e9e11a1acdfd8e6f72e5dc10a227ee6c95743cca0ad161d6a3696fdff5c2c78d

Analysis

max time kernel
146s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 11:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_c43a46895861cbc6118922ec5cd170e1_icedid_vidar.exe
Size 689KB
Sample260810-nv3zzssxes
SHA256 e9e11a1acdfd8e6f72e5dc10a227ee6c95743cca0ad161d6a3696fdff5c2c78d
MD5 c43a46895861cbc6118922ec5cd170e1
SHA1 820473e38394d0fdcb08760dfce91919f283aa36
SHA512 8ef9525245536ccd8e2f554fe0aa416be646566a3ee5d31b87afa0c4e555322e974cbde9d1a47506c2a6731e51b7d91a2632a816d4a9ab4a1be8168a02ffc88b
SSDEEP 12288:w34rfST9ggYx8ezNInZEusqJL+ro14qyGMRKXwVFH8eDBXr4rdieYT7:fc9wz+cRq70KXG9tgdieYT7
TLSH
T16EE4238BB59930F9E535523489A81804E37278301F68DB4F57ED53AA3F33EA09D35B29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
1524	alg.exe
5148	elevation_service.exe
4844	elevation_service.exe
4512	maintenanceservice.exe
4676	OSE.EXE
4840	GameInputSvc.exe
4540	GameInputSvc.exe
4884	msdtc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-10_c43a46895861cbc6118922ec5cd170e1_icedid_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-10_c43a46895861cbc6118922ec5cd170e1_icedid_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2715b5d9b05c2f27.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4540	GameInputSvc.exe
4540	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1236	2026-08-10_c43a46895861cbc6118922ec5cd170e1_icedid_vidar.exe
Token: SeDebugPrivilege	1524	alg.exe
Token: SeDebugPrivilege	1524	alg.exe
Token: SeTakeOwnershipPrivilege	5148	elevation_service.exe
Token: SeTcbPrivilege	4840	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 4540	4840	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-10_c43a46895861cbc6118922ec5cd170e1_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_c43a46895861cbc6118922ec5cd170e1_icedid_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1236

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1524

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4844

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4512

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4676

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4540

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4884

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
PID:4092

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:5904

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:3952

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:5952

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:1872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 82b3ab99726d5a144d6532b027bfa2c8288d8b77b9c681b6eff80122e00b8861
MD5 1c670241c8db5f40d807c6e9d27ed3c4
SHA1 88273078387c38fedb7d8ae0de53f5e6a7a85777
SHA512 5d0a9a68d23c94b1b764cf1320446408dc98428c78d0811a6badbbb9b0cd13d96b66ad50af93866b98acc4da5a10abfe721f38d31145fa9d70392e83fed9bbc9
SSDEEP 49152:5b+632BuPkFKRrdE6oh7stBhuXjfS4LWxn697cRq1ZYn:P3q6gjBB9cRq8n
TLSH
T193D59D03F29900E9E069D178D74A9133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 ff8078480c0df6bdf2dab4b12bd4610fd72dbe54cb4eddffd069723a68962205
MD5 6dc6b8a7865b3da3c6d7da224812930a
SHA1 2f13f3d49f0ab811fbbd86de9b478621cab5717a
SHA512 22575fb97e9a8b302e670fc5fac6b975e0be9385e9afb89d01d24e2e33474a41b01b07be507a3619c6fee9b60eb502b468220f0b0f36064bfd979119eafb46e3
SSDEEP 12288:p1XLsM/EzxK2lRq2czAR9ggYx8ezNInZEusqJL+ro14qyGMRKXwVFH8eDBXr4rd2:nXYEmFczAR9wz+cRq70KXG9tgdieYT7
TLSH
T1DA050128B7D508F9EC67823CC8A58411E733785147A4E78F03E896792F336946E7DB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 33cca2abbd49f7cb5a7363182d2e8b6016c352a26105cc7a51ed9b36c394e5b9
MD5 9182d1ff057166bd7a15fa3010dec9e0
SHA1 6eb939409a779b2daeedc8746eea616e39662970
SHA512 068f1fb50828b8b2c0caf2cfca6953de8b24d31424fa9d28d44946feccbdc5da268eb222b9b63da75c64b561a86914db352df3f234afff778c796b417d1ade8f
SSDEEP 12288:5mw5HEjsChNRBFgl0WDm+Cl9ggYx8ezNInZEusqJL+ro14qyGMRKXwVFH8eDBXrV:UwusOWu9wz+cRq70KXG9tgdieYT
TLSH
T1FD05014A76A91CF9E9665238859BC431F7F27C012A25DB0F53A4C35B6F33621BE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6c5cc94f7cb0503465106ab0f3bd8ad82c8d11988eb824b86cb8d032a4874e30
MD5 b9a14e890f4d328987215891bd16175b
SHA1 58df086516dba2ad64c6dd151fda4f10048fc7f9
SHA512 c59e39b8755e1d257df9e27eaad73cb597f4a5f0f24e15eddae181ef16dfc5eb26a385af7f09c8390fcbcac68e8eda0bc975d0c0b3f1d834c3a5a2ab29462c5b
SSDEEP 49152:0B+taZ3usBWOBr4tEGp0bqx0z+n217aau1gld97cRq1ZYn:uu6JmTxd2dd9cRq8n
TLSH
T1D3D59D13F1DA01E8D06ED178974A9233EA62BC490B34B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 3472c84f2947fbf229c5baca024723c17cd09257a34c7f58d23aba8f063bb578
MD5 48afcc5a605b8feb85444bad8ac045ea
SHA1 4298c9fc870f567419c11d945f3dbf8ecb87fb37
SHA512 92d6e66b2d941f82c166550039f59f0b292200dc7368a346b810d4b9c2d98476d73b3f6e4ab3a2ae50fe723a975ffcc981f2eaa12a7c6367448f90955f2377ac
SSDEEP 12288:KN7Y9ggYx8ezNInZEusqJL+ro14qyGMRKXwVFH8eDBXr4rdieYT7:6Y9wz+cRq70KXG9tgdieYT7
TLSH
T176D42359A85E58A6F938223455DDA820E72638A02F4CD44FF19F73A93973D606EF430F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 7874d1a5416368541eeb0ac0390af9cf4b06aacf4558e0a38761b8fe17b3740d
MD5 5b951544aa864683dcb4a193de428906
SHA1 37e256a3e57c37f7a2475de021422c359c45e6fc
SHA512 bcbcf22a9ef14caa5f62cb4486a714ab5e1a9921bccf988eb331c2df1167363ca824e6925659a834844e866f2be2251cd53ed974891746fbfc7995b94c4b2aaf
SSDEEP 12288:DsGj9ggYx8ezNInZEusqJL+ro14qyGMRKXwVFH8eDBXr4rdieYT7:AGj9wz+cRq70KXG9tgdieYT7
TLSH
T1D0E4126D68AA34E9D838533444AD6811F67134A02B1C94DF91DEB2787B73DF07AB8B0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 aaf8dedfb5e18bb3ce10bb70227384a94528af5b7a748084e9f6a54e7a2304bd
MD5 1d45e50c829707317776ddd6dc826719
SHA1 2f09934adc1cec5a2f293a947bec11e3d5f80e72
SHA512 a5aca9fdbd51113c79dfcfacf29bda2110477e29726a55ccb65ade29b18d627d6b20476dd7aad90d23bad6542754ef8e5797ba527f12eaca01025fca17c03910
SSDEEP 12288:/L9ggYx8ezNInZEusqJL+ro14qyGMRKXwVFH8eDBXr4rdieYT7:/L9wz+cRq70KXG9tgdieYT7
TLSH
T10BD42299A85E18EAE9242234559D6810E76138902F8D98CBF1DF73A83573DF17EF430E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 e152b8757d8bbf28393a0bcfec8c12f41436037f433fc1d676ebe0324ecfacb7
MD5 ce7eb6fa30b890e6e001680254a50cc1
SHA1 4a5e45fd3bcb27895d1d8f680298595f1756ae98
SHA512 3b42e748bc920a0c6fed90ab1ebb610c0c8dd5f2b3dffdeab6df5a4fa021e179e5e8e1ffa62cb2b4b62eda7fd264ac80ad6ed83f98e0b0873456c73aeb497f4a
SSDEEP 12288:THvUrBFrEjwaQi09ggYx8ezNInZEusqJL+ro14qyGMRKXwVFH8eDBXr4rdieYT7:TPUr+NQi09wz+cRq70KXG9tgdieYT7
TLSH
T19705F12F65AD1CE5E63AA13C89868609F77278621711D2CF02E5827E1F23EE4BD3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 0f7c83c8e3d374ff80b7a3f023e1982060f3acefc99218ecb45f57e2ce61a034
MD5 ea7ddddcb3e591fccd94799bb5b330f7
SHA1 43effc71c9a26f52e4d080933750c4fa8146758e
SHA512 b5fda0a35f943d10b2438430ff693b2cde7721c66eecf8c1cfe3eb1836fbbe593f0e481256438dc7776a3c90e9356673a1cc7d25b3672121de515a47d89a5973
SSDEEP 49152:RBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjL97cRq1ZYn:yG05lO43by9cRq8n
TLSH
T17CD5CF6E62EC11F9D0BBD17CD9C64A0BEBB23415032556CF02A486A91F27FF4697E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.1MB
SHA256 bd4e5804aef36a97e928e06f2755bcf244086b4faa2ddec56b4d2c4987985745
MD5 85a2dfa5294cdf7bf847ccce71aa69af
SHA1 95d4e5b3b8f6b6bb6320b451f8d9a635f457df55
SHA512 a799827c65a031c8aec9d9b10529d672a8590a22f0f2cb4c40e9d6f6b0c83eb2b743590d217b1ba81f016ec8cc738d7c34a31e49b6515ce83e1f37e4164c1dd2
SSDEEP 12288:eFKYGNca1w6n8ejbyQ4nLC18yx/oRvnC3e/EOTHxt0wLAxm7aCHd9W:rNcwHdjbyQ4nLC18lb/EOjowL7Fk
TLSH
T17A45271623E901E4F5BBE1BE89779546FAB1786513308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 264a35b8d0eebd4760405522d388a1e0783542ab016b59e2c147357badbdf93a
MD5 89144c24f99d90e9515128e67c333d22
SHA1 08737458e228371c7fe0ba30b0605bd5bbe5e62a
SHA512 760d2c38a6bfff5807d2fff552faac8f01d88f0d7bc723d32413579e652c4f1d403d4cf4786eecaeae25ca82a75f604eb3dfc659c4ca7102e6d2a3b2579df947
SSDEEP 12288:E1Hck6j5ZI78Ys9ggYx8ezNInZEusqJL+ro14qyGMRKXwVFH8eDBXr4rdieYT7:M6DI29wz+cRq70KXG9tgdieYT7
TLSH
T1B6F4015D727A10FAD03B903D86860401E2B274B0975659CF56D9D2BD6FB3EE8BD38B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 73c8334d8852c196cd03f078ebc75f89c998117fb5f46cc1daa12a7bb0202515
MD5 e5a93bbe69df9395c4af884cedf014bb
SHA1 b19ebf8f039cca636398055059629cd6c5ac4c04
SHA512 ed0ed98c59c87c87291446a5d28b559a3f07ed96ed9d89da1d629951606a63103b99984a7409339654a5a175478514b1270161015214dc37bd15405db66e7dfb
SSDEEP 12288:VG6kyG9ggYx8ezNInZEusqJL+ro14qyGMRKXwVFH8eDBXr4rdieYT7:styG9wz+cRq70KXG9tgdieYT7
TLSH
T133F41249669824E5E979123899AA8410DB317C202F5596CFA1D6F37E3F33FE0BD7070A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1236-22-0x00007FF7A0700000-0x00007FF7A07EA000-memory.dmp

Download

memory/1236-1-0x000001F2ED7C0000-0x000001F2ED826000-memory.dmp

Download

memory/1236-0-0x00007FF7A0700000-0x00007FF7A07EA000-memory.dmp

Download

memory/1236-2-0x000001F2ED7C0000-0x000001F2ED826000-memory.dmp

Download

memory/1236-20-0x000001F2ED7C0000-0x000001F2ED826000-memory.dmp

Download

memory/1236-3-0x000001F2ED7C0000-0x000001F2ED826000-memory.dmp

Download

memory/1524-61-0x00007FF6F5290000-0x00007FF6F53B2000-memory.dmp

Download

memory/1524-13-0x000001E054550000-0x000001E0545B6000-memory.dmp

Download

memory/1524-14-0x000001E054550000-0x000001E0545B6000-memory.dmp

Download

memory/1524-12-0x000001E054550000-0x000001E0545B6000-memory.dmp

Download

memory/1524-11-0x00007FF6F5290000-0x00007FF6F53B2000-memory.dmp

Download

memory/1872-300-0x0000027933FE0000-0x0000027934046000-memory.dmp

Download

memory/1872-301-0x0000027933FE0000-0x0000027934046000-memory.dmp

Download

memory/1872-299-0x00007FF7EC4A0000-0x00007FF7EC8B6000-memory.dmp

Download

memory/3952-283-0x000001B2D14E0000-0x000001B2D1546000-memory.dmp

Download

memory/3952-282-0x00007FF7E8600000-0x00007FF7E8D43000-memory.dmp

Download

memory/3952-284-0x000001B2D14E0000-0x000001B2D1546000-memory.dmp

Download

memory/4092-261-0x00007FF63FE70000-0x00007FF63FFB9000-memory.dmp

Download

memory/4092-263-0x0000017FB2B70000-0x0000017FB2BD6000-memory.dmp

Download

memory/4092-264-0x0000017FB2B70000-0x0000017FB2BD6000-memory.dmp

Download

memory/4512-45-0x000001516D430000-0x000001516D496000-memory.dmp

Download

memory/4512-43-0x00007FF610E20000-0x00007FF610F88000-memory.dmp

Download

memory/4512-52-0x00007FF610E20000-0x00007FF610F88000-memory.dmp

Download

memory/4512-44-0x000001516D430000-0x000001516D496000-memory.dmp

Download

memory/4512-50-0x000001516D430000-0x000001516D496000-memory.dmp

Download

memory/4540-241-0x00007FF6C3100000-0x00007FF6C31C8000-memory.dmp

Download

memory/4540-242-0x00000245EA270000-0x00000245EA2D6000-memory.dmp

Download

memory/4540-243-0x00000245EA270000-0x00000245EA2D6000-memory.dmp

Download

memory/4676-57-0x0000028846490000-0x00000288464F6000-memory.dmp

Download

memory/4676-56-0x0000028846490000-0x00000288464F6000-memory.dmp

Download

memory/4676-55-0x0000028846220000-0x00000288462FC000-memory.dmp

Download

memory/4840-232-0x00007FF6C3100000-0x00007FF6C31C8000-memory.dmp

Download

memory/4840-233-0x0000023C105B0000-0x0000023C10616000-memory.dmp

Download

memory/4840-234-0x0000023C105B0000-0x0000023C10616000-memory.dmp

Download

memory/4844-34-0x0000016A60250000-0x0000016A6032C000-memory.dmp

Download

memory/4844-35-0x0000016A60450000-0x0000016A604B6000-memory.dmp

Download

memory/4844-37-0x0000016A60450000-0x0000016A604B6000-memory.dmp

Download

memory/4844-36-0x0000016A60450000-0x0000016A604B6000-memory.dmp

Download

memory/4884-249-0x00007FF7F1F80000-0x00007FF7F2099000-memory.dmp

Download

memory/4884-250-0x000001A5CED60000-0x000001A5CEDC6000-memory.dmp

Download

memory/4884-251-0x000001A5CED60000-0x000001A5CEDC6000-memory.dmp

Download

memory/5148-28-0x0000023658170000-0x00000236581D6000-memory.dmp

Download

memory/5148-25-0x0000023657FC0000-0x000002365809C000-memory.dmp

Download

memory/5148-26-0x0000023658170000-0x00000236581D6000-memory.dmp

Download

memory/5148-27-0x0000023658170000-0x00000236581D6000-memory.dmp

Download

memory/5904-270-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5904-276-0x00000000009E0000-0x0000000000A49000-memory.dmp

Download

memory/5904-271-0x00000000009E0000-0x0000000000A49000-memory.dmp

Download

memory/5952-290-0x0000020B5C3F0000-0x0000020B5C456000-memory.dmp

Download

memory/5952-295-0x00007FF75C890000-0x00007FF75C93D000-memory.dmp

Download

memory/5952-291-0x0000020B5C3F0000-0x0000020B5C456000-memory.dmp

Download