0bbd80e8b44c8bb141d8bec702c9bbd2cc50cf03798a9a2e4b2718e9c81e0466

Analysis

max time kernel
145s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Size 1.0MB
Sample260808-efffpshl2s
SHA256 0bbd80e8b44c8bb141d8bec702c9bbd2cc50cf03798a9a2e4b2718e9c81e0466
MD5 2fa50c882dee772894c300fa1ac221ed
SHA1 3948059a4fc573d541f43e695a8da1901db85966
SHA512 cb23fa0a419f3eb9bfe2f97326cf0e50e82621b46a1d766399e18141010e377c6e9ffbad5b3ad6a9167289be4cffd839f5062a32c420018cc820adbb48e12525
SSDEEP 24576:P+oH6ThNF4Xx7AFT7Jckdwi6i9bNrqq4E41WFpW3oRos:moHGFEBAl7Jckdwi3N7+WTW3
TLSH
T1C335D048A65440E1E1B6C23889539946E6717C015B71EBDF03E8E37A2F37BD19E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 13 IoCs

pid	Process
4880	alg.exe
3120	elevation_service.exe
5780	elevation_service.exe
1340	maintenanceservice.exe
4316	OSE.EXE
904	GameInputSvc.exe
4508	GameInputSvc.exe
2248	msdtc.exe
4892	PerceptionSimulationService.exe
5860	perfhost.exe
2076	ReFsDedupSvc.exe
4380	locator.exe
2856	SensorDataService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3d6ad1f0e62f061e.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe

Modifies registry class 52 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe\""	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe"	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4508	GameInputSvc.exe
4508	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4544	2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	4880	alg.exe
Token: SeDebugPrivilege	4880	alg.exe
Token: SeTakeOwnershipPrivilege	3120	elevation_service.exe
Token: SeTcbPrivilege	904	GameInputSvc.exe
Token: SeBackupPrivilege	2076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2076	ReFsDedupSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 4508	904	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_2fa50c882dee772894c300fa1ac221ed_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4544

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4880

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3120

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5780

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1340

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4316

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:904
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4508

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2248

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4892

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5860

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2076

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4380

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2856

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:5332

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:200

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:3424

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:4912

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:5508

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5564

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:4756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5778082837cffc03380780be11506e3aa7d0a51e20c5563429e8e50751478ad3
MD5 a711d49a86b208c1a7432438561b34c0
SHA1 d3a0aaee3b97e56cfd100ad0fcc4e31dd95c8088
SHA512 4e977c0d32fd5737f0fbc7ff69dc1d90e3325f522527b3125e22989b81127d7f828a1319c177eaa48bb20cf7f391d38d2db9b7286f54ffb60a200263c5b0cabe
SSDEEP 49152:guC632BuPkFKRrdE6oh7stBhuXjfS4LWxnU7Jckdwi3N7+WTW3:L3q6gjBFPdwi3Q
TLSH
T1C0D59D03F2D900E9E06AD178D7469132EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 38348a02d6de1923bc576421669459819c966c48c937c8046ca69c89b04430aa
MD5 9736c33b060e4a226d3ff6482271b336
SHA1 bed78dafe0700f82d2dc240f430cd2304d378ee7
SHA512 73041e431c5745340b837ad8e3cca02ef4a0812293722bc590f88b6a9b6d1d8f6fbcf1ec65dd63aae100e907ec8ce176f8fd8d8f289a3da3d425254949883612
SSDEEP 24576:TXYHDxczAzT7Jckdwi6i9bNrqq4E41WFpW3oRos:6xc27Jckdwi3N7+WTW3
TLSH
T1CA050128A3E409F9ED67C239C9B2C511EA7278514760FB8B03E496751F233946E3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 32e85cd5b049aa67706ef23b93b4ba8fe64fbf439830cc8b90c53cdfa686e68e
MD5 d1261635656dbcdc509ad07f163131a4
SHA1 6fffc88d579605b61e86585df126e247e46fabe2
SHA512 573e5435eae79e3a0f24afa05d8c39855ff567791c6f8accdc480fa7cfaea3337ef09040f9cc5bb22444c719c91aadb0225f9e5c613656579105608e2d1ab413
SSDEEP 24576:Owu+OWR5T7Jckdwi6i9bNrqq4E41WFpW3oRos:OwlOo7Jckdwi3N7+WTW3
TLSH
T13605F14976A40CF9E5A79239C65BC135F7F2BC022A21DB1F0760C65A5F27351BE2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c765e50ff28f6a43c568c6be008edba35d5f72cb928c03dc12a8334d05829f93
MD5 1cdc6aa62c83580961f744ba0765039a
SHA1 2ed5a806081a7c08c12ed31974b22a21d9e1642b
SHA512 086753f0dad6d53b793da67ed6f49c165adc7ed08c301a9a44dc485eb7495ce3cf4f48aa6c82ee879cb69c16729186892d5015e070615ff0aaee05b25fa2e690
SSDEEP 49152:TH+taZ3usBWOBr4tEGp0bqx0z+n217aau1glN7Jckdwi3N7+WTW3:Hu6JmTxd2drPdwi3Q
TLSH
T17AD59D13F1DA01E8D06ED478974A9232FA62BC490B35B6DF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 0aef753150ec389e5278fe1c0be8e59768031254891645cd13bdfc2259e4d25b
MD5 862fc9b8896e52a5745b6cebb29b5719
SHA1 ded1884cb090c0d706b3a02558358962e6c120f9
SHA512 941f0a0661cda9adef6d34ba0e5b9294b4eb262f2f74d93062ee4f0b8d5e15c43caaeb911278b6f931f3126a89a4ec78fad6ec9e1e7ff8eb1252bee9a8a5815a
SSDEEP 12288:cM7NT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:hNT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1F4D42308C35D5A5BE277D231823DD264F6AC3F523F15FA87875462A064293807FABF28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 df6cc328145d5fd040467bab07a16a2503c8f0add611b407fb84c164979e06f1
MD5 dedea841a3d5defce81b85fceec2658b
SHA1 fc06775bdf4d8efcd467603e48bc6ac1d07c9da0
SHA512 60a32741934bf8521d2347c5bb005082eeef3dd4138f7d76792d2b2fe347b27d4129524dc5502f87d5dbaffea582051ea43b092d94395b09390791b1a0766eb0
SSDEEP 24576:Dgb6bmBIi49WNNFpg1rSvFv7bYYT7Jckdwi6i9bNrqq4E41WFpW3oRos:Dgb4mBIBhGFN7Jckdwi3N7+WTW3
TLSH
T1E665AE1E22EC02F5E0FAE2B8CDAA4417D6B278161731D2DF1251426D2F3BEE49D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 93572195c450bfad98e4fdff3da0c079302ef1a71d521258117339b83c681164
MD5 7f5a64d0889f07ffd4facaae8b813b0c
SHA1 2947f24a37a5c0c4479d56f9d0903301401e31eb
SHA512 955a93d903e012f536529b5a411e73fca9a315c3f41a4d07566b1d004c386f686dc054d776fb4e1620b83026b507bfcd38643c7018605922dd18ea9fef2a8c8e
SSDEEP 12288:f9GNT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:1GNT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1F7E4231C61AA35E9C537D235853DE5A5F9F03A513B247AEF06D0A2B09B193D0733EE28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 4fa400baf32b09005dc78011b073a7ce23591606f912565ef5e64f9afd1c7280
MD5 aad317ce3df6d03697eb3f5b81ace9a4
SHA1 2076172071c5a88ec75a5618db8d1aa33a6726b5
SHA512 65b143c34864a3c74c0c76144eb3bee1f6ab035f38881356f5a3691c2419497e22bbde5ce9ef730648de261a4725bf2c7160af85203ff6c82b3ed22ca96fde90
SSDEEP 12288:ZTT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:ZTT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1EDD4234C8259569BD353E232823DE694FAA82F023B55BFC3469462A0545D3C077BBF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 edca9f128cf26d5323e28059dc6c8e88553a2bf05df7742ab21500a48f232106
MD5 b4f850ddb8073c221cbd89d69016cd7f
SHA1 36b20cd3dfe0fa0ed32231b6c2cdce04ce6318c0
SHA512 e785a5f4ae39e301d8b7f7542f763ea305533bc1ceadfa15aeb1e0912558e430ab3ea66ee7f790888e42fe5ae33eed7126e84d72c48d966026539ec0ef30e42d
SSDEEP 24576:ogi8u8FpJqH1sCrDC7/mMT7Jckdwi6i9bNrqq4E41WFpW3oRos:9RZFPqVbC7/R7Jckdwi3N7+WTW3
TLSH
T10F35F165A6E102F1D477D1388A9686A3F6B1B8211364FFDF07A88B511F236D04B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 5caba9ea129cf3d4dde8868d514dfaec3f1d374a2a6dd016fe12bd3e88d51b0d
MD5 bd5fb752e6b49e4421a11caa3d164bbd
SHA1 dca834df4323da9a1c24af7fcaeac557e8103357
SHA512 3670d35022562df65ef446e300d5316e77ee81fcdf579dd8b8bde8724ed39d5d3e6cfd5429ecc92ae881d169c7ba139dfdc4324a98f73301016cfadda6337d41
SSDEEP 24576:vPUr+NQeT7Jckdwi6i9bNrqq4E41WFpW3oRos:vJQE7Jckdwi3N7+WTW3
TLSH
T13205F11E62AC18E5E677E13DC6568718F77178621712E6CF02E0817E4E27AD4BD3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 07042d6269dcc30d29b9d5781edd12f8586925f8eb04ecca4eab7a841fd357ca
MD5 85b2df29ce54b3f266dd6f3f5ec8f86b
SHA1 df3111a4e16f1f4dd74ccbc8a8c4cf19fb0e1617
SHA512 a1d15a6f78cfe6f622f5da48d768a4280b589329ad4c23a449736710c7a0d64728d8099db03e0930647a56bdc8d3eefb4988275a0c08c1f81de41bb1cad69331
SSDEEP 49152:xBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjq7Jckdwi3N7+WTW3:SG05lO43bdPdwi3Q
TLSH
T11FD5CF6E62EC11F9D1BBD17CDAC6860BEBB23415033556CB02A486A91F27FF0667E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3f66bddee6641a22cf9b0f1d8c891c876738bd96df83c127ab4ba1a2a831b1b7
MD5 d2bc68d13442be0dc91cfa37c233a640
SHA1 fc82dc4dbd05c74f029e1870ecb7008b370e5b3d
SHA512 ac358d4b6045afbabee869d54d37db66c0d48d7e171213f95571b398e25ea18e9e27e68729aac961be4d860594121ccb26443782ac82f7e11c6b13d5b29e2384
SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7FkeT7Jckdwi6i9bNrqq4E41WFpW3oRos:tNc/zEOVHFX7Jckdwi3N7+WTW3
TLSH
T139858C1623E901E4F1BBE1BE897B9546FAB1786517309ACF0291811B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 b86f5c575b5dee0c83b76a2277f7b7d194f4ec411def64573b76b2503220f84a
MD5 733ef0d17d6bf423e1243d6cd8fef7fe
SHA1 42da84dc695dad9267e4dbb837835f483bed43ca
SHA512 a07606611844df3e9fe2a285f94f3323c21982322bd345aead0cbd8dbce9da4bb35ae14cc7b7168b18894df6822947f9e745cecaa19051ab807c300a9f32e978
SSDEEP 24576:hJnJPbzB4SmT7Jckdwi6i9bNrqq4E41WFpW3oRos:hJnJv6S87Jckdwi3N7+WTW3
TLSH
T12A15E02CD2A810E9E4B7C2B4811A1799FF71386D2F2669C719B4D5343F12FD0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 3e13c199ebe4206770e7735a93c0d62335b62f6d9a8881279230749b5c29b0c1
MD5 c0d9c889f686e7c2e8d4d22b8a0e648c
SHA1 662d923eb6eb2b6aa8767cd88cc1aba62a30be4d
SHA512 5e2ea7284aaad8bff1031c77c76fb2a214bf8e417482f22f1aedcfbb68390e2f601cc490818d2155df104dfe12253a5790e292c584afae0d5ad5941e8bf2f922
SSDEEP 49152:nCLHGeeV5ijCmlDWDky7Jckdwi3N7+WTW3:CaPdwi3Q
TLSH
T1BCA56B05E7EB5184F8F3CAF5CA2694169A327C549B34F7DF4A80CA6A1E32BD0D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 47a83e629a178f449ce011c778e7cd7131380aa4613e86d1a767d25b2a24e04b
MD5 c2ff359bdb7194a6624b714840c3ef3a
SHA1 f89b012ab160c93d1231fe68310bac40d89f5050
SHA512 6e04b17b80db06a84694d2c53c5ff8e94acaaa437135177ef38538d667c11283771a0784c5a1b865f2e3c0b8b74a923f6dc14801041b5e21815fffbb4fdf3183
SSDEEP 24576:gLDIXT7Jckdwi6i9bNrqq4E41WFpW3oRos:gLDID7Jckdwi3N7+WTW3
TLSH
T1EAF4010C637A10FAD167D03EC6974551E2B2B57197226ACF07D4C1B98EA3EC8BA3DE50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 2e72fc05aecb4d603f99fd7dff50069bd1a02f4855ef5d54acd07884d9cac902
MD5 188842592b100a8f60f5ae196bc929c4
SHA1 2ae72af5caefb3b612ccc29ec9bcd7e9ddd0cb67
SHA512 c42123b543137b9c79777d7192a76085a1a28f61c7a5edaafe50a27c08e0a7b19e8083ce0d40466dbcfbb5e3f718f445687a9e85b57524b6e7d744df8e36a543
SSDEEP 12288:CG6kyVT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:rtyVT7Jckdwi6i9bNrqq4E41WFpW3oRB
TLSH
T151F41208539861D9E6B69234C63682A4EF747C116F21A7CF46D0E33D2E3A7C0BA75F25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 04b57fcdde11f175a577be4ac24eb71bc9c9aa8fc610e46de0c203571f5af17d
MD5 d52f8eb82517c4427a8834ef442b8039
SHA1 518044860d0ba25ec22839d3a603d74ed3c49138
SHA512 7d4f8c82f689c663df8963fd2c5d5b14377ba67476438339e72bddec5ab47bed647b375ebdc4b50aa8ffb366df0c1158e9a4428a981463167c2de2c0c5b5d135
SSDEEP 12288:mmdT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:HdT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T112D4234C925926ABD253E231823DD7D4F6B83A623F157ACB46D4A2B0851E3C0777BF24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 ddbc730376faf4e49a627d76a2aad17dd46279aeac6d1945747b0c6d662d9c83
MD5 2b236f80bd80332464f9f0891dc89174
SHA1 aee9c706dcc3c953f07155a622b5a0668fba4069
SHA512 86097f0d010310d7d043026ce4618247c4ecef95acf2e37f5152955c521600a9dc2ed3ea9daa021e1b4b6a132081271e8f6f79d43ee7e1017af909c14ba1cf87
SSDEEP 24576:pCgN5oTfaidZLT7Jckdwi6i9bNrqq4E41WFpW3oRos:wgETrZX7Jckdwi3N7+WTW3
TLSH
T1EB559D1DA3EA05CAE2B2D235D9725493D633B4315772D6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 1041b9a4fb459f144952e4aa743df7e7cd1d5cac385682e1b2403740d6944181
MD5 235edf17a12f5bff6972984b33fc34e9
SHA1 1cb218789bb08bdd29c6214d5147b5d18e6b19b3
SHA512 8e8398b1ebeadd54fea07ccf277b0babc91a11157722139b1e4b9da1fe522d53b1e9837f884cff60a619e056989c373cc26355d21ba225066a38892453e5a581
SSDEEP 49152:CDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3ps7Jckdwi3N7+WTW3:j3Upow8sBWKPdwi3Q
TLSH
T148A58C3DA2E800A8D9AAC379C54213A5EA71782E3F3055DB0174C578BF1BEF19A39F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/200-321-0x00000161E38A0000-0x00000161E3906000-memory.dmp

Download

memory/200-320-0x00007FF74F6E0000-0x00007FF74F982000-memory.dmp

Download

memory/200-322-0x00000161E38A0000-0x00000161E3906000-memory.dmp

Download

memory/904-309-0x00007FF754320000-0x00007FF7543E8000-memory.dmp

Download

memory/904-233-0x0000020597600000-0x0000020597666000-memory.dmp

Download

memory/904-232-0x00007FF754320000-0x00007FF7543E8000-memory.dmp

Download

memory/904-234-0x0000020597600000-0x0000020597666000-memory.dmp

Download

memory/1340-52-0x00007FF63F190000-0x00007FF63F2F7000-memory.dmp

Download

memory/1340-50-0x0000022F8E510000-0x0000022F8E576000-memory.dmp

Download

memory/1340-45-0x0000022F8E510000-0x0000022F8E576000-memory.dmp

Download

memory/1340-44-0x0000022F8E510000-0x0000022F8E576000-memory.dmp

Download

memory/1340-43-0x00007FF63F190000-0x00007FF63F2F7000-memory.dmp

Download

memory/2076-283-0x0000017B0B200000-0x0000017B0B266000-memory.dmp

Download

memory/2076-282-0x0000017B0B200000-0x0000017B0B266000-memory.dmp

Download

memory/2076-284-0x00007FF749D70000-0x00007FF74A4B3000-memory.dmp

Download

memory/2076-359-0x00007FF749D70000-0x00007FF74A4B3000-memory.dmp

Download

memory/2248-246-0x00000137FA080000-0x00000137FA0E6000-memory.dmp

Download

memory/2248-328-0x00007FF723530000-0x00007FF723649000-memory.dmp

Download

memory/2248-245-0x00000137FA080000-0x00000137FA0E6000-memory.dmp

Download

memory/2248-244-0x00007FF723530000-0x00007FF723649000-memory.dmp

Download

memory/2856-301-0x00000143AC2C0000-0x00000143AC326000-memory.dmp

Download

memory/2856-300-0x00000143AC2C0000-0x00000143AC326000-memory.dmp

Download

memory/2856-299-0x00007FF7440F0000-0x00007FF744506000-memory.dmp

Download

memory/3120-28-0x000001CBA6D00000-0x000001CBA6D66000-memory.dmp

Download

memory/3120-27-0x000001CBA6D00000-0x000001CBA6D66000-memory.dmp

Download

memory/3120-26-0x000001CBA6D00000-0x000001CBA6D66000-memory.dmp

Download

memory/3120-25-0x000001CBA6AE0000-0x000001CBA6BDB000-memory.dmp

Download

memory/3424-329-0x00007FF79FF80000-0x00007FF7A0114000-memory.dmp

Download

memory/3424-330-0x0000023CA38D0000-0x0000023CA3936000-memory.dmp

Download

memory/3424-331-0x0000023CA38D0000-0x0000023CA3936000-memory.dmp

Download

memory/4316-57-0x0000016400840000-0x00000164008A6000-memory.dmp

Download

memory/4316-56-0x0000016400840000-0x00000164008A6000-memory.dmp

Download

memory/4316-55-0x0000016400620000-0x000001640071B000-memory.dmp

Download

memory/4380-291-0x000002BE62D00000-0x000002BE62D66000-memory.dmp

Download

memory/4380-367-0x00007FF725B00000-0x00007FF725BAD000-memory.dmp

Download

memory/4380-290-0x00007FF725B00000-0x00007FF725BAD000-memory.dmp

Download

memory/4380-292-0x000002BE62D00000-0x000002BE62D66000-memory.dmp

Download

memory/4508-255-0x0000026CBCC60000-0x0000026CBCCC6000-memory.dmp

Download

memory/4508-318-0x00007FF754320000-0x00007FF7543E8000-memory.dmp

Download

memory/4508-241-0x00007FF754320000-0x00007FF7543E8000-memory.dmp

Download

memory/4508-254-0x0000026CBCC60000-0x0000026CBCCC6000-memory.dmp

Download

memory/4544-0-0x00007FF72F220000-0x00007FF72F422000-memory.dmp

Download

memory/4544-1-0x0000025F8DA20000-0x0000025F8DA86000-memory.dmp

Download

memory/4544-19-0x0000025F8DA20000-0x0000025F8DA86000-memory.dmp

Download

memory/4544-2-0x0000025F8DA20000-0x0000025F8DA86000-memory.dmp

Download

memory/4544-3-0x0000025F8DA20000-0x0000025F8DA86000-memory.dmp

Download

memory/4544-22-0x00007FF72F220000-0x00007FF72F422000-memory.dmp

Download

memory/4756-368-0x000001E92E610000-0x000001E92E676000-memory.dmp

Download

memory/4756-369-0x000001E92E610000-0x000001E92E676000-memory.dmp

Download

memory/4756-373-0x00007FF6D8800000-0x00007FF6D8D06000-memory.dmp

Download

memory/4880-14-0x00000211EDA30000-0x00000211EDA96000-memory.dmp

Download

memory/4880-13-0x00000211EDA30000-0x00000211EDA96000-memory.dmp

Download

memory/4880-61-0x00007FF683850000-0x00007FF683972000-memory.dmp

Download

memory/4880-12-0x00000211EDA30000-0x00000211EDA96000-memory.dmp

Download

memory/4880-11-0x00007FF683850000-0x00007FF683972000-memory.dmp

Download

memory/4892-261-0x00007FF771750000-0x00007FF771899000-memory.dmp

Download

memory/4892-337-0x00007FF771750000-0x00007FF771899000-memory.dmp

Download

memory/4892-263-0x000001FF277E0000-0x000001FF27846000-memory.dmp

Download

memory/4892-264-0x000001FF277E0000-0x000001FF27846000-memory.dmp

Download

memory/4912-346-0x00007FF697180000-0x00007FF6974A0000-memory.dmp

Download

memory/4912-339-0x000001C4FB9A0000-0x000001C4FBA06000-memory.dmp

Download

memory/4912-340-0x000001C4FB9A0000-0x000001C4FBA06000-memory.dmp

Download

memory/4912-344-0x000001C4FB9A0000-0x000001C4FBA06000-memory.dmp

Download

memory/4912-338-0x00007FF697180000-0x00007FF6974A0000-memory.dmp

Download

memory/5332-311-0x0000021964BA0000-0x0000021964C06000-memory.dmp

Download

memory/5332-310-0x00007FF6667E0000-0x00007FF666893000-memory.dmp

Download

memory/5332-312-0x0000021964BA0000-0x0000021964C06000-memory.dmp

Download

memory/5508-350-0x00007FF6BF270000-0x00007FF6BF4FA000-memory.dmp

Download

memory/5508-351-0x000001872E680000-0x000001872E6E6000-memory.dmp

Download

memory/5508-352-0x000001872E680000-0x000001872E6E6000-memory.dmp

Download

memory/5564-361-0x00007FF675590000-0x00007FF675A60000-memory.dmp

Download

memory/5564-360-0x00000125D6290000-0x00000125D62F6000-memory.dmp

Download

memory/5564-358-0x00000125D6290000-0x00000125D62F6000-memory.dmp

Download

memory/5780-37-0x000001F7C9DC0000-0x000001F7C9E26000-memory.dmp

Download

memory/5780-36-0x000001F7C9DC0000-0x000001F7C9E26000-memory.dmp

Download

memory/5780-35-0x000001F7C9DC0000-0x000001F7C9E26000-memory.dmp

Download

memory/5780-34-0x000001F7C9BA0000-0x000001F7C9C9B000-memory.dmp

Download

memory/5860-271-0x00000000009B0000-0x0000000000A19000-memory.dmp

Download

memory/5860-276-0x00000000009B0000-0x0000000000A19000-memory.dmp

Download

memory/5860-270-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/5860-349-0x0000000000400000-0x00000000004AD000-memory.dmp

Download