31a839919d033a80d5c95116ba3fb664b3d143e21517c1594d6e6e8927676569

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 01:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_bd643d2ba38a5568719a9131d2ecd855_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
Size 1.4MB
Sample260819-bwfvmathja
SHA256 31a839919d033a80d5c95116ba3fb664b3d143e21517c1594d6e6e8927676569
MD5 bd643d2ba38a5568719a9131d2ecd855
SHA1 4c2bb2d19c71837f6a91959f5eb56859a425483a
SHA512 a7db50577c29f798eb7190ee655eafeaa9c3d6e9f5f8380991ad657a07ea8595c6976535f3723dc1a6b2e21c0916d4bdee71a851d468fd5e81a775d612e5aacc
SSDEEP 24576:/Eqqr0VpLP7DhspWcY/0earKlWD4s7zoKgbEfFF4Oy9fWuQ:/ERGpr7FspHYb6/oU4Q
TLSH
T16A65D01BB6A900FDD029C179C7469232EA71B8460B70BAEF0391D3693E776E45F39721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
3848	alg.exe
560	elevation_service.exe
4344	elevation_service.exe
996	maintenanceservice.exe
5984	OSE.EXE
4512	GameInputSvc.exe
2556	GameInputSvc.exe
5288	msdtc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-19_bd643d2ba38a5568719a9131d2ecd855_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d1938807238bf42.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-19_bd643d2ba38a5568719a9131d2ecd855_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2556	GameInputSvc.exe
2556	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2540	2026-08-19_bd643d2ba38a5568719a9131d2ecd855_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	3848	alg.exe
Token: SeDebugPrivilege	3848	alg.exe
Token: SeTakeOwnershipPrivilege	560	elevation_service.exe
Token: SeTcbPrivilege	4512	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 2556	4512	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-19_bd643d2ba38a5568719a9131d2ecd855_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_bd643d2ba38a5568719a9131d2ecd855_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2540

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3848

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:560

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4344

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:996

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5984

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2556

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
PID:5288

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
PID:5920

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:3400

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:3976

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:5976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3405c70e63d8e053988c47e380ccc279a60ae5d475bc65cd949c6263913c4bb7
MD5 e56fd52a3aee7073f7081f57d9227ff6
SHA1 7ebd3b4690b458aee88dfe78eb47fa19a69906af
SHA512 2c8849eb77d39c5613575ef4e749b012d8a8838dce0ccc9fdfb781d692d3b6fdfb31dcc361bd91d4109b607f931420575825512f3b1101c690c049f3a5e6d010
SSDEEP 49152:eb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnp6/oU4Q:g3q6gjBA
TLSH
T134D58C03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 3f4201699002dc36f8a2ec877b34e8151c6fed7a2724015fe6df86259c41d230
MD5 b2e8109d969c9129fc42c1f4d4d3d37d
SHA1 0f6df8268358a8d7e4e6ab1793e6a6f7d51bd138
SHA512 8cadafbc7efe6b0fb6a214dc90f172b9fc331553f2d4bc415545eabb04c2bffa822f5af3fb861865ef4f24d0494580bb4963ccae9a8681339d9890688f311242
SSDEEP 24576:qXYowtczAilWD4s7zoKgbEfFF4Oy9fWuQ:vtcf6/oU4Q
TLSH
T16905F12937E408F8ED67827DD9A28112EA73B4554760E79B03D496360F332D85E3EF92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 832dfc3850faa5f2f1e6889d018acc1ff2d4e608f14f459ebb620d45ff715431
MD5 b8473bab9e059dd9dc48c665dc28d4f2
SHA1 201b68943f0ea690f1e06f6b468f67cf015922bd
SHA512 2f0900438ab190b742e989bf52c6b2f79120f27d5fb6f6073c9b216a43ba664bea22f136b4fbffb06a5d9b9c1c4da67210408903aafc78bd086d1fef5a72035d
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+CGeUFakwRubhD4PE7mMoULYGhXYDE8EfFFTasxW3yxc:uwuuOWClWD4s7zoKgbEfFF4Oy9fWuQ
TLSH
T1A305F11637A50CF8E96782398557C136F7F2B8122A20DB2F17A0C75B5F37261BD29B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 90ecf501de3454626f348ac403f8475ccd843e1f676a72463f188fc41790a9aa
MD5 9abde1da57b562a1d0a8b76befafdcfa
SHA1 69e43a54bde0ff3c72de8bed81d9fa526b7eaa1a
SHA512 7cb7729af3c36cd9b02b09a9906fba3cab406c52099cd19468b4a8cdc05bfde7066c6e155b604cb7216c31e59f9ef1e0a5a8b31dde3c206f9ce2f4354916f99f
SSDEEP 49152:2B+taZ3usBWOBr4tEGp0bqx0z+n217aau1gla6/oU4Q:Eu6JmTxd2d4
TLSH
T140D59D13F1DA01E8D06AD578974A9233F962BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 70d4be27aa91bdbce277e467112afb936ca58241dfafbb00d3c5dd2bd0448911
MD5 2db8747db0c63e2bbaf17cf03e6d6857
SHA1 4215f5c700e93813e71ebb70eda011dd3346cdfb
SHA512 a4a1c27469ae049fedf89ff82a889ef8ac49f1026e3ce8aefcbeaf2056aeda19b53e2da3f4f9ae757341436dd4bc4fae513580b971d11bd96de5b89080974fed
SSDEEP 12288:sU7WeUFakwRubhD4PE7mMoULYGhXYDE8EfFFTasxW3yxyqS5zABC3GE52Z4z:RHlWD4s7zoKgbEfFF4Oy9fWuQ
TLSH
T15CD4233322B98CA0EC3693B1712A8273B469F1358F1055BFA5C553360CB24AD7D51EAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 a2c01508a09c0c140f26dc45db6adad8f3dbd48b103bb03faf991a57ab9cb4cc
MD5 d56c15b0a0668e97e93e3c93f7ae6b27
SHA1 8170308e6e685326d151fd8ab394f87585a72571
SHA512 9918771877263d32bcda082a9e90f8c5e50c250eb3549b99a6959a58debb134fd946e215854ae23aa25a781153591842325b787b460f8b14a68e7d807cf77966
SSDEEP 12288:C2GbeUFakwRubhD4PE7mMoULYGhXYDE8EfFFTasxW3yxyqS5zABC3GE52Z4z:9GKlWD4s7zoKgbEfFF4Oy9fWuQ
TLSH
T1E2E4123B31B568E0C936C3B5746682A3B4B171318B1026FF49C593364E764F87E35EAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 576KB
SHA256 e89b6a1e85acda183b3c4e293449ea2bbe035a6edb198bd96ea4e18cc92ffc5c
MD5 9d1f49ef76762e9094ad6c872353275b
SHA1 693f4330cee7be744b25e6e45870ab63160cb601
SHA512 2b5699388bd376b90fa365d252515bd87e166494f6ad534f5ccbb18988fb2c25dd282eacc48a584edb3bcd7dea5568f4289c424c229b364d8496553013589a9f
SSDEEP 12288:iCeUFakwRubhD4PE7mMoULYGhXYDE8EfFFTasxW3yxyqS5zABC3GE52ZA:i7lWD4s7zoKgbEfFF4Oy9fWuQA
TLSH
T1A7C4232321688CA0E65147B175578253B4E4B03ACB6016F7E9CA133309E61FEBD76EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 cd34ca4d7f4040354bf3d15d280bfe20eb616dc7c1ae1552455c15479e6cb67e
MD5 bb4a8c24abbc0a6e819918a99a3a9644
SHA1 d3171703a3c27d0fdf32686f375042ace0a6149e
SHA512 1a513a643de2ba44f23db3a7d5118d658c14535e9d848031c4c15d8a06f0cfe3a46a2e1642e1c4db6b9e6cf4de7d4f7d5cd8fdf02ac0e0dd983330ce63052a17
SSDEEP 12288:1HvUrBFrEjwaQ9eUFakwRubhD4PE7mMoULYGhXYDE8EfFFTasxW3yxyqS5zABC39:1PUr+NQ8lWD4s7zoKgbEfFF4Oy9fWuQ
TLSH
T17005F12F22E91CE4E676E17D95868319F672B462071192DF02D1827E0E739ECBD39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 448KB
SHA256 2593fa472531c2162f6c97692bf0c37ddfe9f5361f2b6245c09db2d372a13918
MD5 a021ed6b36c5ebe623bd56b2c05d6412
SHA1 168a5b87eee0bcbfbae9047c617b2e8ed0e3aa6f
SHA512 7fa489fe325f15b0f7b68f1694c8f432d71b9cc60e6ab855e71082184c86f2b5bd76eafd2b3ed975fed182431da4621655100bc7bc77dba8f41bcf8573ae4af7
SSDEEP 12288:XA/5mwJxLMhbo6KHgFPmSThMOrhPTxKNV:yZxLMhbo6KHgFPThMOrlANV
TLSH
T199A44A6C16A801F5D0BEE17DCA82890FE5B134258772AACF06A486B94B37FF4513FB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 8043b88e4ab6f5db6f28836eaa415dd044c59ced3d8567847c377c961a222b1c
MD5 0b7e17616821a49eef1c2a61465fac7a
SHA1 d7de674c6f6b3d528b339a3ab7fcee8e7e2aa044
SHA512 ae9c52f49f0c7a5f31bb3145c08d3da1a78fe2da5b439fea07c4eae392fe6c6dfa4a38b896bb37a5f13369847b8da328f1b12ad3c186db0271ed38be0b55b7cf
SSDEEP 12288:p1Hck6j5ZI7CfeUFakwRubhD4PE7mMoULYGhXYDE8EfFFTasxW3yxyqS5zABC3Go:x6DIWGlWD4s7zoKgbEfFF4Oy9fWuQ
TLSH
T1F405F11E337A10F4D167D17E96834152E1B2B07187211AEF4AC4C67A4EA3EDCBD39E92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 8fbb3c182b3dda869334a816c0fec012f35f9a17573d826bb5d21e7d2f370370
MD5 443cef50a9934ca9de675859fa0dbe2d
SHA1 1c438aff93a1506dd40af010f6a6330eb28b988f
SHA512 df2b6ca3068d9a9b7e5ff899f511c48f07af590687ec7421026faf83a3e73e3f9066dd69b709e235e5c80fe7029cc1db258a60188a88e534c5e364dfa9eff396
SSDEEP 12288:HG6kyveUFakwRubhD4PE7mMoULYGhXYDE8EfFFTasxW3yxyqS5zABC3GE52Z4z:mty2lWD4s7zoKgbEfFF4Oy9fWuQ
TLSH
T1E2F4121623A454E0ED764378A66382A1E971B8308B2057EF55C1E33F1F726E8BD31F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/560-25-0x000001C07CAD0000-0x000001C07CB36000-memory.dmp

Download

memory/560-27-0x000001C07CAD0000-0x000001C07CB36000-memory.dmp

Download

memory/560-24-0x000001C07D0D0000-0x000001C07D1E9000-memory.dmp

Download

memory/560-26-0x000001C07CAD0000-0x000001C07CB36000-memory.dmp

Download

memory/996-51-0x00007FF6E6430000-0x00007FF6E6598000-memory.dmp

Download

memory/996-42-0x00007FF6E6430000-0x00007FF6E6598000-memory.dmp

Download

memory/996-43-0x000001569F8C0000-0x000001569F926000-memory.dmp

Download

memory/996-44-0x000001569F8C0000-0x000001569F926000-memory.dmp

Download

memory/996-49-0x000001569F8C0000-0x000001569F926000-memory.dmp

Download

memory/2540-19-0x000001E1A67B0000-0x000001E1A6816000-memory.dmp

Download

memory/2540-1-0x000001E1A67B0000-0x000001E1A6816000-memory.dmp

Download

memory/2540-3-0x000001E1A67B0000-0x000001E1A6816000-memory.dmp

Download

memory/2540-0-0x000001E1A65E0000-0x000001E1A66DA000-memory.dmp

Download

memory/2556-240-0x00007FF6F3230000-0x00007FF6F32F9000-memory.dmp

Download

memory/2556-241-0x000001AD74F70000-0x000001AD74FD6000-memory.dmp

Download

memory/2556-242-0x000001AD74F70000-0x000001AD74FD6000-memory.dmp

Download

memory/3400-270-0x00000000009A0000-0x0000000000A09000-memory.dmp

Download

memory/3400-269-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3400-275-0x00000000009A0000-0x0000000000A09000-memory.dmp

Download

memory/3848-60-0x00007FF6BFF10000-0x00007FF6C0033000-memory.dmp

Download

memory/3848-13-0x00000277262C0000-0x0000027726326000-memory.dmp

Download

memory/3848-14-0x00000277262C0000-0x0000027726326000-memory.dmp

Download

memory/3848-12-0x00000277262C0000-0x0000027726326000-memory.dmp

Download

memory/3848-11-0x00007FF6BFF10000-0x00007FF6C0033000-memory.dmp

Download

memory/3976-283-0x0000016D5BDF0000-0x0000016D5BE56000-memory.dmp

Download

memory/3976-282-0x00007FF7EE070000-0x00007FF7EE7B4000-memory.dmp

Download

memory/3976-281-0x0000016D5BDF0000-0x0000016D5BE56000-memory.dmp

Download

memory/4344-34-0x0000024B351F0000-0x0000024B35256000-memory.dmp

Download

memory/4344-33-0x0000024B35000000-0x0000024B35119000-memory.dmp

Download

memory/4344-35-0x0000024B351F0000-0x0000024B35256000-memory.dmp

Download

memory/4344-36-0x0000024B351F0000-0x0000024B35256000-memory.dmp

Download

memory/4512-232-0x0000016F90110000-0x0000016F90176000-memory.dmp

Download

memory/4512-231-0x00007FF6F3230000-0x00007FF6F32F9000-memory.dmp

Download

memory/4512-233-0x0000016F90110000-0x0000016F90176000-memory.dmp

Download

memory/5288-249-0x00000205F44A0000-0x00000205F4506000-memory.dmp

Download

memory/5288-250-0x00000205F44A0000-0x00000205F4506000-memory.dmp

Download

memory/5288-248-0x00007FF76FD40000-0x00007FF76FE5A000-memory.dmp

Download

memory/5920-260-0x00007FF7D1C30000-0x00007FF7D1D7A000-memory.dmp

Download

memory/5920-263-0x00000209031C0000-0x0000020903226000-memory.dmp

Download

memory/5920-262-0x00000209031C0000-0x0000020903226000-memory.dmp

Download

memory/5976-289-0x00007FF777E00000-0x00007FF777EAE000-memory.dmp

Download

memory/5976-291-0x00000237E1860000-0x00000237E18C6000-memory.dmp

Download

memory/5976-290-0x00000237E1860000-0x00000237E18C6000-memory.dmp

Download

memory/5984-54-0x000001D26E130000-0x000001D26E249000-memory.dmp

Download

memory/5984-56-0x000001D26E370000-0x000001D26E3D6000-memory.dmp

Download

memory/5984-55-0x000001D26E370000-0x000001D26E3D6000-memory.dmp

Download