ca6c0e897ec688685722335f6417215b52e7380bbb9ced30093431a4b9c0efca

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 14:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 5.0MB
Sample261027-rkdh5adx21
SHA256 ca6c0e897ec688685722335f6417215b52e7380bbb9ced30093431a4b9c0efca
MD5 7724f07646f91f156c5cc42bb26f3c52
SHA1 9275944af7b70156e5c9d80800d3195285bf5c8c
SHA512 1b859a4edf84fac69d00af25a332681d9adfa91a57aaf82dd25f88031526dc6cb040a630ceadc88dba1a51c20415cd2456c059e51df431b3938027c23f28f137
SSDEEP 49152:s7JynhJaeICCMw7Y9odSfYFyfFj/Vgrvqzbut1wOq/eRgXUeT+uXEkjNEEBHLuaN:Esohu9Ma+uUkjDBHLuMwZYbJzl8Nw
TLSH
T1AA36DF1AA3E406ACE0F7D679CED6C553EB76B80D07B0A64F029098664F772609F39713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery macro spyware stealer upx

Malware Config

Signatures

Suspicious Office macro 4 IoCs

Office document equipped with macros.

macro

resource
behavioral2/files/0x000f00000001c2c3-382.dat
behavioral2/files/0x001000000001c2a3-383.dat
behavioral2/files/0x000e00000001c2a2-384.dat
behavioral2/files/0x000e00000001c4d2-385.dat

Executes dropped EXE 11 IoCs

pid	Process
5552	elevation_service.exe
5648	elevation_service.exe
5532	maintenanceservice.exe
4348	OSE.EXE
5892	PerceptionSimulationService.exe
5520	perfhost.exe
2776	ReFsDedupSvc.exe
5884	SensorDataService.exe
2092	ssh-agent.exe
4608	AgentService.exe
3088	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1f32c6d3a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000100000000ba34-193.dat	upx
behavioral2/files/0x000100000000934f-401.dat	upx
behavioral2/files/0x00010000000093de-402.dat	upx
behavioral2/files/0x0001000000009952-403.dat	upx
behavioral2/files/0x000100000001b93c-404.dat	upx
behavioral2/files/0x0001000000006215-409.dat	upx
behavioral2/files/0x0001000000009b92-408.dat	upx
behavioral2/files/0x0001000000009cfe-406.dat	upx
behavioral2/files/0x0001000000009cd6-405.dat	upx
behavioral2/files/0x000100000000a1d4-413.dat	upx
behavioral2/files/0x000100000000a0ce-412.dat	upx
behavioral2/files/0x000100000000a304-416.dat	upx
behavioral2/files/0x000100000000a2c1-415.dat	upx
behavioral2/files/0x0001000000009396-414.dat	upx
behavioral2/files/0x000100000000a319-417.dat	upx
behavioral2/files/0x0001000000006223-418.dat	upx
behavioral2/files/0x000100000000bd44-419.dat	upx
behavioral2/files/0x000100000000627a-420.dat	upx
behavioral2/files/0x000100000001b940-749.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\java.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaws.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bb68859f1d66dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000a374a89f1d66dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002322b2d61d66dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fe9113d71d66dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f5a3eb9a1d66dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bbc5a69c1d66dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5552	elevation_service.exe
5552	elevation_service.exe
5552	elevation_service.exe
5552	elevation_service.exe
5552	elevation_service.exe
5552	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	4608	AgentService.exe
Token: 33	3088	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3088	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3088	SearchIndexer.exe
Token: SeBackupPrivilege	2776	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2776	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2776	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2776	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2776	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2776	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2776	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2776	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2776	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2776	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4324	2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	5552	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 980	3088	SearchIndexer.exe	100
PID 3088 wrote to memory of 3492	3088	SearchIndexer.exe	101
PID 3088 wrote to memory of 1948	3088	SearchIndexer.exe	102
PID 3088 wrote to memory of 4568	3088	SearchIndexer.exe	104
PID 3088 wrote to memory of 1284	3088	SearchIndexer.exe	106
PID 3088 wrote to memory of 4628	3088	SearchIndexer.exe	107
PID 3088 wrote to memory of 5500	3088	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_7724f07646f91f156c5cc42bb26f3c52_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4324

