aee96f093a3a9fdb2566d74620291bfe2d18ff67de8cd8f8465cbe62601d6882

Analysis

max time kernel
144s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 14:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_1209ae22f182e9d049eb6b589f514e53_cobalt-strike_icedid_njrat_vidar.exe
Size 840KB
Sample260712-rlpyjsdv6s
SHA256 aee96f093a3a9fdb2566d74620291bfe2d18ff67de8cd8f8465cbe62601d6882
MD5 1209ae22f182e9d049eb6b589f514e53
SHA1 fb67e6ee1dcdfd98abfa7d66e5309eb800860608
SHA512 8ff9a72e8371a1b7a89098989f7a9d5e62d23f271eae65504b9e9575c93e30bc3a6cb2028b6c1357d347540f622e222ee515231244b02d3c2a7943c9aac732f5
SSDEEP 12288:ZhIy3npArW8wSZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTE:Zh76BwLW5hXSHg/ehHeRqh9zS
TLSH
T16105F14573E88CF9E523C17D89928606E77178450B35DBDF03A4427B6F236E2AE39B60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
2388	alg.exe
1796	elevation_service.exe
4880	elevation_service.exe
4180	maintenanceservice.exe
5728	OSE.EXE
764	GameInputSvc.exe
4788	GameInputSvc.exe
5880	msdtc.exe
2796	PerceptionSimulationService.exe
4664	perfhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-12_1209ae22f182e9d049eb6b589f514e53_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\af284e87238bf42.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-12_1209ae22f182e9d049eb6b589f514e53_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4788	GameInputSvc.exe
4788	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4844	2026-07-12_1209ae22f182e9d049eb6b589f514e53_cobalt-strike_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	2388	alg.exe
Token: SeDebugPrivilege	2388	alg.exe
Token: SeTakeOwnershipPrivilege	1796	elevation_service.exe
Token: SeTcbPrivilege	764	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 4788	764	GameInputSvc.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-07-12_1209ae22f182e9d049eb6b589f514e53_cobalt-strike_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_1209ae22f182e9d049eb6b589f514e53_cobalt-strike_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4844

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2388

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1796

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4880

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4180

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5728

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4788

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5880

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2796

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4664

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:4280

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:1400

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:4640

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:3196

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:2644

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:4312

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:4840

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:4564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b505df43ef02ea31694cb72cc9d9aab04c9e5b6b349d3336dbaf38d6dd6a9d25
MD5 35efb79d52b3ca9b167179320429bb0d
SHA1 2994eacfdf17b5a67be8d269e6d1e72a43c1ce5a
SHA512 f4cadd98a20cae930e7ddf6d2d4f72e3888e65acef8855f92d288a5b3b891784a01b11fb2d1e9ff7fe28e1899a17f46bb68d8eb67e3da198a509d065c2e42eb6
SSDEEP 49152:0we632BuPkFKRrdE6oh7stBhuXjfS4LWxnU3F/el4q:53q6gjBS5
TLSH
T13DD59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 7195b129cb6f81ca31def7eba981888f68a8f2305b964c73cf38bea454453691
MD5 1c165fb8e5d2eb331df47669ff6bcc0c
SHA1 9349b14202c5beec8862dbc9f33798fa36c22b15
SHA512 9d346919978dc6365454502276d8b6a7095a90373b97f0f8c3ffa04d02ddb5f91d8e44267d6a50e148e5e5faa9dab25045c0b81acd6db274d499d1a575767934
SSDEEP 12288:T1XLsRre0x8VP5m2czA6Ze0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNln8:JXY9XcczAzW5hXSHg/ehHeRqh9zS
TLSH
T16005022463D448F9ED67927DCDB28901E672785147A4EB8F03F499260F332C96E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 830KB
SHA256 a3455503467fab70a449b06a4b51a5b25fc2ecdf3420233933086bac092d5cdb
MD5 32581223ccd90da96da5acba2d79ec12
SHA1 3d748247a8beb44e269d56526ce0ff06444c0798
SHA512 b06cbc7ed08ee50879ca1e13c1ecc2fb9493b20ab76e6ffc65ee77e2dce331043d056deeb55dd4e3f6c68fa451e2b88e5d4b6c0edb53879b28bf493d3a79bb7f
SSDEEP 12288:Vmw5HEjsChNXBFgl0WDm+CLZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODI:QwuuOWpW5hXSHg/ehHeRqh9zS
TLSH
T1BB05F18573A44CF9E56296398697C536F7F2B8022A25DB1F0370C65B5F33252BE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 708fbf3810ac7a3e008f3cd5514a4d95461b12846899522c1237adabe629d457
MD5 05f53f21d71c2f88c27dc912926f8408
SHA1 6c5409c6c76732b989f0860d0973f87e167c84f0
SHA512 43ecdcb0bbcd1e5d80a30214fceb1848b0a5d621760dce058252376e720a5e121d1d9c4be53e7ffb9cfda0704419d4ab9817801159bdc3d821c561b3636280e8
SSDEEP 49152:kr+taZ3usBWOBr4tEGp0bqx0z+n217aau1glZ3F/el4q:Mu6JmTxd2dq5
TLSH
T148D59D13F1DA01E8D06AD478974A9233FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 5998e1111f20ca5d3901fbdd9e7ce5d5a6c36fcf702866896e26325a798c6f7d
MD5 fd3fa102fdaeb6047ef4b68c2a5a93bc
SHA1 a80b6537721ce8aad5d0b65694423f3c4fa1f7de
SHA512 45d09a6db316f271d0ec37faee650dbf7b1a6740ebe35227f20984afea773729a3450a7117fdb83f94ad2a6c42b8716ef83836317086ca6a3dd13980ca685568
SSDEEP 12288:Rg7mZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:6fW5hXSHg/ehHeRqh9zS
TLSH
T10FD423C08398CC16F270BEF14AAB8F14B11C74512FAEA9CF532DA45A0AB35C7BE5556C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8452fa99044a88fad61263d51e9a5556cd8054a428df29e16dbcb880f5a8191f
MD5 ed5cb48384598b16825fca571293302b
SHA1 c42ab47fe69b01c10f05eac3e3efb314e5a8d7c6
SHA512 b52a5d291fbed67fb341eeb557352d161c82172f1ab5b47a1e87f60a602d3e9ca0f1975b1581a436df3725c36f256a350512bca0f2f3b33f9c60e8b403d6bfb0
SSDEEP 24576:ygb6bmBIi49WNNFpg1rSvFv7bY1W5hXSHg/ehHeRqh9zS:ygb4mBIBhGFp3F/el4q
TLSH
T13365AE1E22EC02F5E1F5E2B8CDAA4417D6B278161732D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 d274543cd64a92e59c04f2204b4805a97330258011ac9c2c275143c9b75eabab
MD5 671eada43e0c087a98701c3a32dcb5d2
SHA1 5cc6a3a91e935a6ed543a5adec2e75fd40e174e4
SHA512 61de73d8cf9cadbdfd333e61ea8eaab6f45640dddc40d98a2a5f07a92db996dc0cdfc649fde22dae62e8ae4255a2432c1e1e7aa15ef460a117860ac2d8418482
SSDEEP 12288:XBGBZZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:xGByW5hXSHg/ehHeRqh9zS
TLSH
T18DE4239462F5D858D130FBB58AB38E56B47430502F6929EF02E9E43A8F725C3B739C58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 cc222b71b712596e61b9823f99e0f4640247576a42d4849938b6a338b69ec32f
MD5 4b72f0d8a0e144a1f08a611c57ce6f9f
SHA1 17dacce2790e7034496746e0036cb278487383ad
SHA512 ffcc297873daaabcde769de680b36b2cbb8184dc3e96ca1cae5c0eb03a2c39db53853cdbe9c60217c430655ac483a45c2b8c661cc481d1498b8e20fda62eef3e
SSDEEP 12288:TYZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:ThW5hXSHg/ehHeRqh9zS
TLSH
T1C2D423C08395CC16E250BEF64BB34F45B54870013FAE2ACF136EA41A0BB75C7BA754A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 fff951905e2b25a238b058e5a2143e6456e10bbbeaf6677821281138f68bd886
MD5 bd6968d671e779cefd668f2f52fd3190
SHA1 9462f5107878ff44a942e28e3129c52f906f1431
SHA512 fa1d79496e9724474598253e74996933f2f6e85db0f5be4a0e7ad30a08f1a521ef13eff77d1b779a566a3b91bc8e5f505e9e25ac1b5e50742cad3908fceebe61
SSDEEP 24576:dOK8E8FpJqH1wQria7/mfW5hXSHg/ehHeRqh9zS:Q5LFPqVoa7/L3F/el4q
TLSH
T11D35F16167E101F1D077E1388A824A63F6B1B4251364FFDF07AC8A561F23AD65B7EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 035341e16ec8203f9bef5797430c9fc24d299511b964940640fd4b8f42d8e75e
MD5 9a97e76d00c2990d5272decda3a2d591
SHA1 420d16410b698791941a92078b759995ea765821
SHA512 30863174ab1d6052bdf9be0e33001e33ff3dd6f1cd4fce8d397f8a5aee83a16522faaef5af57838c1db1c29d2e9c45ffb204b22148f723b58075ab343ca70987
SSDEEP 12288:gHvUrBFrEjwaQ2Ze0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zs4:gPUr+NQPW5hXSHg/ehHeRqh9zS
TLSH
T10905F15E22E81CE5E676F17D8A828709F77174621712A6CF02E1817E0F639D9BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 12ebe2511e8ad0f6a74335e224a966d3cad73c133c1b7d71792d8d85c3b493aa
MD5 b355a95321f7a7f47af69cf128c91c9d
SHA1 bbf2e02808dc973292cf8d9243eff0dc471b1228
SHA512 dda58552ebee257353eb8c94927471654598bb83883a29cdb5032d27ce2f1f740cb2a13fa68affc9c9e4f1f507d9d7700e3ba6e61d7277b3914361db59aa2443
SSDEEP 49152:WBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjz3F/el4q:5G05lO43bf5
TLSH
T117D5C06A62EC01F9D1BBD17CCAC64A0BEBB23415033556CF02A486A91F27FF5A57E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 67a66306b1c37817c8f84aa4e6dd785abe85243ebc6185210c4fdd4663e1d731
MD5 fcb5c8e69fbbf9c7773c0ec6c054f99c
SHA1 65ee5f5421fa30ed1ae695f1642d95a57c9c92a4
SHA512 2b1d11c802d81b37a2706214c7450f583a55332ee96ba825bfcd584099224759a25047ff1119417a52d5537c8abeff611a741cba9432572cd56a295918dd7ab5
SSDEEP 24576:INcwHdjbyQ4nLC18lb/EOjowL7FkcW5hXSHg/ehHeRqh9zS:INc/zEOVHFc3F/el4q
TLSH
T1CF858C1623E901E4F1BBE1BE89779946FA71786517348ACF0291811F1E73BE46C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 6672b1cfe18c5660086a86dd7efb9e4923295b6301746db75d5fec7239cd4b3f
MD5 5d10aa1a8de72a1c3cd5971c20cc4943
SHA1 644ece7c2280f789cb0310f888642d59e3974ce7
SHA512 e9ef732bb662ef56d98994e0587217cbb8e6a80877c623e9166c274d8c0fff1bea4167f0c7b2e85b2d5044c6e03350bcaecaf94743647cfc4f8f05836e01d588
SSDEEP 12288:2QHPJnJP6szeCs6Rl28dL+Ze0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNe:BJnJPbzB4SLXW5hXSHg/ehHeRqh9zS
TLSH
T1E115E06CD2A810E8E4B3D2B4815A1B5AFF31346D2F2669CB15B4D4353F12ED0BA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 f775010e77626f6f8a2caf55bb00c7edab3c1eaa32e3caa99ae62cb84447a936
MD5 14912241b118ebe45fb3a98983d65398
SHA1 e3a44daffa87fe6ac7c22bd2c3fe0c3369bcfa8c
SHA512 04848bd8cc87706fb1d5cfd0f169e124f7fce6919ae000379c5452958d5db2d3b1afe95874bd4865f1caf6922f76800cf67002e610db0a4a7b29837359882fa6
SSDEEP 12288:XxHEk/j5ZI7fZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:b/DIEW5hXSHg/ehHeRqh9zS
TLSH
T18105025C637A40B5D167E07E86930601E1B1B0719B665ADF07A8C47E4FB3EC9B93CE50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 e24e7f9d1bb7796fc885c6db24aac14d0861bbdafcdca978999504fe65ef7a27
MD5 b42cf95a0fe96140fc502fc4814bf9b0
SHA1 b5eeeca56d7b38b5ae491a6bef43ac599394b4b1
SHA512 48cffcf22d30ec92ddab95651a2bc61d9de02ec109eb2d205a99977023fee05463afd6e4a7dd534971c91c0ddc39967f0de941efeab97cb96ce8935307162851
SSDEEP 12288:NG6kygZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:0tyJW5hXSHg/ehHeRqh9zS
TLSH
T196F412405394D495F2756AB88AB38694EA38BC206F6667DF12A1E53F1F337C2BD30B14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 9074c62f8bb5c035c8db3c2880dd850144cd51d8249a7ad7c60e6eaa915ef128
MD5 fc428f81d0161277c52db9b53098ef17
SHA1 1c0b9670eb2cdaad1b08f895b14ef68a590248e6
SHA512 58f21406d27bdb37d1ae7374142acd23937b25c2b09df62d1dab98665bfd67fed9cbe1963f1e3d7731e8443d507305d536e527a52d8a55fc0176a0f4286fec3c
SSDEEP 12288:duTZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:0kW5hXSHg/ehHeRqh9zS
TLSH
T163D423C093A5C815E110FEF546A74F45E16870212FAE2ADF13ADA83A4FB71C3BA74958
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 b80897f5d964feb554fd955ea31f213867aa82575c9e653c195843b11339ef06
MD5 95c48a6e00d374cd94d118a668e41282
SHA1 42d41cf2aa8c6443ecae5f6427ad280fdc6deade
SHA512 84c96cca45860a98d5e1dc564bdb8a5d4a9bc7a7f0ead24e6b6c7bf4e7aa7a2c114ceef608146b65ee4cedab457ad99764a86e1f809fc69aa94f855f10576125
SSDEEP 12288:nlgl/ZyFDK3tT5Tr7aVLIH9lH3c6Ze0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu37:nlglsoTfaidZcW5hXSHg/ehHeRqh9zS
TLSH
T112558C1D63EA09CAE2B2D675D9721493D633B4311772D6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/764-308-0x00007FF610AC0000-0x00007FF610B89000-memory.dmp

Download

memory/764-232-0x00007FF610AC0000-0x00007FF610B89000-memory.dmp

Download

memory/764-234-0x000002310C630000-0x000002310C696000-memory.dmp

Download

memory/764-233-0x000002310C630000-0x000002310C696000-memory.dmp

Download

memory/1400-292-0x00000214CE680000-0x00000214CE6E6000-memory.dmp

Download

memory/1400-290-0x00007FF7C4450000-0x00007FF7C44FE000-memory.dmp

Download

memory/1400-291-0x00000214CE680000-0x00000214CE6E6000-memory.dmp

Download

memory/1796-25-0x000001CD7DFD0000-0x000001CD7E118000-memory.dmp

Download

memory/1796-29-0x000001CD7DF50000-0x000001CD7DFB6000-memory.dmp

Download

memory/1796-26-0x000001CD7DF50000-0x000001CD7DFB6000-memory.dmp

Download

memory/1796-27-0x000001CD7DF50000-0x000001CD7DFB6000-memory.dmp

Download

memory/2388-61-0x00007FF63FEC0000-0x00007FF63FFE3000-memory.dmp

Download

memory/2388-14-0x000001F2EE490000-0x000001F2EE4F6000-memory.dmp

Download

memory/2388-12-0x000001F2EE490000-0x000001F2EE4F6000-memory.dmp

Download

memory/2388-11-0x00007FF63FEC0000-0x00007FF63FFE3000-memory.dmp

Download

memory/2388-13-0x000001F2EE490000-0x000001F2EE4F6000-memory.dmp

Download

memory/2644-320-0x0000026805A00000-0x0000026805A66000-memory.dmp

Download

memory/2644-319-0x00007FF69FBB0000-0x00007FF69FE53000-memory.dmp

Download

memory/2644-321-0x0000026805A00000-0x0000026805A66000-memory.dmp

Download

memory/2796-261-0x00007FF606A80000-0x00007FF606BCA000-memory.dmp

Download

memory/2796-263-0x000002446D180000-0x000002446D1E6000-memory.dmp

Download

memory/2796-264-0x000002446D180000-0x000002446D1E6000-memory.dmp

Download

memory/2796-337-0x00007FF606A80000-0x00007FF606BCA000-memory.dmp

Download

memory/3196-311-0x0000026EA4DE0000-0x0000026EA4E46000-memory.dmp

Download

memory/3196-310-0x0000026EA4DE0000-0x0000026EA4E46000-memory.dmp

Download

memory/3196-309-0x00007FF6AB520000-0x00007FF6AB5D4000-memory.dmp

Download

memory/4180-44-0x00000284B4060000-0x00000284B40C6000-memory.dmp

Download

memory/4180-45-0x00000284B4060000-0x00000284B40C6000-memory.dmp

Download

memory/4180-50-0x00000284B4060000-0x00000284B40C6000-memory.dmp

Download

memory/4180-43-0x00007FF7C0E40000-0x00007FF7C0FA8000-memory.dmp

Download

memory/4180-52-0x00007FF7C0E40000-0x00007FF7C0FA8000-memory.dmp

Download

memory/4280-283-0x000001F676C80000-0x000001F676CE6000-memory.dmp

Download

memory/4280-282-0x000001F676C80000-0x000001F676CE6000-memory.dmp

Download

memory/4280-284-0x00007FF709290000-0x00007FF7099D4000-memory.dmp

Download

memory/4312-330-0x000001CCCCA90000-0x000001CCCCAF6000-memory.dmp

Download

memory/4312-329-0x00007FF7F31F0000-0x00007FF7F3385000-memory.dmp

Download

memory/4312-331-0x000001CCCCA90000-0x000001CCCCAF6000-memory.dmp

Download

memory/4564-350-0x00007FF6760A0000-0x00007FF67632B000-memory.dmp

Download

memory/4564-352-0x00000226BF390000-0x00000226BF3F6000-memory.dmp

Download

memory/4564-351-0x00000226BF390000-0x00000226BF3F6000-memory.dmp

Download

memory/4640-300-0x000002A01F830000-0x000002A01F896000-memory.dmp

Download

memory/4640-301-0x000002A01F830000-0x000002A01F896000-memory.dmp

Download

memory/4640-299-0x00007FF7F2140000-0x00007FF7F2557000-memory.dmp

Download

memory/4664-349-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4664-270-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4664-271-0x0000000000920000-0x0000000000989000-memory.dmp

Download

memory/4664-276-0x0000000000920000-0x0000000000989000-memory.dmp

Download

memory/4788-240-0x00007FF610AC0000-0x00007FF610B89000-memory.dmp

Download

memory/4788-317-0x00007FF610AC0000-0x00007FF610B89000-memory.dmp

Download

memory/4788-243-0x000001D24A7D0000-0x000001D24A836000-memory.dmp

Download

memory/4788-242-0x000001D24A7D0000-0x000001D24A836000-memory.dmp

Download

memory/4840-344-0x0000022BEB4B0000-0x0000022BEB516000-memory.dmp

Download

memory/4840-340-0x0000022BEB4B0000-0x0000022BEB516000-memory.dmp

Download

memory/4840-339-0x0000022BEB4B0000-0x0000022BEB516000-memory.dmp

Download

memory/4840-338-0x00007FF6450E0000-0x00007FF645401000-memory.dmp

Download

memory/4840-346-0x00007FF6450E0000-0x00007FF645401000-memory.dmp

Download

memory/4844-0-0x00007FF65A840000-0x00007FF65A99F000-memory.dmp

Download

memory/4844-20-0x0000011402AE0000-0x0000011402B46000-memory.dmp

Download

memory/4844-22-0x00007FF65A840000-0x00007FF65A99F000-memory.dmp

Download

memory/4844-3-0x0000011402AE0000-0x0000011402B46000-memory.dmp

Download

memory/4844-2-0x0000011402AE0000-0x0000011402B46000-memory.dmp

Download

memory/4844-1-0x0000011402AE0000-0x0000011402B46000-memory.dmp

Download

memory/4880-35-0x000001CA65CE0000-0x000001CA65D46000-memory.dmp

Download

memory/4880-34-0x000001CA65A70000-0x000001CA65BB8000-memory.dmp

Download

memory/4880-37-0x000001CA65CE0000-0x000001CA65D46000-memory.dmp

Download

memory/4880-36-0x000001CA65CE0000-0x000001CA65D46000-memory.dmp

Download

memory/5728-56-0x0000015F87380000-0x0000015F873E6000-memory.dmp

Download

memory/5728-55-0x0000015F87100000-0x0000015F87248000-memory.dmp

Download

memory/5728-57-0x0000015F87380000-0x0000015F873E6000-memory.dmp

Download

memory/5880-328-0x00007FF6212F0000-0x00007FF62140A000-memory.dmp

Download

memory/5880-250-0x0000012E9B4E0000-0x0000012E9B546000-memory.dmp

Download

memory/5880-249-0x00007FF6212F0000-0x00007FF62140A000-memory.dmp

Download

memory/5880-251-0x0000012E9B4E0000-0x0000012E9B546000-memory.dmp

Download