07baebf77a8da94670c9d4bdab2671e3183acb805c4f98a0e6fc5e166e59c367

Analysis

max time kernel
145s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 12:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_1994182c4d91e57ce9b434333d41c55f_icedid_njrat_vidar.exe
Size 825KB
Sample260804-p5ynpaxsgv
SHA256 07baebf77a8da94670c9d4bdab2671e3183acb805c4f98a0e6fc5e166e59c367
MD5 1994182c4d91e57ce9b434333d41c55f
SHA1 878255b23108f78882940f3a44ae2cc8eeb11585
SHA512 ae0a830e9645bc5971a068138a925c95fa1b12ee68b4eae42eee6aa53829cdc19e3392d3fbfde15c7190a4b1864a4712ab7d853c0b253b26e38ed6922f20a9c4
SSDEEP 12288:6mw5HEjsChNnBFgl0W8m+CQodUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTW:Twu+OWM5DZ4qSywz0Tp5IgaMV7iYc+
TLSH
T10B05F14A73A80CF9E9A78638859BC536F7B3BC122A31D71F4760C61B5F273606D29760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 9 IoCs

pid	Process
1980	alg.exe
3364	elevation_service.exe
3940	elevation_service.exe
1304	maintenanceservice.exe
3404	OSE.EXE
5656	GameInputSvc.exe
3868	GameInputSvc.exe
4252	msdtc.exe
2836	PerceptionSimulationService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_1994182c4d91e57ce9b434333d41c55f_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_1994182c4d91e57ce9b434333d41c55f_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\42c78fc4e05f6396.bin	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3868	GameInputSvc.exe
3868	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2836	2026-08-03_1994182c4d91e57ce9b434333d41c55f_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	1980	alg.exe
Token: SeDebugPrivilege	1980	alg.exe
Token: SeTakeOwnershipPrivilege	3364	elevation_service.exe
Token: SeTcbPrivilege	5656	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5656 wrote to memory of 3868	5656	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-03_1994182c4d91e57ce9b434333d41c55f_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_1994182c4d91e57ce9b434333d41c55f_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2836

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1980

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3364

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3940

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1304

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3404

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5656
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3868

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4252

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2836

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:4144

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:5204

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:5644

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:4192

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:3196

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:2116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 46554003c3d008d10b6bad8f3d159406fc208b1e5a392a57b70f93953427bf49
MD5 b40064bc8bddaea6a753fab2e2893048
SHA1 c71934179abf5b05c03f11786d481fe39f761e90
SHA512 3403d52c73b60cbbd8e5c205d9d5cc10e27ca9513b3c96652b89dbae96727a30c77fd3b93d591db1429e8dd637d9b4dd4f60fa4e0475b7abd4373115735cb70f
SSDEEP 49152:mb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnkpq8pvaM0r+:Y3q6gjBng8Qi
TLSH
T170D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 ca12ff8b6dee03f995fae808952ca9a3fc3a5a8afdd8c1dc58ab93d59c5c4fdf
MD5 d49671592b0533ef02b7dc8301a91c7b
SHA1 0a64345a934d577a72f35d1221a7d0fb6083189e
SHA512 00ef968b9ab7384126439bb7bfe26984f5fb45a5bb16b39f5226c60f3c74f3b6b0b23c5856f813b373e9dbd8f70cdcf838e7f4a925d4d51bf9de4bd715df85eb
SSDEEP 24576:GXYaEtczA8DZ4qSywz0Tp5IgaMV7iYc+:ltc5pq8pvaM0r+
TLSH
T1F705F12863E408F9ED6B827CCCB6C516E63378554760E79B03A499394F237D81D3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 d51d0e50549ea08ac00901308b243fdf87f7a33266dbbff7f60162b7b50e25ad
MD5 b74cbddda67748290a8a0d76b6cb3d9c
SHA1 ede2aa59bae7c9cfe6c20690e6468333c0816f77
SHA512 8d3fad042b99f4dbfabbe2c259d91c771192cd989ac0bce9f7b9740ac7c35dd8d3e5d1515b08a25b5d2bac2c77902515bb04a090be07f35586849e4eda8f40f3
SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+CjdUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTdg:Owu+OW3DZ4qSywz0Tp5IgaMV7iYc+
TLSH
T1AD05F14A73A80CF9E9A78638859BC536F7B3BC122A31C71F4760C65B5F273606D29760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4a7bd528f93ef800e95d4e91a9e0773eb9810cced242c904bea1daee4d13961e
MD5 8840e243f91975a88b02305589b6dfb1
SHA1 ebfc33ade067bccb45a020507fcb154b3992d953
SHA512 fe2a8e0d0a4b8337a80c3449c403ca677eb1f2240d39260493cfc978a3788e5e6e8eefdc9354b38566cf2a9d9d5dc4e73bc4c9dd5b5a42f4a81922a68ede50b2
SSDEEP 49152:FB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glmpq8pvaM0r+:ru6JmTxd2dmg8Qi
TLSH
T14AD59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 954fc4815a54fc617c3e8dd4317675936cefac0e2b9c755b13b08d523a75d619
MD5 ef74acc190427489b54754686e320d63
SHA1 9df3950e8acf5eecf52fcfaf29bf58bb40bb175a
SHA512 1488e07f89669f94b6358f24345ee419b84128d9de712a0bec2ebb5daf6be2f7c38a4872e8034b759d63543571465636481814887dd8306b860124c6d42f32d4
SSDEEP 12288:cJ7AbdUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTd/mTktdSxE4:sbDZ4qSywz0Tp5IgaMV7iYc+
TLSH
T123D42385833D0966F4ADCDB8487ED72DB53F3E671A72C1EBD718A13D8C65A5018203AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 489089a76312c4472bb5e83a303ec7bb9b93803eaff11f753eb77b57f50e6675
MD5 7b79fc6254f0d0318df9fbe4d9b4b03a
SHA1 d091d3e9ee7cef63d7867f2ab4b283e73e1c7321
SHA512 3df694689020f2015d1b420854028f96caa782dc06c2a94471a6bba5527a1e863ee4fc23feeab82b57343550e03db772716c82cd02a4498fff39c61064fddbb0
SSDEEP 12288:z0GQLdUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTd/mTktdSxE4:gGhDZ4qSywz0Tp5IgaMV7iYc+
TLSH
T120E4235D21B924E8D47DCABC487A962BB43339A11731D1FF87E4E1398E55AE03034F9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 c81d029ecd00f688cf083e29425860cb5f7a8ab6a01257f3946fa88ecf7cc0e7
MD5 a2631442c2a6c8c69569a73a557bf48c
SHA1 b3efff25b485cb7878db75d341d858ec1616ea0d
SHA512 972dc92ac1435264583d22a6bda327be5ac4eb609e039805b193c3bc2340af5695d94052b42621ff55fc10f7cbe1bed1bf2512333bef3055c8922d2b34551b02
SSDEEP 12288:mYdUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTd/mTktdSxE4:mpDZ4qSywz0Tp5IgaMV7iYc+
TLSH
T1C7D42389513D05AAE599CDBC487EDB1EB4371E631773C2EBC769A1398C5AAD020303A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 768KB
SHA256 f586eea1871c5d1b0e4cb23ac8be6a3add09b08602ff10108e2ff825b259fcec
MD5 ade07f57f56629188379cfb57d230ff8
SHA1 bb22fac2081a8f39115dfa36d02805c21b290eb0
SHA512 aecdd16fd8d040ac491f3d67d9364bd43e4185d0a9b10ffe6c38342d971a25ba139c578cfc9297e9b9440fbbba51a65800783eb1d9f2dce18604e36f07fdf389
SSDEEP 12288:EZA88u8FpJqH1OQqQyizr9wA5hUo7WCmydUWIDZ69/iSywdB0T0nZ:EZJ8u8FpJqH1Vzria7/m/DZ4qSywz0T6
TLSH
T174F4D06576E101F4E47BD13889864667F6B2B8250364EFDF07AC8B551F23AE40B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 704KB
SHA256 31714356511430559f0978fc231d9f1560ff57ec23f9ea98591a3b0e9b25e286
MD5 9d86d946fa0daaaa8d479f9006ced9b8
SHA1 f6245b96b73564eb98c16cc8bc5d12509c6d3a19
SHA512 54341071df5c8efad26d851463131c0fedf3b321161f8716bf85070d7bc7af2ffee420f7a022e5cec459cf68c1202ce8f3dda5c89e01764072c7335f445f77ba
SSDEEP 12288:EZA88u8FpJqH1OQqQyizr9wA5hUo7WCmydUWIDZ69/iSywd0:EZJ8u8FpJqH1Vzria7/m/DZ4qSywu
TLSH
T14CE4DF6576E101F0D47BD1388A864663F6B2B8250364EBDF07AC8B551F23AE50B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 47a109b5ad4e1200a419107c3b8e2874ff711efeceb9e37a5e7f87c3b8914537
MD5 7de24bac103d975a13ef39e5ffd804f5
SHA1 e77f3de9a3bc5478ce8aca2efa932e15b81dc005
SHA512 808cc165b13c201fc3ec0769194db89f24d265b80b0158e7542d1c767ea512d70ee3fa2792885300b43e3fc615554914ae4d4cace4a94aae69eda8024be02103
SSDEEP 12288:JHvUrBFrEjwaQpdUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTd/mTktdSxE4:JPUr+NQ+DZ4qSywz0Tp5IgaMV7iYc+
TLSH
T1C805E11F22AD18E5E67AE17C8996870DF77278621712D2DF03A0813E4E67ED87C39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 cb82da9e615c0b65048ee8cf947eaa04b2953b97626dade8f302c8459cb5b79c
MD5 ebf77856d2a2e43d04691dea345d8f97
SHA1 70a45e3e6b1b9ba0e846d2364e6b89fd7a42908f
SHA512 db957b1e84ec504e17a3770920e43d20be95c48bf811216cf8ea852481605f948c2a918d0148068233a1da902b56e98012b313aeb31db978427fc8b08c1ec863
SSDEEP 49152:DBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjspq8pvaM0r+:sG05lO43b5g8Qi
TLSH
T194D5CF6A62EC11F9D1BBC17CD9C68A0BEBB23815033556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e07a804c6b53cadaa9d7c7fc608e06c8ea356d98515991281390d93807864299
MD5 7873b53a1458135593f6e7d392e54417
SHA1 4ad3f4f638fac0d812038fcc9bf8858da0f97bac
SHA512 7dba0bf40aa3affd990614090d249bddb9ad2c5497601819f5566a40d67d5a42efc47fadbe4446be0b6ba409a223b8ed646acde45e6657f79293a4fe5fe779f5
SSDEEP 24576:INcwHdjbyQ4nLC18lb/EOjowL7Fk7DZ4qSywz0Tp5IgaMV7iYc+:INc/zEOVHFspq8pvaM0r+
TLSH
T105857B5622E901E4F5BBE1BE897B9646FA717865133086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 8c6dd742ee920a8b8141e5b0f14479b3e53b82a1ed140703676cf5ba43c0fa80
MD5 432abb7caef9a8bb229c0eb091348e06
SHA1 df8663de037049607b0f7430a9423c54eae98fc3
SHA512 4aaadcd95c173077511c4967b10cd9a7f8edcef06d5407a7df92bfbf12e758696f86fc899b5d072f7f3a71e719fb80ebbea82e63b129a252d725d3fbfc6f9e01
SSDEEP 12288:p1Hck6j5ZI7FdUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTd/mTktdSxE4:x6DIeDZ4qSywz0Tp5IgaMV7iYc+
TLSH
T1EFF4024C237A10F9D06BD03D85974606E1B3B5B1872296DF47A8C57D8EA3ED87838F92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 f546c09ccef5d380119736e6332d0c22cec0499956d0ea0e588ce5053166f58e
MD5 eb3d5f6e56adec8f182a42ec0772d7d0
SHA1 891a9ac5d5a3f15f1551e9422fdd85f4a6556e27
SHA512 4467e65b66786c3f4c4d15c12661dd13289e68f597d8111516d9b08782bb8d067001527029daad4e6161df716ec6c5ab222759c1df65902de9e0e421afce26d6
SSDEEP 12288:qG6kyYdUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTd/mTktdSxE4:jtypDZ4qSywz0Tp5IgaMV7iYc+
TLSH
T1A1F4124853A810E5F5B9867C89778259EA367C215B32C3EF97A0E63E4E36BD03830757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 20a97695b020581a18d2fcb63a9c7aab0987df944dedb08a22c652d2010aabe1
MD5 6eaef8d190e136fdfd6386ae611cf436
SHA1 0ea14153b43a7e66f5a3dea579e30cb4dd449296
SHA512 285c8d1b597872b8384ac3eabf1076db615a6046755f147124a75cba63868b9322aeaaf265626fb8529093634ab53d85a6afc6e46672584db7e87551902d759d
SSDEEP 12288:1FCdUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTd/mTktdSxE4:LPDZ4qSywz0Tp5IgaMV7iYc+
TLSH
T1F7D4238C523D15A6E459CABC447E9B1EB0373A721B73C1FFC7A8E5398D5A6D02030B96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1304-42-0x00007FF75D990000-0x00007FF75DAF7000-memory.dmp

Download

memory/1304-43-0x000002D5F3E10000-0x000002D5F3E76000-memory.dmp

Download

memory/1304-44-0x000002D5F3E10000-0x000002D5F3E76000-memory.dmp

Download

memory/1304-51-0x00007FF75D990000-0x00007FF75DAF7000-memory.dmp

Download

memory/1304-50-0x000002D5F3E10000-0x000002D5F3E76000-memory.dmp

Download

memory/1980-14-0x0000024549F80000-0x0000024549FE6000-memory.dmp

Download

memory/1980-13-0x0000024549F80000-0x0000024549FE6000-memory.dmp

Download

memory/1980-60-0x00007FF702B50000-0x00007FF702C72000-memory.dmp

Download

memory/1980-12-0x0000024549F80000-0x0000024549FE6000-memory.dmp

Download

memory/1980-11-0x00007FF702B50000-0x00007FF702C72000-memory.dmp

Download

memory/2116-319-0x00007FF6A3180000-0x00007FF6A3422000-memory.dmp

Download

memory/2116-321-0x00000232F13E0000-0x00000232F1446000-memory.dmp

Download

memory/2116-320-0x00000232F13E0000-0x00000232F1446000-memory.dmp

Download

memory/2836-20-0x000001F450DD0000-0x000001F450E36000-memory.dmp

Download

memory/2836-262-0x000001A0B2310000-0x000001A0B2376000-memory.dmp

Download

memory/2836-263-0x000001A0B2310000-0x000001A0B2376000-memory.dmp

Download

memory/2836-0-0x000001F450B50000-0x000001F450CA4000-memory.dmp

Download

memory/2836-1-0x000001F450DD0000-0x000001F450E36000-memory.dmp

Download

memory/2836-260-0x00007FF6A1A40000-0x00007FF6A1B89000-memory.dmp

Download

memory/2836-2-0x000001F450DD0000-0x000001F450E36000-memory.dmp

Download

memory/2836-3-0x000001F450DD0000-0x000001F450E36000-memory.dmp

Download

memory/3196-309-0x00007FF7A2D40000-0x00007FF7A2DF3000-memory.dmp

Download

memory/3196-310-0x0000027846050000-0x00000278460B6000-memory.dmp

Download

memory/3196-311-0x0000027846050000-0x00000278460B6000-memory.dmp

Download

memory/3364-26-0x0000028142FC0000-0x0000028143026000-memory.dmp

Download

memory/3364-25-0x0000028142FC0000-0x0000028143026000-memory.dmp

Download

memory/3364-24-0x0000028142D40000-0x0000028142E6C000-memory.dmp

Download

memory/3364-27-0x0000028142FC0000-0x0000028143026000-memory.dmp

Download

memory/3404-56-0x000001E1F6EE0000-0x000001E1F6F46000-memory.dmp

Download

memory/3404-54-0x000001E1F6CE0000-0x000001E1F6E0C000-memory.dmp

Download

memory/3404-55-0x000001E1F6EE0000-0x000001E1F6F46000-memory.dmp

Download

memory/3868-241-0x000001C84C4D0000-0x000001C84C536000-memory.dmp

Download

memory/3868-242-0x000001C84C4D0000-0x000001C84C536000-memory.dmp

Download

memory/3868-240-0x00007FF74FCD0000-0x00007FF74FD98000-memory.dmp

Download

memory/3868-318-0x00007FF74FCD0000-0x00007FF74FD98000-memory.dmp

Download

memory/3940-35-0x00000293A3C70000-0x00000293A3CD6000-memory.dmp

Download

memory/3940-33-0x00000293A3A20000-0x00000293A3B4C000-memory.dmp

Download

memory/3940-34-0x00000293A3C70000-0x00000293A3CD6000-memory.dmp

Download

memory/3940-36-0x00000293A3C70000-0x00000293A3CD6000-memory.dmp

Download

memory/4144-269-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4144-275-0x00000000008F0000-0x0000000000959000-memory.dmp

Download

memory/4144-270-0x00000000008F0000-0x0000000000959000-memory.dmp

Download

memory/4192-299-0x000001573EFD0000-0x000001573F036000-memory.dmp

Download

memory/4192-300-0x000001573EFD0000-0x000001573F036000-memory.dmp

Download

memory/4192-298-0x00007FF649390000-0x00007FF6497A6000-memory.dmp

Download

memory/4252-248-0x00007FF6444F0000-0x00007FF644609000-memory.dmp

Download

memory/4252-249-0x000002023B0C0000-0x000002023B126000-memory.dmp

Download

memory/4252-250-0x000002023B0C0000-0x000002023B126000-memory.dmp

Download

memory/5204-283-0x00007FF7245A0000-0x00007FF724CE3000-memory.dmp

Download

memory/5204-281-0x000002BA44660000-0x000002BA446C6000-memory.dmp

Download

memory/5204-282-0x000002BA44660000-0x000002BA446C6000-memory.dmp

Download

memory/5644-289-0x00007FF6CD380000-0x00007FF6CD42D000-memory.dmp

Download

memory/5644-290-0x0000020E804F0000-0x0000020E80556000-memory.dmp

Download

memory/5644-291-0x0000020E804F0000-0x0000020E80556000-memory.dmp

Download

memory/5656-308-0x00007FF74FCD0000-0x00007FF74FD98000-memory.dmp

Download

memory/5656-233-0x00000134DC3E0000-0x00000134DC446000-memory.dmp

Download

memory/5656-232-0x00000134DC3E0000-0x00000134DC446000-memory.dmp

Download

memory/5656-231-0x00007FF74FCD0000-0x00007FF74FD98000-memory.dmp

Download