46cbe0cddb1097cbfc97aafc16d9efad8fc6303479f6e7b3889200b7f46f5ceb

Analysis

max time kernel
148s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Size 1.0MB
Sample260711-e6te9abw9l
SHA256 46cbe0cddb1097cbfc97aafc16d9efad8fc6303479f6e7b3889200b7f46f5ceb
MD5 620b82719ce226b0fa787304bcf98c6f
SHA1 c04cbb43975d43fee40322ba20beaad46a81cc05
SHA512 546325d1beef7b790f3837087317ee10979419991fdee55853fab9621fe72db0e5ea6026d32fb899db70bb47307ddc01400dc2a40c43863f0c84a95adaa383c6
SSDEEP 24576:w3oH6hCwF4Xx7ASAGzr55oLGh+3ZZ4OAI:ioHQFEBALW52LGgp9AI
TLSH
T15A35D088A65440E1E1B6C23888435942E7717C115B71EBDF13E8E63A2F77AD19E3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 8 IoCs

pid	Process
5868	alg.exe
3712	elevation_service.exe
4708	elevation_service.exe
1520	maintenanceservice.exe
4612	OSE.EXE
3956	GameInputSvc.exe
5548	GameInputSvc.exe
4632	msdtc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a6aba2238f8562d1.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe

Modifies registry class 52 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe\""	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe"	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2932	2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	5868	alg.exe
Token: SeDebugPrivilege	5868	alg.exe
Token: SeTakeOwnershipPrivilege	3712	elevation_service.exe
Token: SeTcbPrivilege	3956	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 5548	3956	GameInputSvc.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_620b82719ce226b0fa787304bcf98c6f_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2932

