316159847e660d4cbab5d11791c48947ac729963569bcdc08d9e4c8072dcabcb

Analysis

max time kernel
144s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_2ba1e326668bea100d51bdc8b518eee7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Size 1.6MB
Sample260705-b619bagt5x
SHA256 316159847e660d4cbab5d11791c48947ac729963569bcdc08d9e4c8072dcabcb
MD5 2ba1e326668bea100d51bdc8b518eee7
SHA1 361609269684bb2a8c2db9d12f3b6ef7c63e052f
SHA512 8b521c80c531916342c881157b537f34237a6700e17a9bc18a3a11bcee1549cda0725129b06262f32f99e0fc11b877a9651b576eb054f13eaae89302802cc442
SSDEEP 49152:SHs5/EaWEzVHEh2bK2pTETMcdx8T4LXS/UL:SHmI2RUC
TLSH
T1E785BF07B69500FCD06DC1B8CB169532EAB1B8850F31BAEF1290A7292E77AE45F3D715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 9 IoCs

pid	Process
6032	alg.exe
3296	elevation_service.exe
1388	elevation_service.exe
4640	maintenanceservice.exe
1800	OSE.EXE
4644	GameInputSvc.exe
5876	GameInputSvc.exe
4612	msdtc.exe
3580	PerceptionSimulationService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-05_2ba1e326668bea100d51bdc8b518eee7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b3c80f2f4a0960ed.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-05_2ba1e326668bea100d51bdc8b518eee7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114578\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114578\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5876	GameInputSvc.exe
5876	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5784	2026-07-05_2ba1e326668bea100d51bdc8b518eee7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	6032	alg.exe
Token: SeDebugPrivilege	6032	alg.exe
Token: SeTakeOwnershipPrivilege	3296	elevation_service.exe
Token: SeTcbPrivilege	4644	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 5876	4644	GameInputSvc.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-07-05_2ba1e326668bea100d51bdc8b518eee7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_2ba1e326668bea100d51bdc8b518eee7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:5784

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:6032

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3296

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1388

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4640

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1800

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5876

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4612

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3580

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:5256

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:5336

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:3256

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:5024

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:5808

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:4464

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:4448

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:2720

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:2796

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 30c095814d1ea5dfacda3acb0d25fd1363f99832570e704fff24d917e56882bc
MD5 ee6a5e673d75cdc9a696c1ca3699783d
SHA1 3a37c41eebe902bcc022297365dd637978445a10
SHA512 ddb385d990cbd48cdf53ce348fe27942b91e6ad0732866d664c432e1d034b7cf82d2abd16c9a78cbdcc225f8c293c48a8126ed008393252222702efa9e316b90
SSDEEP 49152:Nb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnQx8T4LXS/UL:T3q6gjBNC
TLSH
T10ED59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 73a1f0f64fc2ee818473f546429d29d8bed55828d1739756a90f763913f3e42a
MD5 dd5c6a5db6ca5d9ac049c2a6841f8953
SHA1 bee3d8ef0bf9fd92209b708e144fa807820525b4
SHA512 d8292b1e24babd77c380be892e37e68b4da79e435de4be1eeb4cfac35987bd66b19672c3226ac92e52333a75894a7db88ac30aecd82edfc0068ab8b6737996c0
SSDEEP 24576:7XYLztczAE9+UWPF8T4z1huSmRNJVmIcT+:CtczYx8T4LXS/UL
TLSH
T16005022877D008FAEC67927CCC628915E77378964360E79B03A4D9250F273D86E7EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 1653003578e5548cf30e96682f09f07bb57ce641b4c39528aea5c1edf654257b
MD5 35d37cc2057bf16750f754a6ad86ff8d
SHA1 443e6a93bf5f45b8e15a382d38a085954a140a7e
SHA512 d613c9852994ee72c7d0e43d0e429f4aefb6cdba9bc0937e1f07a583cbda5c661bb655e9fcb0e5ab99cf6ee48bf11bb331995ac403317a5f80b9c62a5ca91dcd
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+CZf2UIttPfN8TrMz5/4ShhufalzE+eNd2uWvVaDCICK:uwuuOW0+UWPF8T4z1huSmRNJVmIcT+
TLSH
T16305F14A77A40CFAE96696388947C53AF7F3BC422621DB1F1360C65B0F27361BD69720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0503c3f5b23cc584eafb5753e3903a5eed9ce4009067be3cc3bfc75b6943e9ac
MD5 ed747ad2d2b8c531e60a10efc027a99d
SHA1 374f104b6a136808d7913d359b96184d512713ea
SHA512 1470ca48dd421a1c93043866978e274360f52b1524155ae25620ebb7c5f62d2892bee3900d289b82312b5cc3f0e6aa1c3aab7937b73ce8a833d71c05554dbed5
SSDEEP 49152:2B+taZ3usBWOBr4tEGp0bqx0z+n217aau1glRx8T4LXS/UL:Eu6JmTxd2dRC
TLSH
T120D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 217418801867ede39ee95ee75795afac56603ae1f0ef28c5cc78e106ff6f62a1
MD5 67ccc44213d3d19160a315035b35b086
SHA1 6abc25bb6b2f63d65a095b7e66a1267c41f0f6f1
SHA512 30d3804c83df5fc06aa57b0fef1676a5fe457ab470f3480e4c269665eb3c8343d7f37789b03a60d1ff50034c8995cd91dfa86aa41e735518593af3226ab5101f
SSDEEP 12288:R37uf2UIttPfN8TrMz5/4ShhufalzE+eNd2uWvVaDCICFcjG04SJD:1u+UWPF8T4z1huSmRNJVmIcT+
TLSH
T1E9D4230EBB9595A3E430BFF45D0E8DBD137B2D9B27118893B011EA49011D7A8FED14AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 3b45a8d9f62b59f6432486ad0476934dfb92297b71c1f7dd2dbdd3414345520a
MD5 582b8bdf5647d89afc2b7154cd0803cf
SHA1 e883295fe81add25d5e14ddfa2f977e586c15774
SHA512 4718017b97524d2df5493b9b5e62bc5038772b5a1a524989bec14184a3985da66e50108b806c4c6ad88bf0093c8c8ddfe3264d092996d9db46997eec15aed38b
SSDEEP 24576:ngb6bmBIi49WNNFpg1rSvFv7bYd+UWPF8T4z1huSmRNJVmIcT+:ngb4mBIBhGFVx8T4LXS/UL
TLSH
T17C65AE1E32E802F5E0F5E2B8DDAA4417D6B278161732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 03ca55a6d13415780e78bc64f76b2b542245c9f1b472498c7d09775ffea5d229
MD5 a8cf791aa399d717ccbfcf12da409248
SHA1 fde26acab09c02c3a2485a1ada269501b2591dc6
SHA512 1eb2acb06bfe0bfcd4503e4372dc5edfc3500f7c1f7891ffdb6487d7629666293333067efaee13cc9b5ac00e009dbc51d6ac671fe5bfcc3e56167ca476111a14
SSDEEP 12288:gnG4f2UIttPfN8TrMz5/4ShhufalzE+eNd2uWvVaDCICFcjG04SJD:CG4+UWPF8T4z1huSmRNJVmIcT+
TLSH
T136E4231D36A160E2C434EBB89C194DEE76B23897132159FF1090E5390B1D7F4BAF9C9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 7ed468399dba7637962cfbac2cf2c33600844fa47b55a8aa8d4ff1457135de0a
MD5 a7d93011bc243db10a04ddf56d2131a7
SHA1 eff224a4c8a12528d9289cf124969ebea1362113
SHA512 b9d356f498074352c5c1c508e69e7f4a7f8234720ecfce5fabc9554f792cb97af80ef7ef812eb4e1edc614c6e8e1c61183cf0ce3fa62053eee0c92e99c38a6d8
SSDEEP 12288:ktf2UIttPfN8TrMz5/4ShhufalzE+eNd2uWvVaDCICFcjG04SJD:kt+UWPF8T4z1huSmRNJVmIcT+
TLSH
T1E2D4234E7B5191E3D530AFF45D0A4DEE13B61D9B232259D3B021E50A020E3E9BEF54AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 ed43a233298f761b0d5000edc97fea70952db4b8493088f97cb337b85e1585bb
MD5 7135167e73b7639d5b692df95f806e90
SHA1 39ddc466417699efd2600fde71dfbf2e6a33d6a5
SHA512 df9c0918b8ac2dd7f1ab07bec94704be2512678394ad00dcae66d272df71ae46065bdeddfbf22faae4d5dc907a473be40e9a52ed66b5e90402b474c9301896ef
SSDEEP 24576:Nc38L8FpJqH1Fzria7/mB+UWPF8T4z1huSmRNJVmIcT+:Cs4FPqV8a7/Rx8T4LXS/UL
TLSH
T10135F16577E101F1D477E13889464AA7F6B2B8160320EFDF06A8CA550F237E45BBEB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 8f59f71fe7f63e2f18e3873597435a3bb8a2a3be110fb8facb3755ca0ab077ff
MD5 da82621c48ce35e092de5dcbe9ba0521
SHA1 f4f3296a830b32be51e38ac68fe16d878dc68170
SHA512 e6456cd8f12ec48620fa8dbea800f17c36e9da1696e6b62c136389ffe7a0387c777d31d1a279a5fc60c673b878b76eb9a557f419e3af89e8a8df331a5c2e13ae
SSDEEP 12288:AHvUrBFrEjwaQlf2UIttPfN8TrMz5/4ShhufalzE+eNd2uWvVaDCICFcjG04SJD:APUr+NQl+UWPF8T4z1huSmRNJVmIcT+
TLSH
T16805F11F36A818E5E676E17C8946871DE77278631312D6CF02A0C17E0F27AE8BD79B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 75ebb872edca53391b029b70b2e6eda27f32d5b5ab494f2c7cf27a90c9dfe5d8
MD5 ff5fad30acbecbbf7d20895b8cc81aa3
SHA1 ba5daa1012a811d08ea375bb27df330d0ab11ef6
SHA512 1de3f8785840a5cdebbfa9ea2f890b56938699121e2f38fdc37abf186bcf5d07ed84482d841960bb93e7b16e7d820f0f6644b3fca98a52c4986c8fbfcd4039fd
SSDEEP 49152:ZBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjXRx8T4LXS/UL:6G05lO43bqC
TLSH
T1E9D5C06E62EC11F5D0BBD17CD9C64A0BEBB23815033556CB02A486A91F27FF4697E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4a365cd0f54c8c0704cb0ff53d4fcf8f584d2934e3712b171109181fdd8a4ca1
MD5 03bdc62710d3aea9c94c2f8f6dd874eb
SHA1 8af2ea613eee028e8efd687c2af6a2e6ccbd2a6c
SHA512 3185260980c354f6f1e2ba38dff7572ecf09ee0f616bdcfffcd951bbe63a6d390d9dc3071bbe3ad0cb4ad6cf8764bb2428a0a469a167af41b005d7f728f5ea78
SSDEEP 24576:1NcwHdjbyQ4nLC18lb/EOjowL7FkJ+UWPF8T4z1huSmRNJVmIcT+:1Nc/zEOVHFhx8T4LXS/UL
TLSH
T1DF858C1623E901E4F5B7E1BE89679946FA71786513308ACF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 7dee144035fa11d5e7ceeaa63faf7cb21017608932cea22fbbe65493772b6b2e
MD5 bcf4323c61b3dca791d9c7800905564e
SHA1 d5af4b86a2a3c33c51aa874c300643ff032364cd
SHA512 5fc30b8330ed61015b79e6b51529527f925597830b46991412444e070433bdf9c7cdb011025310c10c86d25f29d8d09daea7267c4536cb1f2ad217562c4f6711
SSDEEP 24576:OJnJPbzB4SF+UWPF8T4z1huSmRNJVmIcT+:OJnJv6Swx8T4LXS/UL
TLSH
T15115E03DD2A810E5D4B7C2B4811A1B9AFF71386D2B2269C715B4D5343F12FE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 578KB
SHA256 ca37f6247f76360a132b8cdf8205b044a19e7004c6411c42a911c4b285c6f771
MD5 3dae6813bb24e43b0245c6a03d230fe9
SHA1 7e73307359a1ef13e70e8bdc26f4fe6df1dfa831
SHA512 9eddd4a1aae79e67f1d0645333e0302cbc7d48cb823c9c7d2dc6fc4e040106120aefa6e86a06c2f176c1516fc57bfab9f3def218db1b063c4daccb5fc1525712
SSDEEP 12288:UIC0wHGLYRvlWaEU6ohtqzvfm104wKBQwZoe:LCLHGL0MoeVK
TLSH
T134C4E619E3A291D5CDB5C1B4C60AA527EB31BC18533877EF9FC1CEBA5E21AD1A13C601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 5fafc91ad19d36c5302e8a82d3e4dd31bfb3896c0e278cd7c9ee79fc8bda9754
MD5 7a25ee752bb79bdc2d5d7acb13456b94
SHA1 eb26a63c0d8a8301ffad5c9c87607ab4e5b5c19a
SHA512 744473afcf10b16594248b2cbcf789cd237540e93102d44dfc6637b7c4ebacab59ba645ee854585681aa678d13bd95a5b020d34a1dbc98bf7cf01748a0b7030e
SSDEEP 12288:11Hck6j5ZI7wf2UIttPfN8TrMz5/4ShhufalzE+eNd2uWvVaDCICFcjG04SJD:F6DIM+UWPF8T4z1huSmRNJVmIcT+
TLSH
T14005011D337A10F6D037E07D8A830956D2B2B4B283225ADF1694C57E4F67ED8B978D82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 1acfcacacb805be910897a5bf3bbe1c2b0ffc6bd3186664a09fbf578b5a9413f
MD5 a4fbd54be2d3aa4a577a6a309a8b8fcf
SHA1 d7b898e2016d067c67f2ccf6147b2fbc9dc133d2
SHA512 76045b99d6f96e6240b9baef0990047c58f4edad45fd385bfa9071e5fb78ebdfae068928affc138c8232afed92d4f63e8b9a366969f988eafd3922c03d2c80a8
SSDEEP 12288:kG6kyQf2UIttPfN8TrMz5/4ShhufalzE+eNd2uWvVaDCICFcjG04SJD:1tyQ+UWPF8T4z1huSmRNJVmIcT+
TLSH
T108F42309739450E2E5346BB89E2785E88B757C12172246DF6090F63E0F3A7E4BDF0B56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 16d97d1ec5a2a420c499d1d9554ff74c485253c6edb88a37525bd3778bf2c931
MD5 54385389cdfc4bd466bc4ddc6c13b516
SHA1 98f9371ea1b91355f12336aa8fd05fc2d6b3f4d6
SHA512 5f8284a9142200722d38fd214262514df943a2988b1650dedbfe6761abcfde16a6ce6e0fb9da179671e2614faabe756cc03ccd3ad21eb1a9d73887a0bafe711d
SSDEEP 12288:Ltif2UIttPfN8TrMz5/4ShhufalzE+eNd2uWvVaDCICFcjG04SJD:xi+UWPF8T4z1huSmRNJVmIcT+
TLSH
T1E6D4234D775161F3D820FFF45D094EED53B629AB232258E77060E929060E3E4BEF189A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 fc8a0917b8d83a2eb25408ca8726c5a6e574cfebc93fc12fefaff3ca3dc553ec
MD5 e3a746930949c44a85fedb9da0c72179
SHA1 20aea70e4887cd342acb0cdce76e4d7a53ce3e5b
SHA512 e3c5731d6f097884f23b49f20056c5ee07ba2d55ebbb8386c4b6320784e5faa740b4f6959e9e1191529d8e1cfb568cdfc61fa6b5433788b41bd706b404caf59d
SSDEEP 24576:a1g8LoTfaidZI+UWPF8T4z1huSmRNJVmIcT+:mgLTrZ9x8T4LXS/UL
TLSH
T1A2559D1D77EA05DAE2B2D679D8221493D633B4311772C6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1388-35-0x0000028B3CF50000-0x0000028B3CFB6000-memory.dmp

Download

memory/1388-36-0x0000028B3CF50000-0x0000028B3CFB6000-memory.dmp

Download

memory/1388-34-0x0000028B3CD60000-0x0000028B3CE2F000-memory.dmp

Download

memory/1388-37-0x0000028B3CF50000-0x0000028B3CFB6000-memory.dmp

Download

memory/1800-56-0x0000020F6A330000-0x0000020F6A396000-memory.dmp

Download

memory/1800-57-0x0000020F6A330000-0x0000020F6A396000-memory.dmp

Download

memory/1800-55-0x0000020F6A0D0000-0x0000020F6A19F000-memory.dmp

Download

memory/2720-345-0x00007FF63DBC0000-0x00007FF63DEE1000-memory.dmp

Download

memory/2720-338-0x00000281B3E80000-0x00000281B3EE6000-memory.dmp

Download

memory/2720-343-0x00000281B3E80000-0x00000281B3EE6000-memory.dmp

Download

memory/2720-339-0x00000281B3E80000-0x00000281B3EE6000-memory.dmp

Download

memory/2720-337-0x00007FF63DBC0000-0x00007FF63DEE1000-memory.dmp

Download

memory/2796-350-0x00000292232C0000-0x0000029223326000-memory.dmp

Download

memory/2796-351-0x00000292232C0000-0x0000029223326000-memory.dmp

Download

memory/2796-349-0x00007FF7CB7D0000-0x00007FF7CBA5B000-memory.dmp

Download

memory/3256-290-0x00007FF77E4A0000-0x00007FF77E54E000-memory.dmp

Download

memory/3256-292-0x0000017FF4590000-0x0000017FF45F6000-memory.dmp

Download

memory/3256-291-0x0000017FF4590000-0x0000017FF45F6000-memory.dmp

Download

memory/3296-26-0x000001DA58F40000-0x000001DA58FA6000-memory.dmp

Download

memory/3296-28-0x000001DA58F40000-0x000001DA58FA6000-memory.dmp

Download

memory/3296-25-0x000001DA58DA0000-0x000001DA58E6F000-memory.dmp

Download

memory/3296-27-0x000001DA58F40000-0x000001DA58FA6000-memory.dmp

Download

memory/3580-348-0x00007FF6A92E0000-0x00007FF6A942A000-memory.dmp

Download

memory/3580-264-0x00000231F53C0000-0x00000231F5426000-memory.dmp

Download

memory/3580-263-0x00000231F53C0000-0x00000231F5426000-memory.dmp

Download

memory/3580-261-0x00007FF6A92E0000-0x00007FF6A942A000-memory.dmp

Download

memory/4448-328-0x00007FF66DFE0000-0x00007FF66E175000-memory.dmp

Download

memory/4448-329-0x00000202268D0000-0x0000020226936000-memory.dmp

Download

memory/4448-330-0x00000202268D0000-0x0000020226936000-memory.dmp

Download

memory/4464-319-0x0000028507780000-0x00000285077E6000-memory.dmp

Download

memory/4464-320-0x00007FF62B240000-0x00007FF62B4E3000-memory.dmp

Download

memory/4464-321-0x0000028507780000-0x00000285077E6000-memory.dmp

Download

memory/4612-251-0x0000018EAA840000-0x0000018EAA8A6000-memory.dmp

Download

memory/4612-336-0x00007FF78A580000-0x00007FF78A69A000-memory.dmp

Download

memory/4612-247-0x0000018EAA840000-0x0000018EAA8A6000-memory.dmp

Download

memory/4612-244-0x00007FF78A580000-0x00007FF78A69A000-memory.dmp

Download

memory/4640-44-0x0000027DC2000000-0x0000027DC2066000-memory.dmp

Download

memory/4640-43-0x00007FF646E60000-0x00007FF646FC8000-memory.dmp

Download

memory/4640-45-0x0000027DC2000000-0x0000027DC2066000-memory.dmp

Download

memory/4640-50-0x0000027DC2000000-0x0000027DC2066000-memory.dmp

Download

memory/4640-52-0x00007FF646E60000-0x00007FF646FC8000-memory.dmp

Download

memory/4644-318-0x00007FF6E89C0000-0x00007FF6E8A89000-memory.dmp

Download

memory/4644-234-0x000001DEF7180000-0x000001DEF71E6000-memory.dmp

Download

memory/4644-233-0x000001DEF7180000-0x000001DEF71E6000-memory.dmp

Download

memory/4644-232-0x00007FF6E89C0000-0x00007FF6E8A89000-memory.dmp

Download

memory/5024-300-0x000001037B620000-0x000001037B686000-memory.dmp

Download

memory/5024-304-0x00007FF775EB0000-0x00007FF7762C7000-memory.dmp

Download

memory/5024-299-0x000001037B620000-0x000001037B686000-memory.dmp

Download

memory/5256-270-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5256-276-0x00000000009C0000-0x0000000000A29000-memory.dmp

Download

memory/5256-271-0x00000000009C0000-0x0000000000A29000-memory.dmp

Download

memory/5256-355-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5336-282-0x00007FF7B6E30000-0x00007FF7B7574000-memory.dmp

Download

memory/5336-284-0x0000022C7F890000-0x0000022C7F8F6000-memory.dmp

Download

memory/5336-283-0x0000022C7F890000-0x0000022C7F8F6000-memory.dmp

Download

memory/5356-358-0x0000025007170000-0x00000250071D6000-memory.dmp

Download

memory/5356-359-0x0000025007170000-0x00000250071D6000-memory.dmp

Download

memory/5784-3-0x000001FA56430000-0x000001FA56496000-memory.dmp

Download

memory/5784-1-0x000001FA56430000-0x000001FA56496000-memory.dmp

Download

memory/5784-0-0x00007FF75AA80000-0x00007FF75AE64000-memory.dmp

Download

memory/5784-22-0x00007FF75AA80000-0x00007FF75AE64000-memory.dmp

Download

memory/5784-19-0x000001FA56430000-0x000001FA56496000-memory.dmp

Download

memory/5784-2-0x000001FA56430000-0x000001FA56496000-memory.dmp

Download

memory/5808-310-0x0000011B82280000-0x0000011B822E6000-memory.dmp

Download

memory/5808-311-0x0000011B82280000-0x0000011B822E6000-memory.dmp

Download

memory/5808-309-0x00007FF771530000-0x00007FF7715E4000-memory.dmp

Download

memory/5876-246-0x0000017E882D0000-0x0000017E88336000-memory.dmp

Download

memory/5876-327-0x00007FF6E89C0000-0x00007FF6E8A89000-memory.dmp

Download

memory/5876-245-0x0000017E882D0000-0x0000017E88336000-memory.dmp

Download

memory/5876-241-0x00007FF6E89C0000-0x00007FF6E8A89000-memory.dmp

Download

memory/6032-12-0x000001788E8C0000-0x000001788E926000-memory.dmp

Download

memory/6032-11-0x00007FF76C990000-0x00007FF76CAB3000-memory.dmp

Download

memory/6032-13-0x000001788E8C0000-0x000001788E926000-memory.dmp

Download

memory/6032-14-0x000001788E8C0000-0x000001788E926000-memory.dmp

Download

memory/6032-63-0x00007FF76C990000-0x00007FF76CAB3000-memory.dmp

Download