ef76c4c8bc5dc0d9270e6ba9639067bae61705f47bdbb2e6f46a470c40f9bce3

Analysis

max time kernel
147s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 03:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_7140dd35554bd4bd08dfe879042727b6_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Size 766KB
Sample260720-dhe3aadt4k
SHA256 ef76c4c8bc5dc0d9270e6ba9639067bae61705f47bdbb2e6f46a470c40f9bce3
MD5 7140dd35554bd4bd08dfe879042727b6
SHA1 660fa06edd339fd92e6e842f9600b1e3eb308801
SHA512 e25efc32feaf988855ba4be5a60c4457d29667dcd02a84bafd6506501dd8a494500128efaa5618464796f851a8d4dbeecff848cd89d4fd671afe81fc537361f6
SSDEEP 12288:iA26CQsSKdlg8CkJoTtvksIpUFwqWD/GAhjzl/ylVS3zbz78TTPP+DjVGZu2Za9r:id6ydHCkuTeBpU+qXAh9/ylVYj8nUGZz
TLSH
T1BDF41260B2D0D4B2D5AB043148E5CB71193A7C391EA0885F7BDA7BB94E723E1412DB9F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 9 IoCs

pid	Process
2520	alg.exe
624	elevation_service.exe
3444	elevation_service.exe
5900	maintenanceservice.exe
380	OSE.EXE
4528	GameInputSvc.exe
6012	GameInputSvc.exe
5464	msdtc.exe
6124	PerceptionSimulationService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-20_7140dd35554bd4bd08dfe879042727b6_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fc2f8311763f1d8f.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-20_7140dd35554bd4bd08dfe879042727b6_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\javaw.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_7140dd35554bd4bd08dfe879042727b6_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6012	GameInputSvc.exe
6012	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4816	2026-07-20_7140dd35554bd4bd08dfe879042727b6_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Token: SeDebugPrivilege	2520	alg.exe
Token: SeDebugPrivilege	2520	alg.exe
Token: SeTakeOwnershipPrivilege	624	elevation_service.exe
Token: SeTcbPrivilege	4528	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 6012	4528	GameInputSvc.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-07-20_7140dd35554bd4bd08dfe879042727b6_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_7140dd35554bd4bd08dfe879042727b6_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4816

