ca6c0e897ec688685722335f6417215b52e7380bbb9ced30093431a4b9c0efca

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 14:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 5.0MB
Sample261027-rkdh5adx21
SHA256 ca6c0e897ec688685722335f6417215b52e7380bbb9ced30093431a4b9c0efca
MD5 7724f07646f91f156c5cc42bb26f3c52
SHA1 9275944af7b70156e5c9d80800d3195285bf5c8c
SHA512 1b859a4edf84fac69d00af25a332681d9adfa91a57aaf82dd25f88031526dc6cb040a630ceadc88dba1a51c20415cd2456c059e51df431b3938027c23f28f137
SSDEEP 49152:s7JynhJaeICCMw7Y9odSfYFyfFj/Vgrvqzbut1wOq/eRgXUeT+uXEkjNEEBHLuaN:Esohu9Ma+uUkjDBHLuMwZYbJzl8Nw
TLSH
T1AA36DF1AA3E406ACE0F7D679CED6C553EB76B80D07B0A64F029098664F772609F39713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery macro persistence ransomware spyware stealer upx

Malware Config

Signatures

Suspicious Office macro 2 IoCs

Office document equipped with macros.

macro

resource
behavioral1/files/0x00030000000006d5-525.dat
behavioral1/files/0x0004000000000703-526.dat

Executes dropped EXE 22 IoCs

pid	Process
4884	alg.exe
1316	DiagnosticsHub.StandardCollector.Service.exe
3344	fxssvc.exe
2412	elevation_service.exe
732	elevation_service.exe
3216	maintenanceservice.exe
4964	msdtc.exe
4808	OSE.EXE
4428	PerceptionSimulationService.exe
2432	perfhost.exe
4680	locator.exe
4780	SensorDataService.exe
1504	snmptrap.exe
2824	spectrum.exe
4672	ssh-agent.exe
752	TieringEngineService.exe
3096	AgentService.exe
1020	vds.exe
1764	vssvc.exe
2948	wbengine.exe
3780	WmiApSrv.exe
4912	SearchIndexer.exe

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a96a72c49b11239b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0001000000017049-530.dat	upx
behavioral1/files/0x0001000000016790-537.dat	upx
behavioral1/files/0x0001000000017037-536.dat	upx
behavioral1/files/0x0001000000017814-535.dat	upx
behavioral1/files/0x000100000000c537-533.dat	upx
behavioral1/files/0x00010000000232cf-532.dat	upx
behavioral1/files/0x000100000001742f-531.dat	upx
behavioral1/files/0x00010000000232d3-854.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_126703\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a0ccb2a21d66dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000680b16a41d66dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c554dba21d66dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b917ffa21d66dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cdfee0a11d66dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d33439a21d66dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac4dd0a11d66dd01	SearchProtocolHost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR archive"	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV"	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0"	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\""	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR recovery volume"	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\""	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,1"	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0"	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive"	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeAuditPrivilege	3344	fxssvc.exe
Token: SeRestorePrivilege	752	TieringEngineService.exe
Token: SeManageVolumePrivilege	752	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3096	AgentService.exe
Token: SeBackupPrivilege	1764	vssvc.exe
Token: SeRestorePrivilege	1764	vssvc.exe
Token: SeAuditPrivilege	1764	vssvc.exe
Token: SeBackupPrivilege	2948	wbengine.exe
Token: SeRestorePrivilege	2948	wbengine.exe
Token: SeSecurityPrivilege	2948	wbengine.exe
Token: 33	4912	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4912	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4912	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4912	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4912	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4912	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4912	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4912	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4912	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4912	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4912	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4912	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4912	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4912	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4912	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4912	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4912	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4912	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4912	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4912	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4912	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4912	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4912	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4912	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4912	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4912	SearchIndexer.exe
Token: SeDebugPrivilege	4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4460	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	1316	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 4624	4912	SearchIndexer.exe	108
PID 4912 wrote to memory of 4768	4912	SearchIndexer.exe	109

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4460

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4884

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1316

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2856

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3344

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:732

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3216

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4964

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4808

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4428

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2432

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4680

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4780

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1504

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2824

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2040

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:752

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3096

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1020

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1764

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2948

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3780

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4624
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Direct Volume Access

T1006

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 82f28c64a19ca1b6e6eaffe46738373e706164fdae3dc3198b1b0450c73e52c1
MD5 82a3539996496f0696912071cf949d44
SHA1 b63a4776ee2343e6ab094d47d39920eed96bf7b5
SHA512 2cee3c244fb65ac018352dfdcd4a36e6d447cce6ec8ca86365836085a1f512125fefd6bde4b44994b72d0cad4394a60c199fa6ded76efcb5a2028ca8880a3fa1
SSDEEP 49152:Tb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnPT/M+w:x3q6HjB4w
TLSH
T140D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
Size 820KB
SHA256 69bdb7e7e3962afbfdc7feb755b2b2feb5f96ebddaad24b6de8a1cdd008b745a
MD5 738e25a7cec11b3aae45104bb6faa0df
SHA1 05eb7e38ee4a61340bea66ffe66d0033af0c8f80
SHA512 97a7adec1cc6529acdcfc4dd917d09b11a2306d93dffee25a99303a2e407623c8cae3335400e17a2cb9dcae31c79d1a55ee1817c13ed4b1ae24f6fe0431f26b5
SSDEEP 24576:gTZLslqau+VsDexVOqW8PXjj+dUZ8DfYyfcPORAEEMtgF97:gTF3VexVfW8vwyAfYyUPGdEMOF
TLSH
T10105235EDB709CD1C8A045B21C2A3B639EB6AC2708A5EE4B43467FF8E9F11735507278
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.4MB
SHA256 3c32074fde038c44781be30208b87179f836ed893fe8a06652865bc656631a2b
MD5 2783aa136a5afbcb5960f474e58c1056
SHA1 f1ecf0c93741439f2ac71d5e51061b142a9acb82
SHA512 a23201f54bd66be1c4011968fde3b4388d36487c88f7b5c70fb3cbf7a948012b04dc53a71cde6dfdf18af20c5c8048d398cd1ed3691332b573cca54042f3a962
SSDEEP 24576:nXYdDfczARoHjto1GFxlXutIs1WZX5ARFvM3yReRdqmCAzxj884:sfcFT/M+wSyMRYmJzxj8Z
TLSH
T156C52235B7E104F9ED678138C9A28552EA73B85647A0FBDB03A0D9291F333945E3E781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.4MB
SHA256 85dfcbfc8fac6f36fa902e2cf8acec604f63814ec3e5120a6b5e6cb199b572d0
MD5 1678070d2ac5d93c40988de3c41e59af
SHA1 2621cdb2a77d95abad8592ad9803cfd19f1fb24f
SHA512 4ffaeee1fba113df3c3a6d2811853b94b0314f845732c939b63696f1009cd91e9f9ee9ab40ef0b1d4e9bf4f08853ea71a8938957e64de658aa5432eedb19edd9
SSDEEP 24576:6XYdDfczARoHjto1GFxlXutIs1WZX5ARFvM3yReRdqmCAzxj884:TfcFT/M+wSyMRYmJzxj8Z
TLSH
T120C52235B7E004F9ED67813CC9A28552EA73B85647A0FB9B03A0D9291F333945E3E781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 561f4a6a92340d0f5e9efbe02f1d2cb82a641786b3e741aa4f3cea8c6e04f09f
MD5 a094b272de2f40764f1f0ad2618f5d7e
SHA1 47af758193fd399cc19e8dfe76c7e95299cefbee
SHA512 9dbac5608652d10e9911794e57ca2d6efa3f27360f594b51ea9298ea038367b412148f9883430012961ed8ec8cfc1e6edb5cdcf939ecbe1d46e37489d1edd21e
SSDEEP 24576:nXYfDtczARoHjto1GFxlXutIs1WZX5AR:ytcFT/M+w
TLSH
T12785F12977E108F9ED678178CCA38511EA73B8554760E6DB03E4D9290F332D86E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 0f4ca1cd4c5cdb3fa947599be10b828d4d648e3bb8ba8383f87f899e27caddfa
MD5 9738d53132fdb70c7b168a09f1f64366
SHA1 4d00825d6a779f51316547e7070b881e0b0364d0
SHA512 d2dbf1af0435f837092aa7dc5379d6a6dfa05aa346691a36a9bfbe582cd284e7c87596bf9190888d4a2267bd4044080e6f33eabe67d20728db30c9171d81354d
SSDEEP 12288:Emw5HEjsChNDBFgl0WDm+CWhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09z/:hwuiOWHoHjto1GFxlXutIs1WZX5AR
TLSH
T14E85F14676E50CF9E96781388597D536FBF3B8022A25D72F0760CA1B5F37220BD29B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ec9da5f9e08c64e03078c1856c8a7995ba5f25f2600c972a226babc2c3e043bd
MD5 ff2cd20f527e51e32e89eb23973e4190
SHA1 3637e5925167c2ee276d7a29ae77e589fd975824
SHA512 1ec406a77c93efe489c5ae08251fd11da6e10ba7a7057904d0d667a67a765083768ae332478b912757be3d3838df748a343ebca3240554a83fdaa14c6ec0885e
SSDEEP 49152:9B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl6T/M+w:ju6JmVxd2dsw
TLSH
T1A3D59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 02f1bec78f914620b1eedc6cbd8de2e7545f91ce2218defa47118b37df49314a
MD5 d8cfeda2fad74999bbd802f21d9dc48c
SHA1 191624f64a74157d1af3c84c6164d5a4b1a3ea40
SHA512 fa8e599a145cb617073bbbae851c14cee65d7743559b420f18fef916d23d861dde0f65e44c21ae6c4dfa6f6b5f8bdb89109d9de2faf9e9602a9ab64a446d5d91
SSDEEP 49152:IP4m4IpOO67W8KlT/M+wRyMRYmJzxj8Z:gppOOH3wYYbJzl8
TLSH
T1CCB5D02DABDC0096D0BA913486658A4AFAB1742E1F3286CF1160933D7F77EE54E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 518e17868352b503dc1fdb75b0a6bda25f92bdb1f6e80241374652d263e6d6b6
MD5 9fb8141c520d51a47d4f6d65b01a8159
SHA1 5a61a98c6146243b1bcbbb012e65a38fa723d56d
SHA512 235bd2c9caf081fba499d4d64cf1b3d1217a3f7736f4ae8a7d0ba23e28dca8028947e11182c50ded0f11d0eba7fc675317c9be40e02edd7f889a13ac2ec993fc
SSDEEP 49152:3P4m4IpOO6708KlT/M+wRyMRYmJzxj8Z:1ppOO13wYYbJzl8
TLSH
T15EB5D02DABDC0096D0BA913486658A4AFAB1742E1F3286CF1160933D7F77EE54E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\WinRAR.lnk
Size 1KB
SHA256 4f031685e11efd7456d6c27d9fbe0ef56ff70f00b43c95c18cad902cf7162098
MD5 fcf37d54a18aabe49e535bbc8685f154
SHA1 216d1245514574f88b6e7314d11fae9c89a16ab8
SHA512 940e761ec912decc9e4017962658da8b3d9a9da97cf9233d1aa891a7a2ab7b3b3642234a7e47a477e3ec92c7b7c15105449887e9ce5991f9afd21ad7455621bc
TLSH
T1E911FC169ED62B21D7F7DA7082E66321CAB43C66DF956F0E004081492470A41AE75F6B
MD5 SHA1 SHA512 TLSH

Submit Download

InitializeDebug.docm

Path C:\Users\Admin\Desktop\InitializeDebug.docm
Size 779KB
SHA256 c0c196fefb2fae5fc7184590775adc14cbd84164bfe1d95f6f8d25f87d8b6e33
MD5 d02372d7adacf9f1121daf5ab22723c7
SHA1 54e63619bf83011fcc2c62031a8bf913173c61bb
SHA512 a0c64ece907afe87287f0e058f4a4ba618c6ec29825b8476d7d4e9760af33a5b0e0dede5476058695201450b9244cc9a21aa6087c56b9b2c2f9ec78f059f7a5b
SSDEEP 24576:wTE9vnTGTcFqhBM7/Sx6wFR/XnVgUg1NbZ6mgEo:wTwvn6Y0hBMWx/XfnVWb6m1o
TLSH
T1F0052331D7E6C5C3FA524EFB40C8DDD28895DDDD81BE98B0C0D2106B81C69A29A5B27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PublishDisconnect.docm

Path C:\Users\Admin\Documents\PublishDisconnect.docm
Size 778KB
SHA256 1fa5d44a67f9bc1500b22c456b5eaa9c3388a4a18a4edc3d2140d1c8de6cfd42
MD5 1dc9b119a8acce27f9718212489116a5
SHA1 930ff45ffaba19fb8a618a1e1039ffc98aedad94
SHA512 49c0c2f71cf035a151d12d9b8628fb2c448a8ed5a383a59fa78641b3180b94e60f7f4441940acefb276832a1cd894713595e922a821bfe0b81719a0b3fc56b70
SSDEEP 12288:z1i09ttKxma0+AvRpiEERqQr95cC/KQ5kVTqm4MxRP4DObA1OND9mWMY8ZPG8Bpv:A0rtdoqQr9iWKckV/4Mxd4rsQaOD
TLSH
T1200533144FDF21E7E89A07358E30A1F92E45336D4233C2AB257132956EC971E1B4EE9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 dd894788ec5b28d70181afb0e2cf03e39ebe86b96a9b511aab1e2b4dad01fec3
MD5 52ec178521650c6c5fa1ad1fc6d6eb56
SHA1 99369a2ddb1088a8ad178261563a9e95e0856113
SHA512 94008abed78a6b8138cdeb345fc54fb5fc685f988e45b72c2b41950c3bb631da1ee5f3ee9f2534a4b14a6868d4493cab8303d42a14cd1c008a129ac32d79a69b
SSDEEP 12288:JshKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERYCN:J+oHjto1GFxlXutIs1WZX5ARXN
TLSH
T19A65236399F254C7F57A61B02997AA71BC7FB3160F4410FB9B40EE190E3C060AE766D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 cc275034f9b47909e4fad797bdab5a6422e760e17bff16e17f833d593268bc2b
MD5 4c6adff804799e50080de566fbdd7388
SHA1 98b9f00a85db647a109a9531ae3b47d468b545ca
SHA512 edf47be6c3dbb1fced909e2a0c09595845dcafe928dfee4e2f6f4af23401150cd61f40d24c2f98719cfb461054bc6df5cc038f6ceba0f1245f8c87d4af269816
SSDEEP 24576:xoiQ0h2Hm7EkuAK3xV3tk3tLjN2VMbxR86mHx/YY/izSI2sBu9EzwwXg/b8oHjtq:xa0h2GEkuAe73q3pp46zwwQ5T/M+w
TLSH
T1C685AE1E67EC82B5D0BAD278C9A6854BE6B2B4260B3156CF1150853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 2.5MB
SHA256 c80de110143e03cdeed3be203609c182bf25b91897502358ac717845df132268
MD5 8119d008b36b244ac51834df7e2211a8
SHA1 6379f71a1f94600bc2fe6552cb92761a4c743405
SHA512 f8e3c228c6854092862ef9e4feda28c9b80c6a2f83d988d8671a430d30b2eadeabc99526dc2781fa2feac27bb33457024434a1e54d652bceccd81a7d0da14ada
SSDEEP 49152:xa0h2GEkuAe73q3ppj6zwwQ5T/M+w9yMRYmJzxj8Z:xa0hNYGjJwWwEYbJzl8
TLSH
T1A1C5D01E67EC82B5D0BAD278C9A6854BE6B2B4260B3156CF1150853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\System32\AppVClient.exe
Size 2.0MB
SHA256 8580e2b3d41e41f433a31d4d273257533277a35dc0f92363c3ad5b244da0a4f7
MD5 39a57f3d747f299ce96203c665a3143a
SHA1 dd99222686d66be92548e052732bc5aeba651e7a
SHA512 236228e682325b39b87a6264bbe0f184c5cb46cbb103a7a1b9c3faa09fb06f4888b2d4e56e08f958a74f34da2fb57f9e05bc243685ec9ad6dc9f9856c228ebab
SSDEEP 49152:4TDxR+N5YzTfjM2T/M+wNyMRYmJzxj8Z:Uu5Ww0YbJzl8
TLSH
T127A5E12EA7F915E9D1BE85789B23C512FA727821073193CB42A0C13E1E3B5D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 3d8cefd8ba52ccfc4df03995210121b94240130d7c4aacc62bcfc4eab3c0d87c
MD5 9b1af32da27432b7f4136d00d0df9895
SHA1 8a275746d320ccca4d7ec014adfb592a55d05b89
SHA512 9b83efb029128a55bed5bbde1940b086974be44a89366108b5368db3be77b521f789a5a3e2582719b305ca95531451bdd12ec3b7ae825786d4cd325b8b74d02b
SSDEEP 12288:shbHjfX5hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:shbHjPfoHjto1GFxlXutIs1WZX5AR
TLSH
T18575017E1AF920DAF131A1BC99839606DA32B926171163EF1781C23E0F3B9E45D35B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.9MB
SHA256 f5f4d7afb7d4fbda6d1fb721d23ccf74f59fd02c204d16d83a6596c229718da7
MD5 32e07e8110606ca97f3aa96cfe6b0978
SHA1 778dcdfccbcdba534ade8ea83862ab2c395e97eb
SHA512 05f42443d486659e1cccc21a09f6ff6a15d2903318520c251075783d16aace70adf1a85b1585ddd479fa54ab12908587c6f02b65e0dc6db4366b811d356f181f
SSDEEP 24576:G3rgf2cRTk4yti+R5dSR/HoHjto1GFxlXutIs1WZX5AREvM3yReRdqmCAzxj884:G7gf3Tk46pSR/IT/M+wRyMRYmJzxj8Z
TLSH
T1AE95E12EF2F910B9D8A6D136450247B5FB71782E1F209ACB0170C538AF1AEE85E35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 22f37787aaad7e28353dcf65cf4a767503ea924a5c3a5ad3a22c6ce0e1be99d5
MD5 0ad3c29ddbf225dea79fe35844b1026d
SHA1 40a4124bdb0250ec7f15360ba56e5ba590bff77a
SHA512 98aad82a7792bea8b4d37d4d32ad2c4646d2b68f85f211091f61667f17d49519dec983fb2e41931e824d8de4f82679a4d134a873feb4e4de25a8c14e113e75b7
SSDEEP 24576:G3YgnJcRTk4yti+R5dBR/HoHjto1GFxlXutIs1WZX5AR:GIgnaTk46pBR/IT/M+w
TLSH
T11945BF2EF2B910B9D8AAD136450247B5FB71782D1F209ACB0170C538AF1AEE85F35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 5bcfc16e3deafb80fb6cba19736ff12f6127a07180a44a3f40a1f4ce111e1d0b
MD5 e89e8b6d2908da06a19d24e682ae8bc2
SHA1 64b5812b6365cf541dfe3533995e0b1dbd3f5087
SHA512 803133a6ad289637338c29af57ef7c5ceba6aac938c07dc7d281a5cd6e0e5a4371fdd1b723bc1e1ce8fd88a3d8bd728aac06a7626d1164bbcaf1de84cb7b8a9e
SSDEEP 12288:MghKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:MSoHjto1GFxlXutIs1WZX5AR
TLSH
T1F965236298F250C7E63552B02DC76A65EC7BB3061B4920FB8A50EE190F3D0F4BE766D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 8dafc684a552a7306b418d23ff9271a6c744cb6d5672f97f0f90467491c455ec
MD5 8c4b35f5ad272d4abd49c047cb8f1017
SHA1 284aa535a2a759008cbb5954ca40f1fdb7bdd08a
SHA512 d60f1bfa4eef6cb42419c5b25e1b0acf6d959c4ffd0b003836d1c5ad2bb517eda15b4509927041b77700264b79f9768df23e05688db3693fe2820f56d9a78ffa
SSDEEP 12288:VObbA4LWOsvAYFT3hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+J:SPL3UTRoHjto1GFxlXutIs1WZX5AR
TLSH
T103950155E6E100F9E97B913CC9A39A12E672B45D0764E7EF03A88F251F232E14E3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 51bc0fdacba7d6189a14a78fc1c298b3cbdcf63ccc713c3216f5ea1b2e5a9245
MD5 85c16faa540a38891bc4b9c0cf92d193
SHA1 0f0862be0da8171b306b5898996f9b8d0b42d301
SHA512 3953addf963b48f26c6717ec70a38ab7fda2701b5991b4d7a8b9ae6543c460108d6bc776f3fd73a13134620afa82eca94cf29044c799f08e7a9c3cabd027ade9
SSDEEP 12288:ZpFtfO7hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:vOFoHjto1GFxlXutIs1WZX5AR
TLSH
T1D775022A36E910E5E136A17C8A839359D772B466071213EF07D0C53E0F77AF86D3AB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9ac5a7e1d532bd6e7bd44c54d5016116a433e180916d1ec0f9d91e227f03a976
