530cda803afe288a6e5057e8e0394d0b1455baa24876a29661b10d17b2e8c607

Analysis

max time kernel
146s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Size 1.0MB
Sample260808-ens2rsszhx
SHA256 530cda803afe288a6e5057e8e0394d0b1455baa24876a29661b10d17b2e8c607
MD5 152db47db518e737aef26549f9b0d14b
SHA1 486cec018f8082f9caf6d117ec723fd78b158b72
SHA512 d60e48a637a6125543bc787472033002e2d4def71bd6914969a442af5fe2bb90af8f3c0be16ae21871c03464e405525f9e4d53dd09a2fa3c51f573ca19506d65
SSDEEP 24576:P+oH6ThNF4Xx7A9T7Jckdwi6i9bNrqq4E41WFpW3oRos:moHGFEBAt7Jckdwi3N7+WTW3
TLSH
T1D435DF48A65440E1E1B6C23889539946E6717C015B71EBDF03E8E37A2F377E19E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 8 IoCs

pid	Process
4428	alg.exe
4332	elevation_service.exe
5456	elevation_service.exe
5068	maintenanceservice.exe
1560	OSE.EXE
3788	GameInputSvc.exe
2092	msdtc.exe
4236	GameInputSvc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3d7e5db683806d8d.bin	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe

Modifies registry class 52 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe\""	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe"	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4236	GameInputSvc.exe
4236	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3212	2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	4428	alg.exe
Token: SeDebugPrivilege	4428	alg.exe
Token: SeTakeOwnershipPrivilege	4332	elevation_service.exe
Token: SeTcbPrivilege	3788	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 4236	3788	GameInputSvc.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_152db47db518e737aef26549f9b0d14b_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3212

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4428

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4332

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5456

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5068

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1560

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4236

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2092

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
PID:2612

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:6052

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:5100

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:1124

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:5884

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:5444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5e946920bdb83640352c4c953e090e92f8fa6beb81db806e469cd00bcff3aca9
MD5 c8bec09addb9664a5a6707957acffe30
SHA1 ec75d908f18ac22337d94f3a89672718a8f73a11
SHA512 dfe363c191945a1284afac2c1e08a8749160b557f2909d258f45f0682491de4a76aa37f0a05114c69c248413b07b87a24ff9bf980355056e6964047e3c7eccda
SSDEEP 49152:guC632BuPkFKRrdE6oh7stBhuXjfS4LWxnI7Jckdwi3N7+WTW3:L3q6gjBFPdwi3Q
TLSH
T123D59D03F2D900E9E06AD178D7469132EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 b511508e0efe94b0ae31a0177deb9bc6e19391e2dfbc494c1492b5a3ca764136
MD5 8d28d0fef2dfd15d708400c58668f9bf
SHA1 a06c370d1b8adc15540203bf01cefd822c29448e
SHA512 227817e32249eb9a9d368fb5cc2ee883f1f4a215b0b4c9db117473b071828175a0c38007cdfb55ed8689d825421f20d5bd45a9d94e3b71cd95aac06dfe9fcd87
SSDEEP 24576:TXYHDxczAsT7Jckdwi6i9bNrqq4E41WFpW3oRos:6xcv7Jckdwi3N7+WTW3
TLSH
T1DB050128A3D409F9ED678239C9B2C511EB7278524760FB8B03E496751F233946E3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 ab5daa9496b7134d61f89df172f438a7ee6689f4771c4b2f107e81cbdc9c1e23
MD5 c3bfd497241be9827fe451e6021fba08
SHA1 cedf0afad72113ee89c809fa918952fdf2c00ec0
SHA512 57707749865b7f69a917831e464c49d804b4173109fca5be6da17a94e4b3ba901302cd8676db7bef0f2853f98b6092d79007ba322ec63bc383f56e9930736d7e
SSDEEP 24576:Owu+OW2T7Jckdwi6i9bNrqq4E41WFpW3oRos:OwlOb7Jckdwi3N7+WTW3
TLSH
T1FD05F14972A40CF9E5679239C65BC135F7F2BC022A25DB1F07A0C65A5F27351BE2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c744f1b584566200d7887b1675d2b7f54c389ea2d838e2386dc3e2abaa05eb98
MD5 04d68fdaf0163e23dbdad513b016ff41
SHA1 19390b7d195c19c08d708ab2f7a8f3fd1ac1c39d
SHA512 a42ae5949c5713dc88c9ac45130d44ae602a256dfe54e09fd3adc1f5b62b98ab9f16c9c81384215c9ed6bf43f4471acadbada61139f7d543f65b6f6fa4188872
SSDEEP 49152:TH+taZ3usBWOBr4tEGp0bqx0z+n217aau1glW7Jckdwi3N7+WTW3:Hu6JmTxd2dkPdwi3Q
TLSH
T1B4D59D13F1DA01E8D06ED478974A9232FA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 8a9aba600356724c813e80f264149ae07bf2fbdb33b980105c3ee98e523a7bb5
MD5 12dda64458e5c3f0dd8c43b1578238e7
SHA1 d36a084362f7ebfd7da7a2cea3e2ad4088d4aa86
SHA512 b52c3460b3c4509b0b62e0572d3fb4ff85c8ff032657730fc6427ecb48bda776c5f1d1c8757e9094fc4c2b090809aad9e9f788c15476988b7a55732aed1f27ef
SSDEEP 12288:cM7fT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:hfT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1F1D42308C7595A5BE277E231823DD2A4F66C3E523F14FA87875462E054293807FABF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 2bcce6f66938e3110f6a83f4e117c64003be3d1e8625ee0475fa529d1d7d3175
MD5 cab473367883b92f98da8d68282d88c9
SHA1 33109a8c2982a7cd0a574c93a95812002b741139
SHA512 c44aab43cfa6a720aefb8537727653526f6e730985dc0c480b1982564e5ce48109d76c53e3179506596893c67e81307dbc79a74c37fc8a9db7dd6e3faf874ae7
SSDEEP 12288:f9GMT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:1GMT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T108E4231C61AA35E9C637D231C53DE5A5F9F03A512B147AEF06D0A1B09B293D0737EE28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 0e416667f49699a8e1cfeb7a6954d96fa27754720901aa7ad4e22488393d44ea
