5b7bf19d8e449d9343bf1f8254f581e3eb6f6adf4c1c47c99a21e1e5da437012

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 04:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Size 1.0MB
Sample260711-eyshzsdx3s
SHA256 5b7bf19d8e449d9343bf1f8254f581e3eb6f6adf4c1c47c99a21e1e5da437012
MD5 98bb048dd741fd220002c4edc237a4c2
SHA1 a300ab54144c5c122c6f271e4a45928ad3e30ce8
SHA512 105761e72408cff12774fe76776c750567d9aca339e52af00c95737d2463ec25517844337829e51a6bf80828ed3b69f452e506925b0d93e1cee7b75e2fd39fa9
SSDEEP 24576:pVoH6ThNF4Xx7AmcnUJd/vJ/vA5kwzlUoq:/oHGFEBAmVbh/vAqslUoq
TLSH
T18535DF59A75440E1E1B6C23888439946E6717C115B70DBDF13E8E63A2F33BE19E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 15 IoCs

pid	Process
2548	alg.exe
5360	elevation_service.exe
3556	elevation_service.exe
1784	maintenanceservice.exe
1216	OSE.EXE
4200	GameInputSvc.exe
1116	GameInputSvc.exe
3776	msdtc.exe
5012	PerceptionSimulationService.exe
5564	perfhost.exe
1092	ReFsDedupSvc.exe
968	locator.exe
1476	SensorDataService.exe
4140	snmptrap.exe
3124	ssh-agent.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a8cdf8f238bf42.bin	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\UnblockRedo.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe

Modifies registry class 52 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe"	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe\""	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1116	GameInputSvc.exe
1116	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5228	2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	2548	alg.exe
Token: SeDebugPrivilege	2548	alg.exe
Token: SeTakeOwnershipPrivilege	5360	elevation_service.exe
Token: SeTcbPrivilege	4200	GameInputSvc.exe
Token: SeBackupPrivilege	1092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1092	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1092	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1092	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1092	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1092	ReFsDedupSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 1116	4200	GameInputSvc.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_98bb048dd741fd220002c4edc237a4c2_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5228

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2548

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3556

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1784

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1216

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1116

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3776

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5012

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5564

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1092

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:968

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1476

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4140

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3124

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:4684

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:5656

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:5356

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4332

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:4620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ff1dda23321f4996d36a2c5748952380cd48932240b786b368e225adbeedbf5b
MD5 c6003fa773a8b7954e0999463e21f679
SHA1 143e1fe7399121dd5e77ea628e45bc827aeecad1
SHA512 76323e95fe959688c35a9c3133fca6b71d354926af68ddfba9cdf29931e2cd695ad5163dfd3a68e9dbfe2a268c62e4d23cc49746b83afd0f25bf814f4588f086
SSDEEP 49152:Pb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnFVbh/vAqslUoq:N3q6gjBHhlUoq
TLSH
T156D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 7806e4bad48592a5e9ef7c590080e9fa494a7ae769a0a3f8d61f206dc6c82930
MD5 842ff666e1106f0a1a56d8af348ae55c
SHA1 70c602c7b61111ff04a4582b4e0f4acdac981e7e
SHA512 a27db9f83cd25469a60422edde729bb33c6f811d892c0029b51be03e4959c1d13ed7ad8b3ca63943826db96866de2f51ab3a1368322f5181e533b171641a5f2f
SSDEEP 12288:31XLsHwLkxy2lRq2czAYo7ncqwHsn2kwH/0UtvJ/aQADHMW90IzQwaEBjpuN34q:lXYQ6tczAYcnUJd/vJ/vA5kwzlUoq
TLSH
T156050229B3D409FDEC678138CCA2C915EA73789647A0E78B03B489655F233D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 ef42277c990f7d74e6462e0e39db2b843656fb1f58cf195107e6367acb75cd78
MD5 bb856fe0d4364d332d1d11a1c2cc1e69
SHA1 b6abc7ce47a38300ae1998f5263bbafbcda119b9
SHA512 594d0dd3dfb20e769e995cde0c31a58cc96eef8e097490b21eafe97786b570928bfc1d1178f25e331f931b21f9bf94cd7b7ee07d96396b879547dc40a3a18d35
SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+CUxo7ncqwHsn2kwH/0UtvJ/aQADHMW90IzQwaEBjpux:Owu+OWjcnUJd/vJ/vA5kwzlUoq
TLSH
T18E05F14673A41CF9E96386388997D53AF7F2BC422A64D71F0760C6576F23360AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 14bd6597a4c74018ae1092dac233349596396140f6cd2a79f8bd1449af5ce3e3
MD5 12f7893f7cd15049122579105ff03bae
SHA1 c5735b67586bc7c7bd12241692835c3b3d235b64
SHA512 41b34650b7d0e3a1a6bfd5d6c5c0bd71ea469740fc82765bc239a074776d852be01ac0d9abe309057b11bc8c70008482d340cba83537eaa6dcd7adfdb24abe33
SSDEEP 49152:YB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glDVbh/vAqslUoq:yu6JmTxd2dYhlUoq
TLSH
T1A9D59D13F2DA01E8D06ED578974A9233E962BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 0f0402e54736b3982b8e00fc98d6de104911e9f6a0a251015e82df552e13f108
MD5 6e351a517e48e6ce782174f656c7802d
SHA1 4b9628fa1e142f5793725f8425f220f1e2e0b3da
SHA512 4427934efd98cbe10e90beb7929acf0e617525fffad0ce2c12d5a7202c0e4b98edf0d40a69845c97fa1bd8c15b1fb24d97f8fcacd296a48c85893e3fb6b67e53
SSDEEP 12288:Bm7CXo7ncqwHsn2kwH/0UtvJ/aQADHMW90IzQwaEBjpuN34q:sGcnUJd/vJ/vA5kwzlUoq
TLSH
