96953ceea2d28698a75f3a28c9961ab410fc6f21ede673ca6485ef4e30cdb032

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 18:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_0d2c1edad66dcb06e5553656e122b3d9_icedid_stealc_vidar.exe
Size 752KB
Sample260905-xadc9sgp21
SHA256 96953ceea2d28698a75f3a28c9961ab410fc6f21ede673ca6485ef4e30cdb032
MD5 0d2c1edad66dcb06e5553656e122b3d9
SHA1 66a655728bdad1e8cabd44ea7363bb7aa7a3223d
SHA512 1ea6b057a985b99d27055401148b6cc9452c493a49ea0cda5113b9bc7e19db9bdf171268cf66a19b4ed3288f81f232c1d52b9d33921342a76f6ee9772decb241
SSDEEP 12288:uRbDdzT9xJkor2xuHIygWk43iLefDw+pK1fWCN5MQphTDCCRHi9me/o2WpECICmM:uR3dz5xJkqjHzgeSyftk15N+Q3XRCMWY
TLSH
T17CF4014773A521F6F1725939C8605259EB77B83107609A7F47A043B6AF232A09F3BE31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
5724	alg.exe
3800	elevation_service.exe
2824	elevation_service.exe
2984	maintenanceservice.exe
5900	OSE.EXE
4704	GameInputSvc.exe
5968	GameInputSvc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-09-04_0d2c1edad66dcb06e5553656e122b3d9_icedid_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-04_0d2c1edad66dcb06e5553656e122b3d9_icedid_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\74de030763f1d8f.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5968	GameInputSvc.exe
5968	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2156	2026-09-04_0d2c1edad66dcb06e5553656e122b3d9_icedid_stealc_vidar.exe
Token: SeDebugPrivilege	5724	alg.exe
Token: SeDebugPrivilege	5724	alg.exe
Token: SeTakeOwnershipPrivilege	3800	elevation_service.exe
Token: SeTcbPrivilege	4704	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 5968	4704	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-09-04_0d2c1edad66dcb06e5553656e122b3d9_icedid_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_0d2c1edad66dcb06e5553656e122b3d9_icedid_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2156

