72874fe95400034ec7961c06244a5a3b8af8f1dcc348fe56a2e7884343db4eae

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 10:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_b72b9fe8a28c27cafb04a6f7c5dde12f_icedid_vidar.exe
Size 689KB
Sample260804-l4emmsxdka
SHA256 72874fe95400034ec7961c06244a5a3b8af8f1dcc348fe56a2e7884343db4eae
MD5 b72b9fe8a28c27cafb04a6f7c5dde12f
SHA1 21850c9e2b90a01b1182bde457c7ee549bdf1c78
SHA512 9fef46b7ac16d59e20087b6a5b28c4a3211128201f20fba56df5042acb75039d277594cd98058bb96ab39c4471da3947d50860d9cd4a6dac7960af00d7f5ca99
SSDEEP 12288:whBqfSLNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:gtx1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T1E0E412CB63AA31FCE1BE523984141669D7B3F43416A2E75F171802A58FE75E08D1AF38
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
4484	alg.exe
1700	elevation_service.exe
1388	elevation_service.exe
1036	maintenanceservice.exe
4456	OSE.EXE
2112	GameInputSvc.exe
4368	GameInputSvc.exe
5384	msdtc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_b72b9fe8a28c27cafb04a6f7c5dde12f_icedid_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b8bb205c8f8562d1.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_b72b9fe8a28c27cafb04a6f7c5dde12f_icedid_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4368	GameInputSvc.exe
4368	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3936	2026-08-03_b72b9fe8a28c27cafb04a6f7c5dde12f_icedid_vidar.exe
Token: SeDebugPrivilege	4484	alg.exe
Token: SeDebugPrivilege	4484	alg.exe
Token: SeTakeOwnershipPrivilege	1700	elevation_service.exe
Token: SeTcbPrivilege	2112	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 4368	2112	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-03_b72b9fe8a28c27cafb04a6f7c5dde12f_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_b72b9fe8a28c27cafb04a6f7c5dde12f_icedid_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3936

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4484

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1700

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1388

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1036

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4456

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4368

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5384

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
PID:5524

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:5332

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:1552

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:1036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a04b274592e0f2fcebe296ec7f90e10b1ba2feb4385881ace2e9ae58d72007ac
MD5 15d94f258775c4416f7bffcaa7e0912c
SHA1 f4e117e06064ca583ad5dc9dcca9ff9a734118ae
SHA512 c506258ade256413b3b0c187e3f26a9155ac386a4004a1ec50d6afff8aa1a550130097dd7c379dec98d03785165259e45db56c70f3e74d8240a0102ce7a2f83d
SSDEEP 49152:rb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnHadt0zYyC:53q6gjBAktUYyC
TLSH
T123D59D03F29900E9E06ED178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 5060b579abc5be8406c85ecb9bfa07b0aa2d2b674732c97973428715f6dd29b7
MD5 fa7a37ea1b6ae5039f1430d71ecf1dbb
SHA1 e1872dcf6c9248f88a84363f2669618edb8bc7dd
SHA512 ce700539463e7b6f4c9155781e4c751a611ed407112d7bdb9564b1bdd503fb167f52e2a653363b1c6b11beedbd21d6418935ceb9f14fba627364f66027e6fdea
SSDEEP 24576:oXYLDtczA/x1vudUXRpdkrmXMLZHuSwyfyC:7tcaadt0zYyC
TLSH
T11405016963E508FCED7B823DC8A18111EB73B84043A0F79B03A899754F636D85E3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 ce96bf8e2edbc29cf4d271f00603ba90aeefdf2d12886d14dfb6e91bcfa31811
MD5 c41c660ff8f14058e58532015753f366
SHA1 cfe048113d670733ceefe8c96a2b2b8d10c3798b
SHA512 f57b5615f628e76e01fb40d5b8e93c50a2a0c23568746bf60a226c93fee30a7fd52f916a999dfca6dfffe8c76911fd23993aef90ffefb98fa5bb1693ef8b6fa0
SSDEEP 12288:5mw5HEjsChNRBFgl0WDm+CONDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZ2:UwusOWhx1vudUXRpdkrmXMLZHuSwyfy
TLSH
T15705F18A33A50CFCE9BB5239854B9136F7F3F8002665D71F1360C66A5F67261AD1EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6cb9dec6a916af0e4088219750353a4cde67211842da5a8ed91240a38f240998
MD5 9084b8f856b120ad2773b4ab10a72cb6
SHA1 9de8e79940978ced75e138e0bcc221203c876c88
SHA512 e0e9b2331bbf45cd296d46ee4ef20956a188df77a4b44d55fbd6e54aa6777ad74c08885a864e8ab6854dbe98b9b94b1e510868093362bf61b18e71167239fd74
SSDEEP 49152:1B+taZ3usBWOBr4tEGp0bqx0z+n217aau1gleadt0zYyC:7u6JmTxd2dektUYyC
TLSH
T13AD59D13F1DA01E8D06ED079974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 af8dbb2d1f8b8e03e006c7d774c146c4cb06327640c078b5adac5ede5e9e36a8
MD5 915fce508923d355c233721061bb7ec6
SHA1 95828e593bae39032163e525fd3f3efb86ce5c4b
SHA512 cb4648ac9977c68cf7f3a2227c7f83fb7f3c0e885dfc0df705175abaddadf5768d960cfbd400aae444d0ed0f7afdbec7d37da6c420bdb1a3f611d063b896271e
SSDEEP 12288:K87uNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:3ux1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T113D423CB436B4C3CE5BE2136640D22B5EB7FF50467C5E25B700C2AB4C6E98A4C94AB5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 6ba3b32dee131268715505694104841e3134b46dd3d0d901e0ed6d215de55b2d
MD5 15d548bc265ea78ef979f7d7ace118cc
SHA1 e329d251761a998c3066a94d4459f1cb9aaa68f0
SHA512 c228d2af35a135ee1ae1c326b058409d35d7700f7d6e3d0b48e89c0fcb6342687581b11a908e754b981723406826b14c0081e237bc032813d4ee4aa60eb91474
SSDEEP 12288:J6GpNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:0Gpx1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T1D5E412DE12A764ACC47E523A541821B6FBB7F0506385E2FF1488A574CBD98F0923DE9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 192KB
SHA256 5f166a18caf4e85a28522ec57836da89d2f1b4dd4605c8bee80c470b0c5aed5d
MD5 d3b31bc7675817f34f774d863a300b04
SHA1 77802510aee5636cce22eb632e5f898330d6633b
SHA512 5377dfc857c8d051036ab87ec503d1ce35ed126991a4ec851d9c38803fce03d4c32159e19b9106ed03d220eb68e33963b8cfaa5db975eb6f92c7ff7ffc381506
SSDEEP 3072:q1wHFbFxQTSZwSjp3LcbkyzErkuYnV//VTOxY/JkEqpL3B2F8l8:OOd0SZDjWbkyzGkNdGYhqpkKl8
TLSH
T1F8141200A21C848EF5A6153A9467A4049BEC2539F7D2E3DB715D32328BEACC4D93C76F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 71ec65469b502d16efc100ba9a1ff40bf5d5b4cc0c3d7c566b40b67700976698
MD5 320f3dec629b1b733c77ca928c56ec59
SHA1 86f0ef588221a30f17d3c6b8c75195b61c7d125d
SHA512 7caa210e52704441379c592d9f2eeaf9b6c4de99c4333224d8418d495ead75e9c5b720f62d7eae387d6ac8949e6c9a1f0e46d8a5277561a0775e557c4eaaa566
SSDEEP 24576:nPUr+NQXx1vudUXRpdkrmXMLZHuSwyfyC:nJQXadt0zYyC
TLSH
T1BD05F15F22AD1CE8E67AA13D89464319F772F4511352E2CF0290817E4FA7DE8AD3EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 192KB
SHA256 9a89a76756d5f8bb92884f25665bb763846d5e37dd66cf963f99498c0e4bbbbf
MD5 d62d9ade209ecd02d04db5b18820e90d
SHA1 d16add61b8a4b12239a571fccbd5dec4d7746ede
SHA512 d295a6d66a45a8b763a34b7d2c1fea7fb81f2ee9344cf6e5b325dc9bf9ef5396cbd9bb4865cfd65b32c05dc43cf9acd7d5d674900d09fa845daefd33887e4605
SSDEEP 3072:bJkKnt0FPnA/aImwiB2ciaISS9Mpq7m/bL8CBfKvv3Rd:KS+nA/aImwJxt9Mp3bo6KHv
TLSH
T156142A7D16AC00F6D0BAD17DC9C28A0BF471346587726ACF06988AA94F37FF4903E695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 82e43050300088547f33aa5c307e6b136c42a7195db72d05de0e67076882f9ce
MD5 eb697109f88cd0ab7174c39571ce8bd5
SHA1 699f1448b22abebdcb673b35a020dfa0df9efb59
SHA512 36638c4483ee9e7d8ca0caf660d8c0e5b84ab868d62f623364d2c2e9cc6543036da4a7735ac2c3ff3819a4b657ea82a170e9f0fc308c4846cf3de359af44d555
SSDEEP 12288:L1Hck6j5ZI7vNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo3:P6DI7x1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T10BF4019D237B00F9D07B903E95820252E7B3F0609352A6DF169885B98FE3DD8B93DE45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 81edf519e6d89d72fc0cea71084567b83ead77ebbd44e67538bc4db860c68e4f
MD5 ecb9cc5c09e91bb6e98cfe45697835cb
SHA1 35a9a6e8ccfab0555a0b8ac62037c184a20f2c78
SHA512 5ae3a83d42145ecd3f377c40b1e56f9ff5b6f2d12415e5c352ca612c4efd8f272716bb656a809fcf2315a86d8a244dd07b4a126916aa5db820e428462abb5f26
SSDEEP 12288:nG6kywNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:Gtywx1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T144F4228913A954ACE5BE1239985602B0CF37FC106752E3DF2084A63D5FFAAE0A535F1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1036-291-0x000001FE37F60000-0x000001FE37FC6000-memory.dmp

Download

memory/1036-290-0x00007FF7AA0A0000-0x00007FF7AA14D000-memory.dmp

Download

memory/1036-52-0x00007FF6F8DF0000-0x00007FF6F8F58000-memory.dmp

Download

memory/1036-50-0x0000021F026C0000-0x0000021F02726000-memory.dmp

Download

memory/1036-45-0x0000021F026C0000-0x0000021F02726000-memory.dmp

Download

memory/1036-292-0x000001FE37F60000-0x000001FE37FC6000-memory.dmp

Download

memory/1036-44-0x0000021F026C0000-0x0000021F02726000-memory.dmp

Download

memory/1036-43-0x00007FF6F8DF0000-0x00007FF6F8F58000-memory.dmp

Download

memory/1388-34-0x000001D40E0E0000-0x000001D40E213000-memory.dmp

Download

memory/1388-35-0x000001D40E340000-0x000001D40E3A6000-memory.dmp

Download

memory/1388-37-0x000001D40E340000-0x000001D40E3A6000-memory.dmp

Download

memory/1388-36-0x000001D40E340000-0x000001D40E3A6000-memory.dmp

Download

memory/1552-284-0x000001D055160000-0x000001D0551C6000-memory.dmp

Download

memory/1552-282-0x00007FF7E9EB0000-0x00007FF7EA5F3000-memory.dmp

Download

memory/1552-283-0x000001D055160000-0x000001D0551C6000-memory.dmp

Download

memory/1700-27-0x000001BBE29B0000-0x000001BBE2A16000-memory.dmp

Download

memory/1700-28-0x000001BBE29B0000-0x000001BBE2A16000-memory.dmp

Download

memory/1700-26-0x000001BBE29B0000-0x000001BBE2A16000-memory.dmp

Download

memory/1700-25-0x000001BBE27A0000-0x000001BBE28D3000-memory.dmp

Download

memory/2112-232-0x00007FF6AF5A0000-0x00007FF6AF668000-memory.dmp

Download

memory/2112-233-0x000001A1270B0000-0x000001A127116000-memory.dmp

Download

memory/2112-234-0x000001A1270B0000-0x000001A127116000-memory.dmp

Download

memory/3936-22-0x00007FF65E8C0000-0x00007FF65E9AA000-memory.dmp

Download

memory/3936-19-0x000002B847300000-0x000002B847366000-memory.dmp

Download

memory/3936-0-0x00007FF65E8C0000-0x00007FF65E9AA000-memory.dmp

Download

memory/3936-2-0x000002B847300000-0x000002B847366000-memory.dmp

Download

memory/3936-3-0x000002B847300000-0x000002B847366000-memory.dmp

Download

memory/3936-1-0x000002B847300000-0x000002B847366000-memory.dmp

Download

memory/4368-239-0x00007FF6AF5A0000-0x00007FF6AF668000-memory.dmp

Download

memory/4368-243-0x000002AF9B420000-0x000002AF9B486000-memory.dmp

Download

memory/4368-242-0x000002AF9B420000-0x000002AF9B486000-memory.dmp

Download

memory/4456-56-0x000001B75F760000-0x000001B75F7C6000-memory.dmp

Download

memory/4456-55-0x000001B75F500000-0x000001B75F633000-memory.dmp

Download

memory/4456-57-0x000001B75F760000-0x000001B75F7C6000-memory.dmp

Download

memory/4484-11-0x00007FF6D2E10000-0x00007FF6D2F32000-memory.dmp

Download

memory/4484-12-0x00000181F9170000-0x00000181F91D6000-memory.dmp

Download

memory/4484-13-0x00000181F9170000-0x00000181F91D6000-memory.dmp

Download

memory/4484-14-0x00000181F9170000-0x00000181F91D6000-memory.dmp

Download

memory/4484-61-0x00007FF6D2E10000-0x00007FF6D2F32000-memory.dmp

Download

memory/5332-270-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5332-271-0x0000000000A20000-0x0000000000A89000-memory.dmp

Download

memory/5332-276-0x0000000000A20000-0x0000000000A89000-memory.dmp

Download

memory/5384-250-0x000001C94FD60000-0x000001C94FDC6000-memory.dmp

Download

memory/5384-249-0x00007FF798770000-0x00007FF798889000-memory.dmp

Download

memory/5384-251-0x000001C94FD60000-0x000001C94FDC6000-memory.dmp

Download

memory/5524-264-0x00000272921F0000-0x0000027292256000-memory.dmp

Download

memory/5524-263-0x00000272921F0000-0x0000027292256000-memory.dmp

Download

memory/5524-261-0x00007FF77A770000-0x00007FF77A8B9000-memory.dmp

Download