T108D42373F749E64EF831AE306C96AC2CE86DBFD79EA4D08B6D150541AD3038049BA35D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 3134f2a29476a8d44b3adfc465a8653f541e70f726118bb430e2e54a2b4066ed
MD5 0cbe192cf30ae4c724f68d02085d184b
SHA1 370cc5ffe15fac2451a10374114ea8ec26c77732
SHA512 26415fc8ca819a5dbfae5a98790d59e1c02e85f73951cb6acd9cf93887d5c40651e7f7d860c180d03a84f16e6b308c698f8633ecacd9dba05349760c8f0c03c3
SSDEEP 24576:Pgb6bmBIi49WNNFpg1rSvFv7bYncnUJd/vJ/vA5kwzlUoq:Pgb4mBIBhGF4Vbh/vAqslUoq
TLSH
T14865AE1E22EC02F5E0F5E2B8DDAA441BD6B278160731D2DF1251426D2F37EE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 c9078401b5de7199cbf7d743192aecafbff960ebc9573822a0ad1dad01e136b5
MD5 9ac43c37b2082fa7db804e8c44b1013b
SHA1 c47f1c4c875d6d1bcb0e452c477399708227330b
SHA512 78c41756adc4a11ebaeeb7fec05d81f9f88640201e008b774b54b111e61d79ecb910d7ff49c2b081ea7f6c63fda4c1bcd1877caa75b82dc14a3a33b7fe0a1b78
SSDEEP 12288:JOGdo7ncqwHsn2kwH/0UtvJ/aQADHMW90IzQwaEBjpuN34q:QGdcnUJd/vJ/vA5kwzlUoq
TLSH
T19BE4237A72A5718CC835DE345CA2AC6EF8F47AE25B64D0EF0DA145319F203E0517EE98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 8727f48b19929df9e3ff57a3487a0fec44a252519d4c653625f99a7cae5403d9
MD5 eadc5b2cfef80a90bdf05a76dfe1d5d1
SHA1 62a72c3b39ea9dc07ca234f9d8ccf781803f0013
SHA512 959082b501d7e8632b80f76f51f73677fb9993cf0461be159359f880142085403ee8f8bb17cbeaf6f5293cdac8035cea91b739f4995f17e90cb23a13c7ec49b7
SSDEEP 12288:qUo7ncqwHsn2kwH/0UtvJ/aQADHMW90IzQwaEBjpuN34q:qUcnUJd/vJ/vA5kwzlUoq
TLSH
T144D423A6F305E68EE821AE306C93BC5CE8E8AFD79BF4D0CB5D2505429D103D441BF698
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 c164f45a0eb737e2f83d977880afc7beef6ab6ce7c1ce72ef706a4ab05ba70e3
MD5 92707731300f6a2fa7a23f25b12de523
SHA1 3838bba7dbc39b2e1d0f31b9363b611bf84019f4
SHA512 9ada956e65d316eb3f4777d18eabe7d2fdf961e7fc799ae464e5fe539a55e951968c58626e2d1248aa27f0b1d786af2b6e00d3976bac481d276ae628f92b2ad8
SSDEEP 24576:LAP8N8anJqH1Mzria7/m6cnUJd/vJ/vA5kwzlUoq:UkeaJqVra7/FVbh/vAqslUoq
TLSH
T15A35F165B7E101F5D477D13889824A67F6B1B8260364EBDF0BA88A511F237E40B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 3e4bb74a1b361677e9e3653baf53ed9bf21d14d8ee3a1b651b965eccb88f00f9
MD5 f3342e2d18f79230ef673d433d97f148
SHA1 f8f05f771d708fb87b853221cd38f7ca04fc748a
SHA512 3f456fcacbf681871e64ba226ff1c3c7a48208d14ff6f887ee3021f0f5acf598f21ef24d50c23ae3f88394c0e2eb78e887ed27f1fe986e68345862a2f6f092dd
SSDEEP 12288:nHvUrBFrEjwaQTo7ncqwHsn2kwH/0UtvJ/aQADHMW90IzQwaEBjpuN34q:nPUr+NQTcnUJd/vJ/vA5kwzlUoq
TLSH
T18905F22F62AD18E5E676E53C8982861DF671B4A31751D2CF02E0417E5F23AD8BC3EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 ddc207bcb01380084aed82510f790f2dc9f124b794ad6b1ab18d1e46d331a168
MD5 fe977be039e06cfd75c0a583d252ce16
SHA1 c94ff93fafd9ea0a7f3ebcb9ad9b61f9a5a898f7
SHA512 b4b7fbce17a75dc02d6f388e9d628bbae85f9b11c9cdfc33a47b40135a5e397a99041e023f3e245f758ae7316d82fcdd1af5f9cd7a4212bce2deedb7c457f59e
SSDEEP 49152:zBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjMVbh/vAqslUoq:cG05lO43byhlUoq
TLSH
T138D5CF6A62EC11F9D1BBD17CD9C68A0BEBB23815033556CF02A486A91F23FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 28ebeb2a9bdcb5dadf87eda711d94fc7b061c6261483dadd27bb11c5439cb878
MD5 6853080daa4b69b36e3069efbd80bc34
SHA1 02841874f057c0849553d29bee44a8166ca505b2
SHA512 c47b6d66795240c713fcbe9fad4ab33e7b762c7c8a05e98f22b25f1208af6027226828bda5429ee8f7bf9ad204969c5db6e23027016501e9944cb78004255acd
SSDEEP 24576:VNcwHdjbyQ4nLC18lb/EOjowL7Fk0cnUJd/vJ/vA5kwzlUoq:VNc/zEOVHFfVbh/vAqslUoq
TLSH
T11F858C2623E901E4F5BBE1BE89779946FAB17865533086CF0291811B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 7f9503af7cece06c59f52543cdd9e2714052120fbc7a6af8285e481fe428486e
MD5 aa044f6c84ef62246ec9bfc7ea8d4c44
SHA1 6994f39c7b22255125c7571f280ee5d39da79f7c
SHA512 3fa29d003ff8bd69b307884fa78e8cb5f8311cc781f64728d952f80f1579c71e955ed0f683c04e186ab8da2688b4595dbb4593cfb9169ac07d759d7c8177b1f4
SSDEEP 12288:1OHPJnJP6szeCs6Rl28dHo7ncqwHsn2kwH/0UtvJ/aQADHMW90IzQwaEBjpuN34q:aJnJPbzB4SHcnUJd/vJ/vA5kwzlUoq
TLSH
T15615E03DD2A810E8E4B7C274815A1A59FE71387D2F21A9CB19B4D5343F12FE0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 7f0675941c846391161031b877289390c4d68b982adc04836c0c627dd5978064
MD5 461f5fee10a0e16246a95b8fdb41439f
SHA1 d2d9b0f8fbd5d01fa4d5684544bcf407aeba558c
SHA512 c834fe459de38a628c18e4c1e25364ec534a13f602fd64ced84aba8b3c750479ac409a3153a2e0bcaa3c3895cab4259502f21e6bfbd26d796f34a2bce7eaff57
SSDEEP 24576:DCLHGL0MoeVtFumTijCmlKQWDkZcnUJd/vJ/vA5kwzlUoq:DCLHGeeV5ijCmlDWDkZVbh/vAqslUoq
TLSH
T1D2A56B05E7EB5188E8F3CAF5C92694169A327C549B34F7DF4E80CA6A1E32BD0D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 45336d575d3cdb89dfc92d4de2c011a4afe45c817b705bfce2a46b99b48954a8
MD5 c203e1dbc960f5b1ece9165e63646216
SHA1 4869fa8faf96f4ae2414e028a1756580cbc1b960
SHA512 9e8a087650d4786361e4b7d7405750aef011d5c0cf802eace004c7da622726d4dc80db0deb7ab16b60038033801feb1aae1ba6bef2fca29b4a044471e73bc3c0
SSDEEP 12288:C1Hck6j5ZI7No7ncqwHsn2kwH/0UtvJ/aQADHMW90IzQwaEBjpuN34q:e6DIRcnUJd/vJ/vA5kwzlUoq
TLSH
T13EF4016D737A10F9D037D03D88830909E1B2B5B2876195DF0BA4857A9FA3ED8B93DE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 cf963810a52314ea8c53d6bf54f40e46ac5ce565e055f0062089bb63aa4d1bf4
MD5 84ecb662f315abf35cb50c6a2ae83c5f
SHA1 6bc02be6e6fb875eb8514729bdf8b95f1a6034fa
SHA512 461d401cf4386ce37f8c4e087639022c4e4d81c42da82d927bafd96bae21f51409510e2da2350a7c9b3bd73d92e330e256615b5076076566872cee5a956a706d
SSDEEP 12288:oG6kyao7ncqwHsn2kwH/0UtvJ/aQADHMW90IzQwaEBjpuN34q:ptyacnUJd/vJ/vA5kwzlUoq
TLSH
T15CF42201B384B1C9E8355E349CB389ACDD78BDA29F60D2DF19A0963E6F303D0A875B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 d395a6e778b2a7ea2539c1f3445629aebd98a8a18336e8b0d641f96319c0953e
MD5 703de4e6a68dfe1c34765fb08f048bb2
SHA1 59d48eb98900ef42751065452b51311c05716063
SHA512 c8d21448630f39ab79dfcb408884bef7c19d81db5355750b2af7cf7d2309090baf0fbcbc73592fc6165855f66c97408e37dd4f1ff8b92387299ca26a72a66293
SSDEEP 12288:MDLo7ncqwHsn2kwH/0UtvJ/aQADHMW90IzQwaEBjpuN34q:YLcnUJd/vJ/vA5kwzlUoq
TLSH
T115D423BAF315B28DD821EE302CA6AD5CD4B87BE75FA4D0DF1DB50521DE203D041BAA58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 108e892d817dc6ca2a900a6afa181ebc3eefef914509894069be4b3d459f1619
MD5 5f19683d78d9e8caa78caec15922b82a
SHA1 cc1e7bdad735089d22e1750afdee91389bfbf1f6
SHA512 c7bdeed86c4dc5b6522b064aafa97bfc7f08b71cd7cbdec2e11065252c80e2e22d925f3bd0756f0ea3fb087b90ddc6b536e1bafa2f2ccaa1a352a75dfa99dba8
SSDEEP 24576:6tgkLoTfaidZLcnUJd/vJ/vA5kwzlUoq:6gDTrZLVbh/vAqslUoq
TLSH
T1DC559C1DB3EA05CAE2B2D635D8725493D633B4315772D6CF2448C03A4DAAED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 384KB
SHA256 c63057d1a5949d2a78ea5734fbdedcbb3469f160b7166f7d0a99b890a69d6e88
MD5 3206dc6c370b2586e3d1dc37f4740045
SHA1 bbf5dc5024ed4ec298f99eab8b560ee23a53ec29
SHA512 f6b0d998acf6bdd1f37194b584c482c8f7986eccca51314e803fe5227e553f4bb3adde29c83fc6aa913446494e882e3a220716f377dcd5cd650a97f2ba02a98c
SSDEEP 6144:GCUTFVtpsfv+vS3pmXCvpHrnyUVaedcHmIoUCIxQOK3r7qF0vR8qX/ysNGTnVk5F:GfFxLvSZmXSpHrnyi3yHTeqer7q6+qXp
TLSH
T1AC84197CA1E840A8C99A9779C44627A6EE70382E3F3015DB0170D578FF1BEF18639E65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/968-291-0x000001D130E30000-0x000001D130E96000-memory.dmp

Download

memory/968-290-0x000001D130E30000-0x000001D130E96000-memory.dmp

Download

memory/968-295-0x00007FF7D6400000-0x00007FF7D64AD000-memory.dmp

Download

memory/1092-282-0x0000024784320000-0x0000024784386000-memory.dmp

Download

memory/1092-284-0x00007FF765340000-0x00007FF765A83000-memory.dmp

Download

memory/1092-283-0x0000024784320000-0x0000024784386000-memory.dmp

Download

memory/1116-241-0x00007FF685880000-0x00007FF685948000-memory.dmp

Download

memory/1116-242-0x00000237548A0000-0x0000023754906000-memory.dmp

Download

memory/1116-327-0x00007FF685880000-0x00007FF685948000-memory.dmp

Download

memory/1116-245-0x00000237548A0000-0x0000023754906000-memory.dmp

Download

memory/1216-55-0x000001D40B0A0000-0x000001D40B181000-memory.dmp

Download

memory/1216-56-0x000001D40B2E0000-0x000001D40B346000-memory.dmp

Download

memory/1216-57-0x000001D40B2E0000-0x000001D40B346000-memory.dmp

Download

memory/1476-301-0x000001C233EE0000-0x000001C233F46000-memory.dmp

Download

memory/1476-300-0x000001C233EE0000-0x000001C233F46000-memory.dmp

Download

memory/1476-299-0x00007FF673920000-0x00007FF673D36000-memory.dmp

Download

memory/1784-45-0x0000024687D90000-0x0000024687DF6000-memory.dmp

Download

memory/1784-44-0x0000024687D90000-0x0000024687DF6000-memory.dmp

Download

memory/1784-43-0x00007FF6F1AF0000-0x00007FF6F1C57000-memory.dmp

Download

memory/1784-52-0x00007FF6F1AF0000-0x00007FF6F1C57000-memory.dmp

Download

memory/1784-50-0x0000024687D90000-0x0000024687DF6000-memory.dmp

Download

memory/2548-11-0x00007FF613F40000-0x00007FF614062000-memory.dmp

Download

memory/2548-61-0x00007FF613F40000-0x00007FF614062000-memory.dmp

Download

memory/2548-14-0x0000029B32A90000-0x0000029B32AF6000-memory.dmp

Download

memory/2548-12-0x0000029B32A90000-0x0000029B32AF6000-memory.dmp

Download

memory/2548-13-0x0000029B32A90000-0x0000029B32AF6000-memory.dmp

Download

memory/3124-319-0x00007FF7D5AD0000-0x00007FF7D5D72000-memory.dmp

Download

memory/3124-320-0x00000214A44C0000-0x00000214A4526000-memory.dmp

Download

memory/3124-321-0x00000214A44C0000-0x00000214A4526000-memory.dmp

Download

memory/3556-35-0x000002937C7A0000-0x000002937C806000-memory.dmp

Download

memory/3556-34-0x000002937C590000-0x000002937C671000-memory.dmp

Download

memory/3556-36-0x000002937C7A0000-0x000002937C806000-memory.dmp

Download

memory/3556-37-0x000002937C7A0000-0x000002937C806000-memory.dmp

Download

memory/3776-251-0x0000027445550000-0x00000274455B6000-memory.dmp

Download

memory/3776-336-0x00007FF64EA00000-0x00007FF64EB19000-memory.dmp

Download

memory/3776-250-0x0000027445550000-0x00000274455B6000-memory.dmp

Download

memory/3776-246-0x00007FF64EA00000-0x00007FF64EB19000-memory.dmp

Download

memory/4140-310-0x0000019A0EED0000-0x0000019A0EF36000-memory.dmp

Download

memory/4140-311-0x0000019A0EED0000-0x0000019A0EF36000-memory.dmp

