1b8fada537d02dddf50e3f987a7cfdc3caf8550f54c9219fa185fc112fceb2f9

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 08:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_14f1d99b9dab9936542a6e34f3709cfb_bkransomware_elex_icedid_maze.exe
Size 2.3MB
Sample260718-kpr4rahw3t
SHA256 1b8fada537d02dddf50e3f987a7cfdc3caf8550f54c9219fa185fc112fceb2f9
MD5 14f1d99b9dab9936542a6e34f3709cfb
SHA1 ea2ccbf0d8cecb6b07a45ee1f63c31bdb0b7e46b
SHA512 6dad862c8bfae2bda30fd51feb9fe0b1ecd5c91a025b913cce88b3df2103e0ea3ff6f74fa16c0a344c267d53774770b5a80753aee6ae9572d9b6ebce8874cccb
SSDEEP 49152:GDD0FZs/Yl7dYUMQ+fCi6pNO8IFeID8uxV1XL4fq8gCA7ymNW9:uD0FZs/U73MQ+fCi6Xeeo8uxV1XMiymN
TLSH
T187B5BF33F590907AC93313315E9D627C76A9BB710F36428722E55F2D2EB05C36A297A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
2276	alg.exe
5552	GameInputSvc.exe
4116	GameInputSvc.exe
5400	elevation_service.exe
936	elevation_service.exe
5980	maintenanceservice.exe
276	OSE.EXE

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-18_14f1d99b9dab9936542a6e34f3709cfb_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-18_14f1d99b9dab9936542a6e34f3709cfb_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a75798ef8f8562d1.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-18_14f1d99b9dab9936542a6e34f3709cfb_bkransomware_elex_icedid_maze.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-18_14f1d99b9dab9936542a6e34f3709cfb_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-18_14f1d99b9dab9936542a6e34f3709cfb_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_14f1d99b9dab9936542a6e34f3709cfb_bkransomware_elex_icedid_maze.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4116	GameInputSvc.exe
4116	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6128	2026-07-18_14f1d99b9dab9936542a6e34f3709cfb_bkransomware_elex_icedid_maze.exe
Token: SeTcbPrivilege	5552	GameInputSvc.exe
Token: SeDebugPrivilege	2276	alg.exe
Token: SeDebugPrivilege	2276	alg.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
6128	2026-07-18_14f1d99b9dab9936542a6e34f3709cfb_bkransomware_elex_icedid_maze.exe
6128	2026-07-18_14f1d99b9dab9936542a6e34f3709cfb_bkransomware_elex_icedid_maze.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
6128	2026-07-18_14f1d99b9dab9936542a6e34f3709cfb_bkransomware_elex_icedid_maze.exe
6128	2026-07-18_14f1d99b9dab9936542a6e34f3709cfb_bkransomware_elex_icedid_maze.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
6128	2026-07-18_14f1d99b9dab9936542a6e34f3709cfb_bkransomware_elex_icedid_maze.exe
6128	2026-07-18_14f1d99b9dab9936542a6e34f3709cfb_bkransomware_elex_icedid_maze.exe
6128	2026-07-18_14f1d99b9dab9936542a6e34f3709cfb_bkransomware_elex_icedid_maze.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5552 wrote to memory of 4116	5552	GameInputSvc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-18_14f1d99b9dab9936542a6e34f3709cfb_bkransomware_elex_icedid_maze.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_14f1d99b9dab9936542a6e34f3709cfb_bkransomware_elex_icedid_maze.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:6128

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2276

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5552
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4116

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:936

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5980

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c52cc28c1fd5b407a6880d2e51f9707f3f920922424115a03581958afdbb95c1
MD5 87ed9aa9d0de424b2b95fe8dd847c48e
SHA1 9005c06f0f51972c93bdc244ca386a66a5dd5a0a
SHA512 118e78fa9037b063521ace8f47baa23f5353f9d20ea662704cf70930aea62fe27e7a35bafc39ca8fbe4697dc76662e2cb633f90e9f49568800a87bddc601942f
SSDEEP 49152:N3V632BuPkFKRrdE6oh7stBhuXjfS4LWxntq8gCA7ymNW9:63q6gjBoiymN
TLSH
T177D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 6ec6d625795394f4e9b4f7455a6f8ef06647d10a289853033aeb81a2f936e48c
MD5 15096fbe5123f23ef3abd94ca0026477
SHA1 2943317d74644c1c1cd194f38de4916329396a00
SHA512 0e2a0f8877d67c5b0bd9cbf216df55db4586976792de1f0748c5bb2e5a2b8661929995b5c2620899870710d915acb5812d2164a0aa8a88220dc9031f130a0dcd
SSDEEP 24576:wXYmD3czAHOqDIgCTUgI7Zs3q1NMymHYtG9:Q3c1q8gCA7ymNW9
TLSH
T18605022973E408F9ED77827CC8E28521EA73B8454760E75B03E49A791F637980E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 826KB
SHA256 5acf030b3ff63abf471bcb045bbf659b762dc0d4de85ae290e875479218373bc
MD5 88b84d3cabc2895ac1e853adeb7776b9
SHA1 cd9390a3f177f990f27a99395c5a586d4b613bdd
SHA512 c7c066d43aeff83d760b410b46d242349c2da6355ccf7dab3af8439d2b8de65d29269524c9450e7c201fcacbd60ce51a1b71e81ebfdf4eba225c5d32fa8fb97f
SSDEEP 24576:Qwu+OWSOqDIgCTUgI7Zs3q1NMymHYtG9:QwlOyq8gCA7ymNW9
TLSH
T19205F18672A41CF9E9B7963885978136F7F2B8052B25C71F03A0C75B6F673216D2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4ad1f100929a8f45e114703a613be64cd0a0f6c9ce5ce8246256cfd57e7c69ff
MD5 8b0f5c9807f219d73c25c4a42cc360f1
SHA1 27c6a4a9addf03a838ac4c4e66033f2d6b3c1191
SHA512 73795a09583f157fa15644c19886ef8a6e840e2b9e13d4676b98aca532a5fa225f5e11a6d53459cc162836650f5ef19b98328a725d8bffe2865aaada3aea8118
SSDEEP 49152:IO+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl+q8gCA7ymNW9:Ju6JmTxd2dWiymN
TLSH
T1A7D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 5e55806d08f5107169d20cac6b14dc849091056b87b7243f7a5c2b805f570bd9
MD5 521dfd7791549f5268d096d06258a486
SHA1 3d2aa2804a8bdd8e17db68605f678bebde03f67f
SHA512 adb6ce15596efccff32b619ecacbff42f5715cf3280f9c5271d4d75bdff796eeb1bda0f0db42f861fd29711598762e7c73c5d7aa6baf230df1acae47ea0337a0
SSDEEP 12288:NQG560DCqGboIALT2TUuj7wZ7Z7o3q1RA9+v/5X8mjWaMQ8HYtLCzXJMq:6GJOqDIgCTUgI7Zs3q1NMymHYtG9
TLSH
T194E422AB31B530C8E977877851E22272B9B0B1454B1811FF02D0FA3D9FD99F01A39E69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 e7bd2077f1b214aa5988189cf4be32f6ea99e924ad47ef3ea8c44ee8441d6c2c
MD5 e699b648d8216548585441d96c337098
SHA1 d39abd94788c1cf15c6cddfffc34c0b2c1ecf788
SHA512 179a65c394948b05fe9b34b956b30bf949b7104fe3a2d4226951d9bb86b4d9bfa67841f4967e90fa6d1387fe1c06eb66fa3abb4224d9532f14d430fa2aa3fe71
SSDEEP 12288:X1H/kP/5ZI7y60DCqGboIALT2TUuj7wZ7Z7o3q1RA9+v/5X8mjWaMQ8HYtLCzXJh:yP3IOOqDIgCTUgI7Zs3q1NMymHYtG9
TLSH
T1ADF4F19E237A10F9E1B7D13D82830122E2B2B0658B5219DF06D4D57D9FE3ED8B938E51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8165751a26b08aab36717dba545a534b17d462dc9456efa5fcd3d9adbedb6420
MD5 d704f2ec8e2d034a14f11d423b74ac20
SHA1 180805a29aa2c9e0643f53c30be618de712db58a
SHA512 202f8cee88bc3f7b73eb52f60a26f1d3f69f3b8e0a37b556d1c223059f6d7e91ba08976ad34239adb135cf33bc8423acfc456f67ebd6da4ad370df9e5d4ef6fb
SSDEEP 24576:LTkNvNnaFeYhJNtmZBmpOqDIgCTUgI7Zs3q1NMymHYtG9:LTMwBtOmEq8gCA7ymNW9
TLSH
T19055AF6EB6B806E4E1FEC6B48D238512EA727451073253CB5390C13F5E679D89E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/276-80-0x0000017DDBA20000-0x0000017DDBA86000-memory.dmp

Download

memory/276-79-0x0000017DDBA20000-0x0000017DDBA86000-memory.dmp

Download

memory/276-78-0x0000017DDB8F0000-0x0000017DDBA14000-memory.dmp

Download

memory/936-59-0x00000258EEE00000-0x00000258EEE66000-memory.dmp

Download

memory/936-58-0x00000258EEE00000-0x00000258EEE66000-memory.dmp

Download

memory/936-57-0x00000258EEBB0000-0x00000258EECD4000-memory.dmp

Download

memory/2276-15-0x00007FF633220000-0x00007FF633342000-memory.dmp

Download

memory/2276-18-0x000001D690330000-0x000001D690396000-memory.dmp

Download

memory/2276-17-0x000001D690330000-0x000001D690396000-memory.dmp

Download

memory/2276-16-0x000001D690330000-0x000001D690396000-memory.dmp

Download

memory/2276-50-0x00007FF633220000-0x00007FF633342000-memory.dmp

Download

memory/4116-36-0x0000023DAFDA0000-0x0000023DAFE06000-memory.dmp

Download

memory/4116-38-0x0000023DAFDA0000-0x0000023DAFE06000-memory.dmp

Download

memory/4116-35-0x00007FF76A0D0000-0x00007FF76A198000-memory.dmp

Download

memory/4116-85-0x00007FF76A0D0000-0x00007FF76A198000-memory.dmp

Download

memory/5400-46-0x00000264BD350000-0x00000264BD3B6000-memory.dmp

Download

memory/5400-45-0x00000264BD350000-0x00000264BD3B6000-memory.dmp

Download

memory/5400-44-0x00000264BD220000-0x00000264BD344000-memory.dmp

Download

memory/5552-26-0x00007FF76A0D0000-0x00007FF76A198000-memory.dmp

Download

memory/5552-29-0x000001F386AD0000-0x000001F386B36000-memory.dmp

Download

memory/5552-65-0x00007FF76A0D0000-0x00007FF76A198000-memory.dmp

Download

memory/5552-27-0x000001F386AD0000-0x000001F386B36000-memory.dmp

Download

memory/5980-67-0x00000159ABF60000-0x00000159ABFC6000-memory.dmp

Download

memory/5980-68-0x00000159ABF60000-0x00000159ABFC6000-memory.dmp

Download

memory/5980-73-0x00000159ABF60000-0x00000159ABFC6000-memory.dmp

Download

memory/5980-75-0x00007FF6EA760000-0x00007FF6EA8C7000-memory.dmp

Download

memory/5980-66-0x00007FF6EA760000-0x00007FF6EA8C7000-memory.dmp

Download

memory/6128-0-0x0000000002A30000-0x0000000002B73000-memory.dmp

Download

memory/6128-1-0x00000000010A0000-0x0000000001109000-memory.dmp

Download

memory/6128-7-0x00000000010A0000-0x0000000001109000-memory.dmp

Download

memory/6128-6-0x00000000010A0000-0x0000000001109000-memory.dmp

Download