MD5 efadda6c3c1dcaf2da3fdd3322e53836
SHA1 b0d5335514508e6c7907bccddf38df6d0fdf2514
SHA512 f890b137aa551d31735ada4efc658d7a8e343cf34991b01d3c7ddaafe679ba3ef47ef149d9772b3f58ed584924b9e54c2a51cc459ae4972e392ce5543eedacab
SSDEEP 12288:ZeT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:ZeT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T132D4234C8259569BD353E231823EE694FAA82F123B55BFC3429462A0555D3C077BFF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 fff0b9610e0408d1bf9bdc95432f5054a31de53778a935a8aa6ced89d52890c9
MD5 209f1e9d1c33ef1206cc820b3fe54038
SHA1 5e810ef8d8ed04e6ced4c8668a128382f2bdc113
SHA512 7f7054c03248d6b92139405c25992824030167b1d7c1a57b455b030595a47f4b581db0f7e39dc471e4b2d935afd91109fdadb348bb0fd45c97d7562f9d4c47dd
SSDEEP 24576:vPUr+NQdT7Jckdwi6i9bNrqq4E41WFpW3oRos:vJQN7Jckdwi3N7+WTW3
TLSH
T15405F11E62AC18E5E677E13D86568719F77178621712E2CF02E0817E4F27AD4BD3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 b9d95dc60f443a23400535a5657513557118fe5e9cc01130afd861a2300f98f1
MD5 5d6136039f356d0205642a3019e76c95
SHA1 e4a1d79f4aedaec8f440ec194536bbe9c345fb6f
SHA512 dd7be3f846f94cfb766453e9b3ef9ad58f2625e7da6a09e5f196c5da7bd6c533032eabfd368206de84c4eb6dcb00a19ef7ee77aef6ea6c516d90d28a81aad35e
SSDEEP 49152:xBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAju7Jckdwi3N7+WTW3:SG05lO43btPdwi3Q
TLSH
T15AD5CF6E62EC11F9D1BBD17CDAC6860BEBB23415033556CB02A486A91F27FF0667E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3dcb6d152e0af0de76d0c6cab9da0304de416d4c189933c6f64504400bc47664
MD5 3010fd65e098a5dc450e7cb6302be549
SHA1 48ecf8e7065b87fd756da2402da5715cb2b6797c
SHA512 25bf9fc8b6925e0b0415a063a4109259b11965b6d9d6c2953174c6429844a7dab2f051dce9c5b71caa7ce51e500ae1b084987f1fad6abd4b157140dd553b8b44
SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7FkgT7Jckdwi6i9bNrqq4E41WFpW3oRos:tNc/zEOVHFF7Jckdwi3N7+WTW3
TLSH
T109858C1623E901E4F1BBE1BE897B9546FAB1786517309ACF0291811B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 30e9d69fd194f04834ffc678e635011e4b3900728eb664eee1ce7ff1ce56457d
MD5 fafd0e71466b92ab2424a7346a661b7e
SHA1 3d9d1e83dfb906b386ff73809f64bad9d6b0a245
SHA512 c8a410c22d60bd28928d304bd9e99e0d0c0fadcc23f6d228bc51a81fb9df5222c19a1a3415462d8c8e9d9a448c0fda45b83ddcf401202a1c1788723f295ee995
SSDEEP 24576:gLDIrT7Jckdwi6i9bNrqq4E41WFpW3oRos:gLDI37Jckdwi3N7+WTW3
TLSH
T141F4010C637A11FAD167D03EC6934551E2B2B57197226ACF07D4C1B98EA3EC8BA3DE50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 f0fca7a22695e7ea5fc5dafecf50751b5c575721bdad94bed713cb39f90977b8
MD5 3d59be462bda7af20772474c93c957a2
SHA1 a59d7c8bdb12f21e5ef4d9579ec22fe9cb3b2656
SHA512 859c0528f1fbd3e5fb87eabacdf30ec1a2c8432bbaf50d83c91d4d3e8ea179b7f205a410c8dbf532c218f6b00776db4212450ffbd72d0c80e879e3d685270130
SSDEEP 12288:CG6kyF9T7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:rtyLT7Jckdwi6i9bNrqq4E41WFpW3oRB
TLSH
T19BF41208539421D9E6B79234C67682A4EF747C116B21A7CF46D0E33D2E3A7C0BA76F25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 576KB
SHA256 5a21ae08f903d18713004f9a98b661e156c74f49f4470c0e4f1eabd005a96d63
MD5 66e88020e5a3416f1ec26f24d558283a
SHA1 64b904ff2d8bb85f7c6c6e8fef54033fb290ef8c
SHA512 60330a23adfa099084c5870c9ae9afee0de22d04555488acd4504389e2c674c1045903a9869a0a7773201e10c5562a53e9c28215808b173f044df2fb4cd344d6
SSDEEP 12288:mm2T7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdO:H2T7Jckdwi6i9bNrqq4E41WFpW3oRA
TLSH
T18AC4230CD619666AD612D232423DD7A4E5B83F323B127BDF45D492B4961E3C0673AF34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1124-290-0x00007FF713D00000-0x00007FF713DAD000-memory.dmp

Download

memory/1124-292-0x000001CEC93D0000-0x000001CEC9436000-memory.dmp

Download

memory/1124-291-0x000001CEC93D0000-0x000001CEC9436000-memory.dmp

Download

memory/1560-55-0x000001FAE8DD0000-0x000001FAE8ECB000-memory.dmp

Download

memory/1560-57-0x000001FAE8D30000-0x000001FAE8D96000-memory.dmp

Download

memory/1560-56-0x000001FAE8D30000-0x000001FAE8D96000-memory.dmp

Download

memory/2092-247-0x0000020C45320000-0x0000020C45386000-memory.dmp

Download

memory/2092-248-0x0000020C45320000-0x0000020C45386000-memory.dmp

Download

memory/2092-241-0x00007FF660180000-0x00007FF660299000-memory.dmp

Download

memory/2612-261-0x00007FF790350000-0x00007FF790499000-memory.dmp

Download

memory/2612-264-0x0000019DD1E70000-0x0000019DD1ED6000-memory.dmp

Download

memory/2612-263-0x0000019DD1E70000-0x0000019DD1ED6000-memory.dmp

Download

memory/3212-22-0x00007FF724480000-0x00007FF724682000-memory.dmp

Download

memory/3212-19-0x000002024B830000-0x000002024B896000-memory.dmp

Download

memory/3212-3-0x000002024B830000-0x000002024B896000-memory.dmp

Download

memory/3212-1-0x000002024B830000-0x000002024B896000-memory.dmp

Download

memory/3212-0-0x00007FF724480000-0x00007FF724682000-memory.dmp

Download

memory/3788-308-0x00007FF67BE50000-0x00007FF67BF18000-memory.dmp

Download

memory/3788-232-0x00007FF67BE50000-0x00007FF67BF18000-memory.dmp

Download

memory/3788-233-0x0000028DA9630000-0x0000028DA9696000-memory.dmp

Download

memory/3788-234-0x0000028DA9630000-0x0000028DA9696000-memory.dmp

Download

memory/4236-244-0x00007FF67BE50000-0x00007FF67BF18000-memory.dmp

Download

memory/4236-245-0x00000234B82A0000-0x00000234B8306000-memory.dmp

Download

memory/4236-246-0x00000234B82A0000-0x00000234B8306000-memory.dmp

Download

memory/4332-27-0x000002985D240000-0x000002985D2A6000-memory.dmp

Download

memory/4332-26-0x000002985D240000-0x000002985D2A6000-memory.dmp

Download

memory/4332-25-0x000002985D0F0000-0x000002985D1EB000-memory.dmp

Download

memory/4332-28-0x000002985D240000-0x000002985D2A6000-memory.dmp

Download

memory/4428-12-0x000002B85BC90000-0x000002B85BCF6000-memory.dmp

Download

memory/4428-13-0x000002B85BC90000-0x000002B85BCF6000-memory.dmp

Download

memory/4428-11-0x00007FF621840000-0x00007FF621962000-memory.dmp

Download

memory/4428-14-0x000002B85BC90000-0x000002B85BCF6000-memory.dmp

Download

memory/4428-61-0x00007FF621840000-0x00007FF621962000-memory.dmp

Download

memory/5068-43-0x00007FF691B30000-0x00007FF691C97000-memory.dmp

Download

memory/5068-44-0x00000206757A0000-0x0000020675806000-memory.dmp

Download

memory/5068-45-0x00000206757A0000-0x0000020675806000-memory.dmp

Download

memory/5068-52-0x00007FF691B30000-0x00007FF691C97000-memory.dmp

Download

memory/5068-50-0x00000206757A0000-0x0000020675806000-memory.dmp

Download

memory/5100-283-0x000002258D310000-0x000002258D376000-memory.dmp

Download

memory/5100-282-0x000002258D310000-0x000002258D376000-memory.dmp

Download

memory/5100-288-0x00007FF6E6C80000-0x00007FF6E73C3000-memory.dmp

Download

memory/5444-310-0x00000201ABC20000-0x00000201ABC86000-memory.dmp

Download

memory/5444-311-0x00000201ABC20000-0x00000201ABC86000-memory.dmp

Download

memory/5444-309-0x00007FF668400000-0x00007FF6684B3000-memory.dmp

Download

memory/5456-35-0x000002ABC7E20000-0x000002ABC7E86000-memory.dmp

Download

memory/5456-36-0x000002ABC7E20000-0x000002ABC7E86000-memory.dmp

Download

memory/5456-37-0x000002ABC7E20000-0x000002ABC7E86000-memory.dmp

Download

memory/5456-34-0x000002ABC7C00000-0x000002ABC7CFB000-memory.dmp

Download

memory/5884-299-0x0000026B5E3D0000-0x0000026B5E436000-memory.dmp

Download

memory/5884-300-0x0000026B5E3D0000-0x0000026B5E436000-memory.dmp

Download

memory/5884-304-0x00007FF6C9930000-0x00007FF6C9D46000-memory.dmp

Download

memory/6052-276-0x0000000000910000-0x0000000000979000-memory.dmp

Download

memory/6052-271-0x0000000000910000-0x0000000000979000-memory.dmp

Download

memory/6052-270-0x0000000000400000-0x00000000004AD000-memory.dmp

Download