5bc2f14d512b89d6707226b749a2493feff611ed285abf9730ba9f6820de2d13

Analysis

max time kernel
148s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_5f293c0b092840aec927ba007d09cfd9_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
Size 1.8MB
Sample260716-ca2qmsd18t
SHA256 5bc2f14d512b89d6707226b749a2493feff611ed285abf9730ba9f6820de2d13
MD5 5f293c0b092840aec927ba007d09cfd9
SHA1 4dbfa0ff3d6f50845659a521f8de6f5bd1531982
SHA512 d138ea06b29e176967c3e0c549a361ff4216b716356fe08ce1b132139cfcf7efcbd6df4a2e127258cc1632150739269535ed4db5e17e2ff1f430a50588b844fb
SSDEEP 49152:xWJE2ZctEafitmGYj+uYP4D2VPrXdATGBrMGWr7nTC8HPS:GE2ZBaqaj+uYP4srmKtMbTC8HP
TLSH
T155952301B5D5C4B5FAB66A34A875C9A04FB8FC701A608ADF63443E291F785C0E539BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
5764	alg.exe
6024	GameInputSvc.exe
2716	GameInputSvc.exe
3144	elevation_service.exe
5968	elevation_service.exe
1536	maintenanceservice.exe
4776	OSE.EXE

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b1b6d5c58f8562d1.bin	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-15_5f293c0b092840aec927ba007d09cfd9_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-15_5f293c0b092840aec927ba007d09cfd9_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-15_5f293c0b092840aec927ba007d09cfd9_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Temp\GUM882.tmp\goopdateres_en-GB.dll	2026-07-15_5f293c0b092840aec927ba007d09cfd9_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File created	C:\Program Files (x86)\Google\Temp\GUM882.tmp\goopdateres_fa.dll	2026-07-15_5f293c0b092840aec927ba007d09cfd9_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File created	C:\Program Files (x86)\Google\Temp\GUM882.tmp\psuser.dll	2026-07-15_5f293c0b092840aec927ba007d09cfd9_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File created	C:\Program Files (x86)\Google\Temp\GUM882.tmp\goopdateres_ar.dll	2026-07-15_5f293c0b092840aec927ba007d09cfd9_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File created	C:\Program Files (x86)\Google\Temp\GUM882.tmp\GoogleUpdate.exe	2026-07-15_5f293c0b092840aec927ba007d09cfd9_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File created	C:\Program Files (x86)\Google\Temp\GUM882.tmp\goopdateres_nl.dll	2026-07-15_5f293c0b092840aec927ba007d09cfd9_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File created	C:\Program Files (x86)\Google\Temp\GUM882.tmp\goopdateres_sw.dll	2026-07-15_5f293c0b092840aec927ba007d09cfd9_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File created	C:\Program Files (x86)\Google\Temp\GUM882.tmp\goopdateres_ms.dll	2026-07-15_5f293c0b092840aec927ba007d09cfd9_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File created	C:\Program Files (x86)\Google\Temp\GUM882.tmp\goopdateres_en.dll	2026-07-15_5f293c0b092840aec927ba007d09cfd9_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File created	C:\Program Files (x86)\Google\Temp\GUM882.tmp\goopdateres_bn.dll	2026-07-15_5f293c0b092840aec927ba007d09cfd9_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File created	C:\Program Files (x86)\Google\Temp\GUM882.tmp\goopdateres_gu.dll	2026-07-15_5f293c0b092840aec927ba007d09cfd9_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File created	C:\Program Files (x86)\Google\Temp\GUM882.tmp\goopdateres_pt-BR.dll	2026-07-15_5f293c0b092840aec927ba007d09cfd9_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File created	C:\Program Files (x86)\Google\Temp\GUM882.tmp\goopdateres_fi.dll	2026-07-15_5f293c0b092840aec927ba007d09cfd9_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File created	C:\Program Files (x86)\Google\Temp\GUM882.tmp\goopdateres_da.dll	2026-07-15_5f293c0b092840aec927ba007d09cfd9_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File created	C:\Program Files (x86)\Google\Temp\GUM882.tmp\goopdateres_sl.dll	2026-07-15_5f293c0b092840aec927ba007d09cfd9_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File created	C:\Program Files (x86)\Google\Temp\GUM882.tmp\GoogleUpdateSetup.exe	2026-07-15_5f293c0b092840aec927ba007d09cfd9_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File created	C:\Program Files (x86)\Google\Temp\GUM882.tmp\GoogleUpdateOnDemand.exe	2026-07-15_5f293c0b092840aec927ba007d09cfd9_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-15_5f293c0b092840aec927ba007d09cfd9_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_5f293c0b092840aec927ba007d09cfd9_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2716	GameInputSvc.exe
2716	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2836	2026-07-15_5f293c0b092840aec927ba007d09cfd9_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
Token: SeTcbPrivilege	6024	GameInputSvc.exe
Token: SeDebugPrivilege	5764	alg.exe
Token: SeDebugPrivilege	5764	alg.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6024 wrote to memory of 2716	6024	GameInputSvc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-15_5f293c0b092840aec927ba007d09cfd9_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_5f293c0b092840aec927ba007d09cfd9_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2836

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5764

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6024
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2716

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5968

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1536

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8f182ec175c96c12c918fafbf4b9c341f231434e3bceb0f2ad9331b9de8156b1
MD5 7d7962bfe9f346551c3e33122cfb01ab
SHA1 18076140803b23162c767b4e38da1fd645687238
SHA512 8518a4c12fed369dd40c6d58ee2b4ae7f909a69d7e2c8e35784e50602c3e7f4a5de6f2c4c73a2f3900086318b5c836c45be27373f01050af1750fe161d217c43
SSDEEP 49152:jb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnjATGBrMGWr7nTC8HPS:B3q6gjB9KtMbTC8HP
TLSH
T13ED59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 407de46ef25d99bcab429dc9907213d250ed4bda29f801b4ba58f87c4621f315
MD5 87b57c7db86396e5e6bb64e9122b55f4
SHA1 7972fcd8e10e8fd031a7a50c1de725e945615122
SHA512 0e15ddcbb16fee5a1bb39a923a7cb2feb1d9cf9043061e875f6b9fda8bcb8ab4e26af88e618bb53187065aa59dd708ea3d5951b349b39361941b8cb6c732e7c9
SSDEEP 24576:tXYqA1czAxICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:c1ckATGBrMGWr7nTC8HPS
TLSH
T104050229A7D048FDED5BD17CC8B18801EB33B85547A0E79B03A49A691F233D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 8b7664c957f7c84989369d3b4d88aec177dfb41ed4c274bb4d00265ae2ffaf32
MD5 9d5e6d2833c2dff05f0407865ea3736f
SHA1 c86e412e9f4a5e19606d563aa25c0ec8e0ae1c64
SHA512 d3dff7daf217eaa3794fa85580e79fccc4e62541bb1079a8e8c468447523bead510201ce184ed69f1914aae5b559c4b55707fcd341162d49066c467da08001cb
SSDEEP 24576:uwuuOWKICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:uwVOBATGBrMGWr7nTC8HPS
TLSH
T10905F14676A44CF9E96B913C8567C536FBB2B8022A21C71F1320CB5B5F37391AE2D760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b73b08f6de3b3b5c5b53cabb9e181031a52cb46ef1d8cd5c01d9a347c8a3dfec
MD5 76099107619ec454b63d84a38f409a17
SHA1 ccda8e96afa14b0307706329d9d820219bf48287
SHA512 6cb451284eb348f778e461ad2b3dfccfed6fe5dfc7f6321a2ea4f765e4cc2e1c47dc5b17e934b95f36f749c352b150ce1f7411dca4871b17daa0b8628e8c88f0
SSDEEP 49152:/G+taZ3usBWOBr4tEGp0bqx0z+n217aau1glhATGBrMGWr7nTC8HPS:+u6JmTxd2dyKtMbTC8HP
TLSH
T1E0D59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 f307d41e991376efbce1638de12754fa6ee3734a55ff3e888a1d22eaec49563b
MD5 f969a27a5836ef5eda9526c4db7a5776
SHA1 4b4eb8977f15a0afee2562e076ce1ecb6070b87e
SHA512 1e7e5fcfb7106ca7d7c5edf37f25b7aa97870d5796584086382649f83b0d319994bca0e037e085fe2fa0ef22baee4e3129889de0c2752857fb74d905f1bce390
SSDEEP 12288:+mGi4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:NGlICgpB5GBrMVyJWrwgh5AQorrYWbJb
TLSH
T125E4231AA1B5E8ACE83ED07C94718892BD3176A0276093FF66105EBD4F267D0733DDA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 1e5f40cfe51ba52121d7a1f6aa336c7836abc510d1bd0c05dca4dbcf4a013067
MD5 08a49a8e1c2cb37f8fe22820ee1c0d5d
SHA1 1c3ccdd6c3f71931c5851fdff634ca4572f22185
SHA512 3ef0bd62d329684b660274518e3fc11d5203e9571511c62ffc0f0efda519a7acea2946d44e067b7ca6ab9ccccdca10b0962b963dae62d7c7dfa16472e2b22379
SSDEEP 24576:l6DIYICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:l6DIYATGBrMGWr7nTC8HPS
TLSH
T1BC05020D637A50F9E06BE03D81A30441D672B0B1976256DF575489BD4FA3EC8BA3CE91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4503e8af5a0826462f6312f94480b8dab12aa0f8f8d07e609eb1f96c7056e781
MD5 ea1b08ef16cccc06a1d25637ff3cc244
SHA1 013e947fa43ff64def492b94bc57aaff2b74b6d5
SHA512 943ecb2d8078bb11585db9ce07ee8b1f0bbc10de5edf79c256f2f5ba4fab0950c988aeecdd9c93bf0b43371ec09073d453890fc6e520c407ef64869d22a9686f
SSDEEP 24576:wTkNvNnaFeYhJNtmZBmwICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:wTMwBtOmwATGBrMGWr7nTC8HPS
TLSH
T1A255AF2EBAB845E4E1FEC5B4DD238512EA727461173293CB5390C13E0E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1536-137-0x00007FF79AB40000-0x00007FF79ACA8000-memory.dmp

Download

memory/1536-146-0x00007FF79AB40000-0x00007FF79ACA8000-memory.dmp

Download

memory/1536-144-0x00000228CC7E0000-0x00000228CC846000-memory.dmp

Download

memory/1536-139-0x00000228CC7E0000-0x00000228CC846000-memory.dmp

Download

memory/1536-138-0x00000228CC7E0000-0x00000228CC846000-memory.dmp

Download

memory/2716-155-0x00007FF7E6230000-0x00007FF7E62F9000-memory.dmp

Download

memory/2716-103-0x00007FF7E6230000-0x00007FF7E62F9000-memory.dmp

Download

memory/2716-107-0x0000029C3C920000-0x0000029C3C986000-memory.dmp

Download

memory/2716-104-0x0000029C3C920000-0x0000029C3C986000-memory.dmp

Download

memory/2836-106-0x0000000000130000-0x0000000000574000-memory.dmp

Download

memory/2836-6-0x0000000002870000-0x00000000028D9000-memory.dmp

Download

memory/2836-7-0x0000000002870000-0x00000000028D9000-memory.dmp

Download

memory/2836-1-0x0000000002870000-0x00000000028D9000-memory.dmp

Download

memory/2836-0-0x0000000000130000-0x0000000000574000-memory.dmp

Download

memory/2836-125-0x0000000000130000-0x0000000000574000-memory.dmp

Download

memory/3144-113-0x0000021CDCD10000-0x0000021CDCE95000-memory.dmp

Download

memory/3144-114-0x0000021CDCFC0000-0x0000021CDD026000-memory.dmp

Download

memory/3144-115-0x0000021CDCFC0000-0x0000021CDD026000-memory.dmp

Download

memory/4776-149-0x000002224B6A0000-0x000002224B825000-memory.dmp

Download

memory/4776-151-0x000002224B830000-0x000002224B896000-memory.dmp

Download

memory/4776-150-0x000002224B830000-0x000002224B896000-memory.dmp

Download

memory/5764-18-0x0000019ED3B60000-0x0000019ED3BC6000-memory.dmp

Download

memory/5764-15-0x00007FF720380000-0x00007FF7204A3000-memory.dmp

Download

memory/5764-119-0x00007FF720380000-0x00007FF7204A3000-memory.dmp

Download

memory/5764-16-0x0000019ED3B60000-0x0000019ED3BC6000-memory.dmp

Download

memory/5764-17-0x0000019ED3B60000-0x0000019ED3BC6000-memory.dmp

Download

memory/5968-131-0x0000018DD6340000-0x0000018DD63A6000-memory.dmp

Download

memory/5968-130-0x0000018DD6340000-0x0000018DD63A6000-memory.dmp

Download

memory/5968-129-0x0000018DD60E0000-0x0000018DD6265000-memory.dmp

Download

memory/6024-94-0x00007FF7E6230000-0x00007FF7E62F9000-memory.dmp

Download

memory/6024-95-0x000001F15C280000-0x000001F15C2E6000-memory.dmp

Download

memory/6024-97-0x000001F15C280000-0x000001F15C2E6000-memory.dmp

Download

memory/6024-126-0x00007FF7E6230000-0x00007FF7E62F9000-memory.dmp

Download