3f579831aed6a712fe45fb24ac44c0a6b50eceb01138926d643406c22154d9e3

Analysis

max time kernel
147s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Size 1.0MB
Sample260721-cs7dvady9x
SHA256 3f579831aed6a712fe45fb24ac44c0a6b50eceb01138926d643406c22154d9e3
MD5 ef6d15cad90ceb47c57b26cd8e773e30
SHA1 7052505ff971abef6837629d6bd003f7605d5973
SHA512 5c53f3fa792f3a1be7b7f60c674a5ef3454ad480744ea181d1f952690ccf54e84182bbbb333a0e08512c654730213961d1096c4cd2376e118d2218c3b9d99cb2
SSDEEP 24576:CZoH6ThNF4Xx7AHftT736FNKBiMDy5IRcZWvq/qvNg:uoHGFEBA1T73GUBNoIOWvL
TLSH
T17035DF59AA4440E1D1B6C17889539946E7727C104B71DBCF03E8E63A2F37AE19E3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 11 IoCs

pid	Process
4260	alg.exe
4796	elevation_service.exe
2116	elevation_service.exe
712	maintenanceservice.exe
5544	OSE.EXE
2052	GameInputSvc.exe
3200	GameInputSvc.exe
5012	msdtc.exe
5580	PerceptionSimulationService.exe
752	perfhost.exe
1700	ReFsDedupSvc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1d9979fb83806d8d.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe

Modifies registry class 52 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe\""	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe"	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3200	GameInputSvc.exe
3200	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4548	2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	4260	alg.exe
Token: SeDebugPrivilege	4260	alg.exe
Token: SeTakeOwnershipPrivilege	4796	elevation_service.exe
Token: SeTcbPrivilege	2052	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 3200	2052	GameInputSvc.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_ef6d15cad90ceb47c57b26cd8e773e30_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4548

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4260

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2116

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:712

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5544

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3200

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5012

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5580

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:752

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
PID:1700

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:6068

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:344

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:1040

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:3424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ab6ce16ef2f6c99718add7c6c3cb862fbc71a5f7fa2097c1bf9eab4fed130e12
MD5 65bbf955e73772563780144b8d15906f
SHA1 2ee0a9d8ad765f7b4c4b426ed2da0cdabfe7b0c6
SHA512 9009f3d3277021ef5117c8d5548b5d5dd359612aecdf1ced3efa3202e628d6312794c94478eee6bbf1d23057b73dbb528618ad2897afe9d4a21351160ac3e1e8
SSDEEP 49152:UeM632BuPkFKRrdE6oh7stBhuXjfS4LWxnuT73GUBNoIOWvL:l3q6gjB5T7xyItL
TLSH
T16DD59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 920c70370e8cf55685826731d96bae692de1325d60b67470c9a2648664a073a3
MD5 c201502fb60b79082f6912414fbdf30b
SHA1 2171a933b7e0f5abd7e20de0cc4e515eedfe1cab
SHA512 89c8a333747953b0eed40e20c09b858f0aa50bb12486ce4f26da7511f57a41a47f931b7b9b75faa096ae20405e6c548ed52b01691336c698b1ac70d0488b939b
SSDEEP 24576:IXY5BBczA1ftT736FNKBiMDy5IRcZWvq/qvNg:bBcqT73GUBNoIOWvL
TLSH
T1EF05012977D048F9ED67817CCCB2C511EB73B85547A4E78B03A4C9661F232985E3EB82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 830KB
SHA256 79381425954ca1b95b43b168bf2eda94946b94860dd46c69748be1bd61455efd
MD5 617449dc4da9ae661c23343e515195d4
SHA1 cf00b28a63c7f9f4da263fff69034ed4da91fe45
SHA512 f4cbeebd7a416fb25f4819e0dc843321e35dbcccdf93a3ce7311b032874f2bbfcec8ad9a28f7498d51a86b631f9c1c60d2c88ba79bfccf886b6a8706f19143c9
SSDEEP 24576:QwuuOWAftT736FNKBiMDy5IRcZWvq/qvNg:QwVOzT73GUBNoIOWvL
TLSH
T13905F14637A40CF9EA67813C8A57C536E7F3B8122A25D71F0760C65B6F37221AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 143373cd694320aa8c4cf68d781832f2a76a6f304378f438169e78fcd7bbeec3
MD5 e657429cc3b02dff3a4c70026af7ab4f
SHA1 d696673a4486c647dc3a48c67e6eb2f742b30fd5
SHA512 75fa2b410dc893a0205c07d1ccd88d96f4ddb8a32adbcb482a9098c053f338b487367f6f3577415aacef10dd8836bf57ac7783184c68b125facee9134a5115d3
SSDEEP 49152:Zq+taZ3usBWOBr4tEGp0bqx0z+n217aau1glsT73GUBNoIOWvL:Qu6JmTxd2dsT7xyItL
TLSH
T1AAD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 67cacbf05a250a1121037d43143eda451e27a0141c390317efa4385379740a27
MD5 a248138b935c715daf47271ebd4159ce
SHA1 d40fea35ef21090f8f4589884f95347d672f60f8
SHA512 a89e4589e54b1b340adb5ef1a145ad2608f17966f97ddd44879a150bd258ca7a0a6dfcacef1d5f5962fff433a2595e7c374216dc228e819e24b17cd49d14f707
SSDEEP 12288:RQ73+X4xpvftlw4736CmQKlviBgVMD8Ao35PZmRcZWRhi2c/qUeIYNR9/Y:e3ZftT736FNKBiMDy5IRcZWvq/qvNg
TLSH
T1AFD423A33B58C192E63DD4BC4D7B9735171BB6798B98D2C7E50488822E398419D3CB8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 f092cb9ce21a157934a10dabcd58594f38189e071c82ecc217c5a13ed77cb44e
MD5 497f53e583651ff4106687cb36597375
SHA1 9022103c28b1c4670e309f6e46d58fe4f6c1a042
SHA512 0c888e3d5cd610efe7ae71754f15acc8ccaab9b3a164413eb247b838965451cdc57f74034ef0c2e0be430ee381624f2420bd993cfc453142dcb28cf50bb9d1f3
SSDEEP 12288:tRG7xX4xpvftlw4736CmQKlviBgVMD8Ao35PZmRcZWRhi2c/qUeIYNR9/Y:HGUftT736FNKBiMDy5IRcZWvq/qvNg
TLSH
T1B4E4236B3AA5A1D4C63DC1BD8C739A7276B231708718A3EF45D4D4725F294E0A13CEC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 82c9065a1ffd96fac01ef0419686abff266ec02d063b9d37c0701fd60240ed42
MD5 2c34cb51b7178f74661312545bfba29f
SHA1 1f17758904c07c066271918b382b9d86e5e6943c
