e1e938431ad23df1ede8244772d9f95e5d8efb50ed188fdcacdb35b63265be85

Analysis

max time kernel
150s
max time network
131s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 15:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_6cb09a7af05782f96c9c44d8f81c5d4c_darkgate_elex_glassworm_mafia_remcos.exe
Size 1.5MB
Sample260511-taaetsdx7t
SHA256 e1e938431ad23df1ede8244772d9f95e5d8efb50ed188fdcacdb35b63265be85
MD5 6cb09a7af05782f96c9c44d8f81c5d4c
SHA1 cd5eccba44da9a86df4942c029f82be8b1afbdd4
SHA512 8c6cffe94d0fdb6786ef5b578325a396b6e003e4312dcc15882be5bce180bc148eef7378bafcd5788e00a2900f998e464175034a2bbbbf406dfb73ca21c92b01
SSDEEP 24576:8vrHWdZcy2OgbWdraQHznmTMV87BbkjCMvGdLt+SGS/bvF/wwrmAGNSanjh2hAVJ:Esg0WQTmTb7mGVtvtrF/wwNGNthqU
TLSH
T19575AD1277E58035F2B36731A93A931459BABCB29839840E73DC662D1FB0691CE74B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 9 IoCs

pid	Process
3204	alg.exe
5004	DiagnosticsHub.StandardCollector.Service.exe
3920	fxssvc.exe
3548	elevation_service.exe
3912	elevation_service.exe
4868	maintenanceservice.exe
3700	msdtc.exe
1932	OSE.EXE
932	PerceptionSimulationService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-11_6cb09a7af05782f96c9c44d8f81c5d4c_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-11_6cb09a7af05782f96c9c44d8f81c5d4c_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-11_6cb09a7af05782f96c9c44d8f81c5d4c_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\533f1df8cd1bad80.bin	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-11_6cb09a7af05782f96c9c44d8f81c5d4c_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-11_6cb09a7af05782f96c9c44d8f81c5d4c_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-11_6cb09a7af05782f96c9c44d8f81c5d4c_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-11_6cb09a7af05782f96c9c44d8f81c5d4c_darkgate_elex_glassworm_mafia_remcos.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164875\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-05-11_6cb09a7af05782f96c9c44d8f81c5d4c_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-11_6cb09a7af05782f96c9c44d8f81c5d4c_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_6cb09a7af05782f96c9c44d8f81c5d4c_darkgate_elex_glassworm_mafia_remcos.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5080	2026-05-11_6cb09a7af05782f96c9c44d8f81c5d4c_darkgate_elex_glassworm_mafia_remcos.exe
Token: SeAuditPrivilege	3920	fxssvc.exe
Token: SeDebugPrivilege	3204	alg.exe
Token: SeDebugPrivilege	3204	alg.exe
Token: SeDebugPrivilege	3204	alg.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-11_6cb09a7af05782f96c9c44d8f81c5d4c_darkgate_elex_glassworm_mafia_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_6cb09a7af05782f96c9c44d8f81c5d4c_darkgate_elex_glassworm_mafia_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5080

