9950b617c4904ea54f8a15ad488f00f67cec7782a92e8d6c286c4d125115807a

Analysis

max time kernel
145s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 03:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Size 1.0MB
Sample260720-dtdzcsdx3p
SHA256 9950b617c4904ea54f8a15ad488f00f67cec7782a92e8d6c286c4d125115807a
MD5 3bfc1235b8f4bbb534585d9f46727d74
SHA1 5fa370a31d565ec3dfde64b4b2c4634701e68d35
SHA512 3bcf03222c4c5fd0337805bda54f3783d31170c7bb18004565686df8b52da413a1eed6ecafc2ca670ef9f36745772f1b40dc979fe3282a6768649c45216a06cd
SSDEEP 24576:UUoH6ThNF4Xx7AvWLEkgXWHiYKbfZB1v3adCMW:doHGFEBA+cfT1S1
TLSH
T11635DF59A65440E0E1B6C13889539942E7717C104B71EBDF03E8E63A2F77BE19E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 9 IoCs

pid	Process
8	alg.exe
4100	elevation_service.exe
3312	elevation_service.exe
4684	maintenanceservice.exe
5872	OSE.EXE
2832	GameInputSvc.exe
696	GameInputSvc.exe
1504	msdtc.exe
4860	PerceptionSimulationService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b3eacbcb763f1d8f.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe

Modifies registry class 52 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe"	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe\""	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
696	GameInputSvc.exe
696	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4380	2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	8	alg.exe
Token: SeDebugPrivilege	8	alg.exe
Token: SeTakeOwnershipPrivilege	4100	elevation_service.exe
Token: SeTcbPrivilege	2832	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 696	2832	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_3bfc1235b8f4bbb534585d9f46727d74_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4380

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:8

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4100

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3312

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4684

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5872

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:696

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1504

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4860

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:4812

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:5620

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:4496

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:3276

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:5668

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:1768

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:256

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:4712

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:4572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7a3724922ea77aaa8013777b1204843106a8d7cfe6cc9b2d54b3e68e94c68222
MD5 458eb2e132ce3029d240db8531502c82
SHA1 67b707c5c3c988ae0dab4471feaf095f637af873
SHA512 2f8f6650132a01961c77a9dd205de3422c8167e2eac102117bbb717b7b97a8ae943c3f885d4907e1c6d407d1f4fcc987143d078cf1540923c2cca119e0f0221e
SSDEEP 49152:Vqn632BuPkFKRrdE6oh7stBhuXjfS4LWxnJcfT1S1:B3q6gjBKcfT1Q
TLSH
T156D59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 401dc54d176e22ca7298604cb29b4bdc5d2f043d3a316cbe354c99f870d7e4d9
MD5 5a14850ee76cec4aa090ef9922cb7a72
SHA1 267debae763bcaf2a5092c6568c929a6779ddb92
SHA512 3ef6a38271315eee6e9a6cc90e4e2d25a6e55ae988281623f1075d4152610c264ab8f9faf0f317bf49207229c0714a4bec4f573484c4296e983cff44be869ff9
SSDEEP 24576:lXYNaDczACWLEkgXWHiYKbfZB1v3adCMW:LDcWcfT1S1
TLSH
T18C05012973E409F9EDA3C17DC972C512EB3278954750E79F03A488661F237885E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 27b9017468bdc2b36fca098143db5f75e7445e34e6d5181a3b4e09671bab24a7
MD5 c057868a9262f544048582ff4f7c6ddc
SHA1 3d75348f0e553fc9c9626032d78ae1d000dface3
SHA512 79cc7d2893879a4263d4ed9bab352877d2ddf3f873765dffa5512c3a1798e7b6aae317f1e89c8248d7123dfe91a37c5270101339f9bb2dd7d4d2f0080ff9953f
SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+ClWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6I:Owu+OWmWLEkgXWHiYKbfZB1v3adCMW
TLSH
T16505F10676A41CF9E9A391398667C536F7B278512B20DB1F0770C65B2F37321AE2E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1d93ae59ebe14011ddcb1144154d43669d6a203a4112378be8c81e22a3910781
MD5 58e0143eed3784c4a79de79a783fa93f
SHA1 e6fdfe0e270d41fc8710129a76697d9fbd4c273f
SHA512 38868cb05ec5ddf77e334a40d3183cd73672be1640e0d882d4052ec9d88856ca56825dade56b1ca85fbb5d600ebaa74a395b541c271de6cfa2db5400d9b656b7
SSDEEP 49152:7G+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl9cfT1S1:6u6JmTxd2d9cfT1Q
TLSH
T190D59D13F1DA01E8D05ED478974A9233FA62BC490B34B6EF0A9072562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 db856fb0a36ea87be785a9e9fdd09cc546d679b4e58a752778b68735e5df9e33
MD5 d384092cd82bb014099fa957612565f4
SHA1 ed7603d2cd75b3f0725f7dd3f2127a3de2ace69c
SHA512 38feab4971d1c7f9329c6d16d78a214f01561bad8f5c1ea66925e8316cc6553dd9260c0845aee1da52c48b31dd9881606efcf546325d3e2377918285a8504b2c
SSDEEP 12288:Bu75WOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:Y5WLEkgXWHiYKbfZB1v3adCMW
TLSH
T108D4232377591A5DFAE0E5795237C5223B3C34E98F00A0EF972650933AB0F469ED618B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ab50a5a7b8e48a3640b4dec8a79af8eb365df39a7325f7c9c8d6a175787056e5
MD5 c25ea4a3976791eb55f3d968c0429035
SHA1 8ac1e8017b0d71db8f084c3bd9ea06f6016bf773
SHA512 781222fb226a60026964ede2128ab2b7ad311af98d1fc43ce9b4f5e94adc94427d275fd4442cdf614e7dbf552b301a81769a19d68ed69bc5d6aee2ff63a69a88
SSDEEP 24576:Dgb6bmBIi49WNNFpg1rSvFv7bYnWLEkgXWHiYKbfZB1v3adCMW:Dgb4mBIBhGFRcfT1S1
TLSH
T1FD65AE1E22EC02F5E0F5E2B8DDAA4417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 651c228baf7558e12b80530b26453aaafafca3c713bdc0c7bbf72b06200b71a2
MD5 e267bd13c140a64dc5f5466a67fa0399
SHA1 5befb38b327a62c4934cab2777216f0f55dad81e
SHA512 8cfd6869c86d218d9c53cfc8e88e6e522c6be8443447a67c6e1a3cc85de7718b09f4516af43b935e253ac78a4931918f44afb664a316c517784698cd5c44e9c0
SSDEEP 12288:R9G8WOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:jG8WLEkgXWHiYKbfZB1v3adCMW
TLSH
T167E4232A31A636DCC9B1D27D8532C4537A7030E08B0075FF4AF194766FA4AD57A7AC8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 35ff35233ca9d2beb4497288b38a0cb4c1a8cac4a5de35ab8fb66476c68cd9e3
MD5 4e5678763572050f3b3f435a74bf9489
SHA1 30b528077526654a5754b4de2cc5128f441ad1e9
SHA512 177ec7f08ee71a5984b77a3627e1c701dfffd515041b9fce6703c3decdd63af14026ca3cc0e6af3ef96b8744ff101b446348d44106bd2cf8deed3de4f2233665
SSDEEP 12288:P5WOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:P5WLEkgXWHiYKbfZB1v3adCMW
TLSH
T1FAD4231271592B9DEAC0E57A4233C9523B7830E58B0075EF8A76505326D4BDBAEFA0C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 aabf02b062b50f2524675591195fc7eadf337a04de276a04d45379b1303f12f1
MD5 77ef5b1fb2bcec78177697b3b92d274a
SHA1 1cb739cb60592ca806a5e7e2a8008694393fc635
SHA512 e22fb79570f8d8673df15555755cfcdf7d6b07d9e7b5354c33a625b6cbe12f966dba4d53341109d6e44d6216bb702a62cf6557be5ade266daf4799ac3c98f1e6
SSDEEP 24576:itZ8i8FKJqH1Mzria7/mjWLEkgXWHiYKbfZB1v3adCMW:qeFFmqVra7/9cfT1S1
TLSH
T15735F12576E102F5D4B7D1388A528663F6B2B4250360FBDF07A88A521F23BD54B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 e16f10a53fd917862ebc9835756779d9003daff4f2b32d180b94f6792e6791b2
MD5 524449ca560e320ef7a1854ce09eeafc
SHA1 eee441a357413e4d89b1423eff4af7db7db4e649
SHA512 1405c4675322b2a54d3cfdfeadbd47c6ee005c93adf45f3deba6f4acdb600d75ab9625af44b403a769c4ff5c268280a7c44944c3b157f78796ac4b576942cb16
SSDEEP 49152:GBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjdqcfT1S1:pG05lO43b2qcfT1Q
TLSH
T16ED5C06E62EC11F9D1BBD17CDAC6860BEBB23415032456CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7ef57254749f3f31235bba9a64d5935c133ae00f9d1216dee7ded864d2b55fe6
MD5 f14c089f112e1d019ad520cc87ab861e
SHA1 6836c25e6601a4b57dd64557ea8f0b435c5d8bab
SHA512 84619d5ef7e1876a66e20660fe73a44b3b282d50c24b09d911322bf933a40537c2befc6da452bf563a7269ff025041a2e9e0883806cfc9024ff75928d66b45fd
SSDEEP 24576:8NcwHdjbyQ4nLC18lb/EOjowL7FkwWLEkgXWHiYKbfZB1v3adCMW:8Nc/zEOVHFqcfT1S1
TLSH
T16B858C2623E901E4F5BBE1BE89779546FA71786553308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 ee091268c40dc1fcfc6ac56eaa56170c43bb5aa5b9806857c4db3d6b4dad4a26
MD5 be80e1487b3fd26f91db180dd61ecefc
SHA1 1f1df8788aab50d154df323bd101f665de282cff
SHA512 e7c36cba98c22e849a26fd48553148abb3997647a8516dafcf947e98cd20aed5979a310e4893eef79f9997f1eeb7caebe1ab0a7ba36bdd6a69c8de3b08dd810d
SSDEEP 24576:4JnJPbzB4S8WLEkgXWHiYKbfZB1v3adCMW:4JnJv6StcfT1S1
TLSH
T15715D03DD2A810E8E4B7C2B4811A1A5AFF31346D2F1169CB19B4D4353F52EE0AA79F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 a2f76c4056aa0c972ca1ada3cac6c5ee67fb3995cd5a2f2dc38beea3f671c566
MD5 c0674a206480706951c82f45c03afbf9
SHA1 dd5a0ede24a384997ed35e9c53d31c617b8fe5d8
SHA512 404813b003ddb344bddd2555e359567e7713b7e47e5442aa404c759976586c788717afb5fe744d4ff637182bc951419618f5460c2af2db9a9d67153d75e4c9d0
SSDEEP 12288:Q1HKk6j5ZI79WOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:y6DIhWLEkgXWHiYKbfZB1v3adCMW
TLSH
T1D7F4011D337A11F9D1A7D03E82534502E6B270B1C71169DF4BA4C4BA5FA3ED8B93DA82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 eb055d1d2198f8d4e7daea74151183ce06f78dedc319d4d8fe54c8ff91644368
MD5 c75b5494cb7ab84199a8ae570e34e0cb
SHA1 f293908869d2cee624ae73f47425f945822bbb49
SHA512 f514de166af60992f3fa85ed4c9d9dd7aae2fff583039dcb69f862c16cc510df604a2098a18ea55887e933b48a3d94f06508620d85cdbc022866724c30ff2c7a
SSDEEP 12288:qG6ky5WOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:jty5WLEkgXWHiYKbfZB1v3adCMW
TLSH
T18CF41201739421D8EAF192789633C1A1AF347CA08B00A2EF56A1E43F2F75BD5AD76746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 55db82f5484cfb9950e1e5a4b7e69388fdb348b070278582f15d86b0f4f010ea
MD5 efee2e538a57bd51e603c692cd7c2c8e
SHA1 e7e04861d50deaf4c3993443e4870bfaf65b9d21
SHA512 51e5535e81cfe8d44949271281f7eb0a5a94932e7b559d7cec58c3a9d6794c3dbc6488cfaca58f22005d7dbe45854282f7fec3d87adfb8b3a02ecd055413a317
SSDEEP 12288:OwjWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:9jWLEkgXWHiYKbfZB1v3adCMW
TLSH
T17CD4232A7255369CDAC0E5794233C5927B7430F48F0075FF8AB294732BA4BC66EB6487
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 640KB
SHA256 d73ec0fe24a43527c52a6bfd7d0cdef11c938fa2b2a1bf7a4cd4d8107e449c63
MD5 680054986f489c86c8f8a4dc39be06ed
SHA1 73a5e1dd28158d0e60f5c0fe41caa94a53a768eb
SHA512 0b2c2e768bbcb05c662dc71be49f5d7427659a6bfaf1dda25c3061325109fbd88860bb39ab93e52ee682d39faf369fc0875d6237d7467496126a0a641c029214
SSDEEP 6144:f/Zg5Ty5Z1QSLI+lqoDyMpJHS433NhcMV/VUjSTrGNPyCSZB8PTuFcKa45H9g+fv:fhg5cZyFDK3tT5Tr7aVLIH9lH
TLSH
T11DD4061D67EA05CAE2B2D279D8721493D633B4315772D6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 4cdaea10da0185dd6ff02ab2dccf0ddd7c23ffe633440711419f3b2c499d2655
MD5 f2bc63bdc20b328fd9575326af35bcff
SHA1 627e89664d0154dbeebd187e2d8949040c5f071c
SHA512 aa061690e5e53e0772433ca2803751197b617108865cf18cd4f95a4cb8a1e78535b7fdcf04b48fb7e679cc1cd3a2dc3c8db88193b96a3284d6daf12c4ecc8ab0
SSDEEP 12288:oHvUrBFrEjwaQZWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:oPUr+NQZWLEkgXWHiYKbfZB1v3adCMW
TLSH
T1D805F12F32AD18E9E676E17D86528609F77174620701A2DF02E1807E1F67ED8BD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-61-0x00007FF677CD0000-0x00007FF677DF2000-memory.dmp

Download

memory/8-14-0x000002CD0DD10000-0x000002CD0DD76000-memory.dmp

Download

memory/8-11-0x00007FF677CD0000-0x00007FF677DF2000-memory.dmp

Download

memory/8-13-0x000002CD0DD10000-0x000002CD0DD76000-memory.dmp

Download

memory/8-12-0x000002CD0DD10000-0x000002CD0DD76000-memory.dmp

Download

memory/256-328-0x00007FF6E7860000-0x00007FF6E79F4000-memory.dmp

Download

memory/256-329-0x0000026DF17A0000-0x0000026DF1806000-memory.dmp

Download

memory/256-330-0x0000026DF17A0000-0x0000026DF1806000-memory.dmp

Download

memory/696-327-0x00007FF71F3A0000-0x00007FF71F468000-memory.dmp

Download

memory/696-241-0x00007FF71F3A0000-0x00007FF71F468000-memory.dmp

Download

memory/696-243-0x000001C2D7A20000-0x000001C2D7A86000-memory.dmp

Download

memory/696-242-0x000001C2D7A20000-0x000001C2D7A86000-memory.dmp

Download

memory/1504-336-0x00007FF6F0E80000-0x00007FF6F0F99000-memory.dmp

Download

memory/1504-251-0x0000025EDA840000-0x0000025EDA8A6000-memory.dmp

Download

memory/1504-250-0x0000025EDA840000-0x0000025EDA8A6000-memory.dmp

Download

memory/1504-249-0x00007FF6F0E80000-0x00007FF6F0F99000-memory.dmp

Download

memory/1768-320-0x000001FFDE140000-0x000001FFDE1A6000-memory.dmp

Download

memory/1768-321-0x000001FFDE140000-0x000001FFDE1A6000-memory.dmp

Download

memory/1768-319-0x00007FF749C40000-0x00007FF749EE2000-memory.dmp

Download

memory/2832-233-0x0000019D5F970000-0x0000019D5F9D6000-memory.dmp

Download

memory/2832-234-0x0000019D5F970000-0x0000019D5F9D6000-memory.dmp

Download

memory/2832-318-0x00007FF71F3A0000-0x00007FF71F468000-memory.dmp

Download

memory/2832-232-0x00007FF71F3A0000-0x00007FF71F468000-memory.dmp

Download

memory/3276-299-0x00007FF7C3510000-0x00007FF7C3926000-memory.dmp

Download

memory/3276-300-0x0000026B46700000-0x0000026B46766000-memory.dmp

Download

memory/3276-301-0x0000026B46700000-0x0000026B46766000-memory.dmp

Download

memory/3312-37-0x00000126F0840000-0x00000126F08A6000-memory.dmp

Download

memory/3312-36-0x00000126F0840000-0x00000126F08A6000-memory.dmp

Download

memory/3312-35-0x00000126F0840000-0x00000126F08A6000-memory.dmp

Download

memory/3312-34-0x00000126F0650000-0x00000126F0711000-memory.dmp

Download

memory/4100-26-0x000001CC2B740000-0x000001CC2B7A6000-memory.dmp

Download

memory/4100-25-0x000001CC2B5A0000-0x000001CC2B661000-memory.dmp

Download

memory/4100-28-0x000001CC2B740000-0x000001CC2B7A6000-memory.dmp

Download

memory/4100-27-0x000001CC2B740000-0x000001CC2B7A6000-memory.dmp

Download

memory/4380-3-0x0000020862AC0000-0x0000020862B26000-memory.dmp

Download

memory/4380-22-0x00007FF7B60E0000-0x00007FF7B62E2000-memory.dmp

Download

memory/4380-0-0x00007FF7B60E0000-0x00007FF7B62E2000-memory.dmp

Download

memory/4380-19-0x0000020862AC0000-0x0000020862B26000-memory.dmp

Download

memory/4380-2-0x0000020862AC0000-0x0000020862B26000-memory.dmp

Download

memory/4380-1-0x0000020862AC0000-0x0000020862B26000-memory.dmp

Download

memory/4496-289-0x000001FDA48C0000-0x000001FDA4926000-memory.dmp

Download

memory/4496-295-0x00007FF746CB0000-0x00007FF746D5D000-memory.dmp

Download

memory/4496-290-0x000001FDA48C0000-0x000001FDA4926000-memory.dmp

Download

memory/4572-349-0x00007FF67D940000-0x00007FF67DBCA000-memory.dmp

Download

memory/4572-350-0x000002899E680000-0x000002899E6E6000-memory.dmp

Download

memory/4572-351-0x000002899E680000-0x000002899E6E6000-memory.dmp

Download

memory/4684-45-0x0000026285350000-0x00000262853B6000-memory.dmp

Download

memory/4684-43-0x00007FF6735E0000-0x00007FF673747000-memory.dmp

Download

memory/4684-44-0x0000026285350000-0x00000262853B6000-memory.dmp

Download

memory/4684-51-0x0000026285350000-0x00000262853B6000-memory.dmp

Download

memory/4684-52-0x00007FF6735E0000-0x00007FF673747000-memory.dmp

Download

memory/4712-337-0x00007FF7B81F0000-0x00007FF7B8510000-memory.dmp

Download

memory/4712-345-0x00007FF7B81F0000-0x00007FF7B8510000-memory.dmp

Download

memory/4712-343-0x00000154D6CF0000-0x00000154D6D56000-memory.dmp

Download

memory/4712-339-0x00000154D6CF0000-0x00000154D6D56000-memory.dmp

Download

memory/4712-338-0x00000154D6CF0000-0x00000154D6D56000-memory.dmp

Download

memory/4812-271-0x0000000000950000-0x00000000009B9000-memory.dmp

Download

memory/4812-276-0x0000000000950000-0x00000000009B9000-memory.dmp

Download

memory/4812-270-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4860-261-0x00007FF6891D0000-0x00007FF689319000-memory.dmp

Download

memory/4860-263-0x00000224754B0000-0x0000022475516000-memory.dmp

Download

memory/4860-264-0x00000224754B0000-0x0000022475516000-memory.dmp

Download

memory/4860-348-0x00007FF6891D0000-0x00007FF689319000-memory.dmp

Download

memory/5620-294-0x00007FF76EA50000-0x00007FF76F193000-memory.dmp

Download

memory/5620-283-0x000001B69DEC0000-0x000001B69DF26000-memory.dmp

Download

memory/5620-282-0x000001B69DEC0000-0x000001B69DF26000-memory.dmp

Download

memory/5668-308-0x00007FF76BBB0000-0x00007FF76BC63000-memory.dmp

Download

memory/5668-310-0x0000023608870000-0x00000236088D6000-memory.dmp

Download

memory/5668-309-0x0000023608870000-0x00000236088D6000-memory.dmp

Download

memory/5872-55-0x000001A20CB50000-0x000001A20CC11000-memory.dmp

Download

memory/5872-57-0x000001A20CD40000-0x000001A20CDA6000-memory.dmp

Download

memory/5872-56-0x000001A20CD40000-0x000001A20CDA6000-memory.dmp

Download