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2520

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:624

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3444

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5900

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:380

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:6012

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5464

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6124

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:2804

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:4608

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:3720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4e84b12acedcc58746a8d0eaeae9595b585b415838334ab6dd97fd7633d54727
MD5 197144d16337d915974cabac3f518f16
SHA1 192db3a37cba89383748a0dc2a9c59aaa6afa4b3
SHA512 61a946ba5e23f2fa7a0c8c47548c071d6dcc413c533d04ebb05360c5f1368b874ecb78ed0b5c1820708f2d0beb7a5b4ce4239e3c737bf251824adf17c9d85f33
SSDEEP 49152:6b+632BuPkFKRrdE6oh7stBhuXjfS4LWxnKUY3/y3YIzB3:s3q6gjB6Y3gYIF
TLSH
T11CD58C03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 7f8b7fb308781e0ba4c3e306fd92c81d9b973eda08843d20cf0a111568620367
MD5 3c5ad538da8243cbb8a43792229fe795
SHA1 291c833b0b424f77514cf4fc4a11a41cccc80b0c
SHA512 40ef86531ad6b4d9f96b3b2cf264c76358c3ee12826e62b46fd63338be96009824b61fdda18cac3073ede857dc36d81179cf75203e7ebf86628801af5427213b
SSDEEP 24576:mXYZwtczAJU+qXAh9/ylVYj8nUGZukB3D/L:ktcsUY3/y3YIzB3
TLSH
T15A050264B7E408F9EDAB813DCCA28515EA33B85007A0EB9F03E496655F233D45E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 4c2e9248046796fadd77d4094731fe109ca06ff22879ac6e6d1233cc9ac46add
MD5 5af07ef43cf35432f1d656b8e48b1367
SHA1 04f7083fb20444e843f192483cbcc782322598ab
SHA512 8836721061af530b6688f79d06b5e25bf9c85fc2b47f316601773db232293284b9298c8fae05757a61bd4d2b61c43798d8fc4fed278a814ed9d6722ef9e718b6
SSDEEP 24576:Owu+OWAU+qXAh9/ylVYj8nUGZukB3D/L:OwlOrUY3/y3YIzB3
TLSH
T1C605F18577E40CF9E9A781398597C136F7B2B8012A25CB2F57A0C75B5F233616D2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 54bceb42dbfad967d8c6789d8aec1110de234982f2d2557e32a49f45064e94e5
MD5 cc4909575ace7f52e2cb4f9e456c7af7
SHA1 79235e7f54d453e6626b957b7cafec45fc2c6987
SHA512 9673c8ebe669ae226fa283bab675579e8df98b030e4d791390224391bf61fd7177033e4b56c0eec395bb1114cec9d35f495ac9923d04a35bf7a4618f2dbeadce
SSDEEP 49152:QB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glOUY3/y3YIzB3:Ku6JmTxd2d/Y3gYIF
TLSH
T195D59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073552A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 07e41d73add042d5d895951fac5a3c214a090147612f087da8df834834c68434
MD5 63327dc03966d4d852bf75ccfe5e7577
SHA1 a3bd28f7a4d3088e1093ee0b17679f876eee3d9b
SHA512 9586572edd9a39da84cc30b1e86b71fccde1ea9e070526b6f167a7ef576685f42e0a98c080155a310e833c68c93d13a1c6dc372566c98f65af743077a7fb4297
SSDEEP 12288:B07+UFwqWD/GAhjzl/ylVS3zbz78TTPP+DjVGZu2Za9Y3MF6XHEwc0S:m+U+qXAh9/ylVYj8nUGZukB3D/L
TLSH
T119D42391E7B91C8AE5EE893408C6921D791DA9101F84CCFFFDC393C598607D02D2AF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 8c3c4b26b160962a974b32ff8b96051eb3316a17e1c8c6f50b1a8191eaf3220e