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:5868

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4708

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1520

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4612

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:5548

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4632

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
PID:5644

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:2796

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:2492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1f12e98cd944b56ec408b0824ec3b68538fa0d692b1c4d5c9a4d5a9543590e20
MD5 b696fb457bac82e5e1efac6bd07dc26f
SHA1 8d7ba78a7065a3c54d7370bf2aafb752cea75531
SHA512 67d7958d25aa66f0f7a1e536f0735ea23a7a9352de7427453a97404620684e992a9039a99cae140fc4f603a6ec2bf64db3f7ac0aaa9226169373f02820e3bf8b
SSDEEP 49152:Cb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnnW52LGgp9AI:k3q6gjBvo
TLSH
T157D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 72dadec89cd1aabe6f6d49d5bab3b5569b1e634b59837c6e1a3c877b92f70fde
MD5 379228d80cdd9cf950e31aa650b4444d
SHA1 ae3dbe9c19cc899715bfa3e3d5198b10c0df2626
SHA512 60d4dbfef319ef9c8a64fee16e74c19654cba04b30fa73c30abdf444aab7265d99fef1a28aa4e60f0c65dd46ab4e5a76e73281470350a08dba16dbc9c7316de3
SSDEEP 12288:81XLstKWkxy2lRq2czAPmQYhVu4a1zlRPjVNzBKUoF0vsY8Yh+4e/GmtmY4lzIpj:KXYcDtczAfAGzr55oLGh+3ZZ4OAI
TLSH
T12F05025CA3E009F9ED67823CC8A68511EB73B8954790F78B03B489291F336D85E3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 f8c363e8ef17756d18881f763fe502aab0cd7175b2d21386e2e980d63ed50254
MD5 be85fa1ee9fb65e3daf73881021136ec
SHA1 832abe59ed4a916863f140ecc67f2a25303240bc
SHA512 38e97115e256c5bb3c49cce2eb85acd2ac0f940c4ba3e464e4eeba4c7ee7dfa60b10cdcac36dd0118d93e074e33f1458d70971822080c971fc2667bb81e55a25
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+CVmQYhVu4a1zlRPjVNzBKUoF0vsY8Yh+4e/GmtmY4lU:uwuuOW4AGzr55oLGh+3ZZ4OAI
TLSH
T1C505F18977A41CF9E5A78239855B8532E7F2B8512B64E71F0360CA1B6F37250BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f86809de06ac111bace9c5588c24a810317a85c078a6787ab864a96f2045faef
MD5 d2fac601cf4f11adbbc99132bf31dfd4
SHA1 8800406824ae418e3e935698ce259b742d845722
SHA512 55442b6a92ed629b38b10593c463fabd55d72c63965396d2761eddc646bc2f754eff9423318d55058b23d67a4f3871175c879f294d9cf042ab1aea1663be8613
SSDEEP 49152:GB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glCW52LGgp9AI:0u6JmTxd2ddo
TLSH
T15CD59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 cf4d53ddc62bca24f2c5982f7d567d6951471ad1090c23ebbcd5f13ca2afbe7a
MD5 43a88f4229c5814154ba1917d09dd0b1
SHA1 7fd8a5c1748f84f01e439724bd37bb3c12caaf3e
SHA512 9296d68be097aeea44c7a159c99809ca4d5a6c599c28525e9eb1fbe7abc0e1697a179cd803e06e3352b97c151f45ebf8c57c89eeb7b16635fcb339ce02398b5a
SSDEEP 12288:Rh73mQYhVu4a1zlRPjVNzBKUoF0vsY8Yh+4e/GmtmY4lzIpAJy:/XAGzr55oLGh+3ZZ4OAI
TLSH
T17AD423CDD7709652E2BB8370046E0A715A39F0F56F84F6DBE0250C19A978DD0E938B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 4a8148f1abca46552975179faee3c293ebef5dff8329b57b4a301696e2134926
MD5 388e1d26223469c06d6f9e607ec9d658
SHA1 042767eb9dd17829834e3528a80067751a04a38a
SHA512 3310832096e75201a7e95b322f3135fb1bf89a2292487c1d61ab2d35cc3432baa59a1a6d5bdbfcc4cae44db6fe8b31e2731b86d1001506bdaf0bfb52532f7825
SSDEEP 12288:1EGomQYhVu4a1zlRPjVNzBKUoF0vsY8Yh+4e/GmtmY4lzIpAJy:WGoAGzr55oLGh+3ZZ4OAI
TLSH
T1BDE422DCA2B17194C27BC335442D09B2B9B1B0F16F4477EF40A598399F799E0B238E99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 2792d299ecefbd3bc42fa50b0a984c7f4793a6a5eafa3c163e4027d18bfc96a5
MD5 22c9b906885064e829fd5f9468b4928a
SHA1 e922108f8ffbe1a82270f136dc42451e6e19bdd7
SHA512 50cc28e573caa0995c48b5a2828f191029c43fd7659a501df61fd4ef62c5bf9eef52250c830445b789422276f8dcf05a2db8f7fe232551df8ae1cee10e608635
SSDEEP 49152:OBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjNW52LGgp9AI:RG05lO43b/o
TLSH
T125D5CF6E62EC11F9D1BBD17CD9C64A0BEBB23425032456CF02A486A91F27FF4A57E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 2063ffb012db2db751e70651d52fd6acda3f27de4f616d18a9e35ba295c48041
MD5 1c1c0e4285dc0502c10bc2135898806f
SHA1 b9afd77f7338959121c9975c7ff5ed735bf2ce86
SHA512 e458756df7cebd2c312e4b557e18341c8e31c4471bce7b4666c983534d7979f6dcd5167bc6088441515f3b2d3c9d4d1a128d7c4cbdda062b27c79f27327d2d92
SSDEEP 12288:b1Hck6j5ZI76mQYhVu4a1zlRPjVNzBKUoF0vsY8Yh+4e/GmtmY4lzIpAJy:/6DI6AGzr55oLGh+3ZZ4OAI
TLSH
T15A05018C637610F6D1ABD03D85870512D2B2B0B19B517ADF46A4887E9FB3ED8B93CE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 48083576cfef6789ace71189ce034cf1b48d3861ffab6916b811cd325ebefba7
MD5 8e8918602364070de2fa60221dc55b7c
SHA1 d5e05199cd50170e12685fe31c2be73157c6e709
SHA512 e61eb20b094ca9455ae80745ab81c212b00bf5eb678da1c8d612e39725321cc060582a8fd89bb9a2d8099001ea6c2b89c204edced5b512a0edc597eb609201b5
SSDEEP 12288:pG6ky2hmQYhVu4a1zlRPjVNzBKUoF0vsY8Yh+4e/GmtmY4lzIpAJy:Aty+AGzr55oLGh+3ZZ4OAI
TLSH
T163F412CC93A061D5E6BA4234896B06A18F35BC705F40B3DF50A1993E6F39BD0B934F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 18fd6da1498f0fcbcd4b9f16eec2d3579cd4df457b2edb8c444f3d9321268e08
MD5 50de43be4360d7fdbcdcc9f17c0d4fb0
SHA1 5642339e1b5c6244ba35347c56e0b3072f92e13e
SHA512 d0d0e1bb4a52c9563402f13b3d576eb6678ef477dbe857747b44800e90bf1bd3d262bb33c38282301e7d28a5f7047b98f3b2d430284ec52f595c681784ab1ecb
SSDEEP 12288:jHvUrBFrEjwaQUmQYhVu4a1zlRPjVNzBKUoF0vsY8Yh+4e/GmtmY4lzIpAJy:jPUr+NQcAGzr55oLGh+3ZZ4OAI
TLSH
T1AE05F15E62A818E5E67AE17C89464719E771B4621701F3CF02E0803E5F67EE8BD3DB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1520-44-0x000002643BA30000-0x000002643BA96000-memory.dmp

Download

memory/1520-52-0x00007FF777F00000-0x00007FF778068000-memory.dmp

Download

memory/1520-43-0x00007FF777F00000-0x00007FF778068000-memory.dmp

Download

memory/1520-45-0x000002643BA30000-0x000002643BA96000-memory.dmp

Download

memory/1520-50-0x000002643BA30000-0x000002643BA96000-memory.dmp

Download

memory/2492-282-0x000002574EC90000-0x000002574ECF6000-memory.dmp

Download

memory/2492-283-0x00007FF653500000-0x00007FF653C44000-memory.dmp

Download

memory/2796-270-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/2796-271-0x00000000009B0000-0x0000000000A19000-memory.dmp

Download

memory/2796-276-0x00000000009B0000-0x0000000000A19000-memory.dmp

Download

memory/2932-0-0x00007FF7A6370000-0x00007FF7A6573000-memory.dmp

Download

memory/2932-22-0x00007FF7A6370000-0x00007FF7A6573000-memory.dmp

Download

memory/2932-19-0x0000025F034A0000-0x0000025F03506000-memory.dmp

Download

memory/2932-2-0x0000025F034A0000-0x0000025F03506000-memory.dmp

Download

memory/2932-3-0x0000025F034A0000-0x0000025F03506000-memory.dmp

Download

memory/2932-1-0x0000025F034A0000-0x0000025F03506000-memory.dmp

Download

memory/3712-28-0x0000018AEC1B0000-0x0000018AEC216000-memory.dmp

Download

memory/3712-25-0x0000018AEC260000-0x0000018AEC368000-memory.dmp

Download

memory/3712-26-0x0000018AEC1B0000-0x0000018AEC216000-memory.dmp

Download

memory/3712-27-0x0000018AEC1B0000-0x0000018AEC216000-memory.dmp

Download

memory/3956-232-0x00007FF6C05C0000-0x00007FF6C0689000-memory.dmp

Download

memory/3956-233-0x0000019CDC210000-0x0000019CDC276000-memory.dmp

Download

memory/3956-234-0x0000019CDC210000-0x0000019CDC276000-memory.dmp

Download

memory/4612-55-0x000002A6328C0000-0x000002A6329C8000-memory.dmp

Download

memory/4612-56-0x000002A632840000-0x000002A6328A6000-memory.dmp

Download

memory/4612-57-0x000002A632840000-0x000002A6328A6000-memory.dmp

Download

memory/4632-246-0x000001E8E5130000-0x000001E8E5196000-memory.dmp

Download

memory/4632-244-0x00007FF7B7060000-0x00007FF7B717A000-memory.dmp

Download

memory/4632-245-0x000001E8E5130000-0x000001E8E5196000-memory.dmp

Download

memory/4708-35-0x000002D6AF570000-0x000002D6AF5D6000-memory.dmp

Download

memory/4708-34-0x000002D6AF340000-0x000002D6AF448000-memory.dmp

Download

memory/4708-36-0x000002D6AF570000-0x000002D6AF5D6000-memory.dmp

Download

memory/4708-37-0x000002D6AF570000-0x000002D6AF5D6000-memory.dmp

Download

memory/5548-251-0x0000024B132C0000-0x0000024B13326000-memory.dmp

Download

memory/5548-250-0x0000024B132C0000-0x0000024B13326000-memory.dmp

Download

memory/5548-241-0x00007FF6C05C0000-0x00007FF6C0689000-memory.dmp

Download

memory/5644-264-0x000001EED2AE0000-0x000001EED2B46000-memory.dmp

Download

memory/5644-263-0x000001EED2AE0000-0x000001EED2B46000-memory.dmp

Download

memory/5644-261-0x00007FF7AA710000-0x00007FF7AA85A000-memory.dmp

Download

memory/5868-61-0x00007FF7CFF30000-0x00007FF7D0053000-memory.dmp

Download

memory/5868-13-0x00000249B9AE0000-0x00000249B9B46000-memory.dmp

Download

memory/5868-12-0x00000249B9AE0000-0x00000249B9B46000-memory.dmp

Download

memory/5868-14-0x00000249B9AE0000-0x00000249B9B46000-memory.dmp

Download

memory/5868-11-0x00007FF7CFF30000-0x00007FF7D0053000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads