521d990d8fb85d48a0f59e130761233a7f06bd2e16243bed2f61d4f4567adee6

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 21:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Size 2.5MB
Sample260820-1mc5tabj7x
SHA256 521d990d8fb85d48a0f59e130761233a7f06bd2e16243bed2f61d4f4567adee6
MD5 728631ef2ae2031a4240586cd8ac712d
SHA1 cf58bf273d3b58ca3f4b45b8c0070bba8d99e157
SHA512 343fcdea9b62c1022eb02ce3b966c5ffa4272b78991cdb8e8dbea94fc7e44d73002e7b82e9d81fb4e4fb685e9c2f93001c002a2e37cf5405f286dccb2c8d4308
SSDEEP 49152:11FjXkDRiPqYWwqqWZvcQUhM4xbYMPFPLzwatnufxarkztMDJSXeBdH3OML:ljXDRtDJkao+DJ7Bp+ML
TLSH
T1A7C5D05577B040E8C17BD234CAB7864FE2F27811D9F1CF6B5A69A94E1F333A14A29312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence trojan

Malware Config

Signatures

Disables taskbar notifications via registry modification
defense_evasion

Executes dropped EXE 7 IoCs

pid	Process
4644	alg.exe
4728	DiagnosticsHub.StandardCollector.Service.exe
1128	fxssvc.exe
4076	elevation_service.exe
4368	elevation_service.exe
3304	SearchIndexer.exe
4200	TrustedInstaller.exe

Modifies system executable filetype association 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe

Windows security modification 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-540052884-2969440504-464782435-1000	alg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-540052884-2969440504-464782435-1000\EnableNotifications = "0"	alg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	alg.exe
File opened (read-only)	\??\J:	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened (read-only)	\??\N:	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened (read-only)	\??\V:	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened (read-only)	\??\K:	alg.exe
File opened (read-only)	\??\Q:	alg.exe
File opened (read-only)	\??\G:	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened (read-only)	\??\R:	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened (read-only)	\??\T:	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened (read-only)	\??\R:	alg.exe
File opened (read-only)	\??\U:	alg.exe
File opened (read-only)	\??\S:	alg.exe
File opened (read-only)	\??\V:	alg.exe
File opened (read-only)	\??\E:	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened (read-only)	\??\O:	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened (read-only)	\??\Q:	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened (read-only)	\??\S:	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened (read-only)	\??\Z:	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened (read-only)	\??\L:	alg.exe
File opened (read-only)	\??\N:	alg.exe
File opened (read-only)	\??\O:	alg.exe
File opened (read-only)	\??\W:	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened (read-only)	\??\H:	alg.exe
File opened (read-only)	\??\W:	alg.exe
File opened (read-only)	\??\X:	alg.exe
File opened (read-only)	\??\Z:	alg.exe
File opened (read-only)	\??\L:	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened (read-only)	\??\P:	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened (read-only)	\??\X:	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened (read-only)	\??\G:	alg.exe
File opened (read-only)	\??\T:	alg.exe
File opened (read-only)	\??\Y:	alg.exe
File opened (read-only)	\??\H:	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened (read-only)	\??\K:	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened (read-only)	\??\M:	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened (read-only)	\??\I:	alg.exe
File opened (read-only)	\??\M:	alg.exe
File opened (read-only)	\??\P:	alg.exe
File opened (read-only)	\??\I:	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened (read-only)	\??\U:	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened (read-only)	\??\Y:	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened (read-only)	\??\E:	alg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system32\Appvclient.exe	alg.exe
File created	\??\c:\windows\system32\ckebcipp.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	\??\c:\windows\system32\wbem\kgkbdjfo.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\windows\system32\sgrmbroker.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	alg.exe
File created	\??\c:\windows\system32\paggihei.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	alg.exe
File opened for modification	\??\c:\windows\system32\spectrum.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	\??\c:\windows\system32\kbdmogaj.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	\??\c:\windows\system32\perceptionsimulation\dmilibld.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	alg.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	alg.exe
File created	\??\c:\windows\system32\qpngjeao.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\windows\system32\diagsvcs\diagnosticshub.standardcollector.service.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	\??\c:\windows\system32\nijnbken.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\windows\system32\Agentservice.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	\??\c:\windows\system32\bpjqhobl.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	\??\c:\windows\system32\mgaopeff.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\windows\system32\spectrum.exe	alg.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	alg.exe
File created	\??\c:\windows\system32\ckieabkl.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe	alg.exe
File opened for modification	\??\c:\windows\system32\vds.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\windows\system32\sgrmbroker.exe	alg.exe
File opened for modification	\??\c:\windows\system32\tieringengineservice.exe	alg.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	alg.exe
File created	\??\c:\windows\system32\jlbgqboe.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\windows\system32\locator.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\windows\system32\openssh\ssh-agent.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	\??\c:\windows\system32\openssh\dkgckdkc.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\lbnhbmlc.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	alg.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	\??\c:\windows\system32\hkjlnlbb.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	alg.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	alg.exe
File created	\??\c:\windows\system32\apmdolif.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	\??\c:\windows\system32\nedpbqoh.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	\??\c:\windows\system32\pnenlojh.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\windows\system32\locator.exe	alg.exe
File opened for modification	\??\c:\windows\system32\openssh\ssh-agent.exe	alg.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\kignplke.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\windows\system32\alg.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\windows\system32\Appvclient.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	\??\c:\windows\syswow64\bgjmmmme.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\windows\system32\Agentservice.exe	alg.exe
File opened for modification	\??\c:\windows\system32\sensordataservice.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	\??\c:\windows\system32\mdgdbdog.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	\??\c:\windows\system32\fcklcpmb.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	alg.exe
File opened for modification	\??\c:\windows\system32\vds.exe	alg.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	\??\c:\program files\google\chrome\Application\140.0.7339.81\locpnmep.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\program files (x86)\google\googleupdater\141.0.7340.0\updater.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\obkakffi.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	C:\Program Files\Java\jdk-1.8\bin\lgamkbac.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\cedpmnkl.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\occlljkq.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elidehmc.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	\??\c:\program files\common files\microsoft shared\source engine\qaoplpfd.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	C:\Program Files\7-Zip\jgpijieg.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\kgacdccg.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\pijgofaf.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	C:\Program Files\Java\jdk-1.8\bin\dddilmae.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\program files\google\chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	C:\Program Files\Internet Explorer\kjkookie.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\mnmjadqg.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ldcnmoao.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	C:\Program Files\Java\jdk-1.8\bin\iilmmhmc.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\program files (x86)\microsoft\edge\Application\139.0.3405.125\elevation_service.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\mgecidfd.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	C:\Program Files\Java\jdk-1.8\bin\onbaidqf.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ocnfphoi.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\program files (x86)\microsoft\edgeupdate\microsoftedgeupdate.exe	alg.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File created	C:\Program Files\Java\jdk-1.8\bin\knkmmeba.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clmaedbq.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	C:\Program Files\Java\jdk-1.8\bin\mngianin.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	\??\c:\program files (x86)\microsoft\edge\Application\139.0.3405.125\dnjppkja.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nnbpngba.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File created	C:\Program Files\Java\jdk-1.8\bin\dakeokhg.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\program files (x86)\microsoft\edgeupdate\microsoftedgeupdate.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\jkgaipki.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jipjcfed.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Logs\CBS\CBS.log	TrustedInstaller.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	alg.exe
File created	\??\c:\windows\servicing\fnjhhcpm.tmp	alg.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TrustedInstaller.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File created	\??\c:\windows\servicing\hafcloam.tmp	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000056f9375eed30dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000685efc5ded30dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009d95545eed30dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b1cf6e5eed30dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b387c55ded30dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007172f05ded30dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000be96355eed30dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0"	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV"	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\""	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\""	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR 压缩文件"	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP 压缩文件"	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0"	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR 恢复卷"	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\""	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,1"	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4644	alg.exe
4644	alg.exe
4644	alg.exe
4644	alg.exe
4644	alg.exe
4644	alg.exe
4644	alg.exe
4644	alg.exe
4644	alg.exe
4644	alg.exe
4644	alg.exe
4644	alg.exe
4644	alg.exe
4644	alg.exe
4644	alg.exe
4644	alg.exe
4644	alg.exe
4644	alg.exe
4644	alg.exe
4644	alg.exe
4644	alg.exe
4644	alg.exe
4644	alg.exe
4644	alg.exe
4644	alg.exe
4644	alg.exe
4644	alg.exe
4644	alg.exe
4644	alg.exe
4644	alg.exe
4644	alg.exe
4644	alg.exe
4644	alg.exe
4644	alg.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
440	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	440	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Token: SeAuditPrivilege	1128	fxssvc.exe
Token: SeTakeOwnershipPrivilege	4644	alg.exe
Token: 33	3304	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
440	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
440	2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 3804	3304	SearchIndexer.exe	103
PID 3304 wrote to memory of 2096	3304	SearchIndexer.exe	104

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	alg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	alg.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Modifies system executable filetype association
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:440

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4644

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4728

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:632

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1128

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4368

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3804
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 788
  2⤵
  - Modifies data under HKEY_USERS
  PID:2096

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.6MB
SHA256 688fde793726e7efb045c9504280712d65741c9b0ecdf3959ac638567e9bb9af
MD5 216e13d13a9fa83c64658d06744da90b
SHA1 e74fc3a34ec490176171b3f4ffdcdb9065d471e7
SHA512 f5320eec0650d6e48d4b01c103c411e2bdcba3ed84123debfb952277b24b72ac2f2c44230c17c8c8049a5a494f6719e98f676bc81a75d06ae2e2fd99c3694659
SSDEEP 49152:kb+632BuPkFKRrdE6ohastBhuXjfS4LWxn6t/cy:e3q6LjBX
TLSH
T179C57C03F29900D8E06DD578DF4A9123E9A1BC890B24B6DF0790B6562A7FEE45B3D713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 945KB
SHA256 22917d03a661c36f7bcd66df5c1288760b9a412bf7a73116cf4894306d318254
MD5 a40af3c7bd544b10976114ccf5fde332
SHA1 2faae3f994e8fc77c7a0a82ea93886e6bb0b8155
SHA512 fd87c1ac7a9aad82c5cb3028dada3498e226a3731967f9c50fb69c1df04d0271ecd03a017e8a8d3d00bc9374cb73021e71e3c99db6e66322df7f7b92043970bc
SSDEEP 12288:EXZNYVLeyUji0h90ZD0wxpGZIVu6rHsdIkgq/2oW0Qtn+nd62puFuNtyZ2nIh/Q6:E0Le5ji0hmx9rMdIVqs0QQtC2nIhQe
TLSH
T185255B25F66483E5D07FC0B9C5D2AA9AE97130421F3086CB0297877C3E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.3MB
SHA256 3d7894b2daf63b352728d9bc3fe079b2fa050df8a02aaeba8e1e20b5a94cf229
MD5 4ddd6d5c2bc2e938ef9872900de690f8
SHA1 4d9f40f467d3c5358cc53a6d26b905875e7900c9
SHA512 b6f6f5aec0ba6803e35866a039438114bd16d3821d626cd2e9d87f936e8ee49775d1584f0894bb8e340c32ad5166a6548e3e34a92f95ba4602b2304465f9de19
SSDEEP 24576:ja7/ezSC6vUyD/aqgrvWD6q8wyu0b8vIXaisvN/skESNjDZ:O/ezSC6vUzPviHjy+HbZE6Z
TLSH
T100551735B5788323D0B2D0FAFDD2A699FA723046D730C9CB0246926C2D27EE5B535729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.1MB
SHA256 be2f058b6c42c88ee854de7d161c9c1db7489b8ab87b261727bc3514a3f75a51
MD5 3aa35a2b2ccec10bdd6a842cee38101b
SHA1 86bc2b9150193dfe34324b7eeb57babca804a50f
SHA512 0edb143757ab4aa41c65400103b8505be03c4561ab7a7e41947fb5549c43028624a2355260fca39a4b62631704f3454fe4a8b6d9a045917304dc70cb14b976c9
SSDEEP 12288:dVJjBq33vb5O8M+l1D0hwsEBoW/lx4cf0Im98ZJ8/AlVLpetmmVm3vrHwRtfaj4K:dVbqPb88hv/l+EXja83v07aj4sU
TLSH
T13A355975F564BE2FD033F0B6C4D2A69AEAF23441073189C7124687E82E676D68636F31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 410KB
SHA256 2353d6f1f94e7ed713dc804d89e1d4498e18403d3aa776f8a8830dbd87b1be68
MD5 cb7b4c17d98590c416c8457da75b392c
SHA1 58683fa5c72ad07fec5a4e243ada1c89a4277fb3
SHA512 d3de711662d09ecbe737ffc4be9342760842be68ea14cfd1cf2abc191e83a92414b9bf5a5bd44871b553afeac0d42659098368737de0e96afeb5a72d6ef8de3b
SSDEEP 12288:fQi+byVW6VYaBzTXsOmiVB7terYnnpbQMwC:fQh/95iVBQWp0x
TLSH
T10B946CC3A20949C0DFB93D322AAABB0CA13D3791DE54A9C45BD57CF608B8B8574784DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 672KB
SHA256 2dd27f9f49c443097d821cc01560fa5f03b92c925b808e4fead983d03a1674ed
MD5 2b4fb85edd1a8ac9eafe3cb0c29a6b61
SHA1 f6c054fe3157c2dabe449bc63c1652a9d39825c6
SHA512 48edfdde900f67164a88f24ec04e641e3920ff3cd6449a1e9795c1c00259fb08e6c6e9a263243020207b666b1defa0362be2e211d40f3a47acf833a33f82db7f
SSDEEP 12288:1eBNUbTVO86UI6e4Rjl+27SXGhT/LOjzRikEW82f9szNQD:1JIUIdqeXGxzk182fE6
TLSH
T148E48C7B9D24BCDEC26A8DB82641F2C09BE26C305B12538FD5F5823E8E235D54E7D816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.5MB
SHA256 90c65e429c9cfe5e66311acfb9bd5497bb4a0ebcf8cb4eae6b0ea5322ca70e0c
MD5 44e0e12fc33b3024855a9db875ed90f9
SHA1 b00126d4da33628d07f865f2dd3fd1d6521819b7
SHA512 9261618d03daa29f7ebb43ee2b132e6d4625221f68159063814a38fe922d9ca36eddacb9bb678069bbf5fdca8db7566be066291084ac7e8b2f8caee1d3fd28b3
SSDEEP 49152:3QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJ19DN5J8NRV3THj:3QvGAdlCEL8c/1RNw5C/Cy
TLSH
T1D6264A656BFC88F5E0A7D13489768572F6F6780A0D31BB0B0251E61EAF33F906D29325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 742KB
SHA256 80d94b7b21ee8d3bd4545d22090cd081f6e41c26150f56c81e835a8e51effdca
MD5 51603cc388082dc3bca773191bdbd6b0
SHA1 93dd95b0c89ed0b9eb2b97cd54d23bba7dc9349b
SHA512 d083a2af832c0a2ae8566561b5df88c77615ba6cb685152033386f4e2dfb6a8627aff07e30700269f92d276ab88e67252b8cec57646e838b0dad182982fd56bf
SSDEEP 12288:/AwSfxL/2Dc39DLLmt0LDQewsHjdaLAX4qj6EWCwDFEgPYnSEMNYdz:IUewsHjzX70CwDCOEMNY
TLSH
T191F49E52FA6CC490DBBA29723B76F709E03D26D0CF5459C3E6DC6C2E08746C12179B9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 23.8MB
SHA256 a5d1eabc83bc9bc1b5d74747da4d6065c7d3f31055d9c5d526aeacea977c0f35
MD5 bd607edcf2797217a9adc49b5c82db78
SHA1 b2b7212dc8d28f1f27c78fa2936d5530c29896a6
SHA512 26629f1c8f69c74e5ddda426ce9adc4907ca89670888fb59b796d5e105d69f23c61ca8fc1f4ebe40732c9a7d4b9fcbc0c58e50e85f6cd45ff9316d301046fe4b
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLykIldPlbuJH:HUEtQevvqc2W1cpV2kI32
TLSH
T1CC474A91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.5MB
SHA256 211a9adb78c4f24c31d76c9c71e387c3e6be10136e2e3c0cb7d925134b22d6b2
MD5 6eac4de89ef7bfc0514c3fff1d51a66d
SHA1 f47216bd0b0475a3341368eb15bf1ac4b559c641
SHA512 60b91d54f858f371e616fa4f67a3ab39990d51fee642f901fa7b15e170dafbbcd6f30a5188bf0ec103cfca423acd788670d7ae9751195cf0bc2e4dd1659eabc2
SSDEEP 49152:pCbRquA/m2yL5zffFiV+XenmE3/z8mbsOmbMV5:moqmVjnmJmbnmbW5
TLSH
T1DEC55C0976B881A4C1E6C27B8EB28646FF7138154B30D7EF4255461E1FF3AD44A3AF29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.6MB
SHA256 fbbc8fbd2005ced30c5490700e95d1f14b58d05deea4ea0641a367f0d587c9c6
MD5 1dae043f98922685d7861e7e9c591d03
SHA1 04156c0d067d0df08589554f9dc5ed38328c1126
SHA512 5e8058dec3027135285f6ba0ab482e8a80e4bc02ca6fe18d17d0aefb989186d6b4aa5e561279b8f7cd4b0e6f46561ed42d78658e412f8b19aebb8b974d64994f
SSDEEP 49152:KB+taZ3usBWOBr4tEGS0bqx0z+n217aau1gl1JRA8I3:Yu6Jm4xd2ds
TLSH
T1F5D56A13E1D901D8D05BDC77874A9222EA62FC490B34B7DF0AB072562A76EE45B3B71C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jpjemmae.tmp

Path C:\Users\Admin\AppData\Local\bbnqpfea\jpjemmae.tmp
Size 682KB
SHA256 7284433644a49a1e236d8af78297a2418ffc195df3db08b462a023f76fb6d95c
MD5 889a71103063e1e70be35ad82b350bf2
SHA1 3fa3ccae3d828d271c7297c18fdfb88089c78496
SHA512 f3b336efba41bcdd811f4bc1e56dca035a58333018ce6b8a1a43460d9f601068d2302271929d7579db5bc9a4235f3177bf55082e6c7fcfb157d0a244eb4e92da
SSDEEP 12288:g1BhXWvSqY4zvmjOwJITFfKvW4O7veaOuzxWvnubE5/B5/4:2PX0hmOhTcvWnzea5x3bU/BN4
TLSH
T127E4AE6D2E5424DBD862B23D7942C260CD637C70231392EB15D1C97F2F67AE9A678B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 491KB
SHA256 0ec5793a3df79566d972d5d8c5aadac35aa05f3e00444fb77e81b572f2236625
MD5 fc804e9bc7300b7734524ca04b6c7401
SHA1 a511ddc57b6a860f8fd1a29e497083b7a1bd5256
SHA512 b365843384c9fdbc32bc2b892dd91fcb5b3bb97e085a8075363442868a449628ef52269d800fa30f9ed3199f3a894a394b39ebd315e18cdaa46ed9e8176d6442
SSDEEP 6144:4zkCSPNo03faLdLbHjvXdVSehjv9Q9NJftKvTWedilbt0HkEV54dgvlkpPBk4//e:2hbHjfXPhjv9G4vyU++Hks4JkqjLkmq
TLSH
T125B4C056616845CCE971233E2EA2A70AF3767D50CB518FFFD69854F6FE22AC81C34980
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.0MB
SHA256 025dd5c1dc4ac458ea2df295ce9c52d89647c70ab48b6f72fd3414e4bd3d1499
MD5 a128acba46a3cc111f9162f7a99ee4b0
SHA1 28635576813aebcfafc423c4138c1c2a2e77a7bc
SHA512 99f8c0f9655d4f1685282839975ba10ddb0ac5b1b715fe155e6f99eee05f800573138dde39cbdaa5a2dfe5adf266c2db94552603cb3908f56f0b7147f437c430
SSDEEP 24576:c3YgnJcRTk4yti+R5d7R/iQXTma1SZpHVBVK:cIgnaTk46p7R/PTma1SZp1BV
TLSH
T19F356C2EF2E910A8C8A6D236C50107A9EB7174291F209AC741F0F539DF16AF85E35F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 493KB
SHA256 d77a49e94b3de7910a53fd0df0c076cf6c79ff6f4fd27c4eb94f1400b78e6982
MD5 71198d4d1d473edf4c1d229994929f9b
SHA1 a9dab3a600bbc89183269ca64e95b7c8f514e522
SHA512 eb7710eff0c72048ee0986f46ca78842255043a556510554e6e28cc3f6c994268d20743453e46eeaf63f28dd177d028a34ce6d67ab272c65818307d55ed440e5
SSDEEP 12288:IEP3RscLBulbGgzDd4gFwwmg0odHtqt8:jscLBobZ1hFmg/g
TLSH
T170B4BE5B160CE4D8D01EF83820A16672D361B264370163DF99CBDE3F0F6A6DA8B35786
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TrustedInstaller.exe

Path C:\Windows\servicing\TrustedInstaller.exe
Size 193KB
SHA256 73684e31ad4afe3fdc525b51ccaacc14d402c92db9c42e3fcbfe1e65524b1c01
MD5 805418acd5280e97074bdadca4d95195
SHA1 a69e4f03d775a7a0cc5ed2d5569cbfbb4d31d2d6
SHA512 630a255950c0ae0983ae907d20326adea36ce262c7784428a0811b04726849c929bc9cea338a89e77447a6cec30b0889694158327c002566d3cf5be2bb88e4de
SSDEEP 3072:hi7zaxGadwQ4QabJJCe7y/Wch545uddUSSr1Z22drtSrRZGSDByb:gOvyflbJJCe7GWch5+IS5ZNxSrPGS4b
TLSH
T1AA142A3932AC10E4D9B95278D5624325FFF2B464271261FF42A0827C1F2BBECB97A751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe

Path C:\Windows\system32\windowspowershell\v1.0\powershell.exe
Size 839KB
SHA256 6b3bb82d9015f9dab5e3a2654a498562e31ef188b19360160c0ab815cc6a9799
MD5 7cc4b72fe045ff9ad23b288acdec7239
SHA1 46f817d3fc3ab3b717ce52ef5a045b90c248a515
SHA512 7e3fbbe3085866196c4aae70cada35be5f8bb91429715a12e0955b3a7b0acab47bceeb7f392f54b72438b3466c5bcfa1d07ddeaf8dc66fe0ac4812b8b596aedb
SSDEEP 24576:AuW2KjJ4Td3kJnbsPhnzqIFnb8TqSNrfZxlLrC7M:GnJ4Td3mbsPhneUbqqSNZxlLO7
TLSH
T144059D876E837AC5D82958718C279A84432D7C79CB519BC78DC8B5F90C306D05F3ABAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path \??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe
Size 658KB
SHA256 50394fc2157f4c0bee049a984e51b2aeaecae66fda971c878d505434c7875c55
MD5 a8898fd502f5b3bc8b957758e52abe00
SHA1 7f4acf37b60bd577a40f06c87880550d21ede719
SHA512 0a0585f8b6817ab22a7960a9733604f51981bac7d63d8382600c756412c6c2b4cf66dca6c80e397ed5327aab53c1d525ba981e6e34f2eeade6d5b1c20258f211
SSDEEP 12288:I1XLsswWkxy2lRq2czAlfrFxuor2+o8T9j9V1Cft8YTUvL5c9aOOkfWTivjIknt5:uXYfDtczARrbnx504tc9bcivhs4
TLSH
T16BE4CF3567C44AE4DDA66174D9339905F2723C8BC76CEA8B83D89B760E736C41E3CA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ose.exe

Path \??\c:\program files\common files\microsoft shared\source engine\ose.exe
Size 637KB
SHA256 153307375105adb3bfed3713ee96a65f6c33ca4ed88879f3e7040004caadec46
MD5 51fb1b34e5f744681f20d697524d9394
SHA1 dbd588689878f3e67466f8bf6cca2108cab84cdf
SHA512 357ec484c0ab40c57a1dee612170e17ff37c304d701d9f415cdb4d18c8c0f81f44ebc525a607b573400db86573ca514d456d6a6fc0c7d0eb0508739955efe13c
SSDEEP 12288:Cmw5HEjsChN0BFgl0WDm+CY0IdxAUkiuUxl0L24kJDI:bwutOW30IdAib+L7k
TLSH
T1B9D4BE06635449E4E5E240F58D47A639E7B6F8022E28EA0F4FE3DA5E4F773546D383A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path \??\c:\program files\windows media player\wmpnetwk.exe
Size 1.3MB
SHA256 daa302cfca16e8146b56b06a53b4d1eddb1295e18918c209ac64c6aef16deddf
MD5 f3436c9bcac210de1a3268be602f5160
SHA1 6ccc308529147907ebf96d3e25a7db9b6de4fefb
SHA512 46c4ebdba98c2d6611706e21028f3abffd1add1a5c68ddda5504c2dd88d35d3ca5113a657ca23b782c60bf76fedb5208beba54c13e4926cd70d733f92c68ec39
SSDEEP 24576:EcP4mcvIjkGOxhKP2l71ZNKbrh/8KBPBX8HZdVuFkjRqA5:/P4m4IpOO67s8KxBX8F10A
TLSH
T17A556B19E6DC0085D0BAD23476E58BD9FA71742A1F3286CB11609E3D2F77AE14E39F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Agentservice.exe

Path \??\c:\windows\system32\Agentservice.exe
Size 1.6MB
SHA256 5bfe56b37684cfbe10997816c2e98b21584a43f5029fde037e5deccafce23a24
MD5 32fcecc83807055199ed8f65750440f8
SHA1 549034e3df442f358d44eed80fc8763fac5fad2c
SHA512 68a7e3d118cdac59161364b24731dea137ff3481f5e3ad238b2d3ca23c1e5e9c6618f5f09fb9d44e16e6535dad632021d403cbb34e71790bdf7318537c367ad2
SSDEEP 24576:7oiQ0h2Hm7EkuAK3xV3tk3tLjN2VMbxR86mHx/YY/izSI2sB29EzwwXg/bjnCgL4:7a0h2GEkuAe73q3ppc6zwwQHnK
TLSH
T194757C1D76DC82B4D0FEB27B85A6414AE6B277120B3156CB0190BD3D2E37DE74A39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Appvclient.exe

