197b42de1ec13da5ab67f8afff827ac8093c1d14b52558149177ae82d34e719f

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_b8a6ea9134c79456cb80e32b8dcccac8_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Size 786KB
Sample260714-dpg58ac17k
SHA256 197b42de1ec13da5ab67f8afff827ac8093c1d14b52558149177ae82d34e719f
MD5 b8a6ea9134c79456cb80e32b8dcccac8
SHA1 b0ec019d96ae87ea8ab1bdc42bee56a26fa52caa
SHA512 d15b3ef2b4d6b8d3f032e36a4513b4786a673ac360c6b274360720ca0bc74936585af343384e6aefc2aecbaa4be8bb602c395c5da7c167a7d2902079c8f63d7b
SSDEEP 24576:Sr7r+P4rvxL+A8iBZf2ai+MlYeG0OZRxc8BZuAmy:404rJL/brmG0OZUk9my
TLSH
T1CB05021234D3C4B2D57246300AF5EAB56ABFBD710A218EBF13D20B3E2E745C15625AB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
1428	alg.exe
4132	elevation_service.exe
3380	elevation_service.exe
3560	maintenanceservice.exe
2856	OSE.EXE
5648	GameInputSvc.exe
3824	GameInputSvc.exe
5664	msdtc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-14_b8a6ea9134c79456cb80e32b8dcccac8_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e2deec308f8562d1.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-14_b8a6ea9134c79456cb80e32b8dcccac8_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_b8a6ea9134c79456cb80e32b8dcccac8_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3824	GameInputSvc.exe
3824	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5800	2026-07-14_b8a6ea9134c79456cb80e32b8dcccac8_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	1428	alg.exe
Token: SeDebugPrivilege	1428	alg.exe
Token: SeTakeOwnershipPrivilege	4132	elevation_service.exe
Token: SeTcbPrivilege	5648	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5648 wrote to memory of 3824	5648	GameInputSvc.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-07-14_b8a6ea9134c79456cb80e32b8dcccac8_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_b8a6ea9134c79456cb80e32b8dcccac8_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5800

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1428

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4132

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3380

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3560

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2856

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5648
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3824

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
PID:5664

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
PID:4216

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:5632

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:2848

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:1164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1c341fc573a14bfb37fe2bb7d51f192b0499dcda2d8266be334899640c4f5140
MD5 a21c71c3e5df6b2cf3bb30d8f23241f9
SHA1 e80b0a214294df7f6f4b4954d22b28b55b295082
SHA512 8b5f64394f8c35416837976a1ce2fdfef49ddea3591ba33cf6f14673e4d69f3f7cec548d73cb891a074892061190abeb836015d3090115dfc9b3f0766b6f4868
SSDEEP 49152:sb+632BuPkFKRrdE6oh7stBhuXjfS4LWxn9brmG0OZUk9my:W3q6gjBimGxUy
TLSH
T136D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 a6362f14db797f8e6de146568cb21b24f2aff6b9b63d1861fd26ff79d08d31a1
MD5 c5f17acfbd5688babc06b3b9382f57e3
SHA1 d58716d52b6c4d257e1e56fadd59a49ec9708aba
SHA512 c1744b57bcf338e76653549fcc31bb83f204d1f29479cb15ac65116c3ab8582272c66bf1fe8196e7b0aa03cbd572751273535262f28178ef398b3365a193f4a5
SSDEEP 24576:0XYaDtczAuA8iBZf2ai+MlYeG0OZRxc8BZuAmy:QtcabrmG0OZUk9my
TLSH
T16E05F12937D149F9ED678278C962C516E77378564360E7DB03A18A292F333D81E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 9b0f38e6962cdc99530e7c48a3635c6425e3709ef5026069386c5d65ab4e40ea
MD5 cde155deb8a121f5e3000d869cda2a52
SHA1 4151e9b4a20efb7880ebdad7f513cc15c11115a0
SHA512 bc0729a9c6ea9a8594287e69d77b43177388902b34732b7874898055873e89dfeda62e186a64ddf4fa6c9b4e57ebf158e3c06a8b281717f0a01907fe04ceb249
SSDEEP 24576:UwusOWXA8iBZf2ai+MlYeG0OZRxc8BZuAm:UwfObbrmG0OZUk9m
TLSH
T15505F08A36945CF9EA668238C657C13AF7F3B8122A21CB5F0361C75B6F373616D29710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0f4848e16f40e01e627575b8c5c5023dbb831cced31d42b6a1f3eb4e8af80869
MD5 9b3efe7d5653f19113788aa6c8e88670
SHA1 b0bf9515072ada59034f7987a48262385a8b1b07
SHA512 b01c668c20273d0c051a1e68941cb6455143bdddf3687ef09a436d5868cd7330f9a1891a75a7d9ba78be7668ac7baaf864878ebf725149154471fa86d08d846e
SSDEEP 49152:lB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glLbrmG0OZUk9my:Lu6JmTxd2dbmGxUy
TLSH
T10CD59D13F1DA01E8D06ED578974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 de34eae7c8368d1e044f47cb2a4b7e038b91bf503596ffe087b9c947677ae576
MD5 1406972c4e5f2448ed6ec37b68cdd851
SHA1 e4ff34b72407c6705ca8258aaaa66401bda257e1
SHA512 72dda9d767ba775b5c3555a23ffe1cb36e60d422ebe3359ff0d2ea74ecdb24d9ba33242e6997f8e0d67cefc6c5eecc16cbc53c6afc5fe16d5118c8dcc29b9513
SSDEEP 12288:jl7WFV4a/tismLLZZ4Jsj2aROZ+R+9Pv5eeG0GIsZ28E4b4aPBQErKMuC/jSzy:ZWA8iBZf2ai+MlYeG0OZRxc8BZuAmy
TLSH
T152D423973B85EF2AEA29D7709B17D0AE337BBA671750C0D601030B6D7574AC42DA438B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 9b79d924868c4390767696c40e8b849ceb166a12f95c2574d054fc8eb1176f44
MD5 98564d0fc2f1ea88ccc9c72d9fe58b2f
SHA1 e1b21cbf62cde2438658dade1a58406d5ce938e8
SHA512 4aefea642ccb4df1a8b739bc585015133a290ee61307f8bcaa7bf5980a67aea756354e5a025fd5e6afb25b0abd185c1bebf375ce5d3dd30e91f4ac96fb5970f4
SSDEEP 12288:iJGyFV4a/tismLLZZ4Jsj2aROZ+R+9Pv5eeG0GIsZ28E4b4aPBQErKMuC/jSzy:CGyA8iBZf2ai+MlYeG0OZRxc8BZuAmy
TLSH
T143E4239E35D1F6A9CA39C3759B22D0AF36B37562131051EF01834A3DBB746D03678E86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 280KB
SHA256 d8a18b5229fa446686dd214acbe67a8bd2bbd70b1bd2940e4cd2440d47a743b7
MD5 81f3a0752195c1d83e4a9288d879edf1
SHA1 2c2af4b79f2a8ee72a4f65ba8b9bd47e2d2b8a1e
SHA512 4584cdee616adce75e4d206a18310c7278d477b7fec5643fed6a1eaa5e6168dde211ce675b9aba65fde7a060be258476fa7cb3c5049d8c48ed6c11eeeda008f6
SSDEEP 6144:332akUFV4ahmb+tisCnh5PTZZ4JhSj2arEwLOZ+R+HdPoaFdn:33FFV4a/tismLLZZ4Jsj2aROZ+R+9Pvn
TLSH
T13F5413862744FA39DA1255781862DD6B3B797E7E9B811BC31280130C59AEFC62D3C6CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 9c01fe0c1df52b4a1157afae8ae269669937b4b81a01f371a4ddb88ee1dfc868
MD5 7ff3b55b05e15a657ca178f3cc2bccb9
SHA1 175e337ad44bb880cdf85bfd353ec6c7fbd42262
SHA512 2c97629fee2760199bb5dd60d00537d9e374231790f56bffb8ce1ca5a84627d04245c64f2175b48157609e8bce5c1e7314baced4fa52230df74a17a80b8182e9
SSDEEP 24576:UPUr+NQQA8iBZf2ai+MlYeG0OZRxc8BZuAmy:UJQBbrmG0OZUk9my
TLSH
T1E405F16F36981CE5E67AE17D8A42C61DF772B8621312D2CF0291423E5E63ED87C39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 8fd52ef4bb5f34c4e0d56ac4da546c23a6f791130bbcc4dedf19bfba58030343
MD5 dfbd069acf558b38404d08711365faac
SHA1 2bc788a142c57d84cafc53db4b5d8f4f5a4a36de
SHA512 96f8888c751a6518ccc85b93b3ecc16c915eab400b983f54868f6499eb8e71a6a9ab17bcdf2ddc3f93a7b51ae36d812343a145accaef948eb0da3cb42fab7237
SSDEEP 49152:sBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj1brmG0OZUk9my:PG05lO43bomGxUy
TLSH
T1BED5C06E62EC11F9D1BBC17CDA86860BEBB23415033556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 dfb273211afb86c6f654bb47f4c756d75bd999af948680530af08e51ebfc39cc
MD5 5651e18d832da24daf478094238fa5a4
SHA1 57720c6d7f3d5e344302d3e7a72ca7a325db1acc
SHA512 9017ca296c6bcf7a479a514e6a142f03dd3bde0ad7811401c957914eb7f09136fdef79c1ab09b5c70e16ef59af84ae0877a4b86864d3674a315c00f0292dc325
SSDEEP 24576:/6DICEA8iBZf2ai+MlYeG0OZRxc8BZuAmy:/6DIC9brmG0OZUk9my
TLSH
T1B5F4014D336651BAD16BD03DC7438156E2B3B472835259DF07828A7DAFB3EC87938A42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 7b2f782d5579004946d77f5ab8fc815a02f1155b13841e65b8cea762ca7003e8
MD5 ea1f07969b092c1ed65b3c78557e0dee
SHA1 e2c46e84d26d3eb1afd787f048d3c9539039d9a7
SHA512 fc009dd32b76b21a320080d2bcdf966fab9e06dba7d6251eb87bec4b98f4a9f79392c6e78ef4b076d045d1f74a30b767a3c39c320578fce82d5208cc3ef7976a
SSDEEP 12288:/G6kyyFV4a/tismLLZZ4Jsj2aROZ+R+9Pv5eeG0GIsZ28E4b4aPBQErKMuC/jSzy:OtyyA8iBZf2ai+MlYeG0OZRxc8BZuAmy
TLSH
T12BF412453784E5A9EA7982749B23C1AA6B37BC22576182DF01839B3E7F35BC03D70746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1164-292-0x00007FF767FF0000-0x00007FF76809D000-memory.dmp

Download

memory/1428-17-0x000001ABEFF30000-0x000001ABEFF96000-memory.dmp

Download

memory/1428-16-0x000001ABEFF30000-0x000001ABEFF96000-memory.dmp

Download

memory/1428-15-0x00007FF79FC70000-0x00007FF79FD92000-memory.dmp

Download

memory/1428-18-0x000001ABEFF30000-0x000001ABEFF96000-memory.dmp

Download

memory/1428-63-0x00007FF79FC70000-0x00007FF79FD92000-memory.dmp

Download

memory/2848-285-0x00000191BA710000-0x00000191BA776000-memory.dmp

Download

memory/2848-286-0x00000191BA710000-0x00000191BA776000-memory.dmp

Download

memory/2848-284-0x00007FF6C7680000-0x00007FF6C7DC3000-memory.dmp

Download

memory/2856-59-0x000002B5F4D80000-0x000002B5F4DE6000-memory.dmp

Download

memory/2856-57-0x000002B5F4E50000-0x000002B5F4FCD000-memory.dmp

Download

memory/2856-58-0x000002B5F4D80000-0x000002B5F4DE6000-memory.dmp

Download

memory/3380-39-0x000001F642F90000-0x000001F642FF6000-memory.dmp

Download

memory/3380-38-0x000001F642F90000-0x000001F642FF6000-memory.dmp

Download

memory/3380-37-0x000001F644000000-0x000001F64417D000-memory.dmp

Download

memory/3560-54-0x00007FF7AC460000-0x00007FF7AC5C8000-memory.dmp

Download

memory/3560-52-0x000001A2AAE10000-0x000001A2AAE76000-memory.dmp

Download

memory/3560-47-0x000001A2AAE10000-0x000001A2AAE76000-memory.dmp

Download

memory/3560-45-0x00007FF7AC460000-0x00007FF7AC5C8000-memory.dmp

Download

memory/3560-46-0x000001A2AAE10000-0x000001A2AAE76000-memory.dmp

Download

memory/3824-253-0x000002026E800000-0x000002026E866000-memory.dmp

Download

memory/3824-243-0x00007FF78D4C0000-0x00007FF78D588000-memory.dmp

Download

memory/3824-252-0x000002026E800000-0x000002026E866000-memory.dmp

Download

memory/4132-29-0x00000279204B0000-0x0000027920516000-memory.dmp

Download

memory/4132-31-0x00000279204B0000-0x0000027920516000-memory.dmp

Download

memory/4132-30-0x00000279204B0000-0x0000027920516000-memory.dmp

Download

memory/4132-28-0x0000027920260000-0x00000279203DD000-memory.dmp

Download

memory/4216-263-0x00007FF608A20000-0x00007FF608B69000-memory.dmp

Download

memory/4216-266-0x000002E0F1130000-0x000002E0F1196000-memory.dmp

Download

memory/4216-265-0x000002E0F1130000-0x000002E0F1196000-memory.dmp

Download

memory/5632-278-0x0000000000A30000-0x0000000000A99000-memory.dmp

Download

memory/5632-272-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5632-273-0x0000000000A30000-0x0000000000A99000-memory.dmp

Download

memory/5648-235-0x0000020875AE0000-0x0000020875B46000-memory.dmp

Download

memory/5648-236-0x0000020875AE0000-0x0000020875B46000-memory.dmp

Download

memory/5648-234-0x00007FF78D4C0000-0x00007FF78D588000-memory.dmp

Download

memory/5664-248-0x0000023BFB3E0000-0x0000023BFB446000-memory.dmp

Download

memory/5664-247-0x0000023BFB3E0000-0x0000023BFB446000-memory.dmp

Download

memory/5664-246-0x00007FF72A8F0000-0x00007FF72AA09000-memory.dmp

Download

memory/5800-0-0x00000000027F0000-0x00000000028BF000-memory.dmp

Download

memory/5800-6-0x00000000029F0000-0x0000000002A59000-memory.dmp

Download

memory/5800-7-0x00000000029F0000-0x0000000002A59000-memory.dmp

Download

memory/5800-1-0x00000000029F0000-0x0000000002A59000-memory.dmp

Download