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3204

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:5004

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:440

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3920

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3548

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3912

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4868

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3700

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1932

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4c74c863027f119f75f906fbc2c738872c9d0a9792bdff36b7a063cd20df5837
MD5 e12cdabdacfa7a0f136a3c657c0dc6f0
SHA1 c30c36c17463bd24e2ca647c3beefb11e96ae22a
SHA512 1b7fa22d19bb5cd548b03b5aaa2da6d4f45e3b9188656748562b2fafd216a4a8b98887c2d419a3dc2f97d66a8261572cccf894866f0623bc096d6847e0511bcc
SSDEEP 49152:Qb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnkAtrF/wwNGNthqU:63q6gjBPAvwwNYPqU
TLSH
T113D59D03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 76b80687a7a52106275023df4ad424af1d000ad2e33e824ab2f7d6557d4f4dbf
MD5 7c208f0e113cb3f7aa1dc224511b38ab
SHA1 61c6cfdabce4747a169daa6a169227cb5dd3d341
SHA512 2d77eca4fbda33815aee3b2e6c19162efca0a447ebbff98f1fafaca7262d0fbdccd594235479b29965595dfabbf58a1e3806ca395f13a4b8518bf0b0b0a495f1
SSDEEP 24576:FXYor4czAeSGS/bvF/wwrmAGNSanjh2hAVJ:Z4cotrF/wwNGNthqU
TLSH
T1CA05022967E008F8ED5B813DDCA2C511EE73B8914760E79B03F49A251F673885E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 15b2ec25e68bc51d8d22f0e0681cfac726e3ac2dd4b6335bef3743a0d93734e9
MD5 b7635b6dc03cc6378e7af6e27232e9cc
SHA1 57e945fca4e884da2dad7341975e7764755be3f5
SHA512 15852003da0f6bcbafcdec4f7160f14c2748d2c65f90820225ebfd4546ed1e5277daf97dc5f1efc8a29bc8a087784020280b6cacb13cf2a8a2679dbc5e4f7673
SSDEEP 12288:5mw5HEjsChNRBFgl0WDm+CCt+0FJGS33fbvFpFwwrWBGGbAQ94sSak4csPB0ALZ5:UwusOWCSGS/bvF/wwrmAGNSanjh2hAV
TLSH
T1E105F14A36A40CF9EA6685398943C136FBF3B8522A21D72F4770C71B5F77311AD29B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9d95bc373062e074a70b5c3259ca0048813ab63d5785430b0c1295edb02deffc
MD5 4967ae1f651dcbf71b10513acfcf1241
SHA1 03a2997265bef934f7b572ab333e56ae13cc5698
SHA512 b181d4ba70028d817c687419425bdfc4d581b3b9f278fc57613d704191004fbf1b19c49e3853468fefb8fbb85bacafee18f7bb1374033ccd17af9f38635a8c14
SSDEEP 49152:iO+taZ3usBWOBr4tEGp0bqx0z+n217aau1glutrF/wwNGNthqU:bu6JmTxd2duvwwNYPqU
TLSH
T135D59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 2571c7ba8d8e928f951b27a3cf69db13ee16c3eb683c4be0ce528f18e0ef6763
MD5 248d70b426ae7a56595cc367c69dc127
SHA1 6af08a6ab4a74a203380cf2618750279bf21a0d1
SHA512 6c8d441cf739c10ce388d5deff337cd96cf669d78983e82420bc0954e16e31d33005720a3e9783214acb4ded0772df4f1deef298998f0f54835124ba6dc61a12
SSDEEP 3072:no5ZOTNLpT/VA5UR+Y1f2neM9RXEECQ0GjW4AoOhuoP:ocLX
TLSH
T1E5F35396C92F46BB38534BD7C3A97EA85566150F53AE191C32CF82CFA441807CA1F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 700KB
SHA256 5bd3fbfd7ecdd65c82f1f349d2e4a4d3cd792fc5597413c8b55b68d67df93f0f
MD5 822d4b9583a091adebee349b7f46eec6
SHA1 149af0e8632db3483d7a97af3e2cd01862e9d219
SHA512 043822fdc3842188d0a044dd558ee09fd001611b366d4e27588f11540aa736d80f4fba6c0594622e35a09f98d7fac1898f0a24b7a454100111dfcf1e03a8876a
SSDEEP 12288:MKxA1U7KA+0FJGS33fbvFpFwwrWBGGbAQ94sSak4csPB0ALZ9wTrlAfPln3bt:MKxA1UGDSGS/bvF/wwrmAGNSanjh2hAz
TLSH
T109E4025F19AC04E4E26995399C81C105EB73B8A25721A3EF56A0833E0F7BED45D31FD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 937aa6903ec2cb9713f8b1c71cd57a68715fffa70c4c08e0b2031922244629b4
MD5 65f7b2f6c4963748ad4aef2881115039
SHA1 b3fd96171f9f4cb78b7deb941494d7eed02dcc44
SHA512 955cd1fb677560cdbc95da28441f1d65700732f7fd2580d73e691568541e82f74743328e263336be7879ffbb92a61449a62080482954cc087f57c1e21937a2fd
SSDEEP 24576:krsmPLyHaqrVqHra44KDzM+rn+SGS/bvF/wwrmAGNSanjh2hAVJ:krRPLyHfVqzlA+rnvtrF/wwNGNthqU
TLSH
T14E55BF2EF2B900B9D4AAD136454107B5BB71B42D1F219ACB0170C635AF0AEE89F35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 824KB
SHA256 af5ee265165a099263443d57d9f0883291a7474abb718461d02312e8b738ede6
MD5 5999dcd4d767045a3894c51e7e7564fc
SHA1 741d8287dbca98f30c7ecad9fe685b0ec1370690
SHA512 8f2317da413c832c9d0b1e4356b762233c03ff9f77b39c9b61ed6b71a3abdf30032b78bc0d78cd7208b922e8627cc7b275d6610d9b2d37a5bd9fb46cde2023f4
SSDEEP 12288:/uvVmzIYNvUyBpI+0FJGS33fbvFpFwwrWBGGbAQ94sSak4csPB0ALZ9wTrlAfPlJ:gTYNHNSGS/bvF/wwrmAGNSanjh2hAVJ
TLSH
T15805F11F56AD08E4D63F917D99828205F673B8A2171192DF06B0827E0F17EE8BD3A791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 700KB
SHA256 ed6cc12c7388fa85349f8a71c618161c2de95a88445daacbf8b19f14a4b3ca3d
MD5 66100e1a2543e5054609f9703be90fd7
SHA1 252a305ab89e4a1e69d54147b0f0688f1065d324
SHA512 eaa4b0fbedc30cb1529dd1a23683c9f3254f4157e226d9a8dbce57cd193b1eb3c708149cb4bfd7410f4b90c210aac08d88d7ac8a5c9e2d9e20d0c60e34c6ebb8
SSDEEP 12288:IlYJeXm8lkcUuE/+0FJGS33fbvFpFwwrWBGGbAQ94sSak4csPB0ALZ9wTrlAfPlJ:IlYJeXm8ZUuE2SGS/bvF/wwrmAGNSanj
TLSH
T1ECE4124E29A810D8E21D8539A8528550EBB3F0F2570263FF47F0C63E4F9AAD56E35ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 756KB
SHA256 09834f736e941e59e527cef8dfae14f91d042a3cc981bb6635b68d76e28a5808
MD5 eb99f6bff06ba0c9e36fe8904dfb4e76
SHA1 45c5915cf90760c0e06a711069a724d28a85fd5a
SHA512 41c5bc556f33ea77a33e98af4181bd2bdde9a3d07b6912ea5016db48888beb4680b8d758e215e2e7f14350dc6dac3e6efd12cefb7ab3cabb4e7d6a36daec80a4
SSDEEP 12288:IH16ky4+0FJGS33fbvFpFwwrWBGGbAQ94sSak4csPB0ALZ9wTrlAfPln3bt:IVty7SGS/bvF/wwrmAGNSanjh2hAVJ
TLSH
T18AF4120A16944198E76C4A38EC5381906E77BCB14F1193FF47A0F73E5F7A784A931BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c774ec1e06a7688f6d0c4788c53ebb59df6d974e41cba2af4ce550e2feffb4c3
MD5 7dc45f35d76232f24cbaa67162d7a46f
SHA1 2adae98c94bb5c321c182bd9847f92022a755457
SHA512 b4d58898fcc4afc52ff76c2426177a792afb95314be3f2b0cccc69e67536fb1cb5b1dc6d769f7dc21e1380dc9822bd6294a6382374fa54bf4cac7803e56e250c
SSDEEP 24576:/SAwJPE1IDAo+4Kt+l4413vUQ6SGS/bvF/wwrmAGNSanjh2hAVJ:/qPCIo4Kol4dQDtrF/wwNGNthqU
TLSH
T1B655AF1AA6F946E4E17ACB74DA63C611FB737823133163CF8290853E0E16AE85E75F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 768KB
SHA256 60d2f4debe17aecc1bc6f1a67023a088b692789c40601f6f34d5440639905363
MD5 3ca27690e8271cb824ed02c38bd0e148
SHA1 ae5a6cd953582c221e1a05c970d31bfe77fe7e9f
SHA512 3fb8b10f022cb8295045ad3b2f38d61abbd048135ef483b4528d5e110d5a4bbf38a6780484c4b07fa681f83eea5b1d370646d342b1fe3d9d1bc98c6102bc399a
SSDEEP 12288:d9l/Vj3IkxjbBzw+0FJGS33fbvFpFwwrWBGGbAQ94sSak4csPB0ALZ9wTrlAfPlJ:dbV8qjpTSGS/bvF/wwrmAGNSanjh2hAz
TLSH
T18DF4124F19E40498E22C4634E812C16159B3BCF31725A6FF67D4DA3E4F79A80D93AFA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/932-122-0x0000019520D20000-0x0000019520D86000-memory.dmp

Download

memory/932-142-0x0000019521240000-0x00000195212EF000-memory.dmp

Download

memory/932-143-0x00007FF783060000-0x00007FF7831A6000-memory.dmp

Download

memory/932-121-0x00007FF783060000-0x00007FF7831A6000-memory.dmp

Download

memory/932-123-0x0000019520D20000-0x0000019520D86000-memory.dmp

Download

memory/1932-104-0x000001E9E1E10000-0x000001E9E1E76000-memory.dmp

Download

memory/1932-103-0x000001E9E1BC0000-0x000001E9E1CEF000-memory.dmp

Download

memory/1932-105-0x000001E9E1E10000-0x000001E9E1E76000-memory.dmp

Download

memory/3204-17-0x0000013AFBDC0000-0x0000013AFBE26000-memory.dmp

Download

memory/3204-78-0x00007FF6FFF20000-0x00007FF700006000-memory.dmp

Download

memory/3204-15-0x0000013AFBDC0000-0x0000013AFBE26000-memory.dmp

Download

memory/3204-131-0x0000013AFC7A0000-0x0000013AFC84F000-memory.dmp

Download

memory/3204-16-0x00007FF6FFF20000-0x00007FF700006000-memory.dmp

Download

memory/3204-18-0x0000013AFBDC0000-0x0000013AFBE26000-memory.dmp

Download

memory/3548-63-0x0000022CF7AC0000-0x0000022CF7B26000-memory.dmp

Download

memory/3548-64-0x0000022CF7AC0000-0x0000022CF7B26000-memory.dmp

Download

memory/3548-137-0x0000022CF7FF0000-0x0000022CF809F000-memory.dmp

Download

memory/3548-62-0x0000022CF7870000-0x0000022CF799F000-memory.dmp

Download

memory/3700-91-0x00007FF7E03F0000-0x00007FF7E0506000-memory.dmp

Download

memory/3700-141-0x000001E5D2110000-0x000001E5D21BF000-memory.dmp

Download

memory/3700-140-0x000001E5D1BF0000-0x000001E5D1BFC000-memory.dmp

Download

memory/3700-93-0x000001E5D1B60000-0x000001E5D1BC6000-memory.dmp

Download

memory/3700-92-0x000001E5D1B60000-0x000001E5D1BC6000-memory.dmp

Download

memory/3700-139-0x00007FF7E03F0000-0x00007FF7E0506000-memory.dmp

Download

memory/3912-71-0x000001F732490000-0x000001F7324F6000-memory.dmp

Download

memory/3912-138-0x000001F732E30000-0x000001F732EDF000-memory.dmp

Download

memory/3912-70-0x000001F732240000-0x000001F73236F000-memory.dmp

Download

memory/3912-72-0x000001F732490000-0x000001F7324F6000-memory.dmp

Download

memory/3920-51-0x00007FF7D8340000-0x00007FF7D85CA000-memory.dmp

Download

memory/3920-59-0x00007FF7D8340000-0x00007FF7D85CA000-memory.dmp

Download

memory/3920-52-0x00000188CF190000-0x00000188CF1F6000-memory.dmp

Download

memory/3920-53-0x00000188CF190000-0x00000188CF1F6000-memory.dmp

Download

memory/3920-57-0x00000188CF190000-0x00000188CF1F6000-memory.dmp

Download

memory/4868-81-0x000001A9B7280000-0x000001A9B72E6000-memory.dmp

Download

memory/4868-80-0x000001A9B7280000-0x000001A9B72E6000-memory.dmp

Download

memory/4868-88-0x00007FF7F60D0000-0x00007FF7F6238000-memory.dmp

Download

memory/4868-79-0x00007FF7F60D0000-0x00007FF7F6238000-memory.dmp

Download

memory/4868-86-0x000001A9B7280000-0x000001A9B72E6000-memory.dmp

Download

memory/5004-28-0x00007FF66C180000-0x00007FF66C266000-memory.dmp

Download

memory/5004-133-0x0000022DCB0F0000-0x0000022DCB19F000-memory.dmp

Download

memory/5004-26-0x0000022DCA6F0000-0x0000022DCA756000-memory.dmp

Download

memory/5004-120-0x00007FF66C180000-0x00007FF66C266000-memory.dmp

Download

memory/5004-29-0x0000022DCA6F0000-0x0000022DCA756000-memory.dmp

Download

memory/5080-114-0x00000000013C0000-0x000000000149F000-memory.dmp

Download

memory/5080-0-0x0000000002D00000-0x0000000002E92000-memory.dmp

Download

memory/5080-7-0x0000000002F80000-0x0000000002FE9000-memory.dmp

Download

memory/5080-6-0x0000000002F80000-0x0000000002FE9000-memory.dmp

Download

memory/5080-1-0x0000000002F80000-0x0000000002FE9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads