31170d06d567c95b0a035c53611fb09f60a9c8b64c3a87af798d9196d6ba6164

Analysis

max time kernel
146s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 05:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Size 1.0MB
Sample260816-fw642adn51
SHA256 31170d06d567c95b0a035c53611fb09f60a9c8b64c3a87af798d9196d6ba6164
MD5 03d30b2ad1afc0b6a4b6a654c1081eef
SHA1 5e7ac93d76d8d9fcc1010839d2557acff755a684
SHA512 6db09e5ed297758f22f85b6370dcfb60dcb3b0248ae841e45f6b5d57e8f9954af2cc541d56f1340dd85b9c7cf422353faaeb6b305b12227062bedcde8e942e1b
SSDEEP 24576:tWoH6ThNF4Xx7Aa50N/s/OBr0ZqPZDWyiIUPuVOQ:ooHGFEBAahfciIDx
TLSH
T1E535E049AA9440E0E1B6C178C8435946E6717C105B71DBDF13E8E27A2F37BE19E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 17 IoCs

pid	Process
5664	alg.exe
2384	elevation_service.exe
4868	elevation_service.exe
3192	maintenanceservice.exe
4352	OSE.EXE
572	GameInputSvc.exe
3704	GameInputSvc.exe
5544	msdtc.exe
4824	PerceptionSimulationService.exe
2020	perfhost.exe
4852	ReFsDedupSvc.exe
2848	locator.exe
5452	SensorDataService.exe
4612	snmptrap.exe
5156	ssh-agent.exe
3300	TieringEngineService.exe
5536	AgentService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2923f502763f1d8f.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe

Modifies registry class 52 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe"	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe\""	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3704	GameInputSvc.exe
3704	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4512	2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	5664	alg.exe
Token: SeDebugPrivilege	5664	alg.exe
Token: SeTakeOwnershipPrivilege	2384	elevation_service.exe
Token: SeTcbPrivilege	572	GameInputSvc.exe
Token: SeBackupPrivilege	4852	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4852	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4852	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4852	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4852	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4852	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4852	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4852	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4852	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4852	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3300	TieringEngineService.exe
Token: SeManageVolumePrivilege	3300	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5536	AgentService.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 572 wrote to memory of 3704	572	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_03d30b2ad1afc0b6a4b6a654c1081eef_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4512

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:5664

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2384

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4868

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3192

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4352

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:572
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3704

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5544

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4824

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2020

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4852

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2848

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5452

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4612

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5156

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3300

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5536

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1852

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:992

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:5964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0d8f949f8a458aac9c92456e292484cd12b083c8162f5d6de8ad44a82042c8f0
MD5 bcc6ff59309f7131ab47401a189e549d
SHA1 fc135d65cfd70e54873829dd7b691a58ff83afd7
SHA512 0c34fb1595e34df1ab86bce3d6129b8cd45060b50b08fa23ca40f4a601a47a4d2edafa16535305b65fc8af4a7bf72b4239febfb246de168c62d3404e770be189
SSDEEP 49152:Pb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnbhfciIDx:N3q6gjBShfyx
TLSH
T199D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 dc5a5457e3ddae4f84bc2b7c061ca98f632b11eedd3914a0a28a0415ddd4e643
MD5 861f68050d8b4a3b4ee31a34c701c7d9
SHA1 3b22d2aa9b0ded6cc04476be8c9d70903812adaa
SHA512 d1d6b330f2452385114eba1cec65669d1f54e7f3d1a6b3b59772268a92260c5805885480caddda9c88ed2a60f14f7aa7d07447e923d7a0b8ee069e1cc52fef46
SSDEEP 24576:iXYTAtczAH50N/s/OBr0ZqPZDWyiIUPuVOQ:etcEhfciIDx
TLSH
T15905022977E408F8EC67C17CC8B28115EA33B85547A0E79B03A495760F277D85E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 264eb1735062285da9789bdd62e3c208d586f03dd266d4aa2ab46e24bb6fe98e
MD5 04178698d3f5ce3f0f2ffc90841e5c20
SHA1 845a5c14d4ba86e54d955799da68a92c95667338
SHA512 3aa9ac7908e5dd34ea11bda5b8f75757099fbd6a328cf5ad1c64e77b5ba53a68029bbcdd8d5e929d5b7c290cb95aa79304062d0506290033faac7c5fae214f78
SSDEEP 24576:uwuuOWHR50N/s/OBr0ZqPZDWyiIUPuVOQ:uwVOQhfciIDx
TLSH
T1B705F14A36E40CF8E5638578C597C136F7B2B8162B21DB1F1760C69B1F37760AE29B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 db018307da8132c61775bf0d8297a626e0fa09d10ced807ec073d0ab38f1ced5
MD5 edf0735b8193afdcf4d71640695a04c8
SHA1 df4496f5d141a7f19d5c160f84e1784b64922ebc
SHA512 8ee91d04f5cec290f5dd7add96a0518e509d134ac2d7038eef70000fd7f07797905941910616861778520b397c34520aa96dc16661f3372e3446af7cd6281087
SSDEEP 49152:Ia+taZ3usBWOBr4tEGp0bqx0z+n217aau1glnhfciIDx:Vu6JmTxd2dnhfyx
TLSH
T1BAD59D13F1D901E8D06AD478974A9233FA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 7627bfded14aa9df326d4fb42c58ca0db9c75ff2503c460880bf5de8f81dff12
MD5 126a5f0574702006c455cebd8c5697eb
SHA1 87e76a7525f0c05d408ec440c53f28f5297d5dec
SHA512 1f3b9e7e7b49c485a6dd6cec176c888b36c7c87d57380ae0587e4f50c5851b1c918fab0d6a678ea9dc8c6d3dc95e206e9e6b39a892ef88137fbf879ab179bd40
SSDEEP 12288:sY73A50LJtF3s/GtBrSe2ZqjvjZFeiRXHnWy2bIUPuNXOQg:Jw50N/s/OBr0ZqPZDWyiIUPuVOQ
TLSH
T194D4231739EC4CD8F061D8F4C0AE42282915B5A9AF55D5E3B70821EA052EFD8DFE099F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2eb80a0f49b30100182291b9c2d05fb356f3d81a6c19e5f6f2eb2b5fc4432a1c
MD5 7508b311d00ea556bde027561fca5d3d
SHA1 9ff7c9deea7fc4438c785582a007b9fad5ad7fbe
