56a23bf157f546c7723a19ea95378a239e4573a0c64263fb4b194d0f9d21e262

Analysis

max time kernel
144s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 04:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_e05e6e23768ab267e31f349b559390f0_cobalt-strike_icedid_njrat_vidar.exe
Size 840KB
Sample260708-epp2habs4j
SHA256 56a23bf157f546c7723a19ea95378a239e4573a0c64263fb4b194d0f9d21e262
MD5 e05e6e23768ab267e31f349b559390f0
SHA1 f98bd30073469f6b149f0232ddbc0919f80e986e
SHA512 d234feebabcb7dc8b3a4bbf742188efb883e92450ec3b0aa52520ce7410fe0a29e5441530106bdb8de4f4be40e0967cd9161f8bc3636fa705b2429653c3b3759
SSDEEP 12288:05n43npArWpCXsbpK0Os2yUuAlioNMRSn++qL+EaAm+jjGJyU1CxhlVoyB3uq:0546UCX0pKjTJqoNn+jL+aUJDY1Og+
TLSH
T1DE05F11A77A45CF9E967C17D89928606E6717C090B31C7CF03A1427F2F236E1AE39B61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
2076	alg.exe
5088	elevation_service.exe
1156	elevation_service.exe
1892	maintenanceservice.exe
1232	OSE.EXE
1196	GameInputSvc.exe
3464	GameInputSvc.exe
5144	msdtc.exe
2968	PerceptionSimulationService.exe
5344	perfhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-07-08_e05e6e23768ab267e31f349b559390f0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-08_e05e6e23768ab267e31f349b559390f0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\322d357a14575bfe.bin	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118750\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118750\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3464	GameInputSvc.exe
3464	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4084	2026-07-08_e05e6e23768ab267e31f349b559390f0_cobalt-strike_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	2076	alg.exe
Token: SeDebugPrivilege	2076	alg.exe
Token: SeTakeOwnershipPrivilege	5088	elevation_service.exe
Token: SeTcbPrivilege	1196	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 3464	1196	GameInputSvc.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-07-08_e05e6e23768ab267e31f349b559390f0_cobalt-strike_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_e05e6e23768ab267e31f349b559390f0_cobalt-strike_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4084