SHA512 70348a999fbcf3ff56b31223982e4fbc340d152d64cee3badfbc2680152d3ee8e8fc52b7db95265e2691beef024d46b2537d9a1d60ee7cdbd81d2f1b58d883fe
SSDEEP 12288:ckX4xpvftlw4736CmQKlviBgVMD8Ao35PZmRcZWRhi2c/qUeIYNR9/Y:c3ftT736FNKBiMDy5IRcZWvq/qvNg
TLSH
T11BD423A33B18C296C729C4BD4D33AB251756B27683A9D3C7D518D8822F3E4D6943CAC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 b2eaeaa216952b095498c6327fe6bfa446cefbef45748a9c084fb53b22429407
MD5 26d209edda3c0f9f24b30fc1c82c0ec2
SHA1 44f8293d8921bc1267324be432ae9d0a54f4ba16
SHA512 581e1f49840348ad027b96cea92060b49eae2322802d40064c77afcc658fda28cc2369e801de0e15b026aa385cdcf11d06c6c70c0f4ec257c8538f587b253bba
SSDEEP 24576:A7b8S8XOJqH1aErHa7/mBIftT736FNKBiMDy5IRcZWvq/qvNg:OA1XqqVja7/68T73GUBNoIOWvL
TLSH
T1EA35F16677E101F1D47BD0388A974663F6B2B4250364EBDF07A88A511F23AE54B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 912a4b33f7492471e480f192cecab48cda80f604289514da9dc1183edf8459b5
MD5 6b1e7593212b8d31d47b7168eb45c4e8
SHA1 efd47fd1fb679e1a2a05f73bf2f9de39a39a7ca0
SHA512 8692e11b888e2f751ea7312a6dd854440a2cffabc98b09a1e7bc59531fe235df43d4715a2181e030a8a380fbaa8c2ca0ccbd1d60d68461867ede0cee0acfa7f5
SSDEEP 49152:HBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjMT73GUBNoIOWvL:4G05lO43bZT7xyItL
TLSH
T1ABD5C06A62EC11F9D1BBD17CCAC64A0BEBB23425033556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ca619344fcf80fdc83b400db388ddfebad808a813d1cee3dddbbca9e8186232f
MD5 29ef378a256663d3437b54365c78d323
SHA1 f8e618d723d70b907c335f4aff17cf1333a0b300
SHA512 f91abbe4de72c2b2f3badabf39e92d0aae3e1f5ec1fbf65ab21ac9555cec3b7449b610a9be11390c31431fd0deff512a7e9cbd1509f5d8468ea2f2f0e5d6b453
SSDEEP 24576:HNcwHdjbyQ4nLC18lb/EOjowL7Fk6ftT736FNKBiMDy5IRcZWvq/qvNg:HNc/zEOVHF9T73GUBNoIOWvL
TLSH
T18F858C2623E901E4F1BBE1BE89779546FAB17865533086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 42989eb13388a86c85ab794f5c0db4ccac5daa82a210f4036d00e8d6866adda1
MD5 3470487bc54441b670bcc46edf49494f
SHA1 ea3a1d38abd41b6884330080097d3987562c0b82
SHA512 8649ea3e485f8653862eee6d819a4bccf48cce6d8fb51821cfb30be3f1ca5e66c9cc513e9daa9bdfda312a184a27aa75269367c0c4183fbc6a56fe65ec09ef9d
SSDEEP 24576:ZCDIGftT736FNKBiMDy5IRcZWvq/qvNg:ZCDIST73GUBNoIOWvL
TLSH
T16305015D337A10F5D16BD03ECA930612D2B2B071876256DF4694C4BA5FA3ED8B93CE82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 af1df77b2383316203c2d2ced096aa4f13b94f674e3781165ab292edfda57e3d
MD5 fb90ce18d308c1397db2e97e38a5c673
SHA1 a45dbf19cc0e71a9c0a5ea61db267a409a685130
SHA512 83234cc028f94746614b73f82261d0c69f43f38394a91638a8b0cc7aa4db30891e63945cc53be6cfc8d83804af26f0aadc928e0208c40e82cd3ade0057577440
SSDEEP 12288:3G6kyCX4xpvftlw4736CmQKlviBgVMD8Ao35PZmRcZWRhi2c/qUeIYNR9/Y:2ty1ftT736FNKBiMDy5IRcZWvq/qvNg
TLSH
T1A2F412423794A0D4E679817C8E7386648B36BC309B6193DF9590E53F2F3A7D0A838F46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 e6ab4bc996d779945e2e9bd4a5bfc199914b8dcb6ab9d4a5169be0db09fccf8b
MD5 99ea8218b23c86837a7c23272b1b2388
SHA1 506eca002aaed89f4433c10ff729c27aa2c5ef2f
SHA512 b1eea256cb1e48812224f0eec3ab19a95526c1c1f90b2dbe052f2aa1d7609e47a905d064d9ffde6526b6a7900de7aa099190b54288a5c1e5baa93344a9b2b650
SSDEEP 12288:OcPX4xpvftlw4736CmQKlviBgVMD8Ao35PZmRcZWRhi2c/qUeIYNR9/Y:5OftT736FNKBiMDy5IRcZWvq/qvNg
TLSH
T151D423A73B18E1D5C628D4BD4E339B224363717587A9A3DF9594C8726F3E4C1903CE86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 856b6118c517d6458e536276bf5d3c1eb476d19fe7e40de1cd4508f75c1a4752
MD5 8384a54fba999a1f44217d12380df74d
SHA1 dba9405b52aad4b13dd37baa1db0ec35e990e1a6
SHA512 f19965ec318aa300b83069e578413302ca5ba3201d575ce4624cd5820a2803176911d5da49efe83271e4bf987596ef26360e5822ce1c393861bf14a7bba2ae83
SSDEEP 24576:fPUr+NQKftT736FNKBiMDy5IRcZWvq/qvNg:fJQWT73GUBNoIOWvL
TLSH
T14505E12F26AC18E5E67AE17D89928719E772B4620711D2CF02E0817E5F27DD8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/344-299-0x00007FF7F8FB0000-0x00007FF7F93C7000-memory.dmp

Download

memory/344-300-0x00000221F9F90000-0x00000221F9FF6000-memory.dmp

Download

memory/344-301-0x00000221F9F90000-0x00000221F9FF6000-memory.dmp

Download

memory/712-44-0x00007FF737F90000-0x00007FF7380F8000-memory.dmp

Download

memory/712-53-0x00007FF737F90000-0x00007FF7380F8000-memory.dmp

Download

memory/712-51-0x0000016BF81A0000-0x0000016BF8206000-memory.dmp

Download

memory/712-46-0x0000016BF81A0000-0x0000016BF8206000-memory.dmp

Download

memory/712-45-0x0000016BF81A0000-0x0000016BF8206000-memory.dmp

Download

memory/752-270-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/752-271-0x00000000009A0000-0x0000000000A09000-memory.dmp

Download

memory/752-276-0x00000000009A0000-0x0000000000A09000-memory.dmp

Download

memory/1040-309-0x00007FF634810000-0x00007FF6348C4000-memory.dmp

Download

memory/1040-310-0x00000295E6E50000-0x00000295E6EB6000-memory.dmp

Download

memory/1040-311-0x00000295E6E50000-0x00000295E6EB6000-memory.dmp

Download

memory/1700-282-0x00007FF7F3500000-0x00007FF7F3C44000-memory.dmp

Download

memory/1700-284-0x000001D97C460000-0x000001D97C4C6000-memory.dmp

Download

memory/1700-283-0x000001D97C460000-0x000001D97C4C6000-memory.dmp

Download

memory/2052-234-0x000001AD79880000-0x000001AD798E6000-memory.dmp

Download

memory/2052-318-0x00007FF7CB540000-0x00007FF7CB609000-memory.dmp

Download

memory/2052-233-0x000001AD79880000-0x000001AD798E6000-memory.dmp

Download

memory/2052-232-0x00007FF7CB540000-0x00007FF7CB609000-memory.dmp

Download

memory/2116-35-0x0000024301F50000-0x0000024301FB6000-memory.dmp

Download

memory/2116-36-0x0000024301F50000-0x0000024301FB6000-memory.dmp

Download

memory/2116-34-0x0000024301CD0000-0x0000024301E2D000-memory.dmp

Download

memory/2116-37-0x0000024301F50000-0x0000024301FB6000-memory.dmp

Download

memory/3200-243-0x000001F4E84C0000-0x000001F4E8526000-memory.dmp

Download

memory/3200-241-0x00007FF7CB540000-0x00007FF7CB609000-memory.dmp

Download

memory/3200-242-0x000001F4E84C0000-0x000001F4E8526000-memory.dmp

Download

memory/3424-321-0x000001C8454E0000-0x000001C845546000-memory.dmp

Download

memory/3424-320-0x000001C8454E0000-0x000001C845546000-memory.dmp

Download

memory/3424-319-0x00007FF6FE440000-0x00007FF6FE6E3000-memory.dmp

Download

memory/4260-12-0x0000020EEBBE0000-0x0000020EEBC46000-memory.dmp

Download

memory/4260-43-0x00007FF649440000-0x00007FF649563000-memory.dmp

Download

memory/4260-11-0x00007FF649440000-0x00007FF649563000-memory.dmp

Download

memory/4260-14-0x0000020EEBBE0000-0x0000020EEBC46000-memory.dmp

Download

memory/4260-13-0x0000020EEBBE0000-0x0000020EEBC46000-memory.dmp

Download

memory/4548-22-0x00007FF6FFF40000-0x00007FF700143000-memory.dmp

Download

memory/4548-2-0x000001DA858B0000-0x000001DA85916000-memory.dmp

Download

memory/4548-0-0x00007FF6FFF40000-0x00007FF700143000-memory.dmp

Download

memory/4548-3-0x000001DA858B0000-0x000001DA85916000-memory.dmp

Download

memory/4548-1-0x000001DA858B0000-0x000001DA85916000-memory.dmp

Download

memory/4548-19-0x000001DA858B0000-0x000001DA85916000-memory.dmp

Download

memory/4796-28-0x0000025A2F4E0000-0x0000025A2F546000-memory.dmp

Download

memory/4796-25-0x0000025A2F220000-0x0000025A2F37D000-memory.dmp

Download

memory/4796-26-0x0000025A2F4E0000-0x0000025A2F546000-memory.dmp

Download

memory/4796-27-0x0000025A2F4E0000-0x0000025A2F546000-memory.dmp

Download

memory/5012-250-0x00000185D4B40000-0x00000185D4BA6000-memory.dmp

Download

memory/5012-249-0x00007FF72F6F0000-0x00007FF72F80A000-memory.dmp

Download

memory/5012-251-0x00000185D4B40000-0x00000185D4BA6000-memory.dmp

Download

memory/5544-57-0x00000111BF6B0000-0x00000111BF716000-memory.dmp

Download

memory/5544-56-0x00000111BF750000-0x00000111BF8AD000-memory.dmp

Download

memory/5544-58-0x00000111BF6B0000-0x00000111BF716000-memory.dmp

Download

memory/5580-264-0x000002419E4F0000-0x000002419E556000-memory.dmp

Download

memory/5580-261-0x00007FF6739A0000-0x00007FF673AEA000-memory.dmp

Download

memory/5580-263-0x000002419E4F0000-0x000002419E556000-memory.dmp

Download

memory/6068-291-0x0000019FE0E10000-0x0000019FE0E76000-memory.dmp

Download

memory/6068-290-0x00007FF69F3B0000-0x00007FF69F45E000-memory.dmp

Download

memory/6068-292-0x0000019FE0E10000-0x0000019FE0E76000-memory.dmp

Download