5a64ad8a518a124ad2edccd513e8b47d5e8e54ed5c222bf85baf5d00d5342225

Analysis

max time kernel
145s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_0fe8843742efee274803d8332793ab36_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe
Size 819KB
Sample260714-e6exvsgw3y
SHA256 5a64ad8a518a124ad2edccd513e8b47d5e8e54ed5c222bf85baf5d00d5342225
MD5 0fe8843742efee274803d8332793ab36
SHA1 34a1ece161237f96c0f8455666e6dd2ddd5e6ee2
SHA512 5a168bb72b2148b5262bb574882b8cc58f00cdb84b08a8f3b8265d26e819f4483e5f35f13dff926a8a5fa4da5d06b515a68e92bc113bb32d555ad3c95d95da55
SSDEEP 12288:s/Khzpwpc29TmQYhVu4a1zlRPjVNzBKUoF0vsY8Yh+4e/GmtmY4lzIpAJy:v4c29LAGzr55oLGh+3ZZ4OAI
TLSH
T1910501ADF3A049F8DC67C27CCDA28522E63274650750FADB03A449261F376C0AE3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 9 IoCs

pid	Process
2768	alg.exe
4896	elevation_service.exe
5052	elevation_service.exe
4452	maintenanceservice.exe
1140	OSE.EXE
6100	GameInputSvc.exe
4556	GameInputSvc.exe
2016	msdtc.exe
4940	PerceptionSimulationService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-07-14_0fe8843742efee274803d8332793ab36_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-14_0fe8843742efee274803d8332793ab36_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b078614323e529ce.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4556	GameInputSvc.exe
4556	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4284	2026-07-14_0fe8843742efee274803d8332793ab36_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe
Token: SeDebugPrivilege	2768	alg.exe
Token: SeDebugPrivilege	2768	alg.exe
Token: SeTakeOwnershipPrivilege	4896	elevation_service.exe
Token: SeTcbPrivilege	6100	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6100 wrote to memory of 4556	6100	GameInputSvc.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-07-14_0fe8843742efee274803d8332793ab36_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_0fe8843742efee274803d8332793ab36_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4284

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2768

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4896

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5052

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4452

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1140

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6100
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4556

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2016

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4940

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:5992

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:3344

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:4824

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:5888

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:4888

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:120

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:4084

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:2532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1e713fa30aa867065a1bce09ce927aedd178fdc67982edc6f5ea90caf119e168
MD5 d0d9083dd3be45f6f588994e3dfcbe52
SHA1 22a4cd5a397bde144790e3309209672e15b9a95c
SHA512 952c373c13f1f4057fd85e9fd4c259c0906f5d4749f7944c7f47e69aef4d01efbb08a59852deefd1d8d144935a87d9d23249555c4880fae4d23e7fbf1f347ab5
SSDEEP 49152:Ob+632BuPkFKRrdE6oh7stBhuXjfS4LWxnZW52LGgp9AI:Q3q6gjB1o
TLSH
T1E4D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 e21b49ff3259328de8e9c75d2bec67e7634aec198b603d591d513eb842238e13
MD5 b43eb08b92f06b57f2d8ec3280e14746
SHA1 5e711ca3f9b680c62ac53d9e95219e192d14edf5
SHA512 a9bcdf92f952c62d3d8f3346365dff97c735f736d18f624cfea7fb974856c7234f59f27ac742d304b81511ea0e651a34c9d032a64d10692173cfe66c12109643
SSDEEP 12288:N1XLsyM2pxy2lRq2czARmQYhVu4a1zlRPjVNzBKUoF0vsY8Yh+4e/GmtmY4lzIpj:jXYtqtczAFAGzr55oLGh+3ZZ4OAI
TLSH
T19305026CA3E009F9ED67823CC8668511EB73B8954790F78B03B489291F336D85E3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 24243f2e8049a2f0baee022a0d2bf05ee6d7e6e945674826ccfa49c789dfb5c7
MD5 99a7cb701123c850c5886b15bb74fe0d
SHA1 e0709cc546148e06d80dfbca51b33b809fba36b9
SHA512 8628893d961fae4ad997f2206f67e2aca5b318fea64f923201699f7b24e0c768385497444f73a5a0998a60785cb5b1fd9281a45ca9d2c341bb7314d615b9aac0
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+CjmQYhVu4a1zlRPjVNzBKUoF0vsY8Yh+4e/GmtmY4lU:uwuuOWyAGzr55oLGh+3ZZ4OAI
TLSH
T19705F18977A41CF9E5A78239855B8532E7F2B8512B60E71F4360CA1B5F37260BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 538a24b0beb0566addb2798c6cbbb1840a68eb269a0479dd8cb16a663009b661
MD5 8ffc2db895c2802830201d91590f9866
SHA1 5838fcfedfbdb1be09af6b1e1c800434e11dfda1
SHA512 54f1878990df5fa15a158718207528c2bb52f2466785d79f9895aa34bcecaeda13dfe5424c23a38e12bed9b68c3318edb4b4f302992c77b235bd1a44e029dd01
SSDEEP 49152:DB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glkW52LGgp9AI:1u6JmTxd2dXo
TLSH
T171D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 6e877aeade37524c8a47d449080cc89ea4803c299dad16f7ef3242e6572e2a58
MD5 fddb3c9f7d6f1834ac30cd2981b6f894
SHA1 d1f044ff65456e7055c658be53740180bffda339
SHA512 e9734ecd18ea54fc78e8dd7e0bf1afcc9880f9ac2c68ba7b5a5422549f75ff0205542d1f930f4bae7904dab7975166e16779d3446aed84e37a0045b6e85a1ea8
SSDEEP 12288:R57FJmQYhVu4a1zlRPjVNzBKUoF0vsY8Yh+4e/GmtmY4lzIpAJy:HFtAGzr55oLGh+3ZZ4OAI
TLSH
T179D423CCD7719642E2BF8370442E0A715A3AF4B56F80F6D7E0260C19A978DD0E938B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e592a4fa4792ef63810478f4721d2b3b27813c13256b646a2e4c0ef75a4cbd0a
MD5 3ff2209942f40bdb5b427cde01216cba
SHA1 d0955d6930ff158e07b240ba1e8ec3d311f4f04c
SHA512 74fc2602601f02eed58603b3c204a232f900c7f358cb72e90885ed0ec8adaee7497d9569fa2a9d6d9aa4a17ea842bb2e4ffc3686f05f78c4fd529c0709d40b7d
SSDEEP 24576:wgb6bmBIi49WNNFpg1rSvFv7bYjAGzr55oLGh+3ZZ4OAI:wgb4mBIBhGF3W52LGgp9AI
TLSH
T11F65AE1E22E802F5E1FAD2B8CDAA4417D6B278161731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 a3f533c41af315608fe92dd3740a4abae1df12e5cd06d32f425f954cdeee7a72
MD5 0e0a12b9ccd689c6172a3790619ec052
SHA1 f4a28aa990080ccb8086b2263a9e64c5067bd99c
SHA512 38b3083c068b97a4ca45d1545ebbfaddc2f3c5bf3431f50ddc99067e63fa8d06aad8aae6cc312b9a05adf6463f3127969e90c1198388ebf5df008e12ce3590e6
SSDEEP 12288:GRGtmQYhVu4a1zlRPjVNzBKUoF0vsY8Yh+4e/GmtmY4lzIpAJy:yGJAGzr55oLGh+3ZZ4OAI
TLSH
T19FE422DCA2B16194C27BC375442E09B3B971B0B16F44B7EF40A15C399F799E0B238E99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 ab319b8df59bf2fe5412ce9df53b0e80643de4d5303a7aa8c3b1dfe1c8fbf4c0
MD5 87fa67d783c97b392143ba76cde12415
SHA1 77b1a8bbfe13ea45040bfb8c67493213a78b1114
SHA512 0e6d121015d407fda98b1380cb54a0b44fbb70664da5627228eef09d7367b983e1d903126d80f193f3930da24004817a7aae757a471f64ed83fcdf9198ea170e
SSDEEP 12288:PCmQYhVu4a1zlRPjVNzBKUoF0vsY8Yh+4e/GmtmY4lzIpAJy:PuAGzr55oLGh+3ZZ4OAI
TLSH
T144D423CCD2719681D2AB8371042E0E724A75F4F56FC4B7D790660C19AABDDD0E238BAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 52826180309c08cadebdd91187d1e28aece70ac540d76d4f6db0fe8b2b261e5f
MD5 442fe6ec180ad56eff473c1e42f2bed7
SHA1 838b4990686a205f1cae511e967015b4df0b7829
SHA512 77a92b77f5cf20ceb64acda219e77aeabc637d5372b0cc2e7911fb132bbe060dc4bfb5d4dcddf4f664cc8d6a1f00ac252df52031cf3ba6a76636709961d7b5d2
SSDEEP 24576:ViF8u8FpJqH1izria7/mXAGzr55oLGh+3ZZ4OAI:86ZFPqV9a7/rW52LGgp9AI
TLSH
T12B35F1A9B7E101F0D47BD13889464663F6B2B4251364FFDF06A88A551F23AD44B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 f9312c0366fbf1599829b3b9a7feac7e9f9402dcef5025d1840ab7eecadacc8f
MD5 d062b68e86f61863ff403a598a702ec3
SHA1 ba45f9e6e5f5b0b8b7cdf0072c12f44a6f328417
SHA512 84f1ebb1bb37a84f595aaadfadedd4329bcb49175663df47a2383a25d959e61ccf473589a02559bb4614a891915b081514c01d6e3644e9cfc5f4a47eea1e8b10
SSDEEP 12288:1HvUrBFrEjwaQ0mQYhVu4a1zlRPjVNzBKUoF0vsY8Yh+4e/GmtmY4lzIpAJy:1PUr+NQ8AGzr55oLGh+3ZZ4OAI
TLSH
T18F05F15E62A818E5E67AE17C89464719E771B4621701F3CF02E0803E5F67EE8BD3DB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 42d0aa66cd425243ed9b7b3ee9ec2d0cf66499803edb416c1c93a260c0a1db30
MD5 6d81b91e78de878be774c0628dbd0c1a
SHA1 72cf2611a906f47cdc0aaa4401aeeb1f4bbacf8b
SHA512 5872680d46c68d4abe608ca0530a9bce6fc249891cc0822fe541309e687e0e8e302433166f299b41b37a1ac87bd6fa33960d00fc0e17374adda12866cedda9f8
SSDEEP 49152:yBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjRW52LGgp9AI:9G05lO43bvo
TLSH
T1CDD5CF6E62EC11F9D1BBC17CD9C64A0BEBB23425032556CF02A486A91F27FF4A57E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 15b23a38d74ed590f4ceba99fcf6e74a89a57463fcd720b7e7da2252b05d11b6
MD5 746b1b7e31b4a6266044c57bb581c308
SHA1 ce66bb68cb61e45d2c244705978387fd895834a9
SHA512 0f0413033afb88d4b9fd7b766b22330b5b2325ef9e220c6455abe5c533c433e740beed41e0d6ff3203d8e0725096b7a708d195846bd6938c4542952f51c42205
SSDEEP 24576:TNcwHdjbyQ4nLC18lb/EOjowL7FkqAGzr55oLGh+3ZZ4OAI:TNc/zEOVHFIW52LGgp9AI
TLSH
T109858C5A23E801E4E1BBE1BE897B9546FA717865133096CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 2c797c53efb7962869de348c644a0412bb05d40b9572b615b9a54f926123c74e
MD5 bf151079252a5a96a9751cf02e9835e3
SHA1 800c7135c0255c55a743b2ce9096437985c9da48
SHA512 5c3f1e02103241c36462424e3c5cd2be77c5bfff4312425b227ecb9f0bc37e2300c30d3608727a001e372832ac39e6122fcfff9a1efa8035058bbd00d90db71c
SSDEEP 12288:Y6HPJnJP6szeCs6Rl28dtmQYhVu4a1zlRPjVNzBKUoF0vsY8Yh+4e/GmtmY4lzIV:ZJnJPbzB4SJAGzr55oLGh+3ZZ4OAI
TLSH
T13D15D06DD2A810E8E4B7C2B4811A1A6AFF31387D2F1579C755B4D4353F12EE0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 9c05fc95f8c6a955e865536464781a9a7fba009edd8207ebc089c13bfdb64434
MD5 70b34bdca5bbd1126c91eb1de6e8712a
SHA1 1822192bd6e20ec04ef04dd111854276ce5a89ca
SHA512 c0f1976d1d33791789eae78f4e752667f0c5b3b34e054df6ecca7f11da0b2cd844b4c256341e3e7ebcd4c3c98cd624e6acf91f5105919714a5d97d610efbff4b
SSDEEP 12288:C1Hck6j5ZI7xmQYhVu4a1zlRPjVNzBKUoF0vsY8Yh+4e/GmtmY4lzIpAJy:e6DIJAGzr55oLGh+3ZZ4OAI
TLSH
T12605018C637610F5D1ABD03E85870512D2B2B0B19B517ADF46A4887E9FB3ED8B93CE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 ca3778c9bc2be528be0a2278b130648afcd5542d0d52afc374ca00d1b98470a0
MD5 eb60cac057fabe4c4d2b445a3f7c8022
SHA1 446352594277caa7319e3b77c199ec1e56b0e05d
SHA512 09c5c1bdca489445ebfa231c0aa4cb757c59f840f57f16574c19a66ff21f8640f6b8ab193a9f11531bfbae99548027c7a02cc0f10cd49736f78b9649fb1fba43
SSDEEP 12288:5G6kyRmQYhVu4a1zlRPjVNzBKUoF0vsY8Yh+4e/GmtmY4lzIpAJy:wtyFAGzr55oLGh+3ZZ4OAI
TLSH
T1ABF412CC93A061D5E6BA4234892B05A18F35BC706F40B7DF50A1993E6F39BD0B934F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 3b1ba3342fe95423678b056b781ebd60d427783866168e6021fb10e7f24f7ea2
MD5 ea2705314592e5019ef43e2b49d06aae
SHA1 1d7f5d7c31f4e08c205eb3c3dce2133431de0430
SHA512 19cf6a332b19eb11de15ef32d27e851bfbffcf141d8a461d16de8fffa6207595a405ef10a6c1288cfece59045aeb4514df4a63977c5f8745d863429b5cd06358
SSDEEP 12288:pKEBfmQYhVu4a1zlRPjVNzBKUoF0vsY8Yh+4e/GmtmY4lzIpAJy:MEBvAGzr55oLGh+3ZZ4OAI
TLSH
T108D423CCD271A291D2AB8374442E0AB28675B0F56F8477EF90B50C399A7D9D0E238F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/120-321-0x0000028189170000-0x00000281891D6000-memory.dmp

Download

memory/120-318-0x00007FF7510C0000-0x00007FF751363000-memory.dmp

Download

memory/120-320-0x0000028189170000-0x00000281891D6000-memory.dmp

Download

memory/1140-56-0x000001D64AC30000-0x000001D64AC96000-memory.dmp

Download

memory/1140-57-0x000001D64AC30000-0x000001D64AC96000-memory.dmp

Download

memory/1140-55-0x000001D64A960000-0x000001D64AADD000-memory.dmp

Download

memory/2016-249-0x00007FF7AB370000-0x00007FF7AB48A000-memory.dmp

Download

memory/2016-251-0x0000013629820000-0x0000013629886000-memory.dmp

Download

memory/2016-327-0x00007FF7AB370000-0x00007FF7AB48A000-memory.dmp

Download

memory/2016-250-0x0000013629820000-0x0000013629886000-memory.dmp

Download

memory/2532-343-0x00007FF74EDC0000-0x00007FF74F0E1000-memory.dmp

Download

memory/2532-339-0x0000015AD0DA0000-0x0000015AD0E06000-memory.dmp

Download

memory/2532-338-0x0000015AD0DA0000-0x0000015AD0E06000-memory.dmp

Download

memory/2532-344-0x0000015AD0DA0000-0x0000015AD0E06000-memory.dmp

Download

memory/2532-346-0x00007FF74EDC0000-0x00007FF74F0E1000-memory.dmp

Download

memory/2768-13-0x000001CFAC430000-0x000001CFAC496000-memory.dmp

Download

memory/2768-11-0x00007FF6C0750000-0x00007FF6C0873000-memory.dmp

Download

memory/2768-12-0x000001CFAC430000-0x000001CFAC496000-memory.dmp

Download

memory/2768-14-0x000001CFAC430000-0x000001CFAC496000-memory.dmp

Download

memory/2768-61-0x00007FF6C0750000-0x00007FF6C0873000-memory.dmp

Download

memory/3344-284-0x00007FF66BFC0000-0x00007FF66C704000-memory.dmp

Download

memory/3344-282-0x000001F9A1810000-0x000001F9A1876000-memory.dmp

Download

memory/3344-283-0x000001F9A1810000-0x000001F9A1876000-memory.dmp

Download

memory/4084-328-0x00007FF7F3230000-0x00007FF7F33C5000-memory.dmp

Download

memory/4084-329-0x000002C5D0E80000-0x000002C5D0EE6000-memory.dmp

Download

memory/4084-330-0x000002C5D0E80000-0x000002C5D0EE6000-memory.dmp

Download

memory/4284-19-0x000001E034AD0000-0x000001E034B36000-memory.dmp

Download

memory/4284-3-0x000001E034AD0000-0x000001E034B36000-memory.dmp

Download

memory/4284-2-0x000001E034AD0000-0x000001E034B36000-memory.dmp

Download

memory/4284-22-0x00007FF7B6370000-0x00007FF7B64C6000-memory.dmp

Download

memory/4284-0-0x00007FF7B6370000-0x00007FF7B64C6000-memory.dmp

Download

memory/4284-1-0x000001E034AD0000-0x000001E034B36000-memory.dmp

Download

memory/4452-43-0x00007FF7FD200000-0x00007FF7FD368000-memory.dmp

Download

memory/4452-50-0x0000022DB8CA0000-0x0000022DB8D06000-memory.dmp

Download

memory/4452-45-0x0000022DB8CA0000-0x0000022DB8D06000-memory.dmp

Download

memory/4452-44-0x0000022DB8CA0000-0x0000022DB8D06000-memory.dmp

Download

memory/4452-52-0x00007FF7FD200000-0x00007FF7FD368000-memory.dmp

Download

memory/4556-242-0x000002FD0B2C0000-0x000002FD0B326000-memory.dmp

Download

memory/4556-317-0x00007FF70D910000-0x00007FF70D9D9000-memory.dmp

Download

memory/4556-241-0x00007FF70D910000-0x00007FF70D9D9000-memory.dmp

Download

memory/4556-243-0x000002FD0B2C0000-0x000002FD0B326000-memory.dmp

Download

memory/4824-290-0x00007FF652B90000-0x00007FF652C3E000-memory.dmp

Download

memory/4824-292-0x0000023FD4D10000-0x0000023FD4D76000-memory.dmp

Download

memory/4824-291-0x0000023FD4D10000-0x0000023FD4D76000-memory.dmp

Download

memory/4888-309-0x00007FF745F30000-0x00007FF745FE4000-memory.dmp

Download

memory/4888-310-0x000002C6CD140000-0x000002C6CD1A6000-memory.dmp

Download

memory/4888-311-0x000002C6CD140000-0x000002C6CD1A6000-memory.dmp

Download

memory/4896-25-0x000001A1F6F90000-0x000001A1F710D000-memory.dmp

Download

memory/4896-27-0x000001A1F71E0000-0x000001A1F7246000-memory.dmp

Download

memory/4896-28-0x000001A1F71E0000-0x000001A1F7246000-memory.dmp

Download

memory/4896-26-0x000001A1F71E0000-0x000001A1F7246000-memory.dmp

Download

memory/4940-337-0x00007FF7FB5C0000-0x00007FF7FB70A000-memory.dmp

Download

memory/4940-261-0x00007FF7FB5C0000-0x00007FF7FB70A000-memory.dmp

Download

memory/4940-263-0x000001A010640000-0x000001A0106A6000-memory.dmp

Download

memory/4940-264-0x000001A010640000-0x000001A0106A6000-memory.dmp

Download

memory/5052-37-0x000002A3A4120000-0x000002A3A4186000-memory.dmp

Download

memory/5052-36-0x000002A3A4120000-0x000002A3A4186000-memory.dmp

Download

memory/5052-34-0x000002A3A2E40000-0x000002A3A2FBD000-memory.dmp

Download

memory/5052-35-0x000002A3A4120000-0x000002A3A4186000-memory.dmp

Download

memory/5888-301-0x000002DC77F70000-0x000002DC77FD6000-memory.dmp

Download

memory/5888-300-0x000002DC77F70000-0x000002DC77FD6000-memory.dmp

Download

memory/5888-299-0x00007FF74E120000-0x00007FF74E537000-memory.dmp

Download

memory/5992-271-0x0000000000990000-0x00000000009F9000-memory.dmp

Download

memory/5992-270-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5992-276-0x0000000000990000-0x00000000009F9000-memory.dmp

Download

memory/6100-308-0x00007FF70D910000-0x00007FF70D9D9000-memory.dmp

Download

memory/6100-234-0x000002A052520000-0x000002A052586000-memory.dmp

Download

memory/6100-233-0x000002A052520000-0x000002A052586000-memory.dmp

Download

memory/6100-232-0x00007FF70D910000-0x00007FF70D9D9000-memory.dmp

Download