Path \??\c:\windows\system32\Appvclient.exe
Size 1.1MB
SHA256 2297e7aabb2e7c72026788fda378c9cad94ac5b377f631419533d7c980974ad8
MD5 171229ee4cfd25ad54e86419488c6124
SHA1 7d430dd8c120b058e407ecdea9ceeb98f57a26fc
SHA512 8859ffe93594b0d761595f719c31ed457b4ea1d1c4f8f252d5979a74a78ed667a8bbe345f654f51b4722bd983883dbf5f5b48c617e1b85c1bf2140497a4ecb54
SSDEEP 24576:b1QT7EcpfxR+N5AWAz3ooiYXjMqbQXSjI5:mTDxR+N5YzTBjMtSjI
TLSH
T1B8457C3EA7B914E9DD7B8E789F22850DEA727411033153CB52A0C13E0E2A9D85E79FD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path \??\c:\windows\system32\locator.exe
Size 410KB
SHA256 966894106d24cae3572f5e0b7d571a0be3479c8a6fce0974508ded8d8eb979b9
MD5 33552f50be78993424344951d5117ddb
SHA1 1f13ea7dac92e4197511bcba4f46f8f7cdd034c7
SHA512 9bc602cac1a09c8f6f75d227b53995c968115e37545bc9f86e2946625b5e88f6e7b18944756117bd3cb56748fd22cb51d5626b166bfb99b0f5c642c72d5e6e57
SSDEEP 6144:ha7kodOVj2Eerw4Qe0LVFVbMYL/w+7pKTCCBw5Y4smuOrJUZFY/Zs3YNN56npn7v:ckniEeruhRvbPw+7Ey5merJUn3QL6np
TLSH
T1B394D0F69172F580DDA65DB52A94DCD034B02278220B046729FEBDAE13BDEB5CE6C017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path \??\c:\windows\system32\msdtc.exe
Size 544KB
SHA256 8bcdd8a33ebb517f331387828a809751af0d4a742438c33baff1cce287aa6b52
MD5 16c453f1b7d875f6e31d131794ab65aa
SHA1 11c26237fb60e782c8458aff14c3aaed1f5b41fd
SHA512 4b7614552e2ba76bb7aaffd06ce41d92689341417e02630bc743503c4f411dac0667249b8695cb34b0ec1beffe467bd6f274cbb647bac52c381a72e3ce543c27
SSDEEP 6144:5NSxzHkyXn7DaqiTFNGg+0vEtdLdi7AO+l01NWv93hFIbI55/Buewmil:SjkyPiTFT+MGsAg1NWvnubE5/B5/4
TLSH
T1EEC4CFD4BB5074ECE6FA4D382D6EB890996C3F806720B0DFA4A5A51E47313934F78A53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path \??\c:\windows\system32\msiexec.exe
Size 467KB
SHA256 9d981a2cabe09b96fd3ca757c8fd3bcaa915994be885fe9fc0a18760e7a3ae14
MD5 5e9108c8682b538cc3b242c78dc27c41
SHA1 3fd83ca17c81327543a1cd05eac5d8a97c19c20d
SHA512 97be01b286bd292c2044939f16f4ab18201c68557f3e1426077e3d03994761e660c314758253d720948d19f01942fcdcb9c17ca12b6281df11e8ef903bdfd6ed
SSDEEP 12288:m4PynxMysuaR01jV90kSXzl6lU83AF6JGMpBCC:5ynxMysBW1jV90kSx6lUmI6JGMpB3
TLSH
T15BA4D04EE37C15D6CFEC6432C529B3499239A2F55B5468DBCBC9F5300E3ABE498306A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path \??\c:\windows\system32\openssh\ssh-agent.exe
Size 772KB
SHA256 7106eb158697ff0e95ce436109295bc902b0a987f1d443c59d3b666776d8c431
MD5 b4a15db6b9cf90b1ba9da69e55f39cd8
SHA1 5472c1ec9f12fc36346a3c70c7a39a73e81a50ef
SHA512 3f79b12e18557b65709ecf7f69dbd864ddb99492ac071eeec8e6a1ecfe4e378fd1015a58895da618a63fe09f9d637764005dc58459ec8ce17f96f0aeb912e43f
SSDEEP 12288:+ObDA4LWOsvAYFTpogfckWsvY18iDKICS9/A/YOgb9z3:nXL3UTpogfckO/K/OJ
TLSH
T1D1F4D061E29410E8D937A03885B3E705D273305DEB51A7B713A44A660EFB6F2BD39B70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perceptionsimulationservice.exe

Path \??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe
Size 503KB
SHA256 15ddba43008b74e95173d314e7491e8c7f5a5895c92fcf78c6916c200686776f
MD5 aa15f70cd2631b879696175633c4b0dd
SHA1 8189b8e4445b16722173d6c20c58383c6f596f1d
SHA512 e4a6bfbb99ed3e4b46b16868d5eabe1964f9f1b26e33f136a80101cec80a6f185320f51e15e1eef3e7c498091321aa3b61111691bf9ddd7532d845ade9170e95
SSDEEP 12288:CpFtyO7owc73YzZBvLVatiMFk9M0Kx56:PO7owc7s0iGP0
TLSH
T169B4AE963ED421D8DA79613B06AEAB089261B7754B375ECF0584E0FA3E73BD81C3D484
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