SHA512 f04fa90d5333732d26f5fd5d986c63c1504322af47a6b4a295dcdc2d82f17863f5b47fa79288081ae5931beedc0ee890e33326f84c88713db03cdb9274112183
SSDEEP 24576:Ggb6bmBIi49WNNFpg1rSvFv7bYm50N/s/OBr0ZqPZDWyiIUPuVOQ:Ggb4mBIBhGFXhfciIDx
TLSH
T1A865AE1E22EC02F5E0F5D2B8DDAA4417D6B278161732D2DF1250426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 d4db358fc77481afbac316d89246d70f73bdc197a8ca52af9fd664d66ef023e9
MD5 ab32cac28498683587278145a759de18
SHA1 1fdb90c712f04f9ba239a0b092b944000d00d7b8
SHA512 9156d6870199a3b6d1e0c4a90ef611b94b714652e70f2c9f45821971a995204e4a94ab779ec3b9b9508d09e88e368d5bce8eddfe346e9265478d3fb32ed63be0
SSDEEP 12288:l0Gk50LJtF3s/GtBrSe2ZqjvjZFeiRXHnWy2bIUPuNXOQg:mGk50N/s/OBr0ZqPZDWyiIUPuVOQ
TLSH
T114E4231E34F518D8D031C5F8C4BA5265783074A4AB14E6FF6A9460FA0B1EFE4AB74CDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 d1a100b311d47148f0b0702f19375f01a1fbc94f611c35f29a3a16f4ec4b9551
MD5 427c0e40cce46f55ce8c19b91e273f82
SHA1 ac08375ad898c67c391aea47d44a8a1fdc0673a7
SHA512 eccc1c3148e1cdf4c213b97bfe550a90bff886ba80c0be5ed1abef5eec9feabdf531b74b44fff3ce55dbeca65e2e4ca3a66c2bbc1d1b815caf8ab7de84caebd2
SSDEEP 12288:LV50LJtF3s/GtBrSe2ZqjvjZFeiRXHnWy2bIUPuNXOQg:LV50N/s/OBr0ZqPZDWyiIUPuVOQ
TLSH
T162D4234738E84CD8F011D8F4D0AA52546D10B569AF96DAE3B71820EA065FFE89FF04DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 e32ee8853600b89009b08225a3eeb944553b8ffbcf1fb35186d98ec160bc9f2c
MD5 1a2cf0cc6ee08523d83be3cd17f7a07a
SHA1 54bfb169870fb8fd58981bf5eb2205aecafbb045
SHA512 feebcb6b8ea2364debf2ce693bd057358482ac56376eb99d8019373f1f5bcc62aa83b1b4af63ba6503cbde8ef07af12bb7588e9ee802f738f987eb6f19c937c3
SSDEEP 24576:hkj8n8gUJqH1Mzria7/mj50N/s/OBr0ZqPZDWyiIUPuVOQ:2I8gsqVra7/KhfciIDx
TLSH
T13D35F16676E001F4E077D138C9864663F6B2B4251364EFDF07A88A951F23BE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 2c7a20abb826813e44e59a338068918e6bd8473c289803148e94327f5424ee8e
MD5 b73cfe7e351910a46a4bda3cfea5afb5
SHA1 b909c068296e6acc8d331756b8db01f2988d389e
SHA512 55cf268141d8429338089a29a81212bd2750bd519310cd938ab2daceeec130b0c341d58fb77e0e3c3a8be6b28ace704ed59051cfbb0850095a8ee3d063541152
SSDEEP 24576:iPUr+NQa50N/s/OBr0ZqPZDWyiIUPuVOQ:iJQahfciIDx
TLSH
T18205E12F26E81CE4E676E17C85868319F771B4661712D2DF02A0817E0F27EE8BD39B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 8478c750b53f8641cf33999e06e669ece7a323ac9def0fac699b2c9bc01220c9
MD5 4a3e1b75755424db7ce0937f928a6356
SHA1 b14af868a7d80cafe6978d861f4809284084e4aa
SHA512 bb5ad2dbadbc5bd097b5283c22b262e39f00b48f2e117d727c9e0c04b212a5f52d3bf467ae6c57b8db1a565d3c64e2f437b11b4c1782919136669a1b0fa8a415
SSDEEP 49152:IBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjohfciIDx:jG05lO43bbhfyx
TLSH
T105D5CF6E62EC11F8D1BBD17CD9C6460BEBB23415033556CB02A486A91F27FF49A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 68b1d2d5468c563dcf443333464a57159e1f7bed8368c6dda7b3e0d663f45ed6
MD5 06ec5974c55af16200b8d63f0d3230c0
SHA1 bd9517c247c26ce5558e929dec215b0161751b48
SHA512 7fd1ff8b5a22e75983cb3c229471014b42819f30ff5f9c80e3337c0e9ec98122cd812ffc9242e346fce332841114ce9b67c6e3962b3df88cc438e9fd09f540c5
SSDEEP 24576:CNcwHdjbyQ4nLC18lb/EOjowL7Fk250N/s/OBr0ZqPZDWyiIUPuVOQ:CNc/zEOVHFXhfciIDx
TLSH
T158858C1622E901E4F1BBE1BE89779546FA71786957308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 6de62c0394788a4dc314f1fc2f98415af88ae858f2f2e2f5224b501df5f2559c
MD5 68d5b1bde7a26ce9cecfcd07b47cc0a5
SHA1 b795bf13bfd4ae8e7ec5c770e4f537248618c833
SHA512 891c8bcd14196fc2963dd40d020e052fdfdb9c565a9c3050d48ce8711289fdf4d0f524fdf397522881f8368123303476e6f01838a66043ad2b3a29c0068a6676
SSDEEP 24576:7JnJPbzB4S650N/s/OBr0ZqPZDWyiIUPuVOQ:7JnJv6S6hfciIDx
TLSH
T1CF15D02DD2A810E8E4B7C2B4815A1759FE31387D2F2169C729B4D4353F12FE0AA79F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 4ce25ece56bc6c6fce76a7d4e66614b9b33c261e06eb02055966c7d30cb617b7
MD5 fe6c67a814403225ff8f02952a4d2ea1
SHA1 206c69ddea50e466de83c7164522b57f8783bbdc
SHA512 1b89e27830c6caf90afeb02bea32a75be14b1f1f54ad983595155d623ab9aa26d1283a5076b44604c62d620ffacb08b7045db0985bfb5aff7e058e726e40f6da
SSDEEP 24576:KCLHGL0MoeVtFumTijCmlKQWDk450N/s/OBr0ZqPZDWyiIUPuVOQ:KCLHGeeV5ijCmlDWDk4hfciIDx
TLSH
T1B9A56B05A7EB4184F8F3CAF5CA2694169A327C549B34F7EF4A80C96A1E32FD4D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 02495a98b9da06edf1015b5381b94513e0d313dc6d4cf79161f4a8a3875869f5
MD5 d1ec3882dc565f0e3b9a1ea17dbfa9ea
SHA1 23d48e0049397bc4ca56cbb99a6c357844416983
SHA512 cabae0bcf3ec15c8c9133fcf176eb6942932ac4a7707f3882749408bde57e812a98bdcec273a53aa8a9a59abce6a44293cca3ea31d70c72079ce27d437d2b5b7
SSDEEP 12288:71Hck6j5ZI7x50LJtF3s/GtBrSe2ZqjvjZFeiRXHnWy2bIUPuNXOQg:f6DId50N/s/OBr0ZqPZDWyiIUPuVOQ
TLSH
T12C05015D33BA00F8E067D07DC1930105E6B2B0B597529ADF5B9481BA4FA7EDCB938E81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 696faf402b1aaaf797323aa14cee06a28f1f70c38a8abbb895f3c91558e5cbbe
MD5 17d161106c8427698021501fff89e514
SHA1 d70cfe32ae67a2d053d71c425410c165f30f972a
SHA512 29807edaa40a9a2ec62d4953917f01ee1e62ca3d8b28ea447275940e4f7a2f879edef92986440260b01fb76d83c391740bccc2a8135db2bc0b5c761868bc77c7
SSDEEP 12288:QG6kyT50LJtF3s/GtBrSe2ZqjvjZFeiRXHnWy2bIUPuNXOQg:BtyT50N/s/OBr0ZqPZDWyiIUPuVOQ
TLSH
T1B4F4120622E844D8F17585B8C5B742649E30BC20AF21D7EF7690A27E1F3AFD4AD70B56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 3f04e1024ccd8295808e1fddc889096428ed6b9994bcc4cdd7f098d0c91ada56
MD5 ca15d05d2fd426b8ee7b7a45cfd8095d
SHA1 72a01ddf06e3bd712563b60c68bd313057419e21
SHA512 9717cbc43756c186f3c1b044f1d7d91db0812c02a0b56e06dfdb14db414119c71b542e0223d1445283fd90e85da1c479b144cb1ab2db6da7e2d0508cbc2cd6f0
SSDEEP 12288:kIu50LJtF3s/GtBrSe2ZqjvjZFeiRXHnWy2bIUPuNXOQg:7u50N/s/OBr0ZqPZDWyiIUPuVOQ
TLSH
T146D4235E35E80CD8F010D8F480AA4354692074B96F56D6EB7B9421F6072FFE8AFB0D96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 8ded844338369473e7f874a4d49b7fba2244cfc2efd3d0d38877745f0a1aac6a
MD5 4758bd85b667ce5bacde0e9e74800684
SHA1 999b7b741a07092d3774bf79b664772a8dfc96aa
SHA512 d2477df8ea52e9acfb939dc6dd8bfb79aa4c780eaa8662d4503b8c56973abc7c6cbcee5fea5b39636670932aa5b41443893b941142827231bc8aa39f0c26f68d
SSDEEP 24576:1PgHLoTfaidZb50N/s/OBr0ZqPZDWyiIUPuVOQ:Bg8TrZbhfciIDx
TLSH
T1BF558C1D63EA09CAE2B2D675D8721493D633B4315772C6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 c70b8194565e5f388e8cb88569bae29e1f974fe2ed5e7581dae65f1584c79214
MD5 11e21c0480cc1160e027abe8eeaabc18
SHA1 570e9b6aab11b837b8c3061369efe81261a07d65
SHA512 ca769fdb9e37e4aa0b197118ae7b218f94d02cf233edfd455a7c36e7b7ac25a39cc14ab97ea5ce3d0d4539407734eb733ce7a80511a347647e055020c9a5e5e1
SSDEEP 49152:+DL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3FhfciIDx:f3Upow8sBihfyx
TLSH
T101A58C3DA2E800A8D9AAC379C54213A5EA71742D3F3055DB0174C1B8BF1BEF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/572-318-0x00007FF6BAE20000-0x00007FF6BAEE9000-memory.dmp

Download

memory/572-233-0x000001EE93EE0000-0x000001EE93F46000-memory.dmp

Download

memory/572-234-0x000001EE93EE0000-0x000001EE93F46000-memory.dmp

Download

memory/572-232-0x00007FF6BAE20000-0x00007FF6BAEE9000-memory.dmp

Download

memory/992-359-0x000001B5B7C40000-0x000001B5B7CA6000-memory.dmp

Download

memory/992-360-0x00007FF7F48F0000-0x00007FF7F4DC1000-memory.dmp

Download

memory/992-358-0x000001B5B7C40000-0x000001B5B7CA6000-memory.dmp

Download

memory/1852-349-0x00007FF66F6B0000-0x00007FF66F93B000-memory.dmp

Download

memory/1852-351-0x0000024DF83B0000-0x0000024DF8416000-memory.dmp

Download

memory/1852-350-0x0000024DF83B0000-0x0000024DF8416000-memory.dmp

Download

memory/2020-270-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/2020-357-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/2020-276-0x00000000009D0000-0x0000000000A39000-memory.dmp

Download

memory/2020-271-0x00000000009D0000-0x0000000000A39000-memory.dmp

Download

memory/2384-25-0x000001B9777B0000-0x000001B977863000-memory.dmp

Download

memory/2384-26-0x000001B9779D0000-0x000001B977A36000-memory.dmp

Download

memory/2384-28-0x000001B9779D0000-0x000001B977A36000-memory.dmp

Download

memory/2384-27-0x000001B9779D0000-0x000001B977A36000-memory.dmp

Download

memory/2848-291-0x000001F2DB6E0000-0x000001F2DB746000-memory.dmp

Download

memory/2848-290-0x000001F2DB6E0000-0x000001F2DB746000-memory.dmp

Download

memory/2848-296-0x00007FF71DF40000-0x00007FF71DFEE000-memory.dmp

Download

memory/2848-373-0x00007FF71DF40000-0x00007FF71DFEE000-memory.dmp

Download

memory/3192-50-0x00000248E5440000-0x00000248E54A6000-memory.dmp

Download

memory/3192-43-0x00007FF762380000-0x00007FF7624E8000-memory.dmp

Download

memory/3192-44-0x00000248E5440000-0x00000248E54A6000-memory.dmp

Download

memory/3192-45-0x00000248E5440000-0x00000248E54A6000-memory.dmp

Download

memory/3192-52-0x00007FF762380000-0x00007FF7624E8000-memory.dmp

Download

memory/3300-328-0x00007FF7036B0000-0x00007FF703845000-memory.dmp

Download

memory/3300-329-0x0000022834720000-0x0000022834786000-memory.dmp

Download

memory/3300-330-0x0000022834720000-0x0000022834786000-memory.dmp

Download

memory/3704-327-0x00007FF6BAE20000-0x00007FF6BAEE9000-memory.dmp

Download

memory/3704-240-0x00007FF6BAE20000-0x00007FF6BAEE9000-memory.dmp

Download

memory/3704-243-0x00000201833D0000-0x0000020183436000-memory.dmp

Download

memory/3704-242-0x00000201833D0000-0x0000020183436000-memory.dmp

Download

memory/4352-56-0x00000221C3E70000-0x00000221C3ED6000-memory.dmp

Download

memory/4352-55-0x00000221C3C90000-0x00000221C3D43000-memory.dmp

Download

memory/4352-57-0x00000221C3E70000-0x00000221C3ED6000-memory.dmp

Download

memory/4512-22-0x00007FF619C30000-0x00007FF619E33000-memory.dmp

Download

memory/4512-19-0x00000170ACB40000-0x00000170ACBA6000-memory.dmp

Download

memory/4512-1-0x00000170ACB40000-0x00000170ACBA6000-memory.dmp

Download

memory/4512-0-0x00007FF619C30000-0x00007FF619E33000-memory.dmp

Download

memory/4512-3-0x00000170ACB40000-0x00000170ACBA6000-memory.dmp

Download

memory/4612-309-0x00007FF686F20000-0x00007FF686FD4000-memory.dmp

Download

memory/4612-311-0x00000180FBA40000-0x00000180FBAA6000-memory.dmp

Download

memory/4612-310-0x00000180FBA40000-0x00000180FBAA6000-memory.dmp

Download

memory/4824-261-0x00007FF634400000-0x00007FF63454A000-memory.dmp

Download

memory/4824-263-0x000001C47C760000-0x000001C47C7C6000-memory.dmp

Download

memory/4824-348-0x00007FF634400000-0x00007FF63454A000-memory.dmp

Download

memory/4824-264-0x000001C47C760000-0x000001C47C7C6000-memory.dmp

Download

memory/4852-284-0x00007FF7E6590000-0x00007FF7E6CD4000-memory.dmp

Download

memory/4852-283-0x000001AD95410000-0x000001AD95476000-memory.dmp

Download

memory/4852-364-0x00007FF7E6590000-0x00007FF7E6CD4000-memory.dmp

Download

memory/4852-282-0x000001AD95410000-0x000001AD95476000-memory.dmp

Download

memory/4868-37-0x000001E8C1DF0000-0x000001E8C1E56000-memory.dmp

Download

memory/4868-34-0x000001E8C1C10000-0x000001E8C1CC3000-memory.dmp

Download

memory/4868-35-0x000001E8C1DF0000-0x000001E8C1E56000-memory.dmp

Download

memory/4868-36-0x000001E8C1DF0000-0x000001E8C1E56000-memory.dmp

Download

memory/5156-320-0x00000281D76E0000-0x00000281D7746000-memory.dmp

Download

memory/5156-319-0x00007FF660290000-0x00007FF660533000-memory.dmp

Download

memory/5156-321-0x00000281D76E0000-0x00000281D7746000-memory.dmp

Download

memory/5452-301-0x0000024B68E50000-0x0000024B68EB6000-memory.dmp

Download

memory/5452-299-0x0000024B68E50000-0x0000024B68EB6000-memory.dmp

Download

memory/5452-300-0x00007FF6E86F0000-0x00007FF6E8B07000-memory.dmp

Download

memory/5536-343-0x0000015D231F0000-0x0000015D23256000-memory.dmp

Download

memory/5536-337-0x00007FF6C2E90000-0x00007FF6C31B1000-memory.dmp

Download

memory/5536-345-0x00007FF6C2E90000-0x00007FF6C31B1000-memory.dmp

Download

memory/5536-338-0x0000015D231F0000-0x0000015D23256000-memory.dmp

Download

memory/5536-339-0x0000015D231F0000-0x0000015D23256000-memory.dmp

Download

memory/5544-250-0x000002B836300000-0x000002B836366000-memory.dmp

Download

memory/5544-336-0x00007FF793AE0000-0x00007FF793BFA000-memory.dmp

Download

memory/5544-251-0x000002B836300000-0x000002B836366000-memory.dmp

Download

memory/5544-249-0x00007FF793AE0000-0x00007FF793BFA000-memory.dmp

Download

memory/5664-12-0x000002726AF40000-0x000002726AFA6000-memory.dmp

Download

memory/5664-11-0x00007FF7A7CA0000-0x00007FF7A7DC3000-memory.dmp

Download

memory/5664-61-0x00007FF7A7CA0000-0x00007FF7A7DC3000-memory.dmp

Download

memory/5664-14-0x000002726AF40000-0x000002726AFA6000-memory.dmp

Download

memory/5664-13-0x000002726AF40000-0x000002726AFA6000-memory.dmp

Download

memory/5964-367-0x00000230F33F0000-0x00000230F3456000-memory.dmp

Download

memory/5964-368-0x00000230F33F0000-0x00000230F3456000-memory.dmp

Download

memory/5964-372-0x00007FF732390000-0x00007FF732897000-memory.dmp

Download