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:5724

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3800

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2824

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2984

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5900

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5968

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
PID:5496

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
PID:4152

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:2692

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:4468

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:2472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 33ccf4ac4c4d7d2a9952442821e9f2254586ca3df1d31b2d6b95beb11c4b784f
MD5 04e95583630af344a5bf6072061e3431
SHA1 a1c90cb6ffb77a911d8d9d4fe95245e546a09d86
SHA512 90855695b667a5cfbbad37a5e7020c552f33fb7b9e4b9e2c7242c765aa2672d470870f6d87a1d0dacf3d50021e3f66d59fbbca80cecf308f6a03d39575f86654
SSDEEP 49152:Cb+632BuPkFKRrdE6oh7stBhuXjfS4LWxno4zgcftk1DRIUOi5:k3q6gjBfIgm8DRIUO
TLSH
T1FAD59D03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 ce4fa5c76c51f87b3bc64d0fbb1e6be7d2ca12177d39c0a7725dde69d65fc762
MD5 973c740cb4ea897a2afe3b1c64343552
SHA1 a935e1ed84c5de0a58150749f37f0bae170dca1d
SHA512 b86396db8b03ec9a22ce522a99428cbba46a6e072aa186c9632b7ec70162080077217b7388424bf748c9446190391cbea3596c00a5257dffce743c6856769a8a
SSDEEP 24576:hXYroYczAPHzgeSyftk15N+Q3XRCMWmpE31W95Ga:PYcQzgcftk1DRIUOi5
TLSH
T17D05012473E009F9FD67927DC9A18116EB7378414794E78B03E48A661F233985F3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 de05e79c6189e49c4f142b88fd74da3d3f77285bffcfc5c357510216d714361a
MD5 fdbb7c347d2b95c9ad06a67bba45b4b9
SHA1 25c65e3bdc3964b7becb3a67adb3f7291023f111
SHA512 d86bd4f72bf057b54d24a7f0070b67bd74e99e338460663eec25612596cba38b985545133b10123e55025c09a52b60284925fc2259f47cf8de5cf5d6272760c9
SSDEEP 24576:uwuuOWpHzgeSyftk15N+Q3XRCMWmpE31W95Ga:uwVOYzgcftk1DRIUOi5
TLSH
T11405F14533A40CF9F662563985978136FBF3BC021A25D71F4760CA5B6F23361AE2EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4fb0dafa00bf2360cbac4e433372523af348470b40fcc7b6bd603228b9fea23f
MD5 b4d71c7bb9aafc788f39cad3e34737fc
SHA1 d326645f08132dbe4177c71310689a34d747a908
SHA512 52de987d0019ae99d27a79d907aea6661068834b1bbb9c38da2b3e03d16a53a57a7aebec7d3ff5b13ec345482add4b8c68df7aaaf6535a938d2048f54b24997c
SSDEEP 49152:5B+taZ3usBWOBr4tEGp0bqx0z+n217aau1gluzgcftk1DRIUOi5:vu6JmTxd2dOgm8DRIUO
TLSH
T188D59D13F2D901E8D06AD478974A9233FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 13053e1166c66e64ad097fdcd13444b6e70c46d36557b9f55a74e154a03567da
MD5 f2b25e42941fcca9467052b4b6c33c71
SHA1 30053d17b4d42bd23b70d938b080c368324124b1
SHA512 86f0f799cad7779334dfc757e726f33e032cc06fa33db3e43e5370271b63fedd210cb0c37f77c5a39e9a3b8ddd1e25bbeb39462b2a5726b386fd871cca092afd
SSDEEP 12288:s379uHIygWk43iLefDw+pK1fWCN5MQphTDCCRHi9me/o2WpECICmLW95GAf:OUHzgeSyftk15N+Q3XRCMWmpE31W95Ga
TLSH
T1B8D423A163544B22F2703AB785A0523D3F5FBE120B4851D3EE514BC63D202E1AFF95B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 1861f9cf9ed042b47ff793bbd1e0ded46316ab4a0aecd1217c939ef9030e978c
MD5 c4949781d79677d5051da1e22c79f574
SHA1 62446be93e01e30910fc5e484801c60d81e8877e
SHA512 9794fb82d65932af86ae2922f4768dd145ef61d9db798b1ed9d74c95e6a8554fc91215ac8d4bc8c517794a3f7809a29363636cd986d3878f3761368f283ca654
SSDEEP 12288:LBGTuHIygWk43iLefDw+pK1fWCN5MQphTDCCRHi9me/o2WpECICmLW95GAf:tGKHzgeSyftk15N+Q3XRCMWmpE31W95L
TLSH
T1B1E4226523A027A5F631A77A8470517B7EB73951070821EF89E09AB66F102F077BDCB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 6e6d6d67d0838ade8efc53ee97ca8e17ac52500a2eddfd378d88602dee33c078
MD5 1bba237af17e53e35153948b5eb85258
SHA1 7076681e244215ecf68e5a7aa6434c99403f5865
SHA512 70eb341fe64fecf1b0d467bb58b343b9e890e694bff1365b9e0435bd74ab5d2b5815df065ccd9c7d8af52ccf738b2d8715a0a7f49588a50adc7b3a98b518111a
SSDEEP 12288:+KuHIygWk43iLefDw+pK1fWCN5MQphTDCCRHi9me/o2WpECICmLW95GAf:+9HzgeSyftk15N+Q3XRCMWmpE31W95Ga
TLSH
T193D4239023644B66F3703AB74560527E6F4B5E024B8D22D3DD915F932D102F66BFA8F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 a1d2cbbc7e7ffbfeaf1978cb997dd07243fc900c98558fe2e663bf5badc934cb
MD5 209a24accbc5a98b242f1c8b8bf8c4f9
SHA1 a2dee6fad6bdfc5d5e04057f07eb71d88a1a6620
SHA512 eb088a5ebbe93494e96904309f5dee02a86578aaae2b5dbb58a5079fdc1353a5a87fbb53cbbc58d16fff0aa0cec8f64bfe3f750e42ce8c75fa19f20d5613e149
SSDEEP 24576:DPUr+NQ9HzgeSyftk15N+Q3XRCMWmpE31W95Ga:DJQ5zgcftk1DRIUOi5
TLSH
T1FA05E26F22A81CE5F676A17D8581431DF772B852071192CF02E1817E5F63AE8BE3DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 1.4MB
SHA256 1af1457210df4adba68abebc47340b5bae67051417edadd02b8d9419375f7e01
MD5 f60d6afbd83b721e84622ecf0edda58c
SHA1 b02dcea8e13373498e002e012d9fe8a420ff0961
SHA512 47568f86a30b84b3cce001f909ecce2805a0eb68c54a5b9554cee3052d88a7906ea47b961b432fc3bcf663896a9e384b95d6c0e0c3cf1b39bc13de3c11b2726e
SSDEEP 24576:QZxLMhbo6KHgFPThMOrlANeGe+z6bX17BHpV61tKFPNlDlrUz8pHIH4Sd4fIzX7N:eBCKAFbhMY4eGe+GbXzJc1tKFblwzh4W
TLSH
T12D656C6E62E801F9D0BFD16DC6878A0BEBB13426533556CF02A486B55B27FF0A53E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 89f9862f6ef14fadb513ea966148716c30b77300de99effd27bbf72f6ec6507c
MD5 81b3707eab6ed8787031c8cdb2e4b91e
SHA1 9571f035d08eb8eb9aaca064a2d3856f7d1bae58
SHA512 aadf5f0cad7f4da9e11f38da83c0dc995cc77fa5b66616d281021a7f33e0826c9afec5c9103f6ede8abf8a7cb6bfb1c995b2a755f815a00706ae6ba504385892
SSDEEP 24576:06DIxHzgeSyftk15N+Q3XRCMWmpE31W95Ga:06DI1zgcftk1DRIUOi5
TLSH
T16705015C237A01F5E177A03EC6820116E6B3B571870616DF4BD0C5BA5EA3ED8BA3CE91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 b8f4ddb92f6981334140192173697abab6dba9dd48ce0c1fd326ba53d4775077
MD5 0ea98e2c7a216a29e53508c08f2b6138
SHA1 829ded6353349567c94552d6c4da1b0c68a45ac3
SHA512 517f93e46b5a8554fc5643b5cee8c046f9d7b2b16689db0bb4e5e6aa37d7ee982eaa3f3ae9963267a2fe413b7b81307a9914649fcd79457158983dde61436981
SSDEEP 12288:cG6kyXuHIygWk43iLefDw+pK1fWCN5MQphTDCCRHi9me/o2WpECICmLW95GAf:9ty+HzgeSyftk15N+Q3XRCMWmpE31W9h
TLSH
T1BEF4120023941295F67426798A7242B99F3BBC114B0552DF9AE0EB3F2F313E0AB75B75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2156-22-0x00007FF66DAD0000-0x00007FF66DBF0000-memory.dmp

Download

memory/2156-19-0x000001BADF370000-0x000001BADF3D6000-memory.dmp

Download

memory/2156-0-0x00007FF66DAD0000-0x00007FF66DBF0000-memory.dmp

Download

memory/2156-1-0x000001BADF370000-0x000001BADF3D6000-memory.dmp

Download

memory/2156-3-0x000001BADF370000-0x000001BADF3D6000-memory.dmp

Download

memory/2156-2-0x000001BADF370000-0x000001BADF3D6000-memory.dmp

Download

memory/2472-289-0x00000231D4790000-0x00000231D47F6000-memory.dmp

Download

memory/2472-290-0x00000231D4790000-0x00000231D47F6000-memory.dmp

Download

memory/2692-270-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/2692-271-0x0000000000990000-0x00000000009F9000-memory.dmp

Download

memory/2692-276-0x0000000000990000-0x00000000009F9000-memory.dmp

Download

memory/2824-35-0x0000016C3E7B0000-0x0000016C3E816000-memory.dmp

Download

memory/2824-36-0x0000016C3E7B0000-0x0000016C3E816000-memory.dmp

Download

memory/2824-34-0x0000016C3E5F0000-0x0000016C3E685000-memory.dmp

Download

memory/2824-37-0x0000016C3E7B0000-0x0000016C3E816000-memory.dmp

Download

memory/2984-52-0x00007FF69BA10000-0x00007FF69BB78000-memory.dmp

Download

memory/2984-44-0x000002256BE30000-0x000002256BE96000-memory.dmp

Download

memory/2984-45-0x000002256BE30000-0x000002256BE96000-memory.dmp

Download

memory/2984-50-0x000002256BE30000-0x000002256BE96000-memory.dmp

Download

memory/2984-43-0x00007FF69BA10000-0x00007FF69BB78000-memory.dmp

Download

memory/3800-27-0x00000296E9460000-0x00000296E94C6000-memory.dmp

Download

memory/3800-26-0x00000296E9460000-0x00000296E94C6000-memory.dmp

Download

memory/3800-25-0x00000296E8E00000-0x00000296E8E95000-memory.dmp

Download

memory/3800-28-0x00000296E9460000-0x00000296E94C6000-memory.dmp

Download

memory/4152-263-0x000001FC9E290000-0x000001FC9E2F6000-memory.dmp

Download

memory/4152-264-0x000001FC9E290000-0x000001FC9E2F6000-memory.dmp

Download

memory/4152-261-0x00007FF6C75C0000-0x00007FF6C770A000-memory.dmp

Download

memory/4468-282-0x00000247BCE10000-0x00000247BCE76000-memory.dmp

Download

memory/4468-283-0x00000247BCE10000-0x00000247BCE76000-memory.dmp

Download

memory/4704-234-0x00000214D4ED0000-0x00000214D4F36000-memory.dmp

Download

memory/4704-232-0x00007FF697C50000-0x00007FF697D19000-memory.dmp

Download

memory/4704-233-0x00000214D4ED0000-0x00000214D4F36000-memory.dmp

Download

memory/5496-251-0x000001FAAF700000-0x000001FAAF766000-memory.dmp

Download

memory/5496-249-0x00007FF7D4570000-0x00007FF7D468A000-memory.dmp

Download

memory/5496-250-0x000001FAAF700000-0x000001FAAF766000-memory.dmp

Download

memory/5724-14-0x000001E153D70000-0x000001E153DD6000-memory.dmp

Download

memory/5724-11-0x00007FF793600000-0x00007FF793723000-memory.dmp

Download

memory/5724-12-0x000001E153D70000-0x000001E153DD6000-memory.dmp

Download

memory/5724-13-0x000001E153D70000-0x000001E153DD6000-memory.dmp

Download

memory/5724-61-0x00007FF793600000-0x00007FF793723000-memory.dmp

Download

memory/5900-57-0x00000194E5B60000-0x00000194E5BC6000-memory.dmp

Download

memory/5900-56-0x00000194E5B60000-0x00000194E5BC6000-memory.dmp

Download

memory/5900-55-0x00000194E5A70000-0x00000194E5B05000-memory.dmp

Download

memory/5968-242-0x0000016728DB0000-0x0000016728E16000-memory.dmp

Download

memory/5968-243-0x0000016728DB0000-0x0000016728E16000-memory.dmp

Download

memory/5968-241-0x00007FF697C50000-0x00007FF697D19000-memory.dmp

Download