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5648

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5532

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4348

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5892

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5520

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2776

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5884

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2092

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4608

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:980
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3492
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1512 1508 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1948
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2416 2372 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4568
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1284
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2416 2372 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4628
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1512 1508 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ee951a7c5655b551f8d14af0f3f8f782faaa9191e58cb0ec665b6806000b71af
MD5 823eb368584be0b16b83e0ac2a8bfbfc
SHA1 ef6549726b1fa4db7a760d0eb0777c1804408533
SHA512 51290565176b85616551fa9fe4b8272034ff01aea52ed8e753817361782339de2de97d7e06e52621eef09c06c1f54d0f38b29b354a542a497f494829727a0e35
SSDEEP 49152:Sb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnsT/M+w:03q6HjBBw
TLSH
T149D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
Size 820KB
SHA256 10042ddacf7c536ecd65a4132151ef19643e5831c8b8ef76ea3dea01448f779b
MD5 9c1cce4e07b3c0ae6435d714eb881e69
SHA1 c6d02532ee5e1601a7a5fcbeee1f8dc56f2e04e7
SHA512 f7d8e033e7b4d96fec163393a2302c3c4c5a883bbcf4efcea5af8ce80d000ab0b685b91c60ef518fb10d7c705e7629c8fb3161a72627b631c49fa8b411e52c0a
SSDEEP 24576:LT8aSGe/gDE2g3OMCDXVAn52i4ERxwnLIus3YdjHP6hC+2k6:LThr4FoFAo2XwnLIusodDShjz
TLSH
T12C052305ABB09262F597057034378B730D266D2B57B89F2F2F90795AFD31162CC2E98E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.4MB
SHA256 a96937923598ad8350dc92f3fea7754b591727cd5e9b0e42de03f25316e3d800
MD5 44652454a3102f6533179ff264510d2b
SHA1 33c7e226883b6127ba08299a9457abca97c6d4d0
SHA512 3214e0c68d18a08a2310bf4c54e8c210ce259452c4411aa036a6a9e8169c5ebe770e6ba16eb50d15cf1329cc58b8912d4b70ecf91b35177f3f5af2d74c8c0786
SSDEEP 24576:5XYdDfczAIoHjto1GFxlXutIs1WZX5ARZvM3yReRdqmCAzxj884:6fcWT/M+weyMRYmJzxj8Z
TLSH
T171C51235B7E104F9ED678138C9A38552EA73B85647A4FB8B03A0D9291F333945E3E781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.4MB
SHA256 6522148bbcd29e396f064746117c54227d419815ab8f68729d9ddd549ad4fd3e
MD5 58ec2028d1ff2a5641b30481523cbc6a
SHA1 a4cdcc5367aa440443a792cec6ff9ea847256441
SHA512 91b7bcd0f8ab6261d8f55a00852e9f2205a0398f574093d6b86cfafcf5dd8a9dc4a912f98af0ef1188383b1876c10af7352cfa79531f84874089a82987fab65f
SSDEEP 24576:0XYfDtczAIoHjto1GFxlXutIs1WZX5ARZvM3yReRdqmCAzxj884:ztcWT/M+weyMRYmJzxj8Z
TLSH
T100C51235B7E104F9ED679138C9A28512EA73B85647A4FBCB03A099291F333D45E3E781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 b2a846b2d6745bacb4012192aa50abd6ee0e5664bf1058668bc76c2be4b9bfef
MD5 b69a00c5f5bcf850e6575bab35309021
SHA1 3aed3243b84a0c42f2db41b95bf0006509e2512e
SHA512 24a15288fdad69529912993461766d23cfdc15f7f89699dba273d917090a618003eb92335280da1039f7db08a9a144355315e513f70d9b1936df745c27388416
SSDEEP 12288:Pmw5HEjsChNDBFgl0WDm+CrhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09z/:uwuiOWKoHjto1GFxlXutIs1WZX5AR
TLSH
T11485F14676E50CF9E96781388597D536FBF3B8022A25D72F0760CA1B5F37220BD29B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cb7b688b19df6c6acfffbb9ec20310cb1769c1bee4686f492b330dcdac148f7d
MD5 939e1c5d42be0856577ac208a5c03f6e
SHA1 eff5fa9554383b90935dbe15a855de7d6037d7e1
SHA512 d9b6b390227941917cacc2eb1b32293a28bcb3d5b390e9b960ed60b4dcdbe75d2fe6e17aacc4230b8b306a246764c5ea17422628a55d66f5dec403d9402d281a
SSDEEP 49152:oB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glZT/M+w:iu6JmVxd2dVw
TLSH
T109D59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.6MB
SHA256 0cb267e3738211ddb74edbf7d68e5f54befcf27f8934519cf3c8d8109bfcb9b8
MD5 fab6d66cc428c7b083ac37e1ce56b625
SHA1 d683237f505e13f96b018ca81a4235a5c44e1367
SHA512 84230bd512d69d6925e6dce032d78d7fbbfaa8bcedf42d44a4cf0a82b99d85483baae3f5ffe28abc19dd9f39d8647abd70e1f2bdc86c6fbaccf1015d0fd51dee
SSDEEP 24576:kfwv+k9RX6wkyAI3oHjto1GFxlXutIs1WZX5AR7vM3yReRdqmCAzxj884:6MnYIYT/M+wgyMRYmJzxj8Z
TLSH
T123D5012AEBD804E5E1B7913C99E3464AF6B2782D1B71C6CF0259536D0E37EE06D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.6MB
SHA256 daea70b3bb178ae78908c1891c00792224b55838033e2cf8f257b2a4b52677cf
MD5 4499440737b6d234d0e5939458dc18cf
SHA1 0f6fb3a58ee8419e24da5c2a1c2af97541575845
SHA512 21caaa21769228fc9df221457948c457e48f7a87ab9ea31aff20e48f4e888a0aad45ff433fc40016019778d74515707b5a5a84d026f2473bfc463a03522b1758
SSDEEP 24576:rrwvik9RX6wkyAI3oHjto1GFxlXutIs1WZX5AR7vM3yReRdqmCAzxj884:XMnYIYT/M+wgyMRYmJzxj8Z
TLSH
T115D5012AEBD804E5E1B7913C99E3464AF6B2782D1B71C6CF0259536D0E37EE06D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 27a46bcd92bc3a987b27417358665694b79e8062a1daac7e10dbad59ff1a5a38
MD5 b20bff974fd73e40450c919c5f91cd3b
SHA1 8d188ed00cd86c842f03c819ec4078746a5e4bc2
SHA512 f468ce42bce044fe372a6e4e80a931e905d8dd3574bc085e128fccbd830dd53875579a6a9763e4dece453d8905a008087da72691513cfc4b677ac306baeac7bd
SSDEEP 49152:tYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0JT/M+w:tySzPtw
TLSH
T12A066C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 4.3MB
SHA256 105aa1cbb5fe3345d37071f5f07966bf05371c38843b74bc88719d61f4530acf
MD5 e8f17d7086b9b6e14c084327ea6f5c45
SHA1 cdf07a8583310dd966b99660b4c46018dbdd7472
SHA512 e8b07fa90dc0d24ce5d81363a88a8f75bb220a9fa12ba787751ce99fafc4f63a97b879e89c2d28feba7d366ef21ad5175fa2e55001b2cd38ef7e575336184dc2
SSDEEP 49152:gYIfNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0JT/M+w1yMRYm+:4ySzPtwsYbJzl8
TLSH
T195268E57A1A841D5C1B9C1B98B0BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d64f926401ceb2716c489a36f1938465b16bfd9b0c3a36d14bfc6825a9fcfc69
MD5 b4d62e058d0cf870085679b89d144f02
SHA1 d30b24c1ee7c58d7d8bab7a2cf04029d708bff9c
SHA512 c80f52ab740357da1bb63f462f495d245eed79b62c26bcaa50d7a2d97a0058f9fe9408e4df01dc9f4ad7ba363027640db307c7a69af575ecdde31fd7d605fe7c
SSDEEP 24576:Q47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYioHjto1GFxlXutIs1WZX5AR:Q47JUQj1irIhCnDHUPfF/ZT/M+w
TLSH
T16B65AE1EA3EC01E5E1BA927885164A5AEA71742E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 70acb375c2e20181819aa8b254fca2af034a41782ee0596a53639f45f6105f4b
MD5 8ad967c08aa617d4d7c994f588464953
SHA1 8700901719c7b3230488ee68b318fb2e1832913b
SHA512 518bb83c2930688faf418042d7d70152c52c38f9ccf24d041a842efec8cd8666ef231512c08d29b2131566f84f600aef8f6671e9b5c5b8fec4721101385aa86d
SSDEEP 49152:6G7JUQj7irIhCnDHUPfF/ZT/M+wGyMRYmJzxj8Z:zJ5glD0PfwTYbJzl8
TLSH
T175B5E01EA3EC01E5E1BA923885154A5AEA71742E1F31DACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 ead884c5722570465f382bf847c3becd4de8cf9ca3b06317f49a2d8981927b79
MD5 de32c820a7c2be0a879f49ceff86b3e2
SHA1 381b99ee1cfd2c297e09d3244feb67d65a261c34
SHA512 9aa34b3a09bde5b374af53e535b2d1650e0224ac2e72ce1a183e7edb822b01ff6ea14c4d7b991394c3b8f570b4a4d354116ff7df2579e2c89cc08324c423607f
SSDEEP 12288:GcbaGBqVkdZEHXpN8Hbv5verk4SUyfnyeM8M4kp:GFGVd6HXpN8Hbv5veVCnFrM
TLSH
T1394517507626CB4FC6A940325E32D6CCAB707D01EE056F0773C98B3F9576659BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 308758dee3a9d77d55d2fd84e7405b050de15061d04e3fb5fffa1e976199c67e
MD5 991b2e5bc84f4863348976ec9fefd720
SHA1 def43bb9d621d66bd6f077193a08eb2929637bfd
SHA512 45c624b01e2cc0981b2495b964c0167ad335dd09d2455a093c0df9b328cfeae69622c584f60746d333916a827ccef27b18cc4b4f81eab2b039d16e9b69733c4a
SSDEEP 3:OlH/lEK7kudGeqgLvll/lA3mCllltq3mCllltGlslslslslslsl6DQRRtl:KWkd1TsmCtSmCtEEEEEEEBR
TLSH
T1B9819284CF0806F8E10EA0354424C34C0B38E64E750097DB970926234D847A40C17ABA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 54cad8a3886771ead2156551fa396940f325c0cda88682dc99ac47be8c63bc55
MD5 33091e619da49e87cfd3adf5b1878980
SHA1 d41f68287381274e98007094be37672383c1e264
SHA512 1081b644e47e1fbede3ac36c690dea3c2deeb70d5c17e5383216e753992e00ba50d77188439b3b8732b36d5a39e913b6c0f4677d9bf37d977e8d41711a8289a5
SSDEEP 6144:5rIAL544HAbv0AI0XKDeoH28smXKDeoH8AgTVcl1+JlNwoIw/NLiENlDN6:5t44HAbv02eLAgLJlGANf/Dc
TLSH
T180650B819136A78FD0BA5032033A9F4CA7A4EC02B7096F2673CD053AD86B755B4F97D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClearRedo.docm

Path C:\Users\Admin\Desktop\ClearRedo.docm
Size 775KB
SHA256 5f996f4e75c1b8de95b0a12d62b3b4a22faf739f1cadeea62976a538416bf7cb
MD5 b62c899271df86a8df8a0975422de154
SHA1 d8353b66de4a5427a0553060e226ebe67e7e4f49
SHA512 d6fcd5d2c586487dbfd7806c036c051092c696bd6b1245644d55a9338d5d66a90838be704acda4230bf1dd013ba4d5225aef3e2841267c5a69bd6859ff88fbda
SSDEEP 24576:aWt99mEP7jn6kPDMDag5gdCpdISrsDyxvXJYHzPAJ:aWtBj6SMZqdujADyNXJSC
TLSH
T188F4336C1EC1ADF4E91503B5B0BD954990EF07671AD7DAE5A729A3730BF80930B23223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertToOpen.docm

Path C:\Users\Admin\Desktop\ConvertToOpen.docm
Size 779KB
SHA256 a7c5ee6dd76d778f03d311a87bec903055572d509f6f47a7e4eb7b3baebe44a1
MD5 83d309a9ce28757a9ea7b3da484c9020
SHA1 b23c7a7140d24400146d50df40d8b30b75c645d9
SHA512 ba25e33d5ec63df76c24c9c3b312f35c81d5c2c8f7d151e5e33f6f602051549d4b2fd9808a88256150da11f6e86d9af444252961623ca268be6ddfbcb98cec66
SSDEEP 24576:67Xgci6Y4sKuZTOSWrSxnwLKrFL7OSBSJA3V:6bgp6uOsxwL+FLaSMJAF
TLSH
T1E0052320CD6646B5F7715EF342AD1043584F5897BCA787F102AE313DAD9AEAF28C6809
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExportRestart.docm

Path C:\Users\Admin\Desktop\ExportRestart.docm
Size 779KB
SHA256 7daf96621a28a0d96a89439f093d55e21ebc1d43cd8ede8433fcd2592ae48a45
MD5 80463de5986913aea5019c0847d6a2ac
SHA1 a02416c71f676a4b276ddf31162f9869fec1d81a
SHA512 b83c0fac15b5334f096be4b753860ac54837a5a0911516a25c95d7558c730696cb9e773e3d8fb10c9cbd99a46c9778e6eee03a928a92be781ad31e919bb24d3f
SSDEEP 24576:/KNjlj5wZvulTpSBa0o0azsxSzblm5xN67D:/21aZITpSBNo3KSzAzN6P
TLSH
T1DE0523BCCF6265E0D455B735BCBADB93896A1A4C5C8BD086C1B5738C46C9A382131FEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompareSwitch.docm

Path C:\Users\Admin\Documents\CompareSwitch.docm
Size 773KB
SHA256 a1cf228d42b72c66acf0741849b1ef94db13cfc0a1baf911dade695c36b44b5a
MD5 1350d2e9ccefc2f9b584abc1462051d5
SHA1 440b20f82c18bdd343da673d44bfde97541838b8
SHA512 4211fb297737b455c300f0c551f662b0d0f05d887b83b00843fc4178392637906eb01d257308a84dc0704bc44fc9ce9fd30f33fba7553ebacdb65a2d87869ec4
SSDEEP 24576:msNaPBcQeFQq2E7H6UvK5HDleBrF3xaZm3GVaOCpL:mhcJFQQGUWHDleVF3L3GE9
TLSH
T181F43318CC305C9CCA9657718A2F59A4DAFF285A77A795F30A0EB17C3E1B2EE414BD40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 3cab7a980264f3187dd4997bec33d5c98e9036865056a9bcf851ee03b81a6c0c
MD5 b0acbbe125c5fd1ad05dccad3aaf48a7
SHA1 a7741935896effdd0939c09af1df99ee22fca733
SHA512 a74954c005833d7574e8e766c6976d29e261e1be674742fa3592227a58781b0c0f644d44c0be7adcd6e4f411276958060c4cf191a121f19cf3b5aed74b9607aa
SSDEEP 12288:u+7lhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERYJN:NboHjto1GFxlXutIs1WZX5ARIN
TLSH
T14065236399F254C7F57961B029DBAA31BC7FB3160B4410FB9A40EE190E3D0E0AE766D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 21dadd8898e18ff4748166570b35fd6258ce465020c8d9f15f5955d99316ae59
MD5 32940afc228a7fbabd0ee490f9b3106f
SHA1 c77dfdade687e32a235c1ecf309fb39633438b8c
SHA512 74f37bb3139345fe1893f7202b56b77ce9115c2899fba99c99169ae59b006366c75c2a4caeda994fa6631689aee04f85ecd527729535792d44dc377ed24805be
SSDEEP 24576:bgb6bmBIi49WNNFpg1rSvFv7bY1oHjto1GFxlXutIs1WZX5AR:bgb4mBIBhGFbT/M+w
TLSH
T11D659E1E22E802F5E1F9D2B89DAB4417D6B378160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 832KB
SHA256 44570f18c6ec5b364d68ae985c774b8848d9f82ad24d26c21ac4357161a55420
MD5 34d395b0a1cf19f5d19884c2cb0a47f7
SHA1 6cbf39b0518dd1da6fb53515ecda4eb3cda81aaf
SHA512 1eb99a4e7f4d9c7c4360f860a1868506f3e212e54baf10cf2c98068c8d9b259e2cf8bb3ffec85f6e874b7853dbe8d26f50ef2270fe08df4f66250961df238798
SSDEEP 12288:qoG1yLvMtKPMyEUhiqxl4y1uimhsMEm9CLX9U6Pmne2zxj83vUfwN:zGWvM3yReRdqmCAzxj884
TLSH
T1C405233EA2F13058E6709A3952614AD7F9B1742A5BA4FFDF5090A03D9F333E06935C89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 3226de55c91be69113f756de1e86c6d72df523d6241e85bfe182a99ce46af86a
MD5 14a80ddfa5a956495aeb2f1d1f5eb3c7
SHA1 9a178f90a801dbc76cdac50d8f8e8e9fa4771c3a
SHA512 6e4d1fde01e0578b3477fce7b0cf77df0881d68af159ecec8542cc12b50cfd57bea3dfecf6e78b9ef4d9ca7e0bb225e6b26fc4c6ff1bea1bb413a26ba0c929c9
SSDEEP 24576:1G88u8FpJqH1xzria7/myoHjto1GFxlXutIs1WZX5AR:47ZFPqV4a7/uT/M+w
TLSH
T1EC95F16676E101F1D47BD13889874663F6B2B4250364EBEF0BA88F151F236E44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 59fdaf1215861cd94554243ee1a11a104be9ac851d1c595af6e2f40daba9a1dc
MD5 04a4990abd32ae2fe4c70cb8c1b6734c
SHA1 2759da8f41013320055a82c752e93efa3c9cc5a3
SHA512 d62cf2ce7b9d3b8f08408f7395145797b621bc7777fa2565a1b674e3e168ccf214798f3af8b3aed4b241b6e07edb2e9f57705a3869d8208f6c1519da783768ad
SSDEEP 12288:sHvUrBFrEjwaQchKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZXb:sPUr+NQOoHjto1GFxlXutIs1WZX5AR
TLSH
T1A585E12F66E918E5E676A17C89838719F772B462071192DF02E0813E4F379E8BD3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 91f82cca9c99c045e55d9f294bd5905b857960f704dc3e89d2e180110d1f09b1
MD5 d2ce852dd45a610f8a50b42669e327ca
SHA1 d3a9dd6f330026f0661389554cd0b2b47caca31d
SHA512 3d24f6b002dafa4e5a235c430da93e8ec7996c51f35d356e2927652cfdf49a2887625e1f3085d37e4566f8efdee3c5c62511e0b861edbf3cbd82e33d43708aa5
SSDEEP 49152:cBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjfT/M+w:/G05lO43bKw
TLSH
T131D5CF6A62EC11F9D1BBC17CDAC74A0BEBB23415032556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b5af7b5d57d22d5dc822f0ce8285a02ae4e2f5d204c133948bf11080d76ebf2c
MD5 7e2312fecd4c939b067aff6ed055f1a0
SHA1 163cdd56862c017de4e24768c4d8fcc5e94fc2db
SHA512 0c51d196e14d607b68d4289024aabe28774a444fcf712b68e6669edad1a3622d0d219e28233d9de7b47bd1793da48456f43adfa30760aef76708c38d10b27345
SSDEEP 24576:lfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnooHjto1GFxlXutIs1WZX5AR:la5POZ3+Jt2pasx2+mXT/M+w
TLSH
T13665AF5EA6F801D5E579D17CC583461AF5B2342653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 793758a89550d14869a2db2aa532176ba895e75f8b3dec03b28f37a17aeca3ed
MD5 7b5e63bedb619979a0fc542c81097912
SHA1 5d1c682bbb9cf9e028d63fef2de031c26939c734
SHA512 0f53ea3cf3bc62d0779149202adf0c83bc4f57fcb40382331bc4e49232361959b591252b3e82101c0e34d2aac229c5c348c2d271581bdeded1871aad31735967
SSDEEP 24576:lNcwHdjbyQ4nLC18lb/EOjowL7FkqoHjto1GFxlXutIs1WZX5AR:lNc/zEOVHFOT/M+w
TLSH
T14E858C2622E901E4F5BBE1BE89779546FAB17865133086CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\System32\Sgrm\SgrmBroker.exe
Size 2.6MB
SHA256 97c2302de584389955f3197f20eece16081e1cf19c8b8d61748b9ef264240029
MD5 a5cdb6f1f58bed61f4bf5ed9d5600574
SHA1 085ba9e594d52e078c63eb3309b3d3600f12d5ff
SHA512 669c371a298ead5342cf8df69ae150a48e60e78a1a3376ec4bed53ba8c909b4344e627bba3373f6b86b90854929483fcd64e094555eae4827a509f2a2969c3e6
SSDEEP 24576:PD3FHshBIYQgAvoHjto1GFxlXutIs1WZX5ARxvM3yReRdqmCAzxj884:PDVHeBIAAwT/M+wWyMRYmJzxj8Z
TLSH
T17EC5127EEAA800E4E57AD17C96938A07E77234AD076265CB02D0D1791F3BEE47D39B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 2657bd495765e86b2151ade9a179f7977804af0bc8a38130612c2b764dfc3a57
MD5 ee08dd3e4693693c54ccd1e6011b4cc4
SHA1 b67118cde9ae06f982b15e0ed6abac3691ea4972
SHA512 6f6605e644f97fc7f2294ac4b9b5d039f90d90867b6da87cc4760a2aa11b3aea44c5637e5ef9052342b21fbcb133453c48c1f0b80ec239f8f017f58722ad78da
SSDEEP 12288:Y1Hck4j5ZI7kyLvMtKPMyEUhiqxl4y1uimhsMEm9CLX9U6Pmne2zxj83vUfwN:E4DI1vM3yReRdqmCAzxj884
TLSH
T13725126D73BA10B9E177D03E82830543D2B2B0758762AACF5694D07D5EB3FD8B839A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 932KB
SHA256 f9d3d6c2650063fdcb314cc59abace0970220b3bafbe9f897de69058e3934f2e
MD5 060b1938192f68a7069c2798cfb7e2f8
SHA1 48cf229a0e247838182374efd1ac732fdbc9e32d
SHA512 c4e9943a038bf8c6b6b1ce8b806e1c62a8258fc22eb5d595f5353674b721f2045b16a4a25d139e4d4c53870c70fc4e74a00c2acbf8ce457a00b39358550f68d3
SSDEEP 12288:RG6kyAyLvMtKPMyEUhiqxl4y1uimhsMEm9CLX9U6Pmne2zxj83vUfwN:YtytvM3yReRdqmCAzxj884
TLSH
T130152215A3D46098F6B51538976242D6CE35BC259FA1EBCFA190F23E6E337D0AC3170A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 804KB
SHA256 d56f4094eacc8afd2ffb9699e48e694b446f84fe9ff8c10addadeeda78fd0a0e
MD5 3cf4e24f5aaeff987b7cfac780f66597
SHA1 a0a16050065e86c84cd73409a7a2256dedb18bdc
SHA512 11d106a4fb7a1bc8957bd7e63b14fc71baabc317de0149b17e1ee40e62925e3c7d1eccfb9fae0d8108f8229d87dcc947efac335eef219e1ee5fa7c0d316f193e
SSDEEP 12288:ri0yLvMtKPMyEUhiqxl4y1uimhsMEm9CLX9U6Pmne2zxj83vUfwN:WRvM3yReRdqmCAzxj884
TLSH
T1B705237AE6A42119EA70693513454BC7D666B43F6FE6FECFB090A03D9A333E11C7104A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 99b015f205321e0b912e809e4370a6de29bd17f0ae7b8cef762136ff04253943
MD5 7cac7691bb55e4bf10e43b9f053abd0b
SHA1 e9b92c2c8679e9169006a653ac159ac9a90cd83c
SHA512 71853b29c4500a013c45efb6a407932077e71582f934ea940762bcd0054037fc12aa44ec62b9be225c133142e6050edf4a6eafa0d8e892b158fdad39c0a34e83
SSDEEP 12288:fYgQ0ZyFDK3tT5Tr7aVLIH9lH3cSyLvMtKPMyEUhiqxl4y1uimhsMEm9CLX9U6Pz:fYgQloTfaidZwvM3yReRdqmCAzxj884
TLSH
T17665AD1DA3EA05CAE2B2D639D9721493D633B4315772D6CF2448C03A4DABED8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 1031c5d3170721ea68915f5de6e9b8a220dca01d00bc8941199e048f1da1c4a8
MD5 5c85350a7b5f3cf7bb414705b7093778
SHA1 5c0e9e8476c0ebaa201076382fadedca2fbd92f1
SHA512 9d05ca3b1f57d519cbff61570dcd57847c4505fe638b7c10f14312f12ea67501b70ef716a12d54f656bb5aa846aab1e107bbbd4047b0b8daf288622b949500f1
SSDEEP 24576:/gb6bmBIi49WNNFpg1rSvFv7bY1oHjto1GFxlXutIs1WZX5ARBvM3yReRdqmCAzk:/gb4mBIBhGFbT/M+wSyMRYmJzxj8Z
TLSH
T195A5D01E22E802F5E1F5E2B89DAB4417D6B378160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 3caba61763058e04bd6e74c668a9b4ced2f2db588ae1ff502ed34d5046e41b75
MD5 17308bce51c7163784e813ab5bda2297
SHA1 805142997c3d15a4c9529c9e5f889e5f40e9ed89
SHA512 5456077e3f8c1ef1982027bfd1b16d458ac60e055dc009b0be53659b6427109248fc40ddbacc5501925beb5fd1e6dfc8772863c5d37b44a6d5b4231e0785738a
SSDEEP 24576:QDkNvNnaFeYhJNtmZBmMoHjto1GFxlXutIs1WZX5ARHeyvM3yReRdqmCAzxj884:QDMwBtOmFT/M+w1e5yMRYmJzxj8Z
TLSH
T1BEA5D16EBAF445E4E1FAC6749E238512EA727461073293CB9390C13F0E279D89D76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 092a2c535c817c9b405291827c60f39c5cc862c929b05b98ff2d1e648e613587
MD5 5a9222810b460ce3b86b34cbb77e3e50
SHA1 5ffb2acfdc8b93c7d06c6460dc74616903296bd5
SHA512 e189e12741122901e77fcd579236a946406e59d11de4183e426337d1a61eca0858636a85b0a0e9b197e70534d7ce63dbe150af16dea5bdd7c7c596bf386f6df8
SSDEEP 12288:MiHPJnJP6szeCs6Rl28d+yLvMtKPMyEUhiqxl4y1uimhsMEm9CLX9U6Pmne2zxj2:FJnJPbzB4SDvM3yReRdqmCAzxj884
TLSH
T17D35E13DD2A810E8E4B7C274815A179AFE71386D2F2669C759B4D0343F12FE0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 796KB
SHA256 32f15cc42cf45c8b89a21b5004c1ce91ce987421e26aff0cda806cbed634a74a
MD5 7d21343ce0330716cb9947e0b5c6dd0b
SHA1 c8a9325c29b316d75e7be187cdb8bc64da1a1cb2
SHA512 b45ba97be2a43be3e4f424e3d24044e730bd4949cd3da09086cf81923eee18087faf2072cec2633a9d3f972e4083753a791960596ea62f2263e8fe889db52e4c
SSDEEP 12288:vJDyLvMtKPMyEUhiqxl4y1uimhsMEm9CLX9U6Pmne2zxj83vUfwN:vKvM3yReRdqmCAzxj884
TLSH
T192052376D6945119F7B02D3523414AD7DA55B82FABE6FFCBB010701DA9333E26CB108A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 940KB
SHA256 986d19df243966829d926b934e81033deeab93010c0692a42c13e00ead5b6275
MD5 37dd9bf841146b54f9aad7b0577f1283
SHA1 b3ba01d058dca5f0e36d6ebc228c19671301ecc9
SHA512 7d2ad41df84361a797ce555b0803d0d2d757de52bbf92d62e311a96a7d37de1b2eacad977330ad27c45ea3aeb3dbd9f624e43a0e1872ed7177afa92b747a87de
SSDEEP 12288:Oyj6b3IkxjbBzByLvMtKPMyEUhiqxl4y1uimhsMEm9CLX9U6Pmne2zxj83vUfwN:R6UqjpCvM3yReRdqmCAzxj884
TLSH
T12025226E97D020A8F1745530A661826BC5B1BC3717F6EADF71D4A13E8F33BD0983AA05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path C:\Windows\system32\vssvc.exe
Size 2.2MB
SHA256 e83f3ca1a543a694a1142f04bfd2449e82a9c2eed80fbec81b1c04239898e2e4
MD5 67b11f978db8f6d48c11d5e75915bdaa
SHA1 9f44ad4d07ce5ad5dc030fe77a92cacd4d484684
SHA512 7d4712ac05eaa6133143a157fc35c42cad82f80f7d39c2cab245b3f1094c722708bb383ae85d7c2fee138c219ba52dfa9d77d561d8ff834a76349359fd4e6a80
SSDEEP 24576:LCLHGL0MoeVtFumTijCmlKQWDkkvM3yReRdqmCAzxj884:LCLHGeeV5ijCmlDWDknyMRYmJzxj8Z
TLSH
T159A57C05E7EB5184F8F3CAF5CA2294169A327C549B34F7DF4A80C96A2E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\system32\wbem\WmiApSrv.exe
Size 964KB
SHA256 ebf4961815ca3b891d3ad0af0a48dc516d2feabbf114a8b73226abbc583b92bf
MD5 5e8f32b9aeff68fdd5911d056811ac60
SHA1 4eabcef2776820fb7c5a95455f1523690aaaf217
SHA512 e2f93010e9ca5f80d0bcde8377432bc87cc1ad11de2ee39e941da44155af6a7510d3cf58aa6f439f10826ae3fe5dc1e39c58f4be1545a993ce3044b5a926ebc9
SSDEEP 12288:BpJcm8CNNyLvMtKPMyEUhiqxl4y1uimhsMEm9CLX9U6Pmne2zxj83vUfwN:BrcmRuvM3yReRdqmCAzxj884
TLSH
T1AB25025EF3AE00A5E2B7D13C89814646E6B370356752ABCF52A0C37E4E236E97D34B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\system32\wbengine.exe
Size 2.2MB
SHA256 b1427f992a7cca07eae2077f08a5634c43f30c860287ac49c38a5c99f9ffd60b
MD5 b4b657f996e5b66052698e3526097a04
SHA1 3ec9c6c95f79ae585ee36492de67eb4f2d76dd29
SHA512 348268ff784ec2122f4f7ff1b78995b0437d76d8ea0e13cdea0bce03c8485fcca608bda2274bb266daf98e0d465ab144cfefd5b634f82dd314215b4169be27ee
SSDEEP 49152:zDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3+yMRYmJzxj8Z:o3Upow8sBKYbJzl8
TLSH
T1A0B59D3DA2E800A8D9AAC379C54213A6EA71742E3F3055DB0174C178BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1948-365-0x000001EBD2B10000-0x000001EBD2D58000-memory.dmp

Download

memory/2092-355-0x0000000140000000-0x000000014021F000-memory.dmp

Download

memory/2092-123-0x0000000140000000-0x000000014021F000-memory.dmp

Download

memory/2092-124-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2092-130-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2776-346-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2776-104-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2776-98-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2776-368-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2776-367-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2776-97-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3088-173-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3088-171-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3088-179-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3088-362-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4324-144-0x0000000003350000-0x00000000033B0000-memory.dmp

Download

memory/4324-10-0x0000000002850000-0x00000000029F0000-memory.dmp

Download

memory/4324-8-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/4324-7-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/4324-138-0x0000000003350000-0x00000000033B0000-memory.dmp

Download

memory/4324-6-0x0000000140000000-0x000000014055B000-memory.dmp

Download

memory/4324-70-0x0000000140000000-0x000000014055B000-memory.dmp

Download

memory/4324-0-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/4324-11-0x0000000002B90000-0x0000000002C13000-memory.dmp

Download

memory/4324-17-0x0000000002B90000-0x0000000002C13000-memory.dmp

Download

memory/4348-281-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/4348-60-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4348-66-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4348-59-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/4608-155-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4608-146-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4608-147-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4608-153-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4608-157-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5520-87-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5520-88-0x0000000000880000-0x00000000008E7000-memory.dmp

Download

memory/5520-93-0x0000000000880000-0x00000000008E7000-memory.dmp

Download

memory/5520-333-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5532-55-0x0000000001A20000-0x0000000001A80000-memory.dmp

Download

memory/5532-49-0x0000000001A20000-0x0000000001A80000-memory.dmp

Download

memory/5532-84-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/5532-48-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/5532-80-0x0000000001A20000-0x0000000001A80000-memory.dmp

Download

memory/5552-29-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5552-109-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5552-30-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5552-31-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5552-23-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5648-170-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5648-45-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5648-37-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5648-36-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5884-351-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5884-117-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5884-348-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5884-349-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5884-111-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5884-110-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5892-74-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/5892-315-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/5892-82-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/5892-72-0x0000000140000000-0x00000001401AB000-memory.dmp

Download