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2076

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1156

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1892

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1232

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3464

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5144

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2968

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5344

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:3772

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:5852

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:3184

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:1892

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:4552

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:4964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9d6013aa584b13abfc8470dbba997ca4aebfbcad1fa2ad6d3eb32ce16f5b0064
MD5 d3d460d1fff7e9ae3da36df834ef15cf
SHA1 d65a00dcbbcaf643a22b1653b36d990ca031ec64
SHA512 5fef3cf680b2f9c1b566e4790c1d38eb4ae99ea43853bc53aa6c0ccce0696aa3f0135b6b9e85ddd278ac5aa9e10610e211ae6a3baa0478ae715d3893d5b52653
SSDEEP 49152:Rb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnzps84asD4+:X3q6gjBwIar
TLSH
T1A5D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 d78def0b9619eb18c7f33a9988f7c1d205aea505ed62612029a96e929b37db38
MD5 c0200fb64dd34a4f6c729215f0b65406
SHA1 25e6e30f3ba72b8c82b877820531f19ff932cf8d
SHA512 eabdccbcf77ae69b93ccece8756986d51f1bcfd9e34658b60efe5390c316d676d984d21275d15f1a8c6b195f0f0b629c501406612bfa265510c87ed787c9186c
SSDEEP 24576:kXY2KOczAc0pKjTJqoNn+jL+aUJDY1Og+:FOcqps84asD4+
TLSH
T1F405F22877E109F9EC67817DC8A28902EA727C554B60E78F03E096791F237D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 84fe905b527cac9e58e4b39b8c2be2d43fea5d01fead77afcac48f38feab6d57
MD5 85b7ac80d2a668b1975e00e056e56be8
SHA1 c80025a0df91c3306462ec96ed3238ceb88e7ecb
SHA512 508c3c76443db7fc209d58cb3d32d4929eda06a195b200517bcb4362097daf41f15da21ac800c12266708d86056f412e6d97b4ab2d4ed391577322b39eb8ae28
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+C1TsbpK0Os2yUuAlioNMRSn++qL+EaAm+jjGJyU1Cxx:uwuuOWAT0pKjTJqoNn+jL+aUJDY1Og+
TLSH
T14305F14576A51CF9E9A685398593C536FBF2BC162E21C70F0360C76F2F27261BD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b5e6659a3856b33c13548e242012286e2f1d7e83e8f99959183ad155a0be93a0
MD5 a123c7167d137e8dbc2286dd3aa930d1
SHA1 68749c729759f22cfc7db6aac53679274b4f9981
SHA512 be7fe453e95c08043cd022ee7548757437fcfca9f44b360cc89ce08b85db8538500b8bd4e40ade49d6becd60cddfbb9ab3ada3085fa9a145c481c61626dc4224
SSDEEP 49152:rB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glPrps84asD4+:9u6JmTxd2dFIar
TLSH
T1C0D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 1b069e1173abafcdf48cb361d9701c7cec33251bfaf66b3f21a9caa2a274f4e6
MD5 6e38d490cf3db44901dacf0144c9c780
SHA1 ff1161fea6c41d0295a3e33e22ddd58f397bd340
SHA512 2bd3f55f99d130902bcd739acd3c7513d40ce14f26c715cd2e62de39182bab27a285a924345a305d274b17ab27d97b882da95c5c475a9b157fd0367474a82e3d
SSDEEP 12288:Rt7CsbpK0Os2yUuAlioNMRSn++qL+EaAm+jjGJyU1CxhlVoyB3uq:XC0pKjTJqoNn+jL+aUJDY1Og+
TLSH
T169D42360A6717EC6F8B4197814F38F01A964BF3E9F5283CF211293AD31A49D9BD5132A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 8b3c9f467e3d5e2ab854e1a700b7b3049ce62b344e6834a856e3707389b2401e
MD5 3f77b0e05ca65c2cbeee09546ebebab6
SHA1 ad93395bf7d5beca3e20a156c98ebf07c7e3cc40
SHA512 9af0328e06b775da1fc8f60cb429f547cf2d50dfcf38e91d8b0adcd0152f0ccd7f621e8e95d513438aa12efe10f100d96dd87795b0f2d05f4df73d09865c4959
SSDEEP 12288:X+GzsbpK0Os2yUuAlioNMRSn++qL+EaAm+jjGJyU1CxhlVoyB3uq:OGz0pKjTJqoNn+jL+aUJDY1Og+
TLSH
T1A8E4237871B239C9C875863954F28E43B8B03A399F2153DF04E1D37D27689E4B939E68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 3ea3b6b8a4f89a8af1eb053eec5098b72b1db9f417dda17c05d4cbbbda31fc67
MD5 e1d87d8c6b58a9b2de296ed0110aaac8
SHA1 b2aff93720ecbed9391539c4af888e609604e954
SHA512 911546ef3b27391ef92dc3b75d03311603c440f7b42f08e638380031aa26fd75c1b31000dcf032c5dde514358dbcab89a7cbdcc9bebae67ea226d4c42817a983
SSDEEP 12288:9D/sbpK0Os2yUuAlioNMRSn++qL+EaAm+jjGJyU1CxhlVoyB3uq:9b0pKjTJqoNn+jL+aUJDY1Og+
TLSH
T111D42360A1317EC6E890597D54E38F02AD90BF3E9F6243CB1062937D31989EDBD72279
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 3cbd971637f9891d1aa9c828e91b6ff71531e8746bc0023010fc0035a2a2dad2
MD5 640c8e6bbab5da99421df3b62b5ff67d
SHA1 1e85656f4df1d772024b810f1420d7d9a7285011
SHA512 fd682a45f8f186b867f825383f2b4eab4c19c48b452f719761a80f1736b2cbc3e63faf3811e89b0682be77ce42e82888c2f999d4775442b8ba9ae356d18a6be6
SSDEEP 24576:76l8u8FpJqH1Qtrda7/mA0pKjTJqoNn+jL+aUJDY1Og+:uaZFPqVua7/Mps84asD4+
TLSH
T1D0350165B7E102F1D477D13889824A63F6B1B8250760EBCF07A88B551F23AE54B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 5ea34f8d892dfc7b8b0030275a73febc2b8a48d8245d5fc5d8a1f3d0cd992e61
MD5 25a1184851bfaa807f78072ad1ce2e37
SHA1 3a8bc791dda65d3ad68cec62db62c7c52aaefd71
SHA512 86b23762620e2457735e665b74bb22735e18713f54415d683d94bd848751be96843bff88a4ed00867d93e7932e8c4b23360e58077fdda07fd8251d9e243373ad
SSDEEP 12288:SHvUrBFrEjwaQUsbpK0Os2yUuAlioNMRSn++qL+EaAm+jjGJyU1CxhlVoyB3uq:SPUr+NQU0pKjTJqoNn+jL+aUJDY1Og+
TLSH
T1FB05F22E62A91CE5E576E17D85824709F77178660712D3CF02E1817E1F67ED8BC39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 e16510920b09f23fa38f2a01fcb48431616f76b9f82f9eba36126fc273de1ab9
MD5 e3effb9512985676bebddbf306e3ccdf
SHA1 b6ac3fa573558472966e8598381122d590888441
SHA512 fd62a98a639c5b4a4c160e6a5245166c39a269ded566b214fc26812b36d1305e5404e12b980506736a69bf0d77c65597cf95c36f695f7cb06b819fc5f643a01d
SSDEEP 49152:iBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjXps84asD4+:tG05lO43bSIar
TLSH
T1CCD5CF6A62EC11F9D0BBD17CD9C64A0BEBB23815033556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 180c20be9ac3b48b8ac2db85ef481e43adc0a833c42f12516ce372cffb02d7be
MD5 b3bd9bfb8749f767afd20aae3393796b
SHA1 a03b4fdfa55fc96e1786f6f7d7c75ef49cad5180
SHA512 2473ba721b6232ff9cb2b72d29dcc406b88ea3ddb663c2b0ae5719bc4cded4b21390a21805e44644f0c8084e61c3363d513382556db8a7213e89d4a5c4760233
SSDEEP 24576:ENcwHdjbyQ4nLC18lb/EOjowL7Fkh0pKjTJqoNn+jL+aUJDY1Og+:ENc/zEOVHFNps84asD4+
TLSH
T1FA858C2622E901E4F5BBE1BE89779946FA717869173086CF0291811F1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 773KB
SHA256 4cc3e3f8af925c6370ad9a2e329a5964bc889e0ab3e9bc325356c6efd35bf861
MD5 6f915bf6c11301a40cbf00f285c9b1fc
SHA1 b922b1757ab8816550ac0affa10cad98c8af753f
SHA512 269d80251bda389772e725fa2908db4eb213d7c4a411764f9f5c07b82485e13f3cf048e0dc375568ec71d76449724bae918e8169b4fada8af7c2a5d5176a26bc
SSDEEP 12288:I6HPJnJP6szeCs6Rl28dZsbpK0Os2yUuAlioNMRSn++qL+EaAm+jjj:VJnJPbzB4SZ0pKjTJqoNn+jL+aZ
TLSH
T11FF4C03DD2A810E9E4B7C2B481561B5AFE31383D2F2269C719B4D5353F12EE0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 8139a63c3db71dc6e03a7cf08c84d402dec8b17c2d5fb0eb4d2995d975ffaaef
MD5 4ca4adfadf8029dbecb4acff75e0e030
SHA1 99c70d5a7ee2f66c322650b521d887789dd67786
SHA512 84596f48d59221b60ffceac0d7e6a51ada47de666f1096141c3d148798951a96558d7c2515acacb7e55c5f0488c09a3a85a873810d819735859914a252c69ecf
SSDEEP 12288:m1Hck6j5ZI7zFsbpK0Os2yUuAlioNMRSn++qL+EaAm+jjGJyU1CxhlVoyB3uq:K6DIN0pKjTJqoNn+jL+aUJDY1Og+
TLSH
T1A005016C737620FAD067D03E85D30A02E6B1B5758B2256CF0690C6BD1FA3EDCB939A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 644320d816aabd754de8392a43cec65cdaa18114c520f5b2c7b46ca5d5c874b6
MD5 d42d7497747f6ef191bdda42f0728aab
SHA1 c41db09a0fa9976f48649d0f675ba5432ed51c78
SHA512 5131a85bcb53a9c69b9f6e22bf9742d2a895f248203abc9b7619767915832b5bfedd11091994f12ef615ad18aefd75a6573ca1f58a3e290aa82a998f2a90c4b5
SSDEEP 12288:wG6kybsbpK0Os2yUuAlioNMRSn++qL+EaAm+jjGJyU1CxhlVoyB3uq:htyb0pKjTJqoNn+jL+aUJDY1Og+
TLSH
T12DF41210A3B075C5E9B5053899B386919E70BD25AF2283CF11A1E73E2F75BD8BC31B25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 43acfc4a070753a15c21b7131c195967e9da0693950fbd6ea5d48cf795beb864
MD5 d46507ab8566e416a3b1d4ca504a3dde
SHA1 e0795e3df16aa50b0a20ff302737bb463aee4810
SHA512 954bad06178fff9cecd3bd5fa5f450843a3e45b6bcc2943a8c56990185d5fb197512cf29a505eaa0f752f0f637c2ebfe5888cfb8bf3ce8110b872a94153b56b9
SSDEEP 12288:JBMsbpK0Os2yUuAlioNMRSn++qL+EaAm+jjGJyU1CxhlVoyB3uq:jM0pKjTJqoNn+jL+aUJDY1Og+
TLSH
T125D42378A2313AC6E850597D14E24F42A9B07E3E5F6343CF10E2D37D22A89D9BD71A64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1156-36-0x000002115CAF0000-0x000002115CB56000-memory.dmp

Download

memory/1156-35-0x000002115CAF0000-0x000002115CB56000-memory.dmp

Download

memory/1156-37-0x000002115CAF0000-0x000002115CB56000-memory.dmp

Download

memory/1156-34-0x000002115C8D0000-0x000002115C9C3000-memory.dmp

Download

memory/1196-233-0x00000245546F0000-0x0000024554756000-memory.dmp

Download

memory/1196-309-0x00007FF7765F0000-0x00007FF7766B9000-memory.dmp

Download

memory/1196-232-0x00007FF7765F0000-0x00007FF7766B9000-memory.dmp

Download

memory/1196-234-0x00000245546F0000-0x0000024554756000-memory.dmp

Download

memory/1232-57-0x00000216E2EF0000-0x00000216E2F56000-memory.dmp

Download

memory/1232-56-0x00000216E2EF0000-0x00000216E2F56000-memory.dmp

Download

memory/1232-55-0x00000216E2DA0000-0x00000216E2E93000-memory.dmp

Download

memory/1892-310-0x00007FF7C29C0000-0x00007FF7C2A74000-memory.dmp

Download

memory/1892-312-0x0000014B0D3A0000-0x0000014B0D406000-memory.dmp

Download

memory/1892-50-0x00000171B1790000-0x00000171B17F6000-memory.dmp

Download

memory/1892-45-0x00000171B1790000-0x00000171B17F6000-memory.dmp

Download

memory/1892-52-0x00007FF7D6390000-0x00007FF7D64F8000-memory.dmp

Download

memory/1892-44-0x00000171B1790000-0x00000171B17F6000-memory.dmp

Download

memory/1892-43-0x00007FF7D6390000-0x00007FF7D64F8000-memory.dmp

Download

memory/1892-311-0x0000014B0D3A0000-0x0000014B0D406000-memory.dmp

Download

memory/2076-13-0x0000028060550000-0x00000280605B6000-memory.dmp

Download

memory/2076-61-0x00007FF6F8130000-0x00007FF6F8253000-memory.dmp

Download

memory/2076-14-0x0000028060550000-0x00000280605B6000-memory.dmp

Download

memory/2076-12-0x0000028060550000-0x00000280605B6000-memory.dmp

Download

memory/2076-11-0x00007FF6F8130000-0x00007FF6F8253000-memory.dmp

Download

memory/2968-264-0x0000020FB6880000-0x0000020FB68E6000-memory.dmp

Download

memory/2968-261-0x00007FF753760000-0x00007FF7538AA000-memory.dmp

Download

memory/2968-263-0x0000020FB6880000-0x0000020FB68E6000-memory.dmp

Download

memory/3184-300-0x00000277A20A0000-0x00000277A2106000-memory.dmp

Download

memory/3184-299-0x00007FF647450000-0x00007FF647867000-memory.dmp

Download

memory/3184-301-0x00000277A20A0000-0x00000277A2106000-memory.dmp

Download

memory/3464-241-0x00007FF7765F0000-0x00007FF7766B9000-memory.dmp

Download

memory/3464-318-0x00007FF7765F0000-0x00007FF7766B9000-memory.dmp

Download

memory/3464-248-0x000001EAFFCF0000-0x000001EAFFD56000-memory.dmp

Download

memory/3464-246-0x000001EAFFCF0000-0x000001EAFFD56000-memory.dmp

Download

memory/3772-282-0x0000012FA4E90000-0x0000012FA4EF6000-memory.dmp

Download

memory/3772-294-0x00007FF7B1110000-0x00007FF7B1854000-memory.dmp

Download

memory/3772-283-0x0000012FA4E90000-0x0000012FA4EF6000-memory.dmp

Download

memory/4084-0-0x00007FF7BFCC0000-0x00007FF7BFE1F000-memory.dmp

Download

memory/4084-22-0x00007FF7BFCC0000-0x00007FF7BFE1F000-memory.dmp

Download

memory/4084-1-0x00000205E9C20000-0x00000205E9C86000-memory.dmp

Download

memory/4084-3-0x00000205E9C20000-0x00000205E9C86000-memory.dmp

Download

memory/4084-19-0x00000205E9C20000-0x00000205E9C86000-memory.dmp

Download

memory/4552-322-0x000001D76BB30000-0x000001D76BB96000-memory.dmp

Download

memory/4552-321-0x000001D76BB30000-0x000001D76BB96000-memory.dmp

Download

memory/4552-319-0x00007FF68A0A0000-0x00007FF68A343000-memory.dmp

Download

memory/4964-329-0x00007FF6FD8E0000-0x00007FF6FDA75000-memory.dmp

Download

memory/5088-28-0x00000132D3B20000-0x00000132D3B86000-memory.dmp

Download

memory/5088-25-0x00000132D3950000-0x00000132D3A43000-memory.dmp

Download

memory/5088-27-0x00000132D3B20000-0x00000132D3B86000-memory.dmp

Download

memory/5088-26-0x00000132D3B20000-0x00000132D3B86000-memory.dmp

Download

memory/5144-247-0x000001DE54360000-0x000001DE543C6000-memory.dmp

Download

memory/5144-245-0x000001DE54360000-0x000001DE543C6000-memory.dmp

Download

memory/5144-244-0x00007FF709410000-0x00007FF70952A000-memory.dmp

Download

memory/5144-328-0x00007FF709410000-0x00007FF70952A000-memory.dmp

Download

memory/5344-270-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5344-276-0x0000000000950000-0x00000000009B9000-memory.dmp

Download

memory/5344-271-0x0000000000950000-0x00000000009B9000-memory.dmp

Download

memory/5852-295-0x00007FF68ADB0000-0x00007FF68AE5E000-memory.dmp

Download

memory/5852-290-0x000001ADC88E0000-0x000001ADC8946000-memory.dmp

Download

memory/5852-289-0x000001ADC88E0000-0x000001ADC8946000-memory.dmp

Download