f1c4b93f751321afcf47f057b607ee27cfb630ef21fccd1cf327362173cccd7c

Analysis

max time kernel
145s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_8053a1f01180194492b9834fb513f33b_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Size 786KB
Sample260708-e31p6aay5x
SHA256 f1c4b93f751321afcf47f057b607ee27cfb630ef21fccd1cf327362173cccd7c
MD5 8053a1f01180194492b9834fb513f33b
SHA1 90324fb4fe8c5775e82264e971edbe21b44667ab
SHA512 3c98200459bd31ba14f015f2ee97a37b6fef2b1dbccacec9875614a9f63c2b8c0221ba66e068546d4ba1eebaa0cac471bfb698792424cc845fd7def4bbed221c
SSDEEP 24576:Sr5r+o4rvxLYp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:KP4rJLYWS1SZBnHTAsi
TLSH
T127050111B5E2C4B1E0B20A3009F49974AAFEB9714D358F2F23D85B2E1F751D19A25EB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
6068	alg.exe
2452	elevation_service.exe
5796	elevation_service.exe
2672	maintenanceservice.exe
5568	OSE.EXE
5792	GameInputSvc.exe
4164	GameInputSvc.exe
2644	msdtc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-07-08_8053a1f01180194492b9834fb513f33b_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d20893c4f4cf0ea5.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-08_8053a1f01180194492b9834fb513f33b_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120750\java.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_8053a1f01180194492b9834fb513f33b_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4164	GameInputSvc.exe
4164	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5664	2026-07-08_8053a1f01180194492b9834fb513f33b_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	6068	alg.exe
Token: SeDebugPrivilege	6068	alg.exe
Token: SeTakeOwnershipPrivilege	2452	elevation_service.exe
Token: SeTcbPrivilege	5792	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5792 wrote to memory of 4164	5792	GameInputSvc.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-07-08_8053a1f01180194492b9834fb513f33b_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_8053a1f01180194492b9834fb513f33b_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5664

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:6068

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2452

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5796

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2672

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5568

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5792
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4164

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2644

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
PID:4760

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:4512

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:4876

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:2812

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:3216

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:1240

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:4744

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:4668

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:5152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 314e8cb973a0e6a168bd503801534a9ea3f91e80feab8d2f41264e1f46f40bad
MD5 51f3e95bed127a2b20cc89006b575bde
SHA1 1b7f19b08886f73f8c58a825799891aef2dcb492
SHA512 beadb787f0f7fdc6d810e633698954b206d3192470a761df3aa600af814c86d9cb50f98dcd8c0ea749145514fe29086bb401ed057c75bfc2561e7c2fd0647bb5
SSDEEP 49152:pb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnJvWS1SZBnHTAsi:/3q6gjBScNzAz
TLSH
T12AD59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 4f62375494ca8b2988e01becbd8bd573c55c89c59c825264f875353bb97a8be8
MD5 09f765fdec94d5834418272e110d1a84
SHA1 6336701490f1db65f9ddea46ec81baf4fa0727bc
SHA512 ec92478848c4fa352f6cd98320bac08ebeaac8d6502ec26f43a6ce157ab3008ed1c743f3f0f6d435bb7373a9f65f949f0d3de1da84aa713f471acc235e96c7a1
SSDEEP 24576:6XYhztczAkp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:LtcxWS1SZBnHTAsi
TLSH
T18005F128A7E009F9EC974239D9A18405FB73B8518764E74F03E49A6A1F233DC5E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 ed92d44fb22edd17d1dcb917aa932ff6b96ff0f5178ebb7fe8b2c64f6dfeb9f0
MD5 087d99414e29faba9fc3028345b3ff93
SHA1 9450f6613457f8a86de1ad2ef3b5ed9b705970af
SHA512 6098231c394c5c6ab358c97a4957e43523def13027bc4a12d357bb3558b9f8a719ca37f9d67eb73b49efbdd2850577a56ac444de8e162a0951d718dfacc0f0bb
SSDEEP 24576:UwusOWTp8SXdo8ke5i5Xh6wnBLTHTAcZQ:UwfOgWS1SZBnHTAs
TLSH
T1CE05F14967A40CF9E99642398557C436F7F3B8122A25CB1F0760C75B6F33365AE2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d37d4bf1ed5b070dd3290d21c79a575ca77201f32f5bc7d08ef6e82b644f4f02
MD5 d9305fce7272084fad57fb2948da0623
SHA1 596dbad7b197d791990b7750a1a44b8442596178
SHA512 4a454d5785554f07caf6479213f0ca2c0779c2a41947fad07058d40165dcd34b8335ebac2e66d5e6195d0a7ba2bec0f3c2932d246d99a7962899123aa8e1fbbe
SSDEEP 49152:+B+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl8WS1SZBnHTAsi:su6JmTxd2d8cNzAz
TLSH
T14BD59D13F1DA01E8D05ED478974A9233FA62BC490B35B6DF0A9073562A77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 b12f59a08a7bed584e96f13b4045fcc1fc5e5e8917a2a33d497cb04cf1e34ae9
MD5 3c817ba059e51b4417311771e71c7301
SHA1 80178e582e4b124835790276942e0a5f06d412a9
SHA512 4a2eafc8e2f7f3d6360b1490ccc66c9c9eee8a81f4c729b063670dc16ffc49d9c6de8522c602a3c316ebebf77190ce91f9a88ab38452f6736709d9d0b0f627a5
SSDEEP 12288:jl7zp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:Jzp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1AAD42319CFA58E24F4C40A30357C480CBBBFB372CF29474F5658664E6A726DD9E71A42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 832KB
SHA256 b28e35f5ec5c7aef2f754ed5f1293b1284ec8649d9e16e78c50e0ad2bdea0078
MD5 ee584a1d51fea39936414c4eb62787f3
SHA1 0530b7dfb0b4d1d6bd56e11bd941fe0d255dd6ec
SHA512 7eb992b279ffef47be7d794848da000a3c59a00a641d25aee770be7cf9b496a21d2b72deaf9a1719797e632b1226c67e4d3d72d6846063018361c341a6f926a7
SSDEEP 12288:nLIrb698z7emBzvMi49WNNYCXsogVaCHTrSrYg+qv7:Lgb6bmBIi49WNNFpg1rSvFv7
TLSH
T164053B1E22E802F5E0FAD2B8CDAA4417D6B278161731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 4548094653baf16781d0b0160ae032259a1a987caee2b0aed1409844e8d9cb78
MD5 6f175fb5cc2ccff0ba059cd448510dd3
SHA1 03275221be37bb3c075360814cf6603d5e10b798
SHA512 26553bdc3eabe9e8500604dcc23106d1fcde22378729cd97195539f52877484b4cc8c802ff8bfb2721b6e89aacb877630ad553e54f8dea5c9bc35a9745f460f6
SSDEEP 12288:7ZGIp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:tGIp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T11AE4231C8AF149A4D46847356834480EBAF373718B2917DF06E4E67EAF226EC6F39D41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 1d6be78e21311408ac3d1252a77666a7d4fec36c04c2ce9137a5701d86c6cb23
MD5 9f2043e99a5b798341893a829798fca8
SHA1 b93d4b7bd344eb93c10f3b1395d5a02d03910815
SHA512 c123a37355cc16a502ea281901286d7ec9ddeb9434453fd89a51285aedd303c76f73de5b0fb559d58a12079ba0d2a06fd390fe3f741e4dfc012719ed5f8331b9
SSDEEP 12288:S+p8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:S+p8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1B6D42348CE658E64E5C40A3135384C0CBBFBA362CF6E07CF1698A64E67672ED5F71981
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 4b0158a933985b7449d172b2a357b1ea9de4c3e8e219b2639959412174a2df76
MD5 8090834ad5cb16ed1d3faef38c9a71f6
SHA1 18e66a9ae26a46017a3c50999f8be605d091d331
SHA512 cb2d2ea67f7f06a49548eef0b131cd3f39c01f1be024ad2c0c674d523f0f270769347b98175fbbd8728369c01bc4bc60ca5776e6e9df6c11584a567eadb15ed3
SSDEEP 24576:dAZ8u8FpJqH14zria7/mQp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:yeZFPqVna7/rWS1SZBnHTAsi
TLSH
T14535F165A7E102F0D47BD1388A464657F6B2B4210364EBDF07AC8B551F23AE90F7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 156bc4cc2a38fadcbd4fd5ce8ebd35c782950658ff11ea962f6794e5c219bd6c
MD5 1d945c688b6fdeadba59fbf1d8364aa5
SHA1 050583d413eccddd4cced668d10ce1b5d5d9ff53
SHA512 b4552cf2775b0bbab1deae8b681adb83d35b5c9749b5de6fe72c3d51dc19e3da65cea370a2ff81d668c8edae147b70de3003ea9dbf917aef9b73c997d66556ca
SSDEEP 24576:iPUr+NQrp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:iJQrWS1SZBnHTAsi
TLSH
T1F605F12F66A80CE5E676A13D8995460DF772B462471293CF02E0817E5F63EECBD39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 bacce02e10b7e50d024daf93d3a6cc48c3eb5e129c973eb44a432b9729f46653
MD5 0df677542026f76fe476cc37864d7fce
SHA1 3dcb99c7120756daccc9f7a1dc00b6b491d336b1
SHA512 5af643fe1ab2fd9bdb4b95310225eb522d2bfe5155ff08ac1910d35ac5f61b153998cd483b7f1dc753b0641fa7a18c7f0b890d013f749989924166e10d43c491
SSDEEP 49152:FBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjPWS1SZBnHTAsi:OG05lO43bWcNzAz
TLSH
T1DDD5BF6E62EC01F9D1BBD17CDA864A0BEBB23415033556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 05b25524a885ae6d9d36ae69468f2cbaab13f8266bf30320d7d90ad31ef4d243
MD5 14e57450c9b2b2ab677eb6d700626347
SHA1 3caaf04d95220e2a2c0c1c0b17ad1ac4e7f7a1e8
SHA512 4f609662e8d8a4c734c2670b7c9b9a8c26146699783a6b00e57242cf9a920a7f5256ff6bb07ef6cc9e74b5167bcada6c8c67fe4925f7729706eb8148851f1605
SSDEEP 24576:HNcwHdjbyQ4nLC18lb/EOjowL7FkRp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:HNc/zEOVHFGWS1SZBnHTAsi
TLSH
T17E858B1623E901E4E1BBE1BE89779546FAB17865533486CF0291811F1E73BF85C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 e7231110ff79bd715374cca33b5dcdf2cd6308685b887427ef4918a5ebb211b8
MD5 44bfe86af9d8a4286ea781f4126df7ee
SHA1 4c5c256687fb02273fe9824a81758f618403ab32
SHA512 04dd1fc494e5620e584d83543cd8717e2606ee6f79d3c884a09f0060e59e5257a36b00231a8eff6bb6b88f72191dc4ebbf8defe79c3a3c3608da806ad64f698d
SSDEEP 24576:MJnJPbzB4Skp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:MJnJv6SkWS1SZBnHTAsi
TLSH
T1AE15E03DC2A800E8E4B7C27481191A59FF71347D2F266ACB19B4D5353F12EE4AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 6c11067facaf60874291816cb6383028ebf72c9a0cfbdb21dca3b4ffdd48c09f
MD5 f929c004f82134e4145b11a8a96f313a
SHA1 5abce6e9ad6aded4d8017d4753e5fc0411badc45
SHA512 e9140bc81eb932467526309590cba3bb533b888c2de40e4855eb04daddabb82b029a5e4f744be30da3be6d0137bcbb20c1f55fb7086c1e16494dca4c3ac42baa
SSDEEP 12288:q1Hck6j5ZI7Pp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMi:W6DITp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T116F4F15C637A01F5D0AB903996920405F6B2B171C7261ACF0BD8C5BE5FA3EDCBA39E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 aeb4f1c57347505102b5f75cd306b3159961c188205cbaf85de40cb7cbbf6fa4
MD5 89403aaa44e535d868a3b493f5708526
SHA1 eab0dde055b1677f2da8670a5183207023c28958
SHA512 08fc0ad8dcdbedecc451363d45a0d7ef00b75accbbce61c3c0179bc5c0be0d26568130637b090385b5ad13769ac3fd81a5d094fa93f38f6523cb39b06e0ee003
SSDEEP 12288:dG6kymp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:ktymp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1D1F41208879449A4E9A80634AA754458FF76BD208F2647CF16D0E72F2F327DCAD71F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 617efee08ff56a45391b526157c72bcca72013f1087363a555763d33b95b620b
MD5 3289069da3c856e4ed187291e1543367
SHA1 e2cd64969498d14d85d9b22bc5e7fb6d90f5d052
SHA512 90e72ac533475f16b6b7671e2481a501055605a88ad33be1a3320174fc720916d57fa2494870dee9cfb7c32c45611838447636eef9504993fa5eb745c25a3e98
SSDEEP 12288:LIRp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:URp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1B8D4235CCA658E64E8840A3135384C0DB7BB73718F2A07CF1AD8AA6E5B632DD5F71D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1240-313-0x00000243157E0000-0x0000024315846000-memory.dmp

Download

memory/1240-311-0x00007FF6E3BA0000-0x00007FF6E3C53000-memory.dmp

Download

memory/1240-312-0x00000243157E0000-0x0000024315846000-memory.dmp

Download

memory/2452-28-0x000001BEF92C0000-0x000001BEF93B3000-memory.dmp

Download

memory/2452-30-0x000001BEF9490000-0x000001BEF94F6000-memory.dmp

Download

memory/2452-31-0x000001BEF9490000-0x000001BEF94F6000-memory.dmp

Download

memory/2452-29-0x000001BEF9490000-0x000001BEF94F6000-memory.dmp

Download

memory/2644-329-0x00007FF7C4430000-0x00007FF7C4549000-memory.dmp

Download

memory/2644-251-0x00007FF7C4430000-0x00007FF7C4549000-memory.dmp

Download

memory/2644-252-0x0000011C32030000-0x0000011C32096000-memory.dmp

Download

memory/2644-253-0x0000011C32030000-0x0000011C32096000-memory.dmp

Download

memory/2672-47-0x000001DB6D550000-0x000001DB6D5B6000-memory.dmp

Download

memory/2672-45-0x00007FF6F0320000-0x00007FF6F0488000-memory.dmp

Download

memory/2672-46-0x000001DB6D550000-0x000001DB6D5B6000-memory.dmp

Download

memory/2672-54-0x00007FF6F0320000-0x00007FF6F0488000-memory.dmp

Download

memory/2672-52-0x000001DB6D550000-0x000001DB6D5B6000-memory.dmp

Download

memory/2812-292-0x00007FF79D210000-0x00007FF79D2BD000-memory.dmp

Download

memory/2812-294-0x000001C7F1760000-0x000001C7F17C6000-memory.dmp

Download

memory/2812-293-0x000001C7F1760000-0x000001C7F17C6000-memory.dmp

Download

memory/3216-303-0x000001C301100000-0x000001C301166000-memory.dmp

Download

memory/3216-302-0x00007FF716900000-0x00007FF716D16000-memory.dmp

Download

memory/3216-301-0x000001C301100000-0x000001C301166000-memory.dmp

Download

memory/4164-244-0x000002ABB1040000-0x000002ABB10A6000-memory.dmp

Download

memory/4164-245-0x000002ABB1040000-0x000002ABB10A6000-memory.dmp

Download

memory/4164-320-0x00007FF6524E0000-0x00007FF6525A8000-memory.dmp

Download

memory/4164-243-0x00007FF6524E0000-0x00007FF6525A8000-memory.dmp

Download

memory/4512-272-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4512-273-0x0000000000890000-0x00000000008F9000-memory.dmp

Download

memory/4512-278-0x0000000000890000-0x00000000008F9000-memory.dmp

Download

memory/4668-332-0x0000029503D10000-0x0000029503D76000-memory.dmp

Download

memory/4668-331-0x0000029503D10000-0x0000029503D76000-memory.dmp

Download

memory/4668-330-0x00007FF6DD480000-0x00007FF6DD614000-memory.dmp

Download

memory/4744-321-0x00007FF79DD50000-0x00007FF79DFF3000-memory.dmp

Download

memory/4744-323-0x0000016B4B090000-0x0000016B4B0F6000-memory.dmp

Download

memory/4744-322-0x0000016B4B090000-0x0000016B4B0F6000-memory.dmp

Download

memory/4760-265-0x000001FB8E1C0000-0x000001FB8E226000-memory.dmp

Download

memory/4760-339-0x00007FF691630000-0x00007FF691779000-memory.dmp

Download

memory/4760-263-0x00007FF691630000-0x00007FF691779000-memory.dmp

Download

memory/4760-266-0x000001FB8E1C0000-0x000001FB8E226000-memory.dmp

Download

memory/4876-285-0x00007FF7FD940000-0x00007FF7FE083000-memory.dmp

Download

memory/4876-284-0x000002A725EC0000-0x000002A725F26000-memory.dmp

Download

memory/4876-286-0x000002A725EC0000-0x000002A725F26000-memory.dmp

Download

memory/5152-346-0x000001DC4F970000-0x000001DC4F9D6000-memory.dmp

Download

memory/5152-341-0x000001DC4F970000-0x000001DC4F9D6000-memory.dmp

Download

memory/5152-340-0x00007FF7F8FD0000-0x00007FF7F92F0000-memory.dmp

Download

memory/5152-348-0x00007FF7F8FD0000-0x00007FF7F92F0000-memory.dmp

Download

memory/5152-342-0x000001DC4F970000-0x000001DC4F9D6000-memory.dmp

Download

memory/5568-58-0x0000023FD9790000-0x0000023FD97F6000-memory.dmp

Download

memory/5568-57-0x0000023FD9810000-0x0000023FD9903000-memory.dmp

Download

memory/5568-59-0x0000023FD9790000-0x0000023FD97F6000-memory.dmp

Download

memory/5664-1-0x0000000003010000-0x0000000003079000-memory.dmp

Download

memory/5664-7-0x0000000003010000-0x0000000003079000-memory.dmp

Download

memory/5664-0-0x0000000002F20000-0x0000000003005000-memory.dmp

Download

memory/5792-310-0x00007FF6524E0000-0x00007FF6525A8000-memory.dmp

Download

memory/5792-236-0x0000010D7CC00000-0x0000010D7CC66000-memory.dmp

Download

memory/5792-235-0x0000010D7CC00000-0x0000010D7CC66000-memory.dmp

Download

memory/5792-234-0x00007FF6524E0000-0x00007FF6525A8000-memory.dmp

Download

memory/5796-38-0x000002AFC5980000-0x000002AFC59E6000-memory.dmp

Download

memory/5796-37-0x000002AFC5760000-0x000002AFC5853000-memory.dmp

Download

memory/5796-39-0x000002AFC5980000-0x000002AFC59E6000-memory.dmp

Download

memory/6068-17-0x0000022A30F40000-0x0000022A30FA6000-memory.dmp

Download

memory/6068-18-0x0000022A30F40000-0x0000022A30FA6000-memory.dmp

Download

memory/6068-16-0x0000022A30F40000-0x0000022A30FA6000-memory.dmp

Download

memory/6068-63-0x00007FF647C10000-0x00007FF647D32000-memory.dmp

Download

memory/6068-15-0x00007FF647C10000-0x00007FF647D32000-memory.dmp

Download