searchindexer.exe

Path \??\c:\windows\system32\searchindexer.exe
Size 1.3MB
SHA256 b97cc758b69f9c9c83f8f6e7bcd52d9bbd2ab4603ff24c8ee558e42e67150e40
MD5 20c6c1f045419ef763b140e788146029
SHA1 e2b8a54631941329e8c6b57abf30f9b84fe2598c
SHA512 25ee394ad6d71822c8adb09dba16467e4e7dc906832a6c90c7783a5f8dacaca5460f0cb943b7d97fe76be24c8e6d7ec925e8092f33654eb0eb5e51a82e0eb02c
SSDEEP 24576:j7NM9YZZqmWMUkPjZM48Mv6bEhsCDpe0zndAw605me6wqVwgrC7M:j7bBWMpPjN8DbEhRT5gO7
TLSH
T1B35559DE66A843D7C476D1398B9EB2C5F2B174611B318BCFD152422E2E37AE44E35720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sensordataservice.exe

Path \??\c:\windows\system32\sensordataservice.exe
Size 1.6MB
SHA256 41c73c414a250a17f0d5d9038c6c83646b45e7515829213bf185ae04b021cdce
MD5 3e6b79e2a175e30913d90b4461036fd9
SHA1 baea014de78936df232a797600e2c8e72597349a
SHA512 6e079a19c0b759083f377e74cc6485cbe267936da3ffb96ff4ebee7014f46341502f124d90c650f01404ead2d8029d54d9a764265a8d3130148d551073d11267
SSDEEP 24576:jW6BApg2YuyuNDYTabvcOvNYf8km1xi1rWmemkVODIY:jF2YuHNETovbvNYf8kmmtWHmkhY
TLSH
T101753B6927AD8094E0BAD27945B6934DFA727873173045CB02558E2F3E3FAF4493DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sgrmbroker.exe

Path \??\c:\windows\system32\sgrmbroker.exe
Size 709KB
SHA256 b83ca4e43c18e219a2537007bbce23fefde2bc5210666d5bc5ec097c86ad7078
MD5 f4b305fde9ae91836982907cb291c221
SHA1 5e68f80ec10fed894a260acc9af7cd7b2848fedb
SHA512 ada811e34241df33b44b7d22601e075ba537d4d8ed53d609cbf70ee3df89fa89c4333fde827cfd80b4cf2ea34efbcbf7d0bf6713cea037a34996be19905596b4
SSDEEP 12288:J/5T+RdOzMbFFTG+eEWNmSL+h9K4as46AqTYgSRmDVwQSPVd6OJst4u:DTMdOz0FFS+UmSL94aszxYgSRmDVwQco
TLSH
T13FF49C6AA35D14D7F43AB23DA123AAC5E6723C610B116DDB7680803E1A67FDC74F9B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path \??\c:\windows\system32\snmptrap.exe
Size 416KB
SHA256 02d1d654d442739ba8e3db09a6ec57c75575bd41598bde22ed5727046e09fa59
MD5 366967e0fd7605a23ed27c103bf1a0e0
SHA1 ef37d5490845c5691ba335ea22f083b978f3a762
SHA512 fc03db00af7903bdb07d45b5fcd89f9b65c8eeb5d1c0b80f5116d217ad58d343013178dc7eddfd04b9e868734e50bf697050c695f4e7c2a40eb53c4743ef5371
SSDEEP 12288:KJtHyOVBcEnvlAG6IUdsCDrxv2TxAPKS:cVyOVBcsvlAG6IQ5cxAC
TLSH
T10494D0ACAAA5F0C8C765EF32A984FFD49801237016D61CEE6DED63550DB0A5E43FC885
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spectrum.exe

Path \??\c:\windows\system32\spectrum.exe
Size 1.2MB
SHA256 308c42858105a2074f4e23e43dc6b04ec0d083fa1c1cc961a47f115dec47f042
MD5 1db6035301b3559bece4b1688f3005cf
SHA1 d28b60a84e976e04b329750cb48cb08559863c39
SHA512 7e60cd7acdc961dc76f7dc8990d7dbaa8c9c45bbc4fa68e1e7f0d4841acb15291fdf837a7ddb19ba8cf9e761e86cbddc3a49405424cabc47d5647511e3c44e2a
SSDEEP 12288:7hOAY2KY6065+AhS6CVlWwNjNXEbZjtotpcYCe2f3YrPbMkKPrf8R:MAFs06+OmlfJNXEbToUYVFHY8
TLSH
T13C55397E62AF00C5D47D91794A578B16E3B17C66072176CB0D60863E2E6B9E42E3BF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tieringengineservice.exe