Download

memory/4140-309-0x00007FF625960000-0x00007FF625A13000-memory.dmp

Download

memory/4200-318-0x00007FF685880000-0x00007FF685948000-memory.dmp

Download

memory/4200-232-0x00007FF685880000-0x00007FF685948000-memory.dmp

Download

memory/4200-234-0x000002D065660000-0x000002D0656C6000-memory.dmp

Download

memory/4200-233-0x000002D065660000-0x000002D0656C6000-memory.dmp

Download

memory/4332-360-0x0000021EDF9E0000-0x0000021EDFA46000-memory.dmp

Download

memory/4332-358-0x0000021EDF9E0000-0x0000021EDFA46000-memory.dmp

Download

memory/4332-359-0x00007FF710910000-0x00007FF710DE0000-memory.dmp

Download

memory/4620-369-0x0000020C83500000-0x0000020C83566000-memory.dmp

Download

memory/4684-329-0x000002BF1F9A0000-0x000002BF1FA06000-memory.dmp

Download

memory/4684-328-0x00007FF7AC0B0000-0x00007FF7AC244000-memory.dmp

Download

memory/4684-330-0x000002BF1F9A0000-0x000002BF1FA06000-memory.dmp

Download

memory/5012-348-0x00007FF72D430000-0x00007FF72D579000-memory.dmp

Download

memory/5012-261-0x0000021D52BD0000-0x0000021D52C36000-memory.dmp

Download

memory/5012-260-0x0000021D52BD0000-0x0000021D52C36000-memory.dmp

Download

memory/5012-258-0x00007FF72D430000-0x00007FF72D579000-memory.dmp

Download

memory/5228-0-0x00007FF7CA510000-0x00007FF7CA712000-memory.dmp

Download

memory/5228-22-0x00007FF7CA510000-0x00007FF7CA712000-memory.dmp

Download

memory/5228-3-0x00000226797E0000-0x0000022679846000-memory.dmp

Download

memory/5228-1-0x00000226797E0000-0x0000022679846000-memory.dmp

Download

memory/5228-19-0x00000226797E0000-0x0000022679846000-memory.dmp

Download

memory/5228-2-0x00000226797E0000-0x0000022679846000-memory.dmp

Download

memory/5356-351-0x000001F80B880000-0x000001F80B8E6000-memory.dmp

Download

memory/5356-350-0x000001F80B880000-0x000001F80B8E6000-memory.dmp

Download

memory/5356-349-0x00007FF665A60000-0x00007FF665CEA000-memory.dmp

Download

memory/5360-28-0x000001CEDBDF0000-0x000001CEDBE56000-memory.dmp

Download

memory/5360-26-0x000001CEDBDF0000-0x000001CEDBE56000-memory.dmp

Download

memory/5360-25-0x000001CEDBC00000-0x000001CEDBCE1000-memory.dmp

Download

memory/5360-27-0x000001CEDBDF0000-0x000001CEDBE56000-memory.dmp

Download

memory/5564-357-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/5564-277-0x0000000000890000-0x00000000008F9000-memory.dmp

Download

memory/5564-271-0x0000000000890000-0x00000000008F9000-memory.dmp

Download

memory/5564-270-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/5656-337-0x00007FF7A1690000-0x00007FF7A19B0000-memory.dmp

Download

memory/5656-338-0x000002449EDE0000-0x000002449EE46000-memory.dmp

Download

memory/5656-339-0x000002449EDE0000-0x000002449EE46000-memory.dmp

Download

memory/5656-343-0x000002449EDE0000-0x000002449EE46000-memory.dmp

Download

memory/5656-345-0x00007FF7A1690000-0x00007FF7A19B0000-memory.dmp

Download