MD5 af637455a6932953e8ac0f856790d1df
SHA1 398332a491b62fff3cc91abbb5e1a945153c3b94
SHA512 64ef6fa621e3c2bcd96feb3c52acd2fb2c2681996a2fabd8c9ffa75cf08d8c2cfdd7c545c15012c1393a348fa54b558e3c7e957ea2dee95f167c9ce3b7ea4cc7
SSDEEP 24576:I7NM9YqZqmWMUkPjZM48Mv6bEhsOoHjto1GFxlXutIs1WZX5AR:I7cBWMpPjN8DbEhgT/M+w
TLSH
T13C65AE2E6BEC81D5D476D13DC9E28205F6B2B4611B318ADF1262833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 b2f16d4622cd166b68cf14e6f6b586403ebf166cf5b19736890e049e510d2322
MD5 fa957c1b6177938826eb575d22118cf2
SHA1 d43ff5faa53da3a0fa6be61f493155b231930994
SHA512 85cc43842e2c02fa630f439ca2e3b02c678cd5f8396f4ab329294c4e7728cd4333a7ad34593cf7e2dad669fca879f72239338587bb7e02da4cef9c24f2599469
SSDEEP 24576:IW6BApg2YuyuNDYTabvcdvNYf8km1koHjto1GFxlXutIs1WZX5AR:IF2YuHNETovAvNYf8kmPT/M+w
TLSH
T12C858E2A27ED80A4E0BBD27D45B7D246FAB2B8511B3055CF0255862E1F33AF45D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 613530d0942a7ead899c940dc0e9b89a336bcfdfb3df79d39ef11768896c99ce
MD5 9eb82dd61d708727cdbb228507eca049
SHA1 9e8146f0f50a5c7da4764394198c0c8ae483ab08
SHA512 4c7582b5ec992199863b9e8eb238578e86a9f52b6a5246982d29db146f7037782e4f303f45ca568b1973544882733ed6d5ec6e0e3f52be8e6cabcf94e0e81a8f
SSDEEP 24576:wAFs06+Omlf3NXEbToJoHjto1GFxlXutIs1WZX5AR:FFs060lVXuZT/M+w
TLSH
T1DA65AE2F66EC00D5D07ED17D8A97C91AF6B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 2dc99597ef09093246679bc2472e54c1a337edb97621ca0196cb4d25acb21425
MD5 e27f846a7f225265a5fdee46e269131e
SHA1 b586f0948503ee91ffd1ccd2314c9c2d89d1f3a4
SHA512 447aadfb0861105b82b8041b71b9cd22a8a30ddcf97c69429fc5efd7966c234b8ee4157b6fc556df0f39c9bda66231cf86b3433a57f4a85e8a291b890ed14828
SSDEEP 24576:XJnJ5D3WhYoHjto1GFxlXutIs1WZX5AR:XJnJ5DGhZT/M+w
TLSH
T18D85E03DD2A410E8D4B7C2B4819A2B56FE72343D2F2269C718B4D5353F12EE0AA79F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 25a824c1c625f89f33721a7795ab8a34100f8d30b12428d03b2fbaee988dd431
MD5 c7fab2709e2a6e3c7ec0ab56ab8ced48
SHA1 7a0c7fc0bdd85b71a5a28c56c070d6861b17e0a5
SHA512 61864e64e78aa94ed57e97d4894f17ec64a57f73d912530c79ce3e3b72e7fd2859a50a077990c351fcde346102fcee6a7c01f37c15215c7232124030d348b37c
SSDEEP 24576:pEPghm6/7IIXdwcXrif7qQncjlP65i3VuHoHjto1GFxlXutIs1WZX5AR:Og06DIKdwc+eQnSt65aVjT/M+w
TLSH
T10D956C16B7EA5294E8B3CAB0C962A5159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 0851196a87d5081546c57ae08648f84716e3d01fa85009ac8357489a31479e55
MD5 d882e1ce610ed4fda32ee63dc5fe5f55
SHA1 e65646ec9fe68ef76836913bc90ad098989a84c4
SHA512 70a9e89b0998c08bb4a8c126e6002cefe98acf7dc82df27d978a7b541bbb7a96cd8df2f2123cc1537e40ea40afc943149daff382f9ba684f4dbd544ac081c911
SSDEEP 12288:bEP3RFWhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:gFcoHjto1GFxlXutIs1WZX5AR
TLSH
T1CD75126E2AE960E6E136A07C59938645D7B3F0211B5223FF46D0C63D4F3B5E42E39B90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 bfd6975a85f66c1fae6f770266782398256f44b1d3fda0d922159be4686938ea
MD5 0a2d816abe702b5889f2275ed7497c26
SHA1 b60b4fe051c2b93201c4ec1cf83f424aa73f206d
SHA512 d2480c394fd4013c7733297efc64014f721259dac84371e5ca1eed72c607e8bcce7e6e733307ef510aa7c8b54d13473de20b1e3ad8d34a8f9453a65ebd6e94b0
SSDEEP 12288:3jkyJhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:3IyPoHjto1GFxlXutIs1WZX5AR
TLSH
T1E075120567E050C6E67A02789EA392A0DD76BD211F1112EF5680FE3E5F3A6E0BD31B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\System32\msiexec.exe
Size 2.2MB
SHA256 7beee1ce1a6a9ff6955d99c16d88224c4a96ffc332f2c5a371a03d97791c93de
MD5 b2cfd9a1fb6979f50ddf37a37c953a85
SHA1 b8be9cd046a98cf1040fd52a7f8a23d0810d053a
SHA512 0ca48f81fde679354c7ebdde42a3588a492fa746e7550ba7453fe7f9393f3e1da481fa525729920f1b2e01b2672280dd4695b97d99bc9a5ca6cc4d70629ba1ed
SSDEEP 24576:NRoHjto1GFxlXutIs1WZX5ARwvM3yReRdqmCAzxj884:NKT/M+wNyMRYmJzxj8Z
TLSH
T18EB5232AA7F020D5F57165305B970696D972B82B1B957AFF25C0E43E4F372E0AD31382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 6afc010a1fddaadf49d1fde4a784ee9433eccd0c6a7ff7bd1291dcdcb1be200b
MD5 29aa8f84b8a32c7a4448416757b2c106
SHA1 5f7cc7bcffd2ae28ebc839a07cc9346794008002
SHA512 c00444094500c9f7f47a8eba62fdaf89e3b91274b4a8dba7146e437348303154e5a1361cc5036b37813f6cd60865de28bde4736683ee51b869f3ac351dee3e1c
SSDEEP 12288:cQLhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:71oHjto1GFxlXutIs1WZX5AR
TLSH
T1A265236658F260D7F62551B419976BA1EC77B3261B0520FF4AD0EE394F3D0E0BA72AC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 e84db7da74eb053ef492104e4446b74d8ed3070d6481b2fce35d75a118d37811
MD5 0dfeef9ff1c90c0ef50e5629ea7a66de
SHA1 62127b2e343e0cbbae2cf7ed9b186056a024deba
SHA512 41a73bad796ab73e5ee3d6f74a363ba89ffabedc4824e01f5a2d3bdd78ab7860e5ef182a6d8d19cc5f2bcde36206661a874b5c88ce40e4b1b57296d17b585a75
SSDEEP 24576:jQ9MxZKdcz9dw3GoHjto1GFxlXutIs1WZX5AR:jVKZHT/M+w
TLSH
T1CC558C2DABE905CAE177D27595A250C3A633B4311B31D6CF2448D03D4E7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 0ab25fb1cf76e61169aedd843899f0a19a8ec16c33d845a6a2058091546889cd
MD5 777229098c42db619226ad85e86537ce
SHA1 5d94cf67f25d6f99853e9618d4c3667da23adf79
SHA512 0dd7d3f3e0b2eb1eed121108317d50140889095e53299c72029c4ad6855b5b7bd14fdc94ac61d86e521c85c4f2529a012ef4857ddd7934d33f1e0bf3a21c780d
SSDEEP 12288:UyoKo2bRple9pNhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZXb:Uyoc9ApjoHjto1GFxlXutIs1WZX5AR
TLSH
T11D85E01FBBAA40E2E176813C89868745EBB3B0311B6213DB5691C73D4F279E8BD34B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 4f99a793351799a80fa38834bce72b1c35c192f2a1909386886f56c412cc3bfa
MD5 9f02e0f98289c5b67efefe0c5a589890
SHA1 dfe47bd96a2568811461a9abfab9b0463fa5a4c3
SHA512 55f637e33e7c79cf0772aadae7637fcb266697165849cb25c72b96b4f8c55acec14d5e324fca8a282f5f896a2f860064e7d0afc60cce849c6dea1717212db002
SSDEEP 49152:bWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKsT/M+w:L0zuNI8w
TLSH
T17CA57B3DA2F800A9D8AAC375C54613A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.5MB
SHA256 7b529e2b952e0208db702bde2ce8b895cd74adc71daba2864198b0d43e33e9a8
MD5 1b598795aa514e2632677768dd8b519a
SHA1 878dec40693660927a47df4b1da935067ae1656d
SHA512 30cba134656dca9bc95c82de0eed5eb69d4ed81d2f7d73774b635314b4f960c9734b72e2c22f6086ef2917ec0f9eddd5fb135629c6db3f0ff2360f13b0c3b861
SSDEEP 49152:ja0h2GEkuAe73q3ppj6zwwQ5T/M+w9yMRYmJzxj8Z:ja0hNYGjJwWwEYbJzl8
TLSH
T1FDC5D01E67EC82B5D0BAD278C9A6854BE6B2B4260B3156CF1150853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 54667848990f03495a2292eba68c689a5c88efb148e4a4a003b1bb25ad790df6