MD5 d5fc0f48be9bd079449205499ced45ef
SHA1 7dfcbe7189dd9e66210aca97972f172c03fcf729
SHA512 749cded94e1159ca686a61d180b34731389ebaa55460382e77bcfd93e3d45e268226beb11c2a403888dc931db985241a3d3fc1c25313a7f82f3d0b6172eb4372
SSDEEP 12288:2fG3UFwqWD/GAhjzl/ylVS3zbz78TTPP+DjVGZu2Za9Y3MF6XHEwc0S:AG3U+qXAh9/ylVYj8nUGZukB3D/L
TLSH
T161E422A4B6F538C8C5BEC6390892925AB83079501F549DFF8DD2D3B58F507E0363AE98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 b785899944d77c0287f39a643f96291b2fd93b55604b20f6dfd581739ea5fc86
MD5 eecc6f4af228f98d5c3cdae3f287500e
SHA1 9bed5decc14799c7a8a99ddae30e043c3717304b
SHA512 3e9d38bd47ffc7fa5aca6c038a7eed65707ededb7c8497056e4226972eb2158186249a22be68dcfb2a977afba3a0a3bf654e8edf7e6a75899c2ebe8ae2d878ad
SSDEEP 12288:vXUFwqWD/GAhjzl/ylVS3zbz78TTPP+DjVGZu2Za9Y3MF6XHEwc0S:vXU+qXAh9/ylVYj8nUGZukB3D/L
TLSH
T1F6D423C0F7B95CCAE6DA893908C3920D741899101F94DDFFE9D3A3C199907D1293AFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 256d50edb6ae1e8da6c9645e5dcd7f4e698b0c0b2f21eeb1222f15496c6029dd
MD5 f8d5dbb44e01bc67dfcdada6e7e1ae5d
SHA1 29eaf41e99b9e6c7d45d81b9a0c3489c1949c740
SHA512 8a383ece88a0076c8832fecba7608764cf734b8791e406828acce5838f63a7ac2f13210f075ef65a611b86d57bbe033eb87716ed4da039a4acb3d1cfda3bb619
SSDEEP 24576:yPUr+NQ7U+qXAh9/ylVYj8nUGZukB3D/L:yJQ7UY3/y3YIzB3
TLSH
T15005E15A62E81CD5E6BAE13D8982830DF731B4611711D6DF02D1827E4E63AE87D3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 a972880caf9096688b2b820f9e85935ea55a8ead3aa53446d6d2bfcfd7c8c665
MD5 22b36c707cfebeb001f1f8f7717f850f
SHA1 cc831fcba44e5dee5ecf0b7410f41b825ab3dade
SHA512 9790f3f14e79609285b6666fd6b7d9f498665a196f6f2219e3cf77dbf22edefc83f0b5550854fd3f6a35390a3e64ef90d91faef9303f0140b48efa06905e8441
SSDEEP 49152:gBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjhBUY3/y3YIzB3:bG05lO43bCaY3gYIF
TLSH
T11ED5CF6A62EC11F9D1BBC17CD9C6860BEBB23815033556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 d18897e797c8212d8626943963a29eee0ced8ba89cac0245df1cd9ed84fe315a
MD5 41336526e35d09e10a467d3125468ca4
SHA1 868edc5642c9dad77bbeddf359e7fe95308d5a3e
SHA512 bb160aab22e26681ab103c2c4e8b734aaf9fe97642c6ca3d6d59d2834ac8ffb65ff6b4dab685baf8b6261e8905ba98c8ec79c6c3132d5fb222dbd095030a8a08
SSDEEP 12288:x1Hck6j5ZI7MUFwqWD/GAhjzl/ylVS3zbz78TTPP+DjVGZu2Za9Y3MF6XHEwc0S:p6DIIU+qXAh9/ylVYj8nUGZukB3D/L
TLSH
T1C9F4015C73BA10F9D1ABC03E85830206E172B4708B5259EF4AD5C6B98EA3FD8793DE51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 21c2020e4dda1bee6df45e6daf98e3f37a4e2a8433bc17afc2e20445041b73ef
MD5 73ca54851719e15c9162286ba1cf6597
SHA1 1cf1e7a67423cc8e8e5c23ab797f4d3332691115
SHA512 9e0f11d65312ab8792fee6d182b3cc55aa549e88ed01353d50be3afd36cab5fc63de9006fcd5d73d37a182edf38c4451955502f1ed0635eaa6c529b08d1f809a
SSDEEP 12288:UG6kytUFwqWD/GAhjzl/ylVS3zbz78TTPP+DjVGZu2Za9Y3MF6XHEwc0S:FtytU+qXAh9/ylVYj8nUGZukB3D/L
TLSH
T1B7F41240A3B424C9E6FE463848A38258AE35BC201F508AFFA9D2E76E5F317D06C35F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/380-60-0x0000022675B30000-0x0000022675B96000-memory.dmp

Download

memory/380-59-0x0000022675940000-0x0000022675A01000-memory.dmp

Download

memory/380-61-0x0000022675B30000-0x0000022675B96000-memory.dmp

Download

memory/624-29-0x000001D4F8A80000-0x000001D4F8B41000-memory.dmp

Download

memory/624-31-0x000001D4F8C70000-0x000001D4F8CD6000-memory.dmp

Download

memory/624-32-0x000001D4F8C70000-0x000001D4F8CD6000-memory.dmp

Download

memory/624-30-0x000001D4F8C70000-0x000001D4F8CD6000-memory.dmp

Download

memory/2520-16-0x000001EE5D380000-0x000001EE5D3E6000-memory.dmp

Download

memory/2520-17-0x000001EE5D380000-0x000001EE5D3E6000-memory.dmp

Download

memory/2520-65-0x00007FF7B7460000-0x00007FF7B7582000-memory.dmp

Download

memory/2520-18-0x000001EE5D380000-0x000001EE5D3E6000-memory.dmp

Download

memory/2520-15-0x00007FF7B7460000-0x00007FF7B7582000-memory.dmp

Download

memory/2804-275-0x0000000000940000-0x00000000009A9000-memory.dmp

Download

memory/2804-280-0x0000000000940000-0x00000000009A9000-memory.dmp

Download

memory/2804-274-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/3444-39-0x000001CA832D0000-0x000001CA83336000-memory.dmp

Download

memory/3444-42-0x000001CA832D0000-0x000001CA83336000-memory.dmp

Download

memory/3444-40-0x000001CA832D0000-0x000001CA83336000-memory.dmp

Download

memory/3444-38-0x000001CA830E0000-0x000001CA831A1000-memory.dmp

Download

memory/3720-296-0x000001203EB50000-0x000001203EBB6000-memory.dmp

Download

memory/3720-295-0x000001203EB50000-0x000001203EBB6000-memory.dmp

Download

memory/3720-294-0x00007FF644560000-0x00007FF64460D000-memory.dmp

Download

memory/4528-236-0x00007FF7B1430000-0x00007FF7B14F8000-memory.dmp

Download

memory/4528-237-0x00000136F8D00000-0x00000136F8D66000-memory.dmp

Download

memory/4528-238-0x00000136F8D00000-0x00000136F8D66000-memory.dmp

Download

memory/4608-286-0x000001F5DBBB0000-0x000001F5DBC16000-memory.dmp

Download

memory/4608-287-0x000001F5DBBB0000-0x000001F5DBC16000-memory.dmp

Download

memory/4608-288-0x00007FF728850000-0x00007FF728F93000-memory.dmp

Download

memory/4816-1-0x0000000002F60000-0x0000000002FC9000-memory.dmp

Download

memory/4816-6-0x0000000002F60000-0x0000000002FC9000-memory.dmp

Download

memory/4816-26-0x0000000000200000-0x000000000032B000-memory.dmp

Download

memory/4816-0-0x0000000000200000-0x000000000032B000-memory.dmp

Download

memory/4816-7-0x0000000002F60000-0x0000000002FC9000-memory.dmp

Download

memory/5464-249-0x0000022E57A50000-0x0000022E57AB6000-memory.dmp

Download

memory/5464-250-0x0000022E57A50000-0x0000022E57AB6000-memory.dmp

Download

memory/5464-248-0x00007FF70D1C0000-0x00007FF70D2D9000-memory.dmp

Download

memory/5900-49-0x0000024AE76A0000-0x0000024AE7706000-memory.dmp

Download

memory/5900-54-0x0000024AE76A0000-0x0000024AE7706000-memory.dmp

Download

memory/5900-48-0x0000024AE76A0000-0x0000024AE7706000-memory.dmp

Download

memory/5900-47-0x00007FF735000000-0x00007FF735167000-memory.dmp

Download

memory/5900-56-0x00007FF735000000-0x00007FF735167000-memory.dmp

Download

memory/6012-245-0x00007FF7B1430000-0x00007FF7B14F8000-memory.dmp

Download

memory/6012-254-0x0000023CB4C00000-0x0000023CB4C66000-memory.dmp

Download

memory/6012-255-0x0000023CB4C00000-0x0000023CB4C66000-memory.dmp

Download

memory/6124-267-0x00000276FE8A0000-0x00000276FE906000-memory.dmp

Download

memory/6124-268-0x00000276FE8A0000-0x00000276FE906000-memory.dmp

Download

memory/6124-265-0x00007FF782340000-0x00007FF782489000-memory.dmp

Download