85147b11ef0319b054dbadc0d36627e27f02bf8b0c12a668f94c9fb572226cf2

Analysis

max time kernel
146s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 23:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_e27df5a00c6e01b91265e115906ec785_cobalt-strike_icedid_njrat_vidar.exe
Size 840KB
Sample260816-227hmsgd69
SHA256 85147b11ef0319b054dbadc0d36627e27f02bf8b0c12a668f94c9fb572226cf2
MD5 e27df5a00c6e01b91265e115906ec785
SHA1 11120b669b1c5c266c0ed1dc4cd9e42224a6a022
SHA512 22821a3ce67d4507fb614eb120ffaabaf39541dc57e3533c10025694724df6e0c5c757a1e6e476145e13b4f5174368300eee20dc2e0a1d3e9451fbb9ca2294ea
SSDEEP 12288:B+/33npArWjfHps7MkFbNHk1oq+P2vSQRTsWRpDZAU/NmHtHcNERJmzfCYku:B+f6afy7bNX+qIYU/vGm5F
TLSH
T13A05F10A77E84CF9E957C1798CC24605E2727C494731DADF53A0027B6F23AA16E39F61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
2444	alg.exe
936	elevation_service.exe
3420	elevation_service.exe
2548	maintenanceservice.exe
2668	OSE.EXE
4272	GameInputSvc.exe
4500	GameInputSvc.exe
3572	msdtc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-16_e27df5a00c6e01b91265e115906ec785_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-16_e27df5a00c6e01b91265e115906ec785_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\48294b7c5387db0e.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4500	GameInputSvc.exe
4500	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1608	2026-08-16_e27df5a00c6e01b91265e115906ec785_cobalt-strike_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	2444	alg.exe
Token: SeDebugPrivilege	2444	alg.exe
Token: SeTakeOwnershipPrivilege	936	elevation_service.exe
Token: SeTcbPrivilege	4272	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 4500	4272	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-16_e27df5a00c6e01b91265e115906ec785_cobalt-strike_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_e27df5a00c6e01b91265e115906ec785_cobalt-strike_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1608

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2444

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:936

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3420

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2548

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2668

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4500

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
PID:3572

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
PID:2720

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:1360

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:1368

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:1876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d5a47f90b04f6ff2e516e58c6a926ef4e915cee93f670f3411f1bf0b4a643867
MD5 105392037d902a3adceb320255a52392
SHA1 42d967456c444a84932802f377cee2b44b14551c
SHA512 5bf30c42b98b02ffa29eee441c18007f39bb6e845660107905914072221d628275a692fbace9794a54b4dfe26068a653ce653bd935a00a04a5eb2fec3ebb1f2a
SSDEEP 49152:0b+632BuPkFKRrdE6oh7stBhuXjfS4LWxnNV+B33pF:u3q6gjBW2pF
TLSH
T192D59D03F2D900E9E06AD178D7469132E9A2BC890B34B6DF0790B6562F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 6c267cc3548388ab88305b7997ab5eab6561703249a35f813b21d10bc8c970ff
MD5 8d93a78f4def13d10c032dfefa6e2d4a
SHA1 69a0f86a4a069dbd1f75e52d5af1c930f19852a7
SHA512 2d301d7fb36dbfe5e15f32b94f0617b07465cbc668c91f3a5996a51cefcd974abde4296283058be40cbbe02ee521385df621f8e84cef5c2d588916c0561cd6a2
SSDEEP 12288:i1XLs2TWkxy2lRq2czAsps7MkFbNHk1oq+P2vSQRTsWRpDZAU/NmHtHcNERJmzfv:oXYKDtczAX7bNX+qIYU/vGm5F
TLSH
T1D705012877E508F8ED6B9179CCE18514E6337C558790EA8F03E4992A1F237D86E3AF41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 c7991d05450a4e17aebf8f742cdc1421e6de8cab324a6f9114846dbaac4f8659
MD5 413e4b389bcadf4da1801ee877893c5f
SHA1 d56ce7531e333a018e31150bdeab7a261c1cb20e
SHA512 9bef08927cf545d7df3ea1b0a5160b514a792b25b8000d3619c2cc1b22fc8916c8dc423387f7c10c0b0829be2d2f148e06288eca93c8f7e0c10104e6da20439b
SSDEEP 12288:5mw5HEjsChNRBFgl0WDm+Chps7MkFbNHk1oq+P2vSQRTsWRpDZAU/NmHtHcNERJr:UwusOWF7bNX+qIYU/vGm5
TLSH
T1FC05F14676E50CF8EEA7513989D78139F3F2BC012A21DB1F5760C65B6F232217D1AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9e825f34e1c131effcbafbd8153be32f7b3ded0872715a1cf2027b63fd1e8972
MD5 14ec0b35d087e45945a846fc7de88c08
SHA1 ebd5fd6f423677300f807471eb5bc995f86f30c9
SHA512 79af1629d4af3d08c55a018a891e35138f386ee2c613add42de42919a014443af6bf2fb33036930096ec16014a9fb48f61603179a70cedbb6f14bdbec26f9299
SSDEEP 49152:mB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl6V+B33pF:Uu6JmTxd2d42pF
TLSH
T1E4D59D13F1DA01E8D05ED478974A9232FA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 811cd21a74c764a9b20e767c267ea2ee4a727fd4d92a44087d7020e6631f6e6d
MD5 0341192461e2adad984b1c4f102521ad
SHA1 7491b7ca97b4f4a85698a39bc35e6f1ddda7719b
SHA512 b3975d5b880b6cda8229b5a51916182a71e00eb84a4591dbe7ac5a979d7b74c1e8d62e027f6821d6aaec142c375766683f4c7fb131861da24f712244f6610e0c
SSDEEP 12288:K57Eps7MkFbNHk1oq+P2vSQRTsWRpDZAU/NmHtHcNERJmzfCYku:q/7bNX+qIYU/vGm5F
TLSH
T170D4230296FE94D8FE9E35F10CD8172CB0227FA8C681E8DFF549115A7E60D967E42E05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 9595df031a10941d059719ff30b3697bc5cdb215d2c192bf33de721bb8471020
MD5 f6fe5c722032d68db7844f9f133381cf
SHA1 9a6824ed45ca302f66624f36da2897b5843103b7
SHA512 46b7236be9bf2d4677b7b67528e6d72d42b2371d908da9a1227dc11cb97e0e5e603e1556a4ad296ade435a4f1026aac63c44b33dc8fcda4cd1a17a83cd9bd56c
SSDEEP 12288:52GXKps7MkFbNHk1oq+P2vSQRTsWRpDZAU/NmHtHcNERJmzfCYku:YGh7bNX+qIYU/vGm5F
TLSH
T112E4221A25FA70DCDE7EA6B20CE4162CF0713EA0C741A9EF95D4513AAF54DE17A32D40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 f4cd0bd517a0ec9286e8e4fc72ddee65784b9b30f37627be8ca5eb83d5bbc386
MD5 1f305838008855b0ccf3d8e8edbc4338
SHA1 3938c392a0d4f4e85f34cdd277b2c69d2387c400
SHA512 99a45b6e435ddc5a1d1c88f5cd7e19efd4183a7ad40869c125264cf5285ef102741e347874a164ab5bf732900441351d51b1bc125792f5d6976bdeac6e771980
SSDEEP 12288:/gps7MkFbNHk1oq+P2vSQRTsWRpDZAU/NmHtHcNERJmzfCYku:/T7bNX+qIYU/vGm5F
TLSH
T14ED4234664FA94CCEF8A39F20CD42B1CA0617F54C3C2A8DFF589116A6F94DE63A72D41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 8a3d18cd5133eea95580adc09c6352e0da9d5b21cf498b51bd887418587b77ed
MD5 24fd20bc9546ba56e5b9adbe0f39b780
SHA1 c6efa90e729dfaf82e1d9e54d2cac004535e4519
SHA512 c83f243a8a98a41d95ff4149da3e5860def794ce95cdf215c7e9788a8b7bbd53405254e2e1b5c1b138bbca70cd16b8310b0b7f226b5fd2ce515e023895c3e63d
SSDEEP 12288:GHvUrBFrEjwaQBps7MkFbNHk1oq+P2vSQRTsWRpDZAU/NmHtHcNERJmzfCYku:GPUr+NQw7bNX+qIYU/vGm5F
TLSH
T11205E11F26ED18E4EA7AA17989C1471DF271B8624342D6CF02D0817E5F67EE87D3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 ab41444009c485d3f8da35c05d0fa126b53c3dd6ec28c52a4d68b017040a3256
MD5 d664d43c6b10aa06c3d61ae325feb841
SHA1 8d73873f232785e0de256d61eb7affff0b111828
SHA512 e81768d562df6d92793de9716cdadab70e74801d0b7dc4870d5dcdfe190b39a6e56d8654edf88ad7c3a832ce60bff0d460efa011d4cad4a87a4495e3603f1189
SSDEEP 49152:LBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjMV+B33pF:UG05lO43bN2pF
TLSH
T1C6D5CF6A62FC11F9D1BBD17CC9C64A0BEBB23815032556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 5ba1cf8422a6a267a1077b54cb7b93dda7c6281c375c60bce6656b60c374a1be
MD5 4a786f3db0ff965786e02f13a99be836
SHA1 4dd6e65c459a7137e748484e7462db9b67ce6384
SHA512 9f46630f0cef7718a706120cf1da406cab31599b848a596a4ae316355cd69a360f49764c8b689e9d589ff537b8c36ac73e354bb5daaf36fc4525615216c346bf
SSDEEP 12288:g1Hck6j5ZI7JQps7MkFbNHk1oq+P2vSQRTsWRpDZAU/NmHtHcNERJmzfCYku:w6DItj7bNX+qIYU/vGm5F
TLSH
T187F4010D33BA10F9D5ABE07A89C20604E1B2B9B0C35259DF46D4C57E5FA3ED8B935E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 03be932dd9d2c13bbfe1f8ee924f515ece7723b4f2588197a4ae6fd195687c2f
MD5 c2e2ecbe5b94e7a2d969ed8bb7821976
SHA1 faef169ab9081b00a4fe527e2489bb11941eb659
SHA512 f4be0f45ed94374cec541ae7152e208e52bdd7223f320f466efd72bf85c9aab065d595c907f200aa866f301640be5c95acdfc67d8080cc260cd4628a6e5a5bbd
SSDEEP 12288:KG6kygps7MkFbNHk1oq+P2vSQRTsWRpDZAU/NmHtHcNERJmzfCYku:DtyT7bNX+qIYU/vGm5F
TLSH
T141F4120563F8A0D8FEAA25B54DE20228E531BD208B4196DFA5D0A63F6F35BE57D31F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/936-25-0x0000023040F20000-0x0000023040FD3000-memory.dmp

Download

memory/936-26-0x0000023041100000-0x0000023041166000-memory.dmp

Download

memory/936-28-0x0000023041100000-0x0000023041166000-memory.dmp

Download

memory/936-27-0x0000023041100000-0x0000023041166000-memory.dmp

Download

memory/1360-276-0x0000000000980000-0x00000000009E9000-memory.dmp

Download

memory/1360-273-0x0000000000980000-0x00000000009E9000-memory.dmp

Download

memory/1360-270-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/1368-282-0x00000276C79B0000-0x00000276C7A16000-memory.dmp

Download

memory/1368-283-0x00000276C79B0000-0x00000276C7A16000-memory.dmp

Download

memory/1368-284-0x00007FF7375D0000-0x00007FF737D13000-memory.dmp

Download

memory/1608-19-0x00000197672A0000-0x0000019767306000-memory.dmp

Download

memory/1608-3-0x00000197672A0000-0x0000019767306000-memory.dmp

Download

memory/1608-2-0x00000197672A0000-0x0000019767306000-memory.dmp

Download

memory/1608-1-0x00000197672A0000-0x0000019767306000-memory.dmp

Download

memory/1608-22-0x00007FF7FCA70000-0x00007FF7FCBCF000-memory.dmp

Download

memory/1608-0-0x00007FF7FCA70000-0x00007FF7FCBCF000-memory.dmp

Download

memory/1876-291-0x0000020417670000-0x00000204176D6000-memory.dmp

Download

memory/1876-292-0x0000020417670000-0x00000204176D6000-memory.dmp

Download

memory/1876-290-0x00007FF788740000-0x00007FF7887ED000-memory.dmp

Download

memory/2444-14-0x0000028A05150000-0x0000028A051B6000-memory.dmp

Download

memory/2444-61-0x00007FF75F6D0000-0x00007FF75F7F2000-memory.dmp

Download

memory/2444-13-0x0000028A05150000-0x0000028A051B6000-memory.dmp

Download

memory/2444-12-0x0000028A05150000-0x0000028A051B6000-memory.dmp

Download

memory/2444-11-0x00007FF75F6D0000-0x00007FF75F7F2000-memory.dmp

Download

memory/2548-50-0x00000175E7E40000-0x00000175E7EA6000-memory.dmp

Download

memory/2548-52-0x00007FF796580000-0x00007FF7966E8000-memory.dmp

Download

memory/2548-44-0x00000175E7E40000-0x00000175E7EA6000-memory.dmp

Download

memory/2548-45-0x00000175E7E40000-0x00000175E7EA6000-memory.dmp

Download

memory/2548-43-0x00007FF796580000-0x00007FF7966E8000-memory.dmp

Download

memory/2668-56-0x0000022EC4910000-0x0000022EC4976000-memory.dmp

Download

memory/2668-55-0x0000022EC4850000-0x0000022EC4903000-memory.dmp

Download

memory/2668-57-0x0000022EC4910000-0x0000022EC4976000-memory.dmp

Download

memory/2720-263-0x000001C4AD740000-0x000001C4AD7A6000-memory.dmp

Download

memory/2720-264-0x000001C4AD740000-0x000001C4AD7A6000-memory.dmp

Download

memory/2720-259-0x00007FF7EE110000-0x00007FF7EE259000-memory.dmp

Download

memory/3420-34-0x000001CB10390000-0x000001CB10443000-memory.dmp

Download

memory/3420-37-0x000001CB10570000-0x000001CB105D6000-memory.dmp

Download

memory/3420-36-0x000001CB10570000-0x000001CB105D6000-memory.dmp

Download

memory/3420-35-0x000001CB10570000-0x000001CB105D6000-memory.dmp

Download

memory/3572-249-0x00007FF730F80000-0x00007FF731099000-memory.dmp

Download

memory/3572-251-0x00000249EA790000-0x00000249EA7F6000-memory.dmp

Download

memory/3572-250-0x00000249EA790000-0x00000249EA7F6000-memory.dmp

Download

memory/4272-234-0x0000013ADA870000-0x0000013ADA8D6000-memory.dmp

Download

memory/4272-232-0x00007FF7C9D30000-0x00007FF7C9DF8000-memory.dmp

Download

memory/4272-233-0x0000013ADA870000-0x0000013ADA8D6000-memory.dmp

Download

memory/4500-240-0x00007FF7C9D30000-0x00007FF7C9DF8000-memory.dmp

Download

memory/4500-243-0x000002527F6B0000-0x000002527F716000-memory.dmp

Download

memory/4500-242-0x000002527F6B0000-0x000002527F716000-memory.dmp

Download