f4f4
SHA512 d64dac8b5277915886dcd2c50a2ebc7de1f139bc04d821c99d5e8351780bb3dd4d09e011702023542191d38bd90405892a5693d2c1c120278455feaafd481124
TLSH
T1DBF0BB7E26F42045B2F3F9D19EE9E8709711F9650C19CEBE01C2550E05E1201A1A3FBF
MD5 SHA1 SHA512 TLSH

Submit Download

7.reg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\7.reg
Size 574B
SHA256 d82f839ba4c03956146365c1af07ea6b7d5c2a76a71d7207574f025e4a3ce0ac
MD5 626b5e08ac9b835f119d186aef361081
SHA1 40890ba5557f5e2e1476b9c318504edeb5aafa87
SHA512 203886e3d0babffc5cc4aaeeb405673e9d61b9bca68b5647818206b9428156a016d16e7c6d17dd8d1fcf928de258104331591281ee7d9c76ee6b2717f6f042f1
TLSH
T17BF0F60B23DC104AF2B2A9C09BE2A8B1A711F9FA2C16DDED05C1550E06E5E016521EFF
MD5 SHA1 SHA512 TLSH

Submit Download

8.reg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\8.reg
Size 554B
SHA256 a14730c23659ade4f0cffdc52ae7cea02dc6fd62dcd3b754921bff9741a59c44
MD5 244028d10b384a872013c36ef6d20e2d
SHA1 46ff537b411c9807d2e93d669cd00e95f7185777
SHA512 ba3164aba7ca50c354dd9dfeb55241b6ea61e67bddce62dfd82ec606945c995b11d6fb7269c292f5ab9f0b0adb2d0a304accb2247d0b2cafe6aa3d9af3da8f57
TLSH
T164F0902E12F46109F3B2E481AEE598B1CB22A5920C169EBD00C1690D8AE59056593EBF
MD5 SHA1 SHA512 TLSH

Submit Download

9.reg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\9.reg
Size 2KB
SHA256 42509ab4c082d8df3b10e7bedb2f302d4d379162de2fb9d002f128979fb6b3e6
MD5 e9dc341d483493ef8451801e1bfd9cfd
SHA1 e3db36d336b2b664133a4444808331de10a12453
SHA512 dc980df018faa11045a998d2c262ea5ee923a563d2a301075d007807ef30489e67482c0bbcdfe0b4c7af89fd0a97d8cf395c2304ada26908b356975c643d6d48
TLSH
T19D51F75AE7F82149A3329D55EFF68463C7667462381EDE8E05C06B4A04D2E02B423B7B
MD5 SHA1 SHA512 TLSH

Submit Download

Delete.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\Delete.bat
Size 174B
SHA256 64524841ce583e5b87cef80ea1f40a19ac4b62e1c144639b59bea4b2059c4404
MD5 46310e871b53d81f9dc8e8662ef8a9d2
SHA1 396b8ac4f1db47aacfbc1d7ec212e5dcdc96940e
SHA512 aeb6b9fcf8f160746217bac0738e2a9d0dcb208eeb48e71421e40a966169235ecb1a05c87b73d6ec13cb8c31b2e7a0272993aafe6da8666419645363375c653d
TLSH
T13FC08041CC3388027B1308010017556DBD0DC187745B9B1879E0685C77DECD4DA9D5CC
MD5 SHA1 SHA512 TLSH

Submit Download

PowerRun.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\PowerRun.exe
Size 919KB
SHA256 b32b9fc9a4f11f62d7bb2cb462d6a57846bc156abf88824cbed1a50b486a5212
MD5 91e2bf4d204e9cb6ee90282d4d96e530
SHA1 4c21625e2ad7bb78aeb931585b13041a8e142d43
SHA512 26f2d280e418c5de6970b0e8411e5354c2c937cb5fa7a998ff0514a886db8b0676ea976d2d09640a14e829326789640060d3caa4acc2b4cd58c23bc720faa837
SSDEEP 24576:Z2DW/xbMX2YIbxQsu3/PNL7Q+HyX59AMN:Z2EgXoQsW/PNXQWS9tN
TLSH
T1C4158E59F6E454E9C47BE1B6CE46C22BE2F1B809437597DF02A04E6A1F23BD06937321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Task.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\5RegFiles\Task.bat
Size 233B
SHA256 060f4ab29dc4ebdfed2995aa929d1cbac6d2438cfcc0bc0a08b86a52f4b95b2b
MD5 d6c72755de7b6dcc596e27fa604b398b
SHA1 2e617df61e3768d13e722fb4a0e899f503bebaeb
SHA512 cc85a191c9d8a7d4f761094d92998030d31e0be39abc21bee4364222c761dbea2d6c834fe27cbcb06578198a0a922c4b23c345271dcedc12ea29bf50956f07b6
TLSH
T173D0A71A9C0354E613A88EDC4A16513D7C3B505363065E507241D7B467B45D8599DC9C
MD5 SHA1 SHA512 TLSH

Submit Download

Copy.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\Copy.bat
Size 365B
SHA256 aac3a5d9b9512d693e98a14d53dc51ed2cd8e5df6aac2b1aea05041b05e4d496
MD5 f2a91cededbe181724280b782e83ff78
SHA1 9a8b795fdbf6414ac1b89bfb18626dcb52fda522
SHA512 372c96af38fd64b559ee7e6b7ca545ac19a88c06528a0e997e52776cea3f8a3093309d4f82e011dad1b1fb4417554df090d6ea322cf1fc1bec8e1a607c76384b
TLSH
T132E012944B52A5A0F6796E80114E9359E738F11BA102BD33B19C1298FE860018E328DD
MD5 SHA1 SHA512 TLSH

Submit Download

gameux.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\SysWOW64\gameux.dll
Size 2.3MB
SHA256 afd55b15352eb7e878db7b0ce9fd7744db135808cbdde26f95c3f628c87daefe
MD5 a722417b878571895e6e3c0f85247b86
SHA1 972e71adc40e7503b55a955b0b51c6b291f8e826
SHA512 dd1e615da8fc9aed5d894ab68231b3070cdeaf558344852b85d3c646e10332703e1e66e81495e564c7e122548b06dacd017beef920b29f1aa7639ff1242364fd
SSDEEP 49152:o6zdaqDIknoNlBYEFuuVjlnwjCHz4skv:BLD9oNlBYs9nwjAlk
TLSH
T121B5A1F9ED527048E0D16AB2AEB7F944AAC854191D5300F22F10DBB954FC0BA352ADDF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gameuxmig.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\SysWOW64\migration\gameuxmig.dll
Size 29KB
SHA256 39e4b7bc831b8428eadca2ff9ad714c2ebd3911d045358460191320d03a09f5d
MD5 1b5dea6324d190ad664d5cf16d253795
SHA1 7f659888a7abc7ea87e10fc57b000f0b159aa60e
SHA512 54e7f759c7cadf82434ce7f5f6cdf92441d336db669562d7c998e614d1df6beed6bc610e26a587875d31c67c30e2d12631c0cca7f90de5bab503518504308309
SSDEEP 384:XJ+qNd7MjhZ654jaThSeP3yrAh6xsoJHkhW5hWc1rFDBRJnvQVlDbNWR:UuxhkzxFkcJ1R1PnvKpWR
TLSH
T17CD24A5197988062E3FE3930507EE52A2C3DB7510FE080D7192BD6DA2DA57E2EB3436D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameUXLegacyGDFs.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\System32\GameUXLegacyGDFs.dll
Size 4.0MB
SHA256 def32eb30b1966bd9dae4e8957d58a3a1a4799853303061997daa397a6f639d1
MD5 af8b5eed282a43da74394f5cda2af797
SHA1 052d5cf75302de7359cd8aa4a48047d6325ecc0f
SHA512 4a58c1a1b4d5c2552f3a4cd17f5f7ca8a4d8a1d422c53f5e77f413f6f2f52dadeaa091aa8c0a9b99b67dbf5cf9f0a28fb6eea0831a06d33fac3e214fc3608194
SSDEEP 6144:zjUc4opJX+UNWxQ6H9asS1ngKrEE7A8Tm97VW3wYLIlQCJ1sojCQg/Jjz:z48JXIlwsS1gK40Ap/W3w6JoJg/
TLSH
T1821604171BEE1129F0F79B68C6F54065AE67BC422C399C3D109D290D9BE3C429892F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gameuxmig.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\System32\Migration\gameuxmig.dll
Size 34KB
SHA256 17a6ad0fda10b0767ca5d722a2c680073dbae788fbabac310fb9173d7ad2c562
MD5 db3587598ae40cce42d8ecbcf734d75a
SHA1 9652c70ff48205bf1ba4c3805d94c297f6909b83
SHA512 e65a326cb58c990ab8f93566cd4c1acbb3d06a16ab83ca679e674daa7ab47c78717902ae8a97ff18111067ab05b37decbd6ab634d6a071bb308c41a6dde82629
SSDEEP 768:k2wofzqJcFNv5/MRVxNbxKaYCZIwQUtFUtFR1Pnl:VH4zPdKaYCZIwJtFUttPl
TLSH
T17FF26C92777D0099F56729348AAB9503F938F3552B3096DF4025E24E1F273E1EA3C72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gameux.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\System32\en-us\gameux.dll.mui
Size 18KB
SHA256 4a96dbdaad707ed4e30f3a06deadbf3797dc86c74a20acd248d15901aec70a47
MD5 a7b4072aaf614050f86e9e67d6295e10
SHA1 194cfe328547d6e273c3a0ff45c3d408dfee258c
SHA512 022fd2756d81163b899dc926e83d6be796afa7de9a611db47232bc60e6d7d8afa34458d61e6050d848d66534b4c6e2d55d5037e0028d23cfbe3d781608cd16c7
SSDEEP 192:38nnQnkrImzUMWZpWn1qK7y33le3BUnGEAmfTq03kGDoS8JWb9VWGR:snQngLzUMWZpWAAy9FqZGDonJWxVW4
TLSH
T122827741A3FE4258F6F77F706AB616A40A3ABCA6BD79D31D1600214E59B1A50DCB0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gameux.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\System32\gameux.dll
Size 2.4MB
SHA256 3c507b8345c87d3b285a332448c2d9f55a0db7e66b619b42f0d700516ef4c485
MD5 c1fbc73b8d0e5c88474394494d2fa5f2
SHA1 720a021b0e8bb5f8fde8dffe1e97edb61f28b9be
SHA512 c8c68d9ef76e3deb3da4807a76f3f58f08f72b8a5fe2be09c72404b14d55cda9cb00066310d14b6adcd1cdefc5015861c2c719079908d51ba2f9a25c6eedf373
SSDEEP 49152:OWDjrKA/5/WoTNlBYEFuuVjlnwjCHz4skv:bjrx/NlBYs9nwjAlk
TLSH
T1BFC5C4F8ED527008E0D46AB2DDB3F944BAD468181E1341F61B10D7A90AFE276352ADDF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aut7C94.tmp

Path C:\Windows\Temp\aut7C94.tmp
Size 25KB
SHA256 ebab45d654e0045a4e77b90e72cf3fa9bda53f6dea616fb12c236422444dc966
MD5 29659ba808d43ea5b70ebc22cdba1569
SHA1 2a7c0fcbb02671e9bdaa55dfa97883ad795a815f
SHA512 9ead7ed60e0db9de1161e8f4f0bc34ee9796eeb4626ec602c9fa2912288a310a7d81a8e0b87f36c695e972b456c352d2c5e1206b899b2a69ae9414fda4a1d823
SSDEEP 384:w11w9WE5PrDDlQcEscW0lCMeg63bcS9Axlgj4xQI7X/J/xGPYABa20Ee2U5ghnla:w1O9WGDlQjzNlHV6rWXXVgXfjz07Yuj
TLSH
T115C2F226C46C80F27B70FE5C214953AF4AAD5C37E934A17424513227E5E7D76E3A3B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fibioxz

Path C:\Windows\Temp\fibioxz
Size 86KB
SHA256 5e1f306e445d100325bbc23f98f2cf3cf659f5a37ccbc973c58162d830224c9a
MD5 618b8d4d2820fec05f1a645cad7f7fb8
SHA1 f18704363e3eb312abf50c4a06e9092d0bd16fc3
SHA512 2242e3d5ee0bd60061dfebab2480cc5efff3801aaad25af5eac53dc2c2197320eb1bdf5f7db681cf7eecfa226d9a0bdc3c95b988187b5d2bd3efd8d142dc27a4
SSDEEP 768:q79WjjIiFWzK2BnXD3gtbp4WdycHXClIwVShy1R2xUIijEao3:q79sjIiFWzK2BDgtbp7yc/hgRsU5Bm
TLSH
T19383CDE0A152D0816C1E354DF18A398F4B16346BF90F9E025D3E79EB06FD64A3A5887F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download