7d3a905ff1d54c53d263f48c218d2351ba01d603e569a100dd75fcc800f635f8

Analysis

max time kernel
136s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 09:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_32623ec6faed6a01bc82c9ccd98535a7_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
Size 1.6MB
Sample260729-llws7sdm7s
SHA256 7d3a905ff1d54c53d263f48c218d2351ba01d603e569a100dd75fcc800f635f8
MD5 32623ec6faed6a01bc82c9ccd98535a7
SHA1 5abcb83f834f4706ed2d9037970ec43b847fcaf9
SHA512 7f1f55dc30c4647c6c4a74f269bddeab5afd125296e8c308c63a121457aee371b0b18c03df29e13203e16ac6a77d0ed7ca7902a2cf24dc005f3ed8c89876dea3
SSDEEP 49152:510AYDWxyXGohjIMdATGBrMGWr7nTC8HPS:QkyWrKtMbTC8HP
TLSH
T11375AE0BB26518EAD2A9C074CE16C531AB21BC4D0BF299FB3581F6D92D36AD07F39711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
5748	alg.exe
244	elevation_service.exe
4960	elevation_service.exe
3192	maintenanceservice.exe
3932	OSE.EXE
2684	GameInputSvc.exe
5780	GameInputSvc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-29_32623ec6faed6a01bc82c9ccd98535a7_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fd0c1b0b763f1d8f.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-29_32623ec6faed6a01bc82c9ccd98535a7_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5092	2026-07-29_32623ec6faed6a01bc82c9ccd98535a7_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	5748	alg.exe
Token: SeDebugPrivilege	5748	alg.exe
Token: SeTakeOwnershipPrivilege	244	elevation_service.exe
Token: SeTcbPrivilege	2684	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 5780	2684	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-07-29_32623ec6faed6a01bc82c9ccd98535a7_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_32623ec6faed6a01bc82c9ccd98535a7_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:5092

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:5748

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:244

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4960

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3192

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3932

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  PID:5780

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
PID:4604

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
PID:3152

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:3544

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:4896

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:4876

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:2388

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:5084

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:2196

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:792

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:2416

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:5472

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5296

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:5948

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 65f59c26bbb5a56ff4012d2e1361de57d193f51f0ec95ba53ddb66975f8bfdc7
MD5 4a57cb602e3477945217b6cc52b36e64
SHA1 4ff1e5354bacec143acf452355244f0d84400833
SHA512 e55ad233fe451aa3aed3f85c7d784ed817fd61a2702e90f85a22d20300885d31b4188d9899d8d9ab0c96576f5340f9d71d5ced08cc6aa05042ca1b28276a0e73
SSDEEP 49152:Ub+632BuPkFKRrdE6oh7stBhuXjfS4LWxntATGBrMGWr7nTC8HPS:O3q6gjBrKtMbTC8HP
TLSH
T182D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 b3696d370a7274d83388c599c6b55dd67c7a4ecf5dee4519a215749e13180b68
MD5 1bdaaf859fd84487f0efd7868245731a
SHA1 9b82fcd544218013f4abdab2a6783eb4e7ab8a39
SHA512 98574d42d15c9d33c085d9e31d82f0421d5353e7c0a696618dcc44c082a49836971ff6d4f4b5d237d3a00bb0fb5bc9ad958f0ee753c1a497709dde0a43a084fa
SSDEEP 24576:xXYNopczAOICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:RpcHATGBrMGWr7nTC8HPS
TLSH
T1DA050229A3D048F9ED5BD17CC8B18511EF33B85547A0E79B03A49A691F233C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 26ca49c5c4f12931afd0d683a9f40862aecda1d66ae6d9a297a765fd1f5a8df5
MD5 3ed0612d4f6fd81c0fd85b8fde854b85
SHA1 f8bed0a3e4ee2c1664037507a2e94475ff738f3c
SHA512 a30c5875df7297e3ab9fdcb270c82d268786405971689704d7defb3f527f02568eae3e31b1db407e67737b2aa65aba286f7b395a48fdfce52487f14658ce040a
SSDEEP 24576:uwuuOWoICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:uwVObATGBrMGWr7nTC8HPS
TLSH
T12305F14676A44CF9E967913C85A7C436FBB2B8022A21C71F1720CB5B5F37391AE2D760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 30fb29eabaf6d71e4f428800d7c4e6f6a53139066a5b8c875076881e032146dd
MD5 5d974cce315b579947ebac903894ec46
SHA1 4d272f4a85919e7d54b429a3b12e166aa59db262
SHA512 a0fcef0e5a1fda651f5caf679e3955c29cade46423167b1707ec7c218a50064f313814ac9422a1b296c7ea81e37b3421329dbce7477d6dac5f59cb27572644c6
SSDEEP 49152:kB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl5ATGBrMGWr7nTC8HPS:+u6JmTxd2d6KtMbTC8HP
TLSH
T185D59D13F1DA01E8D05ED478974A9233EA62BC490B34B6EF0A9077562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 8eef393117ee56e9185ceae1824567bf269ae71ad2d7148d8ba4a0954eb33520
MD5 941380cb1ad43c7b60581d04cbef9c89
SHA1 26f5a647540436517a646b8f5cbc24b2442ad8c8
SHA512 2d1af54c64b6c446c40704c59f55690bb93793333446bf9f60549f681a66c9884acfbf687d1b9f48bf5024103d6bedb110d11244248152c4b1a782d06d0781c5
SSDEEP 12288:RG7ug74ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb38:8ubICgpB5GBrMVyJWrwgh5AQorrYWbJb
TLSH
T120D42302C668CC6DFD1EF07C60758C519E39BA952BA0C3DBF7041FDD19367C4AA692A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1d24e9d314b49899b3d8d55204b1caaff726419c483f9025620ff2f522ec9517
MD5 b7cf2d05f981c379f2c6208c47434eaf
SHA1 e07d20606779aff8d4fc52ad73089a87726d063a
SHA512 f0c76cd7ac6fdf56be86032088febe6177ba8cf9d98300a7586e50e4c2d7d0ac12f4c139dbae3862ff16da2530b917405912fab54cb704595f929a94e5df3098
SSDEEP 24576:xgb6bmBIi49WNNFpg1rSvFv7bYB+ICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:xgb4mBIBhGFk+ATGBrMGWr7nTC8HPS
TLSH
T17065AF1E22EC01F5E0FAE2B8DDA64417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 2bab5105e9bda8911d396f03c711d2ef860f6747e5e7024b7ecbedc22978f5ec
MD5 ab1acc84ebf7b180a7da03fd564046e8
SHA1 1318e61deeafd189973f11a00e062a8bb81f19e4
SHA512 ef7ed6012d4ecbcad957df5892e70713805164d97cb0a2358380e92dc20d0de177e27637c62c533d95e17f858ac068f67de44b976edc8fd1017fcd191aa9ee7f
SSDEEP 12288:xGG+Pn4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb38:4G+P4ICgpB5GBrMVyJWrwgh5AQorrYWR
TLSH
T1F5E4221AA1B5E8ACE83ED07C94718892BD3175A0276093FF56106EBD4F267D0B33DDA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 bb5400aeb4f7bafb83c2c5f5ee31373d793857149675d2ee750696633b3f33ab
MD5 39e787e2df18291e8e21c44fc2763d0f
SHA1 a249f27a46fbc5ea5ead67ab2b37796ae9204857
SHA512 78fdb43602f8122dcfd2170fab8301c6921a0707434330f0ec3a818d3ac9e58516785f645947f7e36a475477043d7e5e3cbcfa3ed07b2f121a20ec10aa68c0a5
SSDEEP 12288:L2c4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:L2rICgpB5GBrMVyJWrwgh5AQorrYWbJb
TLSH
T181D42306C564DCADFD0AE47C60729C819E34BA9627E0C3D7B7042E9D092A7C4A27D5F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 008a10813c1dfc78abff44a5f9cbd8265181958fd87d8f3dcc380785892d610e
MD5 eb9b5ca2047c551df28818e343b4fc40
SHA1 59b277bba62efdbf2b90baf6a284ebc805bbba28
SHA512 19b317006847fdb863aaef2502701f48fbe912ad33b4e4ef4fa637e4aecb39f3d57e4aa3821e7c987d3890a3078709726bae0dc98204b757a224ada1303c41fd
SSDEEP 24576:DFr828FpJqH1mzria7/mo0ICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:pwhFPqVxa7/N0ATGBrMGWr7nTC8HPS
TLSH
T1AD350165A7E101F4D47BD03889924AA3FA72B4251360EBDF07A88F551F23BD44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 35fbafaadb2ba193f05d09cc3d07be90b2668512e300ac9157d0dfda90c3087e
MD5 df4d9e2dd975b0666de570adcf4984b1
SHA1 dd1d1746ad10a75790c4438d6250b0ec271381ba
SHA512 2325c780f82024d537a010d66d3ebcd5686489a7bdbcb7866f93490906a4892ba4d8f6587e55210d8f61ecb808c0da2b7fe80c052bdf03b526a43e161e288fd9
SSDEEP 49152:LBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjU4ATGBrMGWr7nTC8K:UG05lO43b1KtMbTC8HP
TLSH
T1B8D5CF6A62EC11F9D1BBD07CD9C64A0BEBB23415033556CF02A486A91F27FF4667E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f76b289eec63818683b8877224413a64067e8ae297ba3b6e454afba65cf46765
MD5 8a896106a4fa601ed5e761ddb7565ce0
SHA1 e86eba32c7b4b511b4333aa445054caa17b96fa2
SHA512 81d481c5d57e31966f2c6f833c06dfe3a0ea10bf7ae8c116b29a0b81a1b125a30477a4d4da82fa03a97cd27f7ce685ec97f732a2b52d2fdc9650e2af02fb5335
SSDEEP 24576:HNcwHdjbyQ4nLC18lb/EOjowL7FkoSICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:HNc/zEOVHFpSATGBrMGWr7nTC8HPS
TLSH
T111857B1622E901E4F5BBE1BE89779946FA717869133086CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 0bf143c92f61bbcbce47ce7b2ae540bffb45b85bc1ee80e014132bd6b4231acf
MD5 a4cbc8bae666c4a559ccf8635d469373
SHA1 1178446a579d59e791591ff625f59157b9d07154
SHA512 2158ff37f5b563c711038fedb0898edaa0841fc34977e88e7eb0c5138c32c0b4ad806968f39c18a7e8a39ae776cfd7c9399761630fdcaa3d34143c9a8f8456ad
SSDEEP 24576:DJnJPbzB4SKmICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:DJnJv6SKmATGBrMGWr7nTC8HPS
TLSH
T1C015E02DD2A810E8E4B7C1B4816A1A5AFF31387D2F2169C76974D5343F12FD0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 6a25cc7308dc8d3e1cb5d3f2c0de4188b6ec7b67d14dfa114c5fda1b6a3b8115
MD5 1bbc44f5d64af76d3dc35ae1267ab7cb
SHA1 f15feeafdbda1fcb7440e3deec47a5e19fc75c8e
SHA512 cf28e49ea84311652d3224e8e7061f31a08ab2694cb82c30b14c318a1af7f12eb651e2253850d526ab1a7ac7a199c6bbb0559c1d7edb9250183dd0d09b9c64be
SSDEEP 49152:iCLHGeeV5ijCmlDWDkILATGBrMGWr7nTC8HPS:ZNKtMbTC8HP
TLSH
T1DCA56B05A7EB5184F8F3CAF5C92294169E327C549B34F7EF4A80CA6A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 612d41d8c6dd832d0f56677f0f3805d7c5e8e15df32b8dc8fc2eb751feb03733
MD5 d12e3154b4569f8f9de918efe2b32966
SHA1 89a00b9859e0f195b10a36476709ccba08aacef4
SHA512 83497214d405f6b839237e8a30ce41e1301f8cb75b590d3c35649a85fb062e1cb9275f132cc5929e2fe4e6d78cd65a2ce6fe6de8cf7d677d7b112ac941c92a9c
SSDEEP 24576:O6DIZICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:O6DIZATGBrMGWr7nTC8HPS
TLSH
T1D005020D637A50F9E06BE03DC1A30442D672B1B1976296DF179489BD4FA3EC8B93CE91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 e4a951888372c5a443059604c35fc840556c125bb80df89d78575757fa6dd495
MD5 158c3192bd1f74fadffa8a4acf9e99f2
SHA1 62ad8f89298ff9e48c9c4502fa16c398c30cb8e7
SHA512 60177b39e40bf77a4db3091ddb450885341c4d70c372a8dd2643a8eee5fc73949e9a9bc02848ab65af14ac4b5f2266f2146472bfcd91be68afa700389143dcc4
SSDEEP 12288:EG6kyLX4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYbs:VtyLIICgpB5GBrMVyJWrwgh5AQorrYWR
TLSH
T1E5F412059394E4E8F96E907C997285909F35BC202B60C3DF6650AF7E1F367C4BA34B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 16e2b311e63f03d8a7f606e00f5095827e6c17f884f171aa7c24bb80500c749b
MD5 4b2548e8937db7c6f0c13a881749d95d
SHA1 80534d35651e0b03f3f77391ac88593553401d29
SHA512 c73bcd942f3d9f079b9ef3fd1adc454d8dc00d3bd5d45d1fe1bda6b61578395c95a0060c17a2e802475ce67ca17ef9d6f569fdf4c8a328a5a55e828a154f827a
SSDEEP 12288:5t/9m4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:f/TICgpB5GBrMVyJWrwgh5AQorrYWbJb
TLSH
T109D4230AD165E8ACFC0EF47C60714C819E34B6A527A0D3EFB7041EBD4A3A7C463799A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 27c6a594de471604c8af09eb5a3f2331016f7e43ed1c79c081b3bb1aa0583600
MD5 41cd55a8c7cb8835ef95cf4dd6f1ea46
SHA1 f1dbb0bfeb1f7876b2880a66dabf5500c75902f2
SHA512 1d4b38a45eebebeafd1c186f312039084346e43416ca9fa2a6a717dd2d95b283b3b1b2e4d8720921a2ad45baea65fdaa7f6475a4bd9f43fba04927054cb6f6d4
SSDEEP 24576:EDgCLoTfaidZe8ICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:GghTrZe8ATGBrMGWr7nTC8HPS
TLSH
T1BF559D1DA3EA05DAE2B2D179D8725493D633B4311772C6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 de562977938496630ef3e9a56a90a543abd9357d9bbf9353d35d9cd0f2b07a98
MD5 57a4489d1a562b30690b7db2703cc13e
SHA1 d9226db8b8ece1c18678a2f18510b184bf2b443c
SHA512 6e229d55fccc044d7a18bce6ffd12cc1b09fe90e69f17543b6690461557fa94b3e4dfdee2e3acabfba6f275bf5e231621c4a00a5743fb40a3e88861aaff38588
SSDEEP 24576:TrcmR4ICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:vcmR4ATGBrMGWr7nTC8HPS
TLSH
T1D505F10EB2AE40F5E17BD13C88514945FA73B070276293DF52608B7E4E27AE97E38B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 e45952a7ed827f90e8e998f50a2d70c405447c78e1d7781e3b1628aa6eedc21f
MD5 484b978aee3337fdda0cd400659c9134
SHA1 04afda239bfd52a69cdb6a84d185f3f1c2db5720
SHA512 52eb981bdbd6fb9fbdda21fc9fb908f9ae608ba6a93f0e4fb7d8f6d27b9e6152d8e1845652a2de3dd10765b93177405d3444106f82b14336b3b1696e13746466
SSDEEP 49152:QDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3HHATGBrMGWr7nTC8HPS:93Upow8sB3KtMbTC8HP
TLSH
T17EA58C3DA2E800A8D8AAC379C54213A6EA71742E3F3055DB0174C578BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 ff158e4a44fa63749b9ef10c5c1325c0a31473e7cdbfa62478e8f5f5ab5c3f0c
MD5 c10ce2511b9d25c603e352643e4e76ec
SHA1 97c0425a8b05b29083b771c55cea927f49ecf5c9
SHA512 0c2e35c6284df70c06105e8ef493740317e2c8f5988466d30efb4c03b9d71fb70964d4a538178fbe8dbd865bdbbeb2ab2382ebfdddb6f877ff7f2fc5fd8091e7
SSDEEP 24576:JPUr+NQHFICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:JJQHFATGBrMGWr7nTC8HPS
TLSH
T16C05E11F62A91CE9F67AE17C85928609FB71B4621751D2CF0290817E0F27ED8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-25-0x0000020F8DE20000-0x0000020F8DFAF000-memory.dmp