Path \??\c:\windows\system32\tieringengineservice.exe
Size 717KB
SHA256 415656e981321e122fc30263bf51b9ef380cbdc0fad1223341df07982e60adf2
MD5 15594ddaf8d8e392092fd165970bbf6a
SHA1 930309fe149f740fc821026136b498db3c0fd1e0
SHA512 0c92bc059b0c1a2fe37b2d88b95173e9a56b6b6afff3df24f2634372bda10517887917b18282bd36212952190172da2d94f1337cf35a9bf77e5deeecaa7f8ce2
SSDEEP 12288:ICJnJ5D3VkrtzxXM/QlAIHe655xvVu5PjhseQyGLgVBH94Ipw/8:9JnJ5D3Wlrv4pjhsvmH4+I
TLSH
T117F49D3CE26410E8D477C734CE8D2695BE72356D2B32A5DF2BE4F4352B25ED08639A18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path \??\c:\windows\system32\vds.exe
Size 1.1MB
SHA256 d127a87859a51928475ff084798c6d97595150859ecada82c6d8f33b8a8b1940
MD5 2d8a3dc73ade1801b36eeb140c58dc0b
SHA1 e24689a25727014e65fc0f96799bb4a6763d3d20
SHA512 2128b6ac9c2148fad7d5a69789b5568f7a6bf62f58ef5becb44b488ae7aefd8fc954add13fb11660f12168e247575c4534886985f7f8758bd83ef476d96e2666
SSDEEP 24576:HQ9MxZKdcz9Yw33wTi+ku7HqdCkGukg/MNWid:HVKAGe2
TLSH
T17E35282DABF90985E1729235D5A25082F6F2B4711F2586CB3C49D03E0D6FEE8D974B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path \??\c:\windows\system32\vssvc.exe
Size 1.8MB
SHA256 ad782b0c4c4c26e66a02f82e03d9220aeab43f17afa32598fa8271305a97c6cf
MD5 15620216bbf883aba707e450f5958c1c
SHA1 727242a51084dd5dbc977d72aa9ab880f74a66c2
SHA512 ed2a4f3ede60ef57336e701f9c7eb5c5cbf07bf7f867276fa90ec8e5f3b82d663d15106daac4d00f0bb4c59f20fee11573e46c7681b63be1fe8c97bddbff3abf
SSDEEP 24576:ZEPVhm6/7IIXdwcXrif7qQncjlP65i3VuYHfJ90Y3vk:eV06DIKdwc+eQnSt65aVNRGYc
TLSH
T155952A05A7EB5D94E8B3CAB3C5619115BA327C139B34AEDF0980C9EB1D32AD0F935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmiApsrv.exe

Path \??\c:\windows\system32\wbem\wmiApsrv.exe
Size 604KB
SHA256 468efdab41b20c2d791d7e4bd66a189751ae1aa895af553736d8399215fe24d0
MD5 2e2cc065f0e47076d992bb970646a638
SHA1 9d82d4b7467a55be8e186360d2f9c6e1b033bdaa
SHA512 19f17087946a674df960c1067e5fc44b302140a1b92106d29553363859e61893a06a2b907da8ae5223b9c07719c39e87802ea6b23f3ac771378f25fa74d3d18d
SSDEEP 12288:jyoKo2vRple9p//ugPHGoymL074mu1lgU+Al:jyoc5ApegPMmLdv+w
TLSH
T18ED4BEDAB3292093D023B23889949A54FB333323FB7116DF15558B3D0E676E96D38672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path \??\c:\windows\system32\wbengine.exe
Size 1.9MB
SHA256 cd3a7df03c0253814e8447f0605f47711833e505ad68c65c364be1a8904b82d5
MD5 4aa2cc090fedd1b811a8d18c5b090a60
SHA1 8721b46c1cee5c651b040dd1b40b00681d8b4722
SHA512 bdebe28586acc7ab7fd8f494cc015c71de935d1a3471a01087f415d7033018831177a00357e612f0861252f50b1a9813d58e96747398d67a70eb526e2e51b65b
SSDEEP 49152:FWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKLIKo755sIycUy:10zuNIxMDy
TLSH
T1D195393DA3A800A9FC66827585471255AA7374EDFF2017D700A0C578AFFADE19A3CB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path \??\c:\windows\syswow64\perfhost.exe
Size 420KB
SHA256 572b822383d5d5c4306c7bffee4b2093e80ad5cf226b1eebe59966adf732cfd0
MD5 521e3e2c1ee249101887dcf9269c298d
SHA1 e24bbb41e6e5adfc5584e6bf2385b2e211dfb448
SHA512 fc93181c6b8a7f421010700a84f32978166f6a597b2645ada2694b3881ee10202eef2be9a8df9721cc8d90018e057a168a279e54477ecd1b00cc622f2823e4a1
SSDEEP 6144:gjUgvGCGehl14vEi9ldJo1L35tdY0mxezTT77y6BBpUyHS5HKj0fyc9W:gjUgvKv/FJWL3r2e/THDxUw/41
TLSH
T120945CB3A3490BC7FE7B7D36566EBB04B33902A1DE549B44698DB8F6087CB90540C8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/440-2-0x00007FF7B3530000-0x00007FF7B38AB000-memory.dmp

Download

memory/2096-265-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-279-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-254-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-253-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-252-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-251-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-250-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-249-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-248-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-247-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-266-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-256-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-267-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-268-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-264-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-263-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-269-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-273-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-275-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-276-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-278-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-277-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-274-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-272-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-271-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-270-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-284-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-283-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-282-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-281-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-280-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-255-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-285-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-294-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-293-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-292-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-291-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-290-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-289-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-288-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-287-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-286-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-258-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-296-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-297-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-298-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-299-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-301-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-300-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-302-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-303-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-304-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-305-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-257-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-259-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-260-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-261-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/2096-262-0x00000270DD9F0000-0x00000270DDA00000-memory.dmp

Download

memory/3304-217-0x000000000AC60000-0x000000000AC68000-memory.dmp

Download

memory/3304-201-0x00000000025F0000-0x0000000002600000-memory.dmp

Download

memory/3304-185-0x0000000002370000-0x0000000002380000-memory.dmp

Download

memory/4076-96-0x0000000000B40000-0x0000000000D24000-memory.dmp

Download

memory/4644-63-0x0000000140000000-0x0000000140139000-memory.dmp

Download