ed9e939ed04bca792d75ca067062ffab2958061871810506c0591bc5c68c9db2

Analysis

max time kernel
146s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_a66623762e5e05d7d40170b8348ddeb8_elex_redline-stealer_rhadamanthys_stop.exe
Size 1.2MB
Sample260708-vrfhvac18p
SHA256 ed9e939ed04bca792d75ca067062ffab2958061871810506c0591bc5c68c9db2
MD5 a66623762e5e05d7d40170b8348ddeb8
SHA1 2cc3555540932d3bfd9326d9539cdd30353be3fe
SHA512 681c8b5a8ceb570139e0d6836a70473a8bfb61a917118156a09d1abc9ecf2221671a0c61c625fd98c651e5a045048cb005adf76effedffeaa806bd8dbc1ed622
SSDEEP 24576:2nY0n0Jq+hM1iGI75Vn7TbtkmywjJ/0isbto/QUwInM48+8tkZB9T:MY00s1iFvLtkmyO/IVEMy8ts9
TLSH
T13745231834880573DC456639B4B9E6587E1FBCF69EBC21822ED33A5F1F763E1582432A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4592	alg.exe
2252	elevation_service.exe
2076	elevation_service.exe
4196	maintenanceservice.exe
5668	OSE.EXE
5096	GameInputSvc.exe
1584	GameInputSvc.exe
5688	msdtc.exe
5292	PerceptionSimulationService.exe
3268	perfhost.exe
616	ReFsDedupSvc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f7e33c7984defa61.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-08_a66623762e5e05d7d40170b8348ddeb8_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-08_a66623762e5e05d7d40170b8348ddeb8_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_a66623762e5e05d7d40170b8348ddeb8_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1584	GameInputSvc.exe
1584	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2864	2026-07-08_a66623762e5e05d7d40170b8348ddeb8_elex_redline-stealer_rhadamanthys_stop.exe
Token: SeDebugPrivilege	4592	alg.exe
Token: SeDebugPrivilege	4592	alg.exe
Token: SeTakeOwnershipPrivilege	2252	elevation_service.exe
Token: SeTcbPrivilege	5096	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 1584	5096	GameInputSvc.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-07-08_a66623762e5e05d7d40170b8348ddeb8_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_a66623762e5e05d7d40170b8348ddeb8_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2864

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4592

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2252

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2076

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4196

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5668

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1584

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5688

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5292

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3268

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
PID:616

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:5108

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:3304

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:4864

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:700

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:2416

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:1160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ad65e943300ab20fd78588a74387816df8230df9acf866d1a6f4863ce6a807e9
MD5 bf3c5f878fdfc3aed60f4d13b68a394a
SHA1 c908824228c0cd4a38035a49544e12423d6051cc
SHA512 4224c77434ba9eec4609c27cf370191d967cee4fbf3b6c18f0422004d2b9535ec79738f5be928414bcccc428fcf31fd7d8a56fe58951ddb0766e46bb0e580754
SSDEEP 49152:lwg632BuPkFKRrdE6oh7stBhuXjfS4LWxnpY00s1iFvLtkmy:23q6gjB8r8+/
TLSH
T199D59D03F2D900E9E069D178D7469132EAA2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 441c5c4dd8b7deff03bf4918dfb609a134395421fc7c42d2b6fa931300869268
MD5 e8d7f6d06b4bc91254d28c18167dee3c
SHA1 768d45ae76cc6c235298b2b227e89b5c525aaf67
SHA512 a0484d9591a17d377b46c59a3a5aa0d1e2fd507bd6e4dd67702d377f60f740cb45aea2d06e77b07520d3f79f5cc5ba3cf42669441c20dbeddfc8d6e34a3403c2
SSDEEP 24576:TXYJcRczA+Y0n0Jq+hM1iGI75Vn7Tbtkmywj:jRcpY00s1iFvLtkmy
TLSH
T12805012863E408F5ED67923DCCB28505EA33B8A547A4F74B03E4966A1F233D45E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 ead45c8aa19595493e1c2f82147eaeef9af2a3b463155e7501cf4c2c3d13d14d
MD5 c94e2353d64be11d2b7cd4cd328cf809
SHA1 65f1e176d0917fdbc7567cc43239f84c75a819cb
SHA512 49476e2841f204621004d3726c44bf86a5a19cd87bbc32453d95a8cfdca5c22d1931ea45dfd85663593a3711f3201ade5a0b431a017066d21f43a642ad22ce22
SSDEEP 24576:Owu+OWRY0n0Jq+hM1iGI75Vn7Tbtkmywj:OwlOwY00s1iFvLtkmy
TLSH
T11805F14972E80CF5E9A6923D85978535F7B2BC522A35D70F07A0C75B1F23361AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cbd9543464eb2fca5345a4e987092fde583fc51b2c37abe7b2e3a54851daba06
MD5 52fa6b5d8a9d8e0c7aca9fd3fd4722e9
SHA1 767a60acfa45c42e303221d48433f432a07c17aa
SHA512 65a14c9ec993b36daf1310ff5390042d8e37a5935dd6ad327885599fe63bbb325b476c280777d56ded37f01e8d4466c127224d725629a0d1a706acbb40062c3b
SSDEEP 49152:ru+taZ3usBWOBr4tEGp0bqx0z+n217aau1glWY00s1iFvLtkmy:6u6JmTxd2dir8+/
TLSH
T134D59D13F1DA01E8D06ED578974A9232FA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 607KB
SHA256 cf0d811672d37cb581305973a86182dc9a8a39510009a973285320b82b0a2b1b
MD5 930f898d20fff6bf60d829d3aad9662f
SHA1 5a95a46bb90767e168f2fdc119d5ba23c81d31ff
SHA512 962e6b4558033d85672cd2eb83e0a972c0edd51a7b71100eeb6fa30d7c2e3eca5f392fe8654346dac21ce7567acb241ee7c1c18a3c7208cb3f02d1913909d230
SSDEEP 12288:IN7jY0n0qYLOIjvJM1iGIlCa5gpUn7Tbt/ADgqDap77FcbfOg8tEHW:ojY0n0Jq+hM1iGI75Vn7Tbtkmywj
TLSH
T114D4231996EC1540F458773E38BA591C3A1EB8FA8FACB1C76ED2339B2D402D14D3971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7f798e08ce5a378a3daa26bcff23fe6585c9d70e59cd9ff1143e29deb3b7f4f5
MD5 57d1541d2039c11bad7b9a49543421b6
SHA1 bd267a07d4122da86e8f94f03535e61924023c1b
SHA512 2da57f430089b89c565535348aa39432859cab98c786bac48508d64558ba5c07db6a9f7c9d217f373f04407a5bfd1d09f58064863afdfb9880acfb56045770d5
SSDEEP 24576:rgb6bmBIi49WNNFpg1rSvFv7bYmY0n0Jq+hM1iGI75Vn7Tbtkmywj:rgb4mBIBhGF7Y00s1iFvLtkmy
TLSH
T15265AE1E22EC02F5E0F9E2B89DAA4417D6B278164731D2CF1251427D2F3BEE49D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 c9e923d5f7e976022cb352736532146607ad160b6edfe1c687116d744727780c
MD5 bc69709b46a6c52e9312025bde9d9ecb
SHA1 1b8e6a70b4f93b6bc3155a5b6de45ac68126030f
SHA512 d38e415d6ddeeaf51403b8a17b5ba4d8fef2463d760b1ae482e9f82b55fdcd640fdee305157d4cf316a1fd4834b983939d998be81b6234b265f5afd68ac6ca9d
SSDEEP 12288:vNG/PY0n0qYLOIjvJM1iGIlCa5gpUn7Tbt/ADgqDap77FcbfOg8tEHW:VG/PY0n0Jq+hM1iGI75Vn7Tbtkmywj
TLSH
T152E4222C61F83090D439A33E28755919797A78F58F2C72CF0AE2B27B5F452E06A3DE54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 7017c3b40b76ce73892a06924eb889504c8f60c3ef3d378babb8438c27045e79
MD5 a41d3ee596cd2698335745f183c036c4
SHA1 eb0ac36a43a0cb499716806bf34a26396b81daa4
SHA512 b412188438213c60239eff9933a2bdf3e46ff00ac397b4d45d13e3827717d33a5902afcfc86224eb0f6658a1a75fa4ab36c087b761882c9ad8dcde317a18f8ea
SSDEEP 12288:GgY0n0qYLOIjvJM1iGIlCa5gpUn7Tbt/ADgqDap77FcbfOg8tEHW:GgY0n0Jq+hM1iGI75Vn7Tbtkmywj
TLSH
T164D4231C91AC1580F544B73E38B6590C3E0EB8FB8FBD72C71EE2329B1E852D15939626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 fdb7b07b7f4705513bdbaa2f88829544b7f01fbc17c42cad2323018d4b1ae447
MD5 6f510bcbec5b8ae6c115a742f53ca0b4
SHA1 718e7848c14fcccd07f884b517b8f66298cfe074
SHA512 6f6cadf71e4dc8781e6ad3e7a93b0de2f4639c536f748829fe76bac44de2f08946468019e12ae936daa5838a0ed35e8a64c74ca5bf4330cac3dae570d5bcfc92
SSDEEP 24576:I748D8gbJqH1Mzria7/mpY0n0Jq+hM1iGI75Vn7Tbtkmywj:mHQgtqVra7/MY00s1iFvLtkmy
TLSH
T10F35F16566E401F0D47BE13889964667F6B2B8250364FBCF0BE88B561F137E14B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 99a7e7a7db2fcade80a4ed25dd93044fc1baae0d871b123967cc9dcd68d3f162
MD5 e486f21dd1d1290c82c6e820cbd3987c
SHA1 724da29867c834e59aae4e5fa45f17c38472ceef
SHA512 cc9aa69a5a3e2b745c9c76a46a4c8bf695926699edfc8bcd3ade1ae49fb6f72246532e46948c704bdbc516509136f8319949159f6a284ec037fcb08c0b11a957
SSDEEP 24576:SPUr+NQJY0n0Jq+hM1iGI75Vn7Tbtkmywj:SJQJY00s1iFvLtkmy
TLSH
T15005F12E62EC18E5F676E13D9996460DF772B4620712A2CF02E1817F1F53AE4AD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 38da73f3306c217155375da9ab60e95d17e2d30e970c13a247a597ca6c276f67
MD5 e7af8f6715b30888978778613b8a4b03
SHA1 d5ec5ade9b13da543ec0c155accb70a8f05dda39
SHA512 76562257f768ba569dd3f03bc7d28a085fa6ce19cebb99de1999a64986d1770eede76ec078b119d97c5e6ec660d7bc2724d43c549b443574a9da1c34c8cced7a
SSDEEP 49152:0BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjEY00s1iFvLtkmy:XG05lO43bRr8+/
TLSH
T100D5CF6E62EC11F5D0BBD17CD9C64A0BEBB23825033556CB02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 182b6d4ba16607246d366a519c12fdcb806f79c2d5172d4f919a104086f77cdb
MD5 bca1ea28efff4a01a01b12087759a251
SHA1 f5530a6fa2e20580d057aa8b896ec180711abb4a
SHA512 9edd50f63451be59ea7e169486038303baa0b5eedaee87fa9c0a3afb14dbf2f5b1124a2648399ecb5add7172f53f87692162de629e016aa3ce092c7d903d984d
SSDEEP 24576:kNcwHdjbyQ4nLC18lb/EOjowL7Fk/Y0n0Jq+hM1iGI75Vn7Tbtkmywj:kNc/zEOVHFeY00s1iFvLtkmy
TLSH
T158858B2622E901E4F1BBE1BE89779546FA717869173486CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 dd5ceb711a64e66ab30e715ec7965f52d9a806213b7d196406398321ea20d5fa
MD5 fc920aaa8768bb7c23c0516ac383727d
SHA1 ba85eaf02232273b9120cb60a296cdc5573a5859
SHA512 89239833072cf085b8f9f633918c19652b71ebd1caa4361f0f499c324b3b3f4315b04676d7cb100c0491d8a79ee591a4f59a79c7eba46bbcd096578af9960184
SSDEEP 24576:1JnJPbzB4ShY0n0Jq+hM1iGI75Vn7Tbtkmywj:1JnJv6ShY00s1iFvLtkmy
TLSH
T14015D03DD2A810E4E4B7D2B8815A1A59FE31387D2F2669C719B4D5353F02FE0A939F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 580827df770ab9c26e109eb28387f3c89bce09d8e2c0355603ee750309f090d5
MD5 a8d2a9158eae87556fd7932787e55310
SHA1 00e6c54c9d3a1b81a45e449933bb92a7fca66efc
SHA512 5cb20f27fd29b531675893742630800dfdb5aa83320a8b292b95b136b7afd6ee82160283c4aae59907bd1b28141da36ceb55070ed46c187951411332f3758b4e
SSDEEP 12288:YkHck6j5ZI7/Y0n0qYLOIjvJM1iGIlCa5gpUn7Tbt/ADgqDap77FcbfOg8tEHW:x6DITY0n0Jq+hM1iGI75Vn7Tbtkmywj
TLSH
T14AF4011C23BA10F1E067E03E95930505E6B2B4B58B6666CF0BD491BE5F93ED8B93CE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 20307438ff125cda9199d92dd6a5bdfddef61a9adb8602c85e8b8c34b9405261
MD5 c41a9d0de4e819379300b6aff57ee6b4
SHA1 0864d62ee83895bb5f1b71e84f201bd10a705b61
SHA512 63dee3974bfdf22d8f72383a6769fb32d3a377d2c76a5bbc05042912aac9c9ae828d6c2cc1401866abaf63b9f7836c6cf19c366103cca8a01fbd36cf17897b1e
SSDEEP 12288:7G6kyvY0n0qYLOIjvJM1iGIlCa5gpUn7Tbt/ADgqDap77FcbfOg8tEHW:6tyvY0n0Jq+hM1iGI75Vn7Tbtkmywj
TLSH
T114F4120853E82090F5A9623D697341586E3ABC718F6562CF1AE1B33F2F367D0AD35B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 a65e73ec98a9e1e90ec11fc7b5aee6d7dfc34ed8fa49ae5494be4b277a6d465f
MD5 e48d88919a43534bc5c60d3da537da97
SHA1 22a2eb9a4f25353f1dd9dd6e10eaf53e81a55b02
SHA512 dad16a8d555463cb7d57821520c07700c938279a51c8eff4595703b0b4a2e1a441226ef93f31695f15ca195d2bd75cf7bbeab994eaecfdc525d25a5865d29e0e
SSDEEP 12288:CyEY0n0qYLOIjvJM1iGIlCa5gpUn7Tbt/ADgqDap77FcbfOg8tEHW:rEY0n0Jq+hM1iGI75Vn7Tbtkmywj
TLSH
T1DFD4232C91EC2580E444B63E387A0A0C792EB8FA4F7D71CF1EE272BB5E452D15939E15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/616-297-0x000001B0DDB30000-0x000001B0DDB96000-memory.dmp

Download

memory/616-298-0x000001B0DDB30000-0x000001B0DDB96000-memory.dmp

Download

memory/616-296-0x00007FF6C90A0000-0x00007FF6C97E3000-memory.dmp

Download

memory/700-336-0x000001E4363D0000-0x000001E436436000-memory.dmp

Download

memory/700-335-0x000001E4363D0000-0x000001E436436000-memory.dmp

Download

memory/700-334-0x00007FF704530000-0x00007FF7047D2000-memory.dmp

Download

memory/1160-354-0x00007FF6A1380000-0x00007FF6A16A0000-memory.dmp

Download

memory/1160-353-0x000002584E7A0000-0x000002584E806000-memory.dmp

Download

memory/1160-358-0x000002584E7A0000-0x000002584E806000-memory.dmp

Download

memory/1160-360-0x00007FF6A1380000-0x00007FF6A16A0000-memory.dmp

Download

memory/1160-352-0x000002584E7A0000-0x000002584E806000-memory.dmp

Download

memory/1584-255-0x00007FF7ED610000-0x00007FF7ED6D8000-memory.dmp

Download

memory/1584-256-0x0000025FCC5D0000-0x0000025FCC636000-memory.dmp

Download

memory/1584-257-0x0000025FCC5D0000-0x0000025FCC636000-memory.dmp

Download

memory/1584-333-0x00007FF7ED610000-0x00007FF7ED6D8000-memory.dmp

Download

memory/2076-51-0x0000019D857C0000-0x0000019D85826000-memory.dmp

Download

memory/2076-50-0x0000019D857C0000-0x0000019D85826000-memory.dmp

Download

memory/2076-49-0x0000019D857C0000-0x0000019D85826000-memory.dmp

Download

memory/2076-48-0x0000019D855C0000-0x0000019D8569E000-memory.dmp

Download

memory/2252-40-0x000001E92BB00000-0x000001E92BB66000-memory.dmp

Download

memory/2252-39-0x000001E92BA20000-0x000001E92BAFE000-memory.dmp

Download

memory/2252-41-0x000001E92BB00000-0x000001E92BB66000-memory.dmp

Download

memory/2252-42-0x000001E92BB00000-0x000001E92BB66000-memory.dmp

Download

memory/2416-343-0x00007FF7B45B0000-0x00007FF7B4744000-memory.dmp

Download

memory/2416-345-0x000001ADEAFB0000-0x000001ADEB016000-memory.dmp

Download

memory/2416-344-0x000001ADEAFB0000-0x000001ADEB016000-memory.dmp

Download

memory/2864-29-0x0000000002F80000-0x0000000002FE6000-memory.dmp

Download

memory/2864-36-0x0000000000400000-0x0000000000532000-memory.dmp

Download

memory/2864-0-0x0000000000400000-0x0000000000532000-memory.dmp

Download

memory/2864-24-0x0000000002F80000-0x0000000002FE6000-memory.dmp

Download

memory/2864-7-0x0000000002440000-0x00000000024A9000-memory.dmp

Download

memory/2864-8-0x0000000002440000-0x00000000024A9000-memory.dmp

Download

memory/2864-2-0x0000000002440000-0x00000000024A9000-memory.dmp

Download

memory/2864-1-0x00000000021D0000-0x000000000230D000-memory.dmp

Download

memory/3268-284-0x0000000000400000-0x0000000000548000-memory.dmp

Download

memory/3268-285-0x00000000007A0000-0x0000000000809000-memory.dmp

Download

memory/3268-290-0x00000000007A0000-0x0000000000809000-memory.dmp

Download

memory/3304-313-0x00007FF61A4F0000-0x00007FF61A906000-memory.dmp

Download

memory/3304-314-0x0000018581820000-0x0000018581886000-memory.dmp

Download

memory/3304-315-0x0000018581820000-0x0000018581886000-memory.dmp

Download

memory/4196-60-0x0000014581040000-0x00000145810A6000-memory.dmp

Download

memory/4196-67-0x00007FF718230000-0x00007FF718397000-memory.dmp

Download

memory/4196-65-0x0000014581040000-0x00000145810A6000-memory.dmp

Download

memory/4196-59-0x00007FF718230000-0x00007FF718397000-memory.dmp

Download

memory/4196-58-0x0000014581040000-0x00000145810A6000-memory.dmp

Download

memory/4592-16-0x00007FF652670000-0x00007FF652792000-memory.dmp

Download

memory/4592-17-0x000001C0493B0000-0x000001C049416000-memory.dmp

Download

memory/4592-19-0x000001C0493B0000-0x000001C049416000-memory.dmp

Download

memory/4592-18-0x000001C0493B0000-0x000001C049416000-memory.dmp

Download

memory/4592-57-0x00007FF652670000-0x00007FF652792000-memory.dmp

Download

memory/4864-326-0x000001BB23720000-0x000001BB23786000-memory.dmp

Download

memory/4864-324-0x00007FF7EA4A0000-0x00007FF7EA553000-memory.dmp

Download

memory/4864-325-0x000001BB23720000-0x000001BB23786000-memory.dmp

Download

memory/5096-323-0x00007FF7ED610000-0x00007FF7ED6D8000-memory.dmp

Download

memory/5096-248-0x000001FC63D80000-0x000001FC63DE6000-memory.dmp

Download

memory/5096-247-0x000001FC63D80000-0x000001FC63DE6000-memory.dmp

Download

memory/5096-246-0x00007FF7ED610000-0x00007FF7ED6D8000-memory.dmp

Download

memory/5108-304-0x00007FF77BF40000-0x00007FF77BFED000-memory.dmp

Download

memory/5108-306-0x0000014192A10000-0x0000014192A76000-memory.dmp

Download

memory/5108-305-0x0000014192A10000-0x0000014192A76000-memory.dmp

Download

memory/5292-278-0x00000229182E0000-0x0000022918346000-memory.dmp

Download

memory/5292-351-0x00007FF6C8510000-0x00007FF6C8659000-memory.dmp

Download

memory/5292-277-0x00000229182E0000-0x0000022918346000-memory.dmp

Download

memory/5292-275-0x00007FF6C8510000-0x00007FF6C8659000-memory.dmp

Download

memory/5668-71-0x000001B41C150000-0x000001B41C1B6000-memory.dmp

Download

memory/5668-70-0x000001B41C020000-0x000001B41C0FE000-memory.dmp

Download

memory/5668-72-0x000001B41C150000-0x000001B41C1B6000-memory.dmp

Download

memory/5688-342-0x00007FF647740000-0x00007FF647859000-memory.dmp

Download

memory/5688-265-0x0000029131980000-0x00000291319E6000-memory.dmp

Download

memory/5688-263-0x00007FF647740000-0x00007FF647859000-memory.dmp

Download

memory/5688-264-0x0000029131980000-0x00000291319E6000-memory.dmp

Download