188e77433357d3db075169886475c4db7da0f1572118e67602c40367d4438f7e

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 04:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_0881eb5a8efb6e67c6a17afc61f145db_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Size 1.6MB
Sample260808-escwcabf82
SHA256 188e77433357d3db075169886475c4db7da0f1572118e67602c40367d4438f7e
MD5 0881eb5a8efb6e67c6a17afc61f145db
SHA1 8aa077f46fa754856260d4677d40a12d7c2d3a58
SHA512 1119781ebb34e759e623f6191c259d9088331b6f85911e4d2b00ffa090c02e5c3bc17e0b718b300a917fe3964dcda43788326136b472b1de3ae63fb1545144d0
SSDEEP 49152:aHs5/4aWEzVHEh2bK2pTETMcA7Jckdwi3N7+WTW3:aHm02RRPdwi3Q
TLSH
T15985BF07B69600FCD06DC1B8CB169532EAB1B8850F71BADF1390A3692E76AE45F3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
1736	alg.exe
1824	elevation_service.exe
2744	elevation_service.exe
1440	maintenanceservice.exe
4144	OSE.EXE
1096	GameInputSvc.exe
1116	GameInputSvc.exe
5828	msdtc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_0881eb5a8efb6e67c6a17afc61f145db_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_0881eb5a8efb6e67c6a17afc61f145db_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b3b89e2524febf98.bin	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	540	2026-08-08_0881eb5a8efb6e67c6a17afc61f145db_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	1736	alg.exe
Token: SeDebugPrivilege	1736	alg.exe
Token: SeTakeOwnershipPrivilege	1824	elevation_service.exe
Token: SeTcbPrivilege	1096	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1116	1096	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-08_0881eb5a8efb6e67c6a17afc61f145db_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_0881eb5a8efb6e67c6a17afc61f145db_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:540

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1736

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1824

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2744

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1440

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4144

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:1116

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
PID:5828

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
PID:1640

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:3908

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:2940

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:3160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 dc929650a2c4bc8f2576f6b688d8389aaa72b1a3e953acdaf8bef315344768e9
MD5 e2b942b2300142bb46c2a58cc6eb9840
SHA1 bdc7a597d429568ed5721849e56bb6b8329bbaf7
SHA512 8e38cd7fd6f56962fcff667ecfcf3c8cf5d27794aad154f0384dc6167d45281b2c396156463a8dfd4435592a96a7ab8517b974a62d7f11bc2b857b7d64ee4c4a
SSDEEP 49152:guC632BuPkFKRrdE6oh7stBhuXjfS4LWxnS7Jckdwi3N7+WTW3:L3q6gjBjPdwi3Q
TLSH
T1A0D59D03F2D900E9E06AD178D7469132EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 0eb3b3b06bdd7106d75f0cdebf2e3b2735114453a44b43e07b47acace271db89
MD5 210110f56b3747685b772001f03b120a
SHA1 203a73c86b2bbd69d2681f54796534ba0a295765
SHA512 db4d830652924535c1258a85f899d5ed6508dc3a0472675a339754bf2dac631e6a519653e97c14f5f152f2bbfbd32420ed9626b8d691a02274a323064be83682
SSDEEP 24576:TXYHDxczANT7Jckdwi6i9bNrqq4E41WFpW3oRos:6xc47Jckdwi3N7+WTW3
TLSH
T112050128A3E509F9ED67C239C9B2C511EA7278514760FB8B03E496751F233846E3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 750f7a2f7a998eb26fcc832f4b0a8550546afafc30febaa173b78d13953cdabf
MD5 b4affde70e5c0d5e4cc8a2910a707690
SHA1 35d543313a0dc5e3062b86d1c648012c875009db
SHA512 2d90126e36325eea9291b19dd57cac1b2c46b62acfaacc40545a0882cedf788d34fefc16384ff3ba00544db53518a02a45eba922aca4a4a394a796e45338f40b
SSDEEP 24576:Owu+OW4T7Jckdwi6i9bNrqq4E41WFpW3oRos:OwlOR7Jckdwi3N7+WTW3
TLSH
T13205F14972A40CF9E5679239C65BC135F7F2BC022A25DB1F07A0C65A5F27351BE2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9e9405ff04d2a1c582b4b3b4d80caef120b42608d10a2d35cfcb613156986b74
MD5 cb3fb5d9af035bed6b3fd7e480fc9664
SHA1 17d5f9752b4cb65c5cddd0d476243c50dcb4bbff
SHA512 47f4e726de444cf3a53818b1bdb61f7de0b200b01b99e206367ed8103703a6191451fbe6c68813552b10c97f768189b3d31d0979fffcca93d146bd803fd46762
SSDEEP 49152:TH+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl37Jckdwi3N7+WTW3:Hu6JmTxd2dNPdwi3Q
TLSH
T1A5D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6EF0A9073552A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 d7d88c7cf3d882f187aaf3f717eb5595a4b6100bbb80b264f1924c593fb06ccf
MD5 c5e6235ecbcb93b8dd5a37c5dfdc62b8
SHA1 dcda117c7c26da3ea4ef622d0755a9edb7fc039c
SHA512 e01c53a7562b01a2ac30b2a557154c5a4047e67f00ff50ccaa741f682d8c13171d42a491c99ff6376dd5f7b907ff16a7098092e61ff57a3a615bd9469fcd3db7
SSDEEP 12288:cM7ZT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:hZT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1DED42308C3595A5BE677E231863DD264F66C3F522F54FA87874463A054293807FABF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 9df74bf959d31564e236746adf851eea3abb7a4a114baf62024f5403c49a4137
MD5 00edb332801819beea52ac9b10552036
SHA1 768683bdcf7669abbc04ca77bf2cc9c91ea2dce2
SHA512 544278b31a668b280b084e3d3f67e40781ed070c374f9250b425aab59758a1c0ddd203fae22e8b5168500dbd522a4932483152d17ce015726b2ff9c6fcacf161
SSDEEP 12288:f9G0T7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:1G0T7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T12DE4230C61AA35E9C637D331853DE5A5F9F03A512B147AEF46D0A2709B193D0773EE28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 edf339cf6b78f19e22b7ddbe55f5b46ca46f48cbea28e94cda46f2d93ec07702
MD5 ee5fc1cacaca530f45fcf37d79ffe63f
SHA1 57fcafb5e3712427f8acec8bd1667148baa53d0f
SHA512 f3068d7dd8abfba419728893be7adc1780d3e3d452a9b1cab24356608edd36cc598bf20fedead5955cd2c53f010b260b7b78b8b591ca91f416581d2dff4bdd3c
SSDEEP 12288:ZwT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:ZwT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T160D4234C824956AFD353E232823DE6A4FAA82F423B55BBC3469462A0555D3C077BBF34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 a96e1b394dcdb5ff23c080e0bf7f1f34012d7d8b4752b722c9c7e3e410aa115d
MD5 e06d9d2c2714964a2280ff57152c8a45
SHA1 956ef752957cea64f7f43fdc60ac133923d8165e
SHA512 47759f391c379706171f3febc1d803e3111a2be0f216c21cc3785a7da94466990253e0a7586a974fc4db0012230bf93e1d48f8b150e7b2ced701b6c097ef2db4
SSDEEP 24576:vPUr+NQMT7Jckdwi6i9bNrqq4E41WFpW3oRos:vJQ+7Jckdwi3N7+WTW3
TLSH
T13305F11E62AC18E5E677E13D86568719F77178621712E2CF02E0817E4F27AD4BD3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.1MB
SHA256 ca03283165bba8ebadd57412d7c59d9c7d1bfdb6a6cf026f4f3d992579cb9794
MD5 4d8bd03fa25ad5c82ac1bb98d7c72704
SHA1 2e1dc323167b8b7a63704262ebd0c7a306617717
SHA512 caa28d4af0e1721864129b37ae9f29d9cf5314befe24f728f116b25f0878fd48f01ed5b5760a86a5cbbd729e7ced980ffeaae1ece188e7886fe3be1f88a29961
SSDEEP 49152:xBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjp:SG05lO43bM
TLSH
T187A59F6E62EC11F9D1BBD17CDAC64A0BEBB23415032556CF02A486A91F27FF4693E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 b6caf0de3869854e017db0e46e2239ce04e20dd3ebaec4de533d07fbbf9f1f5f
MD5 cd72579329123e2d300d1da42b8f4351
SHA1 b94066b7feb5940ed719838dac983af4c7ecd02d
SHA512 1da12199d4e489bdbad8a58af1baa4db63e87ee748f2245633270f6978543744619efd185ccbaf916009f46d6ad06841d9236002c1567906770d73cc8ae830fb
SSDEEP 24576:gLDILT7Jckdwi6i9bNrqq4E41WFpW3oRos:gLDIX7Jckdwi3N7+WTW3
TLSH
T106F4014C637A10FAD167D03EC6934151E2B2B57197226ACF07D4C1B99EA3EC8BA3DE50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 e7dfab8f55b02f37a915fafa62e2ebd0f5ea56cd40c12c79ec8b0a1bcd0bd3a6
MD5 3d08f0a0b444ca497733e174aeda5dc9
SHA1 8510f52e729496625e117a828c038e3ed61afd89
SHA512 6672adfff96f9e684fd2bb6b955cb09736003b101fdb73cd7c97bfc43dd03a6410755c40eb1d54a0f1ca3a2546b6a0d28900499fa6dc59328373b8edd3ed50a5
SSDEEP 12288:CG6kyzT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:rtyzT7Jckdwi6i9bNrqq4E41WFpW3oRB
TLSH
T15EF41208539821D9E6779234CA7682A4EE747C216B21A7CF46D0E33D2F367C0BA75F25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/540-19-0x0000020908880000-0x00000209088E6000-memory.dmp

Download

memory/540-1-0x00007FF7CB590000-0x00007FF7CB973000-memory.dmp

Download

memory/540-22-0x00007FF7CB590000-0x00007FF7CB973000-memory.dmp

Download

memory/540-0-0x0000020908880000-0x00000209088E6000-memory.dmp

Download

memory/540-3-0x0000020908880000-0x00000209088E6000-memory.dmp

Download

memory/1096-233-0x000002110C270000-0x000002110C2D6000-memory.dmp

Download

memory/1096-232-0x00007FF7B37F0000-0x00007FF7B38B8000-memory.dmp

Download

memory/1096-234-0x000002110C270000-0x000002110C2D6000-memory.dmp

Download

memory/1116-242-0x00000289CB9A0000-0x00000289CBA06000-memory.dmp

Download

memory/1116-241-0x00007FF7B37F0000-0x00007FF7B38B8000-memory.dmp

Download

memory/1116-243-0x00000289CB9A0000-0x00000289CBA06000-memory.dmp

Download

memory/1440-50-0x0000028711470000-0x00000287114D6000-memory.dmp

Download

memory/1440-46-0x0000028711470000-0x00000287114D6000-memory.dmp

Download

memory/1440-44-0x0000028711470000-0x00000287114D6000-memory.dmp

Download

memory/1440-52-0x00007FF7F0590000-0x00007FF7F06F7000-memory.dmp

Download

memory/1440-43-0x00007FF7F0590000-0x00007FF7F06F7000-memory.dmp

Download

memory/1640-261-0x00007FF6A73F0000-0x00007FF6A7539000-memory.dmp

Download

memory/1640-263-0x000001EDE4480000-0x000001EDE44E6000-memory.dmp

Download

memory/1640-264-0x000001EDE4480000-0x000001EDE44E6000-memory.dmp

Download

memory/1736-61-0x00007FF7496B0000-0x00007FF7497D2000-memory.dmp

Download

memory/1736-13-0x000001BA17DE0000-0x000001BA17E46000-memory.dmp

Download

memory/1736-14-0x000001BA17DE0000-0x000001BA17E46000-memory.dmp

Download

memory/1736-12-0x000001BA17DE0000-0x000001BA17E46000-memory.dmp

Download

memory/1736-11-0x00007FF7496B0000-0x00007FF7497D2000-memory.dmp

Download

memory/1824-29-0x000001E0B8500000-0x000001E0B8566000-memory.dmp

Download

memory/1824-25-0x000001E0B8400000-0x000001E0B84FB000-memory.dmp

Download

memory/1824-28-0x000001E0B8500000-0x000001E0B8566000-memory.dmp

Download

memory/1824-26-0x000001E0B8500000-0x000001E0B8566000-memory.dmp

Download

memory/2744-37-0x0000021036300000-0x0000021036366000-memory.dmp

Download

memory/2744-35-0x0000021036300000-0x0000021036366000-memory.dmp

Download

memory/2744-34-0x00000210360E0000-0x00000210361DB000-memory.dmp

Download

memory/2744-36-0x0000021036300000-0x0000021036366000-memory.dmp

Download

memory/2940-283-0x00007FF634EC0000-0x00007FF635603000-memory.dmp

Download

memory/2940-284-0x0000018961060000-0x00000189610C6000-memory.dmp

Download

memory/2940-282-0x0000018961060000-0x00000189610C6000-memory.dmp

Download

memory/3160-291-0x0000024D2D3C0000-0x0000024D2D426000-memory.dmp

Download

memory/3160-292-0x0000024D2D3C0000-0x0000024D2D426000-memory.dmp

Download

memory/3160-290-0x00007FF7611E0000-0x00007FF76128D000-memory.dmp

Download

memory/3908-270-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/3908-276-0x0000000000970000-0x00000000009D9000-memory.dmp

Download

memory/3908-271-0x0000000000970000-0x00000000009D9000-memory.dmp

Download

memory/4144-57-0x000001FF17950000-0x000001FF179B6000-memory.dmp

Download

memory/4144-56-0x000001FF17950000-0x000001FF179B6000-memory.dmp

Download

memory/4144-55-0x000001FF17730000-0x000001FF1782B000-memory.dmp

Download

memory/5828-249-0x00007FF798540000-0x00007FF798659000-memory.dmp

Download

memory/5828-251-0x0000019B9BA60000-0x0000019B9BAC6000-memory.dmp

Download

memory/5828-250-0x0000019B9BA60000-0x0000019B9BAC6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads