801a5b2246b29a8521c45d33428f139d0b68192811e95b000bb35f24b4171453

Analysis

max time kernel
146s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_e68d543e6792fb79494db7e3f8722fce_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Size 862KB
Sample260714-dbah8acy3j
SHA256 801a5b2246b29a8521c45d33428f139d0b68192811e95b000bb35f24b4171453
MD5 e68d543e6792fb79494db7e3f8722fce
SHA1 e15bdca0a7d7d07ff08a5c49ec0d506eb5fd9d19
SHA512 d622ffac4767e5ba83384fd2ed4bb1952b6cb6999967684f1f30d0e1e1c339da7d44d391d57c1e9cbc51fe30d04a7b7e37359cd1e1829fe36755780eb73b499f
SSDEEP 24576:NxcVyzLD2SrGxsp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:ceX2Sr+sWS1SZBnHTAsi
TLSH
T143150211BAE18C72F6B305321DB899656AFDB93108328F2F13D40A5E9E71590D63AF73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
4352	alg.exe
4560	elevation_service.exe
2372	elevation_service.exe
1968	maintenanceservice.exe
5288	OSE.EXE
5888	GameInputSvc.exe
4548	GameInputSvc.exe
4632	msdtc.exe
5128	PerceptionSimulationService.exe
1972	perfhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-14_e68d543e6792fb79494db7e3f8722fce_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8344b43623e529ce.bin	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-14_e68d543e6792fb79494db7e3f8722fce_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_e68d543e6792fb79494db7e3f8722fce_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4548	GameInputSvc.exe
4548	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1376	2026-07-14_e68d543e6792fb79494db7e3f8722fce_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	4352	alg.exe
Token: SeDebugPrivilege	4352	alg.exe
Token: SeTakeOwnershipPrivilege	4560	elevation_service.exe
Token: SeTcbPrivilege	5888	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5888 wrote to memory of 4548	5888	GameInputSvc.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-07-14_e68d543e6792fb79494db7e3f8722fce_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_e68d543e6792fb79494db7e3f8722fce_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1376

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4352

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4560

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2372

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1968

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5288

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5888
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4548

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4632

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5128

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1972

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:4544

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:4904

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:5948

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:4564

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:3480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 263d915d54b01d155b90bde0e41611a9b88b0cd4deb67e0472501e3f37885860
MD5 5dd9154c2d6bbf726e5e96acc4fb9cc8
SHA1 b93bd4cbfe1d55fd7d0079df09018b483dd0fe50
SHA512 f983fe6d5184bc726b961c1fb0e5a737d31e84efffdf8fbef9e4a9683806a269fc4a68a9d81c73d981ee076cf493f73ef178a9315de7e371eebd69b12ba100ce
SSDEEP 49152:8b+632BuPkFKRrdE6oh7stBhuXjfS4LWxnpWS1SZBnHTAsi:m3q6gjB2cNzAz
TLSH
T13AD59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 b0fb9c64b3ee466b2318de0b0e73647d03493b7f609c4eb37866fabbc5ffec2c
MD5 8ba9460ade68e7e30e020e77bba176a9
SHA1 ac70ffbccc1b53e0156cb95af00794da68159260
SHA512 39f8e176ce46e3dc2b5153446a2d75c326b92112d268a60d43b440bffb5605dfb822ccef98eaf72bcdcc1b6286af20b99c48ad222b94b6a3bfaae552db193b65
SSDEEP 24576:TXYGEtczAgp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:itcFWS1SZBnHTAsi
TLSH
T1FD05F128A7E409F9EC574239C9A18405FB73B8518764E78F03E49A6A1F233DC5E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 4811160de36239942b4c0878beab8f6caf40018e308abdd358c6cd770b86b626
MD5 a7db2938b31a3c87c359dcd89b6959af
SHA1 f3e91d66a04dc5d4db533bb8e43ff9b9ec16482b
SHA512 83df32fd6c8eb82b09f90d50f3537f291e949c100154d303e8804c9b34e04c5f4f22d161b1755bdfb4991c0e3f31d48a99a336c5f7f4147429ef80a40db1fc0d
SSDEEP 24576:UwusOWup8SXdo8ke5i5Xh6wnBLTHTAcZQ:UwfOtWS1SZBnHTAs
TLSH
T1A005F14967A40CF9E9A642398557C436F7F3B8122A25CB1F0760C75B6F33365AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 caf332d5bb805660fe04e6fea296b54e910a95695788e4d5b608462c2abcc79c
MD5 6b3c1811413ba2334963c53c159946ff
SHA1 2aeaed8bff43edd1dd587f7b91de87673ddb1f96
SHA512 b683b33ec4d26f0a0d838a6610f68d8a762367093b3e20a44e13bc896f4c67a28ef4e6d60c4d7549bca94eeb1bcb0a3d32bbd241039e2103064be0d19268eb72
SSDEEP 49152:1B+taZ3usBWOBr4tEGp0bqx0z+n217aau1glTWS1SZBnHTAsi:7u6JmTxd2dTcNzAz
TLSH
T170D59D13F2DA01E8D05ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 74614cd96b5705e3a4bdecaa1891e6405d4b51308734644b64d472844ef76c54
MD5 2f2b1c65d03473994bb7c640da392755
SHA1 57b284d5949e05f4764949f69c497eacebcb3aec
SHA512 d42c3cf7118a68f75a1f18b350fbbd0e3645d154fa405b7a287561828d73d830e91f8ffe1ff9d832eda791ffa0f81af6afb66f71e853322e72961fc22fae1f07
SSDEEP 12288:ji7Vp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:aVp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T185D42319CFA58E24F8880630353C480CBBBFB371CF69474F6658664E6A726DD5F71A42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 52a5b29740641b0e17f55ca3f049b4692b985580fce384077a987d15a1030dde
MD5 a644bc3df0f5bee8f63186c6913b984e
SHA1 0fee87d49e9c28e687e91210540e05b36cee25b2
SHA512 5cd08cafee533f29cc9a698e0e8036b7a5f8ba2fcea6cb6a995120c0276bb87cfdbe22b9cd91e9248f5e26bb471269bee9c59f7aaa11a9e3b5fa056a7bef9835
SSDEEP 12288:20G6p8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:zG6p8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T15BE4231C8AF549A4D46847356538480ABAF373708B2917DF0AE4E63E9F226EC6F39D41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 0e9aa93054a32976702fbdca4f273e0e98eea8e6b6c6d711b32735bc6949257a
MD5 864a833d8488dd8d58129c9f98435d1c
SHA1 cd780d439e48cf899fd11ca8e0b2ea6aa1b0c40e
SHA512 e0b8066c7407c80def68f289f57b0d1ec50feb66b55d5ae33881e8bbeceea83cd1994c4021c89c45e15ee6b04e3eab4dfb062a4a51f03059e44b2560342df609
SSDEEP 12288:dmp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:dmp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T18ED4230CCA658E64E4840A3135384C0CBBFB6362CF6E07CF1698A64F67676ED5F75942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1024KB
SHA256 95fcd8dfd45f1a782a3e88dfe43b97eefe619d63c08b31a1523aee9abe764040
MD5 f5b403a1e1cf15cfce42ab6458d9b14a
SHA1 e2333cc144e1598f5ac7b4c9162466677a742a73
SHA512 0e975ce8fa6cf47e476b948160c81e9791a7c1f2608a3c92b7a0b9754b2486d55181c061b580a23cbc2873e3d52c4e462798c88e1b9e5cc1753b8bafa013be6b
SSDEEP 24576:Pid8ZGkRJqH1Mzria7/m1p8SXdo8ke5i5Xh6wnBLTHa:KS0kXqVra7/OWS1SZBnHa
TLSH
T1BB25F165A7E101F0D47BD13889864A63F6B2B4250364EFDF07AC8A551F23AE50B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 960KB
SHA256 627fc8a280a20a52080e8f5470a4886c522dab3b434c2e689901408c16429796
MD5 dcce3e94cff7f74ad05361231807fd86
SHA1 6ea12ddc6b6e6b6b395e5d62d6381f297fea85e3
SHA512 afe977f73310a652cf12ef8e4e70434021238886ec30c44c6929410942ef533097c28c344eff92b0d2c946bf1439b26a9a433da89e762299349969ce0d8fb475
SSDEEP 24576:Pid8ZGkRJqH1Mzria7/m1p8SXdo8ke5i5Xh6wnBa:KS0kXqVra7/OWS1SZBa
TLSH
T10A25F165A7E105F0D47BD13889864A63F6B2B4210364EFDF07AC8B551F23AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 7738fe5db10b0d6979536105da1206eb2b3762c7a43eeebd27b57de16ef00195
MD5 767209ab8878a941d3e94f59cd91fbcc
SHA1 41bcf8bfd6a2b9f4ab91e31afde1fdd7346f816e
SHA512 989093667820dcf062a889246aa3ff35d91f4d8f1916c61dda7bace91c9ec904d16d35af83232adcca2976d0d70ce3f4f7fe28ef2daa12b59f2b3681ea3f08ad
SSDEEP 24576:pPUr+NQnp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:pJQnWS1SZBnHTAsi
TLSH
T12705F11F66A80CE4E676A13D9995860DF772B462471293CF02E0817E5F63EECBD39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 5f4fe2bce9f452c1296df902d85e873318221f491b4e74c1f236d6338a344558
MD5 c38a392f384b95c57e96350f303c0f92
SHA1 7648d2ddffe44cef43123ee018134b397ca593a1
SHA512 c78b05f431082305e86a9a782428fe31194d26666ae7fd5e3e47f45206603273f54c21206aa4cfc85980fad58e85450bcc3235daef7a4ba634a3ae27ac6ef1ec
SSDEEP 49152:mBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjuWS1SZBnHTAsi:JG05lO43bPcNzAz
TLSH
T1E1D5BF6E62EC01F9D1BBD17CDA864A0BEBB23415033556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 dc6cd80130927450a798565d0fafafefe51c4378615e0038ce300f3b231f4835
MD5 d6496541b97332771962ac7f973aa297
SHA1 94026a70d89603d8f07a61bfad5c9d83ee8dce37
SHA512 f326284cad7cbc601107f7b675f1aa3f6a96f693c86c85f21f6efb079a8f734cb031c2bb6c04cd833a904be90a85ad3dc238d5f912a0f55fef31ba0ee22232ff
SSDEEP 24576:cNcwHdjbyQ4nLC18lb/EOjowL7Fkrp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:cNc/zEOVHFoWS1SZBnHTAsi
TLSH
T137858B1622E901E4F1BBE1BE89779546FAB17865533486CF0291811F1E73BF85C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 601677d85fddbb40af2a36185e45ab9229ed5f0162b7e3a645beec2fb993abcb
MD5 0a96057bad77f4c81dc87569e8423684
SHA1 6f85849b930f6e2af0a70dcabd2c76a21bb97b50
SHA512 954d7d4978fc62965be58dd4b8a13ce1e3c175f8ef9958090488e00c6d27d374d4cf40f4f9446586a7c466b9862f2503ab5f75d936cda3a9baa66efdee5933a2
SSDEEP 12288:/1Hck6j5ZI7tp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMi:b6DIJp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1F1F4F15C637A01B5D0AB903A96920405E6B2B171C7261ACF0BD8C57E5FA3EDCBE39E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 d2220a63aa96dd0c49f62de33a33ebf4011ba1368a41ae63cfe0452b23df420f
MD5 e5bd50729b37a35b7554be968afe2d9f
SHA1 16e2483e2806c12c30cac48efee929cdd1e0d32a
SHA512 dcaef5ab8fdaf7d08ab75b54eca06a870a28b6f877011815297734d53561563b95c73c24d885118accaa291225336bc43392c16657d0f07d0a6f76262d590659
SSDEEP 12288:8G6ky9p8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:dty9p8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T130F4120887A449A4F9A90634AA754448FF76B9208F2657CF16D0E72F2F327DCAD31F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 0c851f1350703fe0468b0c941c98c17ed3a0dafb8ba5c66d56da2429fea5380d
MD5 d74e4ee83b939aacec8ca050257dcd6c
SHA1 297e56ff7349ad47e9b5badbd9108603b01cf53f
SHA512 e373b8ec55afc248e2d2f321913198fc62972e61d1df2186905c8f00e067b28673ee4d438724ed001780540dedab7adeeb8a4a7721d7f97a771c96ac5488735f
SSDEEP 12288:K+np8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:nnp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T123D4235CCA658E64E8840A3135384C0DB6BB7371CF2A07CF1AD8AA6E5B632DD5F71D41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1376-0-0x0000000002530000-0x00000000025FF000-memory.dmp

Download

memory/1376-6-0x0000000002470000-0x00000000024D9000-memory.dmp

Download

memory/1376-1-0x0000000002470000-0x00000000024D9000-memory.dmp

Download

memory/1968-54-0x00007FF6032C0000-0x00007FF603428000-memory.dmp

Download

memory/1968-46-0x000001F53FB80000-0x000001F53FBE6000-memory.dmp

Download

memory/1968-45-0x00007FF6032C0000-0x00007FF603428000-memory.dmp

Download

memory/1968-47-0x000001F53FB80000-0x000001F53FBE6000-memory.dmp

Download

memory/1968-52-0x000001F53FB80000-0x000001F53FBE6000-memory.dmp

Download

memory/1972-273-0x0000000000990000-0x00000000009F9000-memory.dmp

Download

memory/1972-278-0x0000000000990000-0x00000000009F9000-memory.dmp

Download

memory/1972-272-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/2372-38-0x000001C13AD30000-0x000001C13AD96000-memory.dmp

Download

memory/2372-39-0x000001C13AD30000-0x000001C13AD96000-memory.dmp

Download

memory/2372-36-0x000001C13AA90000-0x000001C13AC0D000-memory.dmp

Download

memory/2372-37-0x000001C13AD30000-0x000001C13AD96000-memory.dmp

Download

memory/3480-323-0x00000244764B0000-0x0000024476516000-memory.dmp

Download

memory/3480-321-0x00007FF795CD0000-0x00007FF795F73000-memory.dmp

Download

memory/3480-322-0x00000244764B0000-0x0000024476516000-memory.dmp

Download

memory/4352-14-0x00007FF608530000-0x00007FF608652000-memory.dmp

Download

memory/4352-63-0x00007FF608530000-0x00007FF608652000-memory.dmp

Download

memory/4352-15-0x0000014FFECE0000-0x0000014FFED46000-memory.dmp

Download

memory/4352-16-0x0000014FFECE0000-0x0000014FFED46000-memory.dmp

Download

memory/4352-17-0x0000014FFECE0000-0x0000014FFED46000-memory.dmp

Download

memory/4544-286-0x00007FF74B750000-0x00007FF74BE93000-memory.dmp

Download

memory/4544-284-0x000002275FDA0000-0x000002275FE06000-memory.dmp

Download

memory/4544-285-0x000002275FDA0000-0x000002275FE06000-memory.dmp

Download

memory/4548-245-0x000001F01D170000-0x000001F01D1D6000-memory.dmp

Download

memory/4548-244-0x000001F01D170000-0x000001F01D1D6000-memory.dmp

Download

memory/4548-243-0x00007FF744D90000-0x00007FF744E58000-memory.dmp

Download

memory/4560-28-0x000001F0FF8A0000-0x000001F0FF906000-memory.dmp

Download

memory/4560-29-0x000001F0FF8A0000-0x000001F0FF906000-memory.dmp

Download

memory/4560-27-0x000001F0FF600000-0x000001F0FF77D000-memory.dmp

Download

memory/4560-31-0x000001F0FF8A0000-0x000001F0FF906000-memory.dmp

Download

memory/4564-311-0x00007FF6710D0000-0x00007FF671183000-memory.dmp

Download

memory/4564-313-0x0000022733920000-0x0000022733986000-memory.dmp

Download

memory/4564-312-0x0000022733920000-0x0000022733986000-memory.dmp

Download

memory/4632-251-0x00007FF644D10000-0x00007FF644E29000-memory.dmp

Download

memory/4632-252-0x000002D5DEFB0000-0x000002D5DF016000-memory.dmp

Download

memory/4632-253-0x000002D5DEFB0000-0x000002D5DF016000-memory.dmp

Download

memory/4904-294-0x000001E111C60000-0x000001E111CC6000-memory.dmp

Download

memory/4904-293-0x000001E111C60000-0x000001E111CC6000-memory.dmp

Download

memory/4904-292-0x00007FF79F720000-0x00007FF79F7CD000-memory.dmp

Download

memory/5128-266-0x000002863C860000-0x000002863C8C6000-memory.dmp

Download

memory/5128-265-0x000002863C860000-0x000002863C8C6000-memory.dmp

Download

memory/5128-263-0x00007FF6DD2C0000-0x00007FF6DD409000-memory.dmp

Download

memory/5288-58-0x000001F7DFF40000-0x000001F7DFFA6000-memory.dmp

Download

memory/5288-59-0x000001F7DFF40000-0x000001F7DFFA6000-memory.dmp

Download

memory/5288-57-0x000001F7DFCA0000-0x000001F7DFE1D000-memory.dmp

Download

memory/5888-234-0x00007FF744D90000-0x00007FF744E58000-memory.dmp

Download

memory/5888-235-0x000001D697C20000-0x000001D697C86000-memory.dmp

Download

memory/5888-320-0x00007FF744D90000-0x00007FF744E58000-memory.dmp

Download

memory/5888-236-0x000001D697C20000-0x000001D697C86000-memory.dmp

Download

memory/5948-302-0x000002117C9C0000-0x000002117CA26000-memory.dmp

Download

memory/5948-303-0x000002117C9C0000-0x000002117CA26000-memory.dmp

Download

memory/5948-301-0x00007FF66E990000-0x00007FF66EDA6000-memory.dmp

Download