Download

memory/244-28-0x0000020F8E0D0000-0x0000020F8E136000-memory.dmp

Download

memory/244-27-0x0000020F8E0D0000-0x0000020F8E136000-memory.dmp

Download

memory/244-26-0x0000020F8E0D0000-0x0000020F8E136000-memory.dmp

Download

memory/792-325-0x000001F84A400000-0x000001F84A466000-memory.dmp

Download

memory/792-326-0x000001F84A400000-0x000001F84A466000-memory.dmp

Download

memory/792-324-0x00007FF711FD0000-0x00007FF712165000-memory.dmp

Download

memory/2196-315-0x00007FF6C5A90000-0x00007FF6C5D33000-memory.dmp

Download

memory/2196-317-0x0000019E0DBD0000-0x0000019E0DC36000-memory.dmp

Download

memory/2196-316-0x0000019E0DBD0000-0x0000019E0DC36000-memory.dmp

Download

memory/2388-370-0x00007FF7A5BF0000-0x00007FF7A6007000-memory.dmp

Download

memory/2388-294-0x00000140EF540000-0x00000140EF5A6000-memory.dmp

Download

memory/2388-299-0x00007FF7A5BF0000-0x00007FF7A6007000-memory.dmp

Download

memory/2388-295-0x00000140EF540000-0x00000140EF5A6000-memory.dmp

Download

memory/2416-340-0x00007FF7E9580000-0x00007FF7E98A1000-memory.dmp

Download

memory/2416-332-0x00007FF7E9580000-0x00007FF7E98A1000-memory.dmp

Download

memory/2416-333-0x00000270427D0000-0x0000027042836000-memory.dmp

Download

memory/2416-338-0x00000270427D0000-0x0000027042836000-memory.dmp

Download

memory/2416-334-0x00000270427D0000-0x0000027042836000-memory.dmp

Download

memory/2684-283-0x00007FF7AA6D0000-0x00007FF7AA799000-memory.dmp

Download

memory/2684-234-0x0000023B795F0000-0x0000023B79656000-memory.dmp

Download

memory/2684-233-0x0000023B795F0000-0x0000023B79656000-memory.dmp

Download

memory/2684-232-0x00007FF7AA6D0000-0x00007FF7AA799000-memory.dmp

Download

memory/2924-373-0x0000025177230000-0x0000025177296000-memory.dmp

Download

memory/2924-372-0x0000025177230000-0x0000025177296000-memory.dmp

Download

memory/2924-371-0x00007FF6635E0000-0x00007FF66370F000-memory.dmp

Download

memory/3152-261-0x00007FF627EB0000-0x00007FF627FFA000-memory.dmp

Download

memory/3152-264-0x00000258C9DE0000-0x00000258C9E46000-memory.dmp

Download

memory/3152-263-0x00000258C9DE0000-0x00000258C9E46000-memory.dmp

Download

memory/3152-313-0x00007FF627EB0000-0x00007FF627FFA000-memory.dmp

Download

memory/3192-51-0x0000021EEF410000-0x0000021EEF476000-memory.dmp

Download

memory/3192-46-0x0000021EEF410000-0x0000021EEF476000-memory.dmp

Download

memory/3192-45-0x0000021EEF410000-0x0000021EEF476000-memory.dmp

Download

memory/3192-44-0x00007FF7EE740000-0x00007FF7EE8A8000-memory.dmp

Download

memory/3192-53-0x00007FF7EE740000-0x00007FF7EE8A8000-memory.dmp

Download

memory/3544-271-0x0000000000990000-0x00000000009F9000-memory.dmp

Download

memory/3544-270-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3544-323-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3932-57-0x000001D861FF0000-0x000001D862056000-memory.dmp

Download

memory/3932-56-0x000001D861D30000-0x000001D861EBF000-memory.dmp

Download

memory/3932-58-0x000001D861FF0000-0x000001D862056000-memory.dmp

Download

memory/4604-303-0x00007FF625FF0000-0x00007FF62610A000-memory.dmp

Download

memory/4604-250-0x00000227EB4A0000-0x00000227EB506000-memory.dmp

Download

memory/4604-251-0x00000227EB4A0000-0x00000227EB506000-memory.dmp

Download

memory/4604-249-0x00007FF625FF0000-0x00007FF62610A000-memory.dmp

Download

memory/4876-366-0x00007FF6C10A0000-0x00007FF6C114E000-memory.dmp

Download

memory/4876-286-0x00000216A36E0000-0x00000216A3746000-memory.dmp

Download

memory/4876-285-0x00000216A36E0000-0x00000216A3746000-memory.dmp

Download

memory/4876-284-0x00007FF6C10A0000-0x00007FF6C114E000-memory.dmp

Download

memory/4896-280-0x00007FF7C47F0000-0x00007FF7C4F34000-memory.dmp

Download

memory/4896-365-0x00007FF7C47F0000-0x00007FF7C4F34000-memory.dmp

Download

memory/4896-275-0x00000227F9960000-0x00000227F99C6000-memory.dmp

Download

memory/4896-276-0x00000227F9960000-0x00000227F99C6000-memory.dmp

Download

memory/4960-34-0x00000211586B0000-0x000002115883F000-memory.dmp

Download

memory/4960-35-0x0000021158960000-0x00000211589C6000-memory.dmp

Download

memory/4960-37-0x0000021158960000-0x00000211589C6000-memory.dmp

Download

memory/5084-304-0x00007FF6C8280000-0x00007FF6C8334000-memory.dmp

Download

memory/5084-306-0x000002D9F8270000-0x000002D9F82D6000-memory.dmp

Download

memory/5084-378-0x00007FF6C8280000-0x00007FF6C8334000-memory.dmp

Download

memory/5084-305-0x000002D9F8270000-0x000002D9F82D6000-memory.dmp

Download

memory/5092-22-0x00007FF7329A0000-0x00007FF732D7E000-memory.dmp

Download

memory/5092-3-0x0000023821920000-0x0000023821986000-memory.dmp

Download

memory/5092-1-0x0000023821920000-0x0000023821986000-memory.dmp

Download

memory/5092-0-0x00007FF7329A0000-0x00007FF732D7E000-memory.dmp

Download

memory/5092-20-0x0000023821920000-0x0000023821986000-memory.dmp

Download

memory/5296-351-0x0000020E276D0000-0x0000020E27736000-memory.dmp

Download

memory/5296-352-0x0000020E276D0000-0x0000020E27736000-memory.dmp

Download

memory/5296-356-0x00007FF7EB250000-0x00007FF7EB721000-memory.dmp

Download

memory/5472-345-0x000001EB95950000-0x000001EB959B6000-memory.dmp

Download

memory/5472-344-0x000001EB95950000-0x000001EB959B6000-memory.dmp

Download

memory/5472-343-0x00007FF652560000-0x00007FF6527EB000-memory.dmp

Download

memory/5748-13-0x000002588E7B0000-0x000002588E816000-memory.dmp

Download

memory/5748-14-0x000002588E7B0000-0x000002588E816000-memory.dmp

Download

memory/5748-12-0x000002588E7B0000-0x000002588E816000-memory.dmp

Download

memory/5748-11-0x00007FF7417D0000-0x00007FF7418F3000-memory.dmp

Download

memory/5748-43-0x00007FF7417D0000-0x00007FF7418F3000-memory.dmp

Download

memory/5780-241-0x00007FF7AA6D0000-0x00007FF7AA799000-memory.dmp

Download

memory/5780-293-0x00007FF7AA6D0000-0x00007FF7AA799000-memory.dmp

Download

memory/5780-243-0x0000024615E60000-0x0000024615EC6000-memory.dmp

Download

memory/5780-242-0x0000024615E60000-0x0000024615EC6000-memory.dmp

Download

memory/5948-360-0x00000279E5A40000-0x00000279E5AA6000-memory.dmp

Download

memory/5948-359-0x00000279E5A40000-0x00000279E5AA6000-memory.dmp

Download

memory/5948-364-0x00007FF641CF0000-0x00007FF6421F7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads