e49ef1f1f30372119a9931beae5f03adc2f27426c7d6765950c1ddd9873028c7

Analysis

max time kernel
147s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_1918bb1ba5f2a7d4253e10eff97d9d44_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
Size 1.6MB
Sample260714-e2xl4sgv4v
SHA256 e49ef1f1f30372119a9931beae5f03adc2f27426c7d6765950c1ddd9873028c7
MD5 1918bb1ba5f2a7d4253e10eff97d9d44
SHA1 837a31adf38d0188c8ea56bf42c435717501c669
SHA512 c2df55beeeea146c5efabcfe99a9454917229e7c1d9d8233e5e00ae83e5c50986cadd07bd4cad14c17d25a65e14edabfec8496b9a6dbfa81c694be67c9238cb1
SSDEEP 24576:YDT0AYyaE9Wx/tEX6PoC0jIMukRppD3eBR8nvn9ZyXLYKM/s7q:Yv0AYaWxyXGohjIMjpJOBR8nv9PU
TLSH
T11B75BE0BB29118EAC2A9C074CE16D531A761BC4E0BF269FB3591F2D92D36AD07F39711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
2820	alg.exe
4824	elevation_service.exe
4528	elevation_service.exe
4484	maintenanceservice.exe
5572	OSE.EXE
1160	GameInputSvc.exe
1676	GameInputSvc.exe
1372	msdtc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-14_1918bb1ba5f2a7d4253e10eff97d9d44_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\79659aa4e62f061e.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-14_1918bb1ba5f2a7d4253e10eff97d9d44_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1676	GameInputSvc.exe
1676	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2604	2026-07-14_1918bb1ba5f2a7d4253e10eff97d9d44_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	2820	alg.exe
Token: SeDebugPrivilege	2820	alg.exe
Token: SeTakeOwnershipPrivilege	4824	elevation_service.exe
Token: SeTcbPrivilege	1160	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1676	1160	GameInputSvc.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-07-14_1918bb1ba5f2a7d4253e10eff97d9d44_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_1918bb1ba5f2a7d4253e10eff97d9d44_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2604

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2820

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4824

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4528

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4484

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5572

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1676

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
PID:1372

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
PID:3616

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:5324

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:2844

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:2392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d9b260fe1484c24a2f42fb7129540890dbdafc8615b34a965b0ae250eb298b66
MD5 02e66a981688e35d36186847da390285
SHA1 8b1d1d46094a0712a0cb2df32a9f5fb55cb24d69
SHA512 498e8483f50f7b3461469c827b6b9b9983e8891f0c15347da0746d669cc7b19ef98af4fb2ee619b17e03bff11aaa616e0cf2eca0d6b7b9f5f8aa2a0f0143a956
SSDEEP 49152:Yb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnmJOBR8nv9PU:y3q6gjBNSR8nR
TLSH
T1C4D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 6192b34fb1a201ccc2bb71728b92a547febd88d3447f118f27bca3127b935f4b
MD5 e3fd51fc0f9b95dd6696d085ab5e8e06
SHA1 880d593f11cab2e1c7b4212d070ec165b0777a4f
SHA512 faefd1745065458caca0020a094132d01914c7df0f28b46e96993ff7b4f14efa1915753f554032ddc809672bd8fa04229e2e3a6ec63d32fe45faa772e7052bbf
SSDEEP 24576:GXYOEtczADpD3eBR8nvn9ZyXLYKM/s7q:NtcUJOBR8nv9PU
TLSH
T14605F12873E008F9ED6B823CC8619516EA73BC8143A5E79B13F489155F637C89E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 6675f233e0fcd9996854342cff457fd8100f5e2c6de413810740927ba47affcd
MD5 641a153393aca1a59c11ba51b9913e4f
SHA1 2bcee9fa13c413a5b5e476ef5a0c5863c48e85de
SHA512 e3eabdb2e3f07e9a575771ab781e49093a29eb66f31024971dc94d62a48accaa9bc0fe3377dec8b407f8cf00865265bfefccfe902cef1f91a0a8967d072548e6
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+C/YpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/B:uwuuOWNpD3eBR8nvn9ZyXLYKM/s7q
TLSH
T10F05F10932A41CF9EA6782388557D536F7F2BC022676DB1F2770C64B6F67350AE29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f79bc2fb48e6a9f0772f7c43db9e1dfd31730bbea01ca94433aff2c37ab74eb5
MD5 0dcb844237044bed1ba7647e8510af73
SHA1 4486b2b0a7e01250baa05583521c20e319429d7c
SHA512 c4298efe13c427b503e67b842791df084509ee2194a2519cf8fc54fe3b99fbf7b6c2e8a200b8b373522724861acb584b35dd42deafd1a4472dc628ad41834b30
SSDEEP 49152:cB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glZJOBR8nv9PU:2u6JmTxd2dPSR8nR
TLSH
T1FAD59D13F1DA01E8D05ED478974AA233EA62BC490B35B6DF0A9073552E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 f83214a4989150af7dfe89c601aeeb6234213ec4f9ef1f5980a2aaf8feb35efd
MD5 356d771b7cf6045d070b95a13ee4e9ae
SHA1 5740a7f6816cb74c1401255810add620c20f4b2f
SHA512 2d0e3260d0921de792120b200fe308e02e08774d727b0e5cb02539eeacb019944bbff5b34117684d147dc785bc18d75b4cdf87de4990a5e9b6c5f69ed73ce20d
SSDEEP 12288:R07qYpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46b7q:GNpD3eBR8nvn9ZyXLYKM/s7q
TLSH
T1D4D4232423A56845FA3D87342418B61B256DFD82A3BBE19F757B0505A8E2FC0DB2523E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 08152b8f385588b012536e03114178e6b7842d5e48c4cbce035f154c1fe1dcf7
MD5 2048200c3feca0a5f99b0e4da9fa463a
SHA1 6335237b0494ac103a1364964d2c928944eab9bc
SHA512 0fb62ee1c5e85a7c543d9808466fde66adc48e939c1eb3b6467b79d6da12b8291f9c25bcdbccb04c699066acd329ac0f9d3def333f2f8ca5925fa57efd0ff9ac
SSDEEP 12288:OzGgYpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46b7q:IGHpD3eBR8nvn9ZyXLYKM/s7q
TLSH
T166E4122C31F23494DA3EC3385420B51B38B1BC81636B61FF29F695259E96ED0E338D69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 f28dabfe7671444872cfab68513883bd00b477327ef0dc36565c7ce6a7b50971
MD5 458bca37331f66c91d3ecd639742b10e
SHA1 03c378daf098ab5f6d1fb8045fa62f2d1779b03f
SHA512 f745424e974e7f85688ba2d2896ad2ac8f963f2cbcec7996d5a26dad9e2521c797554bb15d2760a21ffa8f0cc614ccff94d798f698a6f11a206303522cd640c0
SSDEEP 12288:XEYpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46b7q:XzpD3eBR8nvn9ZyXLYKM/s7q
TLSH
T1C8D4231832A16885FA19873524107A0F25A5FC82B3FB62EF79BF5501A9D7FC0D33527A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 676ece6eba7a32f41fa500b9d8bff1e666817d1ad143b4884ffd74e6c9b01e73
MD5 f0075118d8acbc724752c255ae123d98
SHA1 5d59c16e2eda3055fcbeb950dae9115bd11d6f71
SHA512 a4c8eb7c0602683a884caea3ac36d5ffd2e4db1107eac5417c5bea04eaf9678b1c29324f7e1b5fde93f8219132f908813bf40e1d8d37299ee0a4388ee498e0d9
SSDEEP 12288:nHvUrBFrEjwaQpYpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46q:nPUr+NQmpD3eBR8nvn9ZyXLYKM/s7q
TLSH
T11905F12E22E918E5F67AE13D8541970DF771B8521312E2CF02E1816E5E67ED8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 339112cd4f36b131e1a66e9cc7d41d730f2c2465c2727d885f5b8a24211b7858
MD5 b7400fdbf1abbca7062cba7e8e325a52
SHA1 aa0b1569bcefc0f187bff74a9937ce0391d80c42
SHA512 365819e7f6da44bf3a71c4e1fcbea55fc7712dc3628ed123d96c6ce77eef007fb51488218368b2a6c94b5e9f899d6360ec6e331ba937a9c2176eeaa4a4095007
SSDEEP 49152:RBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjdJOBR8nv9PU:yG05lO43buSR8nR
TLSH
T143D5CF6E62EC11F9D1BBC17CD9864A0BEBB23815033556CF02A486A91F27FF4967E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 fcbb269b49e78a9a3730b54b896747c5e6005afc49b343151bf674fda5d8c2af
MD5 aed8bbec691c851a643873fd1732e090
SHA1 20a8d45d14dfb91df996e05fa7b6d849d294d620
SHA512 e54651eba844bfb700fed452aff61c64ce6f4e925776cfb09c4ef7f3c6aa7e05d83187bb69eadc8726cf318825c08f2a2e8097678244301b0b26e84b4d59e0d1
SSDEEP 12288:Z1Hck6j5ZI7wFYpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46be:B6DI8apD3eBR8nvn9ZyXLYKM/s7q
TLSH
T1C405021C337610F5D12BD03D85820506D2B2F8A193676ADF1AE9C5799EE3EC8FA38E51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 0186b5fb550041960de76241ab0489cd34af76f2de52dd993dd0a939a5047520
MD5 e2ad1fd7f2dbb993f2caa3bd635f0165
SHA1 bc9a43ee6eda820fd894ed17a4224bd1614e3863
SHA512 a3edfdb66b04d70f1eb32d66e11f15a38100879cb7c48ec159892b7f332d3f22b5ac201670c7136d79a316c810dec2df27e7200be27755f9548162272566f389
SSDEEP 12288:7G6kyiYpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46b7q:6tylpD3eBR8nvn9ZyXLYKM/s7q
TLSH
T1F1F4120423A474C5FA7943389921A2565A35FC106377A3EF35E2961E6F77FC0EA30726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1160-233-0x000001BFEF690000-0x000001BFEF6F6000-memory.dmp

Download

memory/1160-232-0x00007FF7BE000000-0x00007FF7BE0C9000-memory.dmp

Download

memory/1160-234-0x000001BFEF690000-0x000001BFEF6F6000-memory.dmp

Download

memory/1372-251-0x000001E9EA6A0000-0x000001E9EA706000-memory.dmp

Download

memory/1372-245-0x00007FF6E8EB0000-0x00007FF6E8FCA000-memory.dmp

Download

memory/1372-246-0x000001E9EA6A0000-0x000001E9EA706000-memory.dmp

Download

memory/1676-242-0x0000024047C20000-0x0000024047C86000-memory.dmp

Download

memory/1676-241-0x00007FF7BE000000-0x00007FF7BE0C9000-memory.dmp

Download

memory/1676-247-0x0000024047C20000-0x0000024047C86000-memory.dmp

Download

memory/2392-290-0x00007FF768E20000-0x00007FF768ECE000-memory.dmp

Download

memory/2392-292-0x0000021CE74E0000-0x0000021CE7546000-memory.dmp

Download

memory/2392-291-0x0000021CE74E0000-0x0000021CE7546000-memory.dmp

Download

memory/2604-3-0x0000021B8EB10000-0x0000021B8EB76000-memory.dmp

Download

memory/2604-19-0x0000021B8EB10000-0x0000021B8EB76000-memory.dmp

Download

memory/2604-2-0x0000021B8EB10000-0x0000021B8EB76000-memory.dmp

Download

memory/2604-0-0x00007FF697280000-0x00007FF69765E000-memory.dmp

Download

memory/2604-22-0x00007FF697280000-0x00007FF69765E000-memory.dmp

Download

memory/2604-1-0x0000021B8EB10000-0x0000021B8EB76000-memory.dmp

Download

memory/2820-12-0x0000023CD3F20000-0x0000023CD3F86000-memory.dmp

Download

memory/2820-61-0x00007FF61D2E0000-0x00007FF61D403000-memory.dmp

Download

memory/2820-11-0x00007FF61D2E0000-0x00007FF61D403000-memory.dmp

Download

memory/2820-13-0x0000023CD3F20000-0x0000023CD3F86000-memory.dmp

Download

memory/2820-14-0x0000023CD3F20000-0x0000023CD3F86000-memory.dmp

Download

memory/2844-283-0x000001D026160000-0x000001D0261C6000-memory.dmp

Download

memory/2844-284-0x000001D026160000-0x000001D0261C6000-memory.dmp

Download

memory/2844-282-0x00007FF7AE2C0000-0x00007FF7AEA04000-memory.dmp

Download

memory/3616-260-0x000001E143240000-0x000001E1432A6000-memory.dmp

Download

memory/3616-258-0x00007FF618530000-0x00007FF61867A000-memory.dmp

Download

memory/3616-261-0x000001E143240000-0x000001E1432A6000-memory.dmp

Download

memory/4484-43-0x00007FF605C90000-0x00007FF605DF8000-memory.dmp

Download

memory/4484-45-0x00000294A5E20000-0x00000294A5E86000-memory.dmp

Download

memory/4484-44-0x00000294A5E20000-0x00000294A5E86000-memory.dmp

Download

memory/4484-52-0x00007FF605C90000-0x00007FF605DF8000-memory.dmp

Download

memory/4484-50-0x00000294A5E20000-0x00000294A5E86000-memory.dmp

Download

memory/4528-34-0x000001DCA1470000-0x000001DCA15ED000-memory.dmp

Download

memory/4528-37-0x000001DCA1710000-0x000001DCA1776000-memory.dmp

Download

memory/4528-35-0x000001DCA1710000-0x000001DCA1776000-memory.dmp

Download

memory/4528-36-0x000001DCA1710000-0x000001DCA1776000-memory.dmp

Download

memory/4824-28-0x00000246BB100000-0x00000246BB166000-memory.dmp

Download

memory/4824-27-0x00000246BB100000-0x00000246BB166000-memory.dmp

Download

memory/4824-26-0x00000246BB100000-0x00000246BB166000-memory.dmp

Download

memory/4824-25-0x00000246BAEB0000-0x00000246BB02D000-memory.dmp

Download

memory/5324-276-0x0000000000960000-0x00000000009C9000-memory.dmp

Download

memory/5324-271-0x0000000000960000-0x00000000009C9000-memory.dmp

Download

memory/5324-270-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5572-56-0x000001AC5DF10000-0x000001AC5DF76000-memory.dmp

Download

memory/5572-57-0x000001AC5DF10000-0x000001AC5DF76000-memory.dmp

Download

memory/5572-55-0x000001AC5DC50000-0x000001AC5DDCD000-memory.dmp

Download