MD5 dd5fbe085c7bd4dd5823279beb506860
SHA1 e147220a5567226c667a0e97eb89d7801f48c78c
SHA512 f3bee2bf00faee6f3d7892bb01eb41b982c78f695a646aaa8e829626ad107c478341a0d61d47d3475dbacdc992c712fa82419ae96ac0f2a4867bab8fa652cd13
SSDEEP 49152:wTDxR+N5YzTljM2T/M+wNyMRYmJzxj8Z:su50w0YbJzl8
TLSH
T158A5E12EA7F915E9D1BE85789B23C512FA727821073193CB42A0C13E1E3B5D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 2.5MB
SHA256 101fa8934587b1205fc75f7403af96a864e4c1f9c9553e6ad72decabe09466e0
MD5 ceacae8be548f24da024388dc49edb70
SHA1 b7579a87913b898f1709e012e3bbe7f7ddd580a5
SHA512 49b10f2e737450fb4f3717f8d0ccb1fb877a32e5f0272ad9de0d64a30e8b4bd9f1d0c2079978e321d3a8fb63dda56d22d4ee47af2100bff67a1dfc5cf562db4d
SSDEEP 24576:ATMdOz0FFS+bmSLQoHjto1GFxlXutIs1WZX5ARavM3yReRdqmCAzxj884:o0K+bmSLxT/M+w/yMRYmJzxj8Z
TLSH
T167C5123EA7A910E5F57AD17C96438A07E97374660321BADB0690C07D2F6BEE43D39B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.9MB
SHA256 32c4b7751e68bc5a2c2419309fc1e30dab51f1beb96b687095b4ff1f8f67d7ce
MD5 6ddf311ef049d2160848eb9a2af89554
SHA1 c3edc0fa29a04e400c55186e229d2e71bfdfa7a2
SHA512 ad5f94f37c6e57f25ba48e9879bbf4a73bbf0988c4e3c13566474d27aa52366b9e02c26d1feaa8fba94ea1da97a3f5f692a7909e3367fe248b714ed6e492082f
SSDEEP 24576:T5Igf2cRTk4yti+R5dSR/HoHjto1GFxlXutIs1WZX5AREvM3yReRdqmCAzxj884:TWgf3Tk46pSR/IT/M+wRyMRYmJzxj8Z
TLSH
T15695E12EF2F910B9D8A6D136450247B5FB71782E1F209ACB0170C538AF1AEE85E35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 2.2MB
SHA256 82f2ca821c76e5235ab1fe687b8cecdd6cb9e5463c7f173ac967e8c1cd1982e1
MD5 a772160f6c2ec9d96951004a03571b3a
SHA1 ba51b748ab5e17715c7eb0254b0d75c8d6dc5e60
SHA512 fe78beb06644df67d4f506ac9d3de1f01566ed2463804b1f22bdfd5a98e1141d0068600d39ce55248a3b8ad84f1fd9ae4b0b99ff031744c7fdb250d16fa07193
SSDEEP 24576:BRoHjto1GFxlXutIs1WZX5ARwvM3yReRdqmCAzxj884:BKT/M+wNyMRYmJzxj8Z
TLSH
T13EB5232AA7F020D9F57165305B970696D972B82B1B957AFF25C0E43E4F372E0AD31382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/732-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/732-152-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/732-62-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/732-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/752-405-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/752-156-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/1020-411-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1020-165-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1316-27-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1316-34-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/1316-35-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1504-128-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1504-277-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1764-412-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1764-169-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2412-50-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2412-42-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2412-48-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2412-139-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2432-111-0x00000000008A0000-0x0000000000907000-memory.dmp

Download

memory/2432-116-0x00000000008A0000-0x0000000000907000-memory.dmp

Download

memory/2432-118-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/2432-172-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/2824-140-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2824-137-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2824-360-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2948-414-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2948-173-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3096-160-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3096-162-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3216-74-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/3216-76-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/3216-70-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/3216-64-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/3216-78-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/3344-79-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3344-39-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3780-415-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/3780-177-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/4428-168-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/4428-96-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/4428-102-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/4428-104-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/4460-9-0x0000000140000000-0x000000014055B000-memory.dmp

Download

memory/4460-8-0x0000000002720000-0x00000000028C0000-memory.dmp

Download

memory/4460-73-0x0000000140000000-0x000000014055B000-memory.dmp

Download

memory/4460-282-0x0000000002D90000-0x0000000002DF0000-memory.dmp

Download

memory/4460-272-0x0000000002D90000-0x0000000002DF0000-memory.dmp

Download

memory/4460-18-0x0000000002D00000-0x0000000002D83000-memory.dmp

Download

memory/4460-6-0x0000000001EC0000-0x0000000001F20000-memory.dmp

Download

memory/4460-10-0x0000000002D00000-0x0000000002D83000-memory.dmp

Download

memory/4460-0-0x0000000001EC0000-0x0000000001F20000-memory.dmp

Download

memory/4672-153-0x0000000140000000-0x00000001401E3000-memory.dmp

Download

memory/4672-388-0x0000000140000000-0x00000001401E3000-memory.dmp

Download

memory/4672-150-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4680-121-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/4680-176-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/4768-430-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-437-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-454-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-455-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-456-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-453-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-419-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-420-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-421-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-424-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-423-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-422-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-452-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-434-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-433-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-432-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-431-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-429-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-428-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-427-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-426-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-425-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-435-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-436-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-438-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-440-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-439-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-451-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-446-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-449-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-448-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-450-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-447-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-445-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-444-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-443-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-442-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4768-441-0x000002AC148E0000-0x000002AC148F0000-memory.dmp

Download

memory/4780-181-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4780-124-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4780-368-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4808-164-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/4808-85-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/4808-93-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/4808-91-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/4884-110-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/4884-22-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/4912-223-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4912-203-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4912-187-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4912-182-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4912-409-0x000000000B9B0000-0x000000000B9B8000-memory.dmp

Download

memory/4912-416-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4964-81-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/4964-159-0x0000000140000000-0x0000000140199000-memory.dmp

Download