dde7bebaf190d98489808ab53bd41034861911d841d8c00e871eb4cc45ee86f2

Analysis

max time kernel
147s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_355cbc57eab4506ef48b314d701e7b8e_elex_rhadamanthys_stop.exe
Size 656KB
Sample260721-c99wasew2x
SHA256 dde7bebaf190d98489808ab53bd41034861911d841d8c00e871eb4cc45ee86f2
MD5 355cbc57eab4506ef48b314d701e7b8e
SHA1 48738293d4189fbf67724765d4f9c95a46ff58be
SHA512 dfcf433114b17a3c9960653ae811b28b311c0953e03e4a4a67e63e906138cadb9ae49ca606fa44ada280638862dbc23579a67db34f78ec33ac8e53e89ba7f2c5
SSDEEP 12288:OK+GllEdTUZO3ReC7yucYAXraSrwqPnz61QkZYMwZsDiAIpm+CI:OZG3EuUnmtXeuw6BBwD0vC
TLSH
T15BE4120B79878032F41945749CA443C71BFEAE53B9E2F11FFF90110B6D6264A8E6A6F1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
4484	alg.exe
2368	elevation_service.exe
3292	elevation_service.exe
4744	maintenanceservice.exe
2700	OSE.EXE
1264	GameInputSvc.exe
5944	GameInputSvc.exe
3776	msdtc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-21_355cbc57eab4506ef48b314d701e7b8e_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\cefd720d8f8562d1.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-21_355cbc57eab4506ef48b314d701e7b8e_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_355cbc57eab4506ef48b314d701e7b8e_elex_rhadamanthys_stop.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5944	GameInputSvc.exe
5944	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3936	2026-07-21_355cbc57eab4506ef48b314d701e7b8e_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	4484	alg.exe
Token: SeDebugPrivilege	4484	alg.exe
Token: SeTakeOwnershipPrivilege	2368	elevation_service.exe
Token: SeTcbPrivilege	1264	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 5944	1264	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-07-21_355cbc57eab4506ef48b314d701e7b8e_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_355cbc57eab4506ef48b314d701e7b8e_elex_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3936

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4484

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3292

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4744

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2700

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5944

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
PID:3776

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
PID:3360

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:528

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:5868

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:6068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c7742ed3a899c0d883fae36cd630524c52e29a13f5c83eaa6c01e3edc83d04f5
MD5 c0c8ab89540882c56386447b3942c23d
SHA1 748701cb74328578633be6b6ee547df5f6ca0d31
SHA512 e242862bb296dc2944b80bc358bc430e357a077b0c401813b8b76f0694bd1f8423e3b861b0dce3503aa9ab9e0ea1312c403c662d7f055d15ed1a3c2c1e917193
SSDEEP 49152:kC+632BuPkFKRrdE6oh7stBhuXjfS4LWxnAAEXeiBw4v:b3q6gjBSEXeiS
TLSH
T174D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 f5bfc14d122568b782e6a4ad3c093515c2def809dc7dffb30aeb2697709d0203
MD5 68d330923f58a1c80a0b67567bcd23d5
SHA1 536fc9e54ec51c72c0d365be5728b59644056b5c
SHA512 90b401abd148f1717fca10a785cedf1e2e9a2a64745afd268041d870b24aaa9826c632e2673312cbff3588e244dd84b79e0f4975fc5b0606dac90bbe4cbe5c11
SSDEEP 12288:Q1XLsrUBGxz2lRq2czAkllEdTUZO3ReC7yucYAXraSrwqPnz61QkZYMwZsDiAIpv:GXYYK2czAk3EuUnmtXeuw6BBwD0vC
TLSH
T12005F12973D508F8FD67827CCCA28516EA73B85547A0F78B03E095261F237895E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 826KB
SHA256 fa17677b6fb5de775ddad8fd2741fc9c8ee11abf8b6634acf3252a7711f20182
MD5 9770cbff88fb116146f639e7d8a1a72b
SHA1 356dbb25464dce2c1625199479d8109898f7b660
SHA512 c7df4512f31058954f2c602ec11250c8edc6d7cba47240b2c4cdd9bd7ac897323dede00de1b5e7adf827936e38fa956afa94613758d6f7ce34dbcb77a3b65ca5
SSDEEP 12288:Vmw5HEjsChNnBFgl0WDm+CAllEdTUZO3ReC7yucYAXraSrwqPnz61QkZYMwZsDid:Qwu+OWF3EuUnmtXeuw6BBwD0vC
TLSH
T1DD05F14A73A41CF8F9669238C9578536F7F2BC112A61D71F17A0C61B6F33211AD2EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b7f9ceff3e7c3b6460d74d7469a94732df257a6f154e4643eaffc60a4c2903e4
MD5 4c1352c6a9eb39c5a7f0c893adbac9dc
SHA1 4a5baab6fe694fdefe4e3902488431f8f57166c2
SHA512 4157f68f384ef59a29a54720320ffdaca72b10f494dcf215fab020f2fe30b87ea340d85e99c67e59d88a84d9cc9abd43552dda045774f76692af63eb08214239
SSDEEP 49152:IL+taZ3usBWOBr4tEGp0bqx0z+n217aau1glDAEXeiBw4v:ou6JmTxd2dcEXeiS
TLSH
T15ED59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 b628bc3deda20433fb935b1737ae3b347e7568f84f827b5fa67152038273a0e0
MD5 63b9f6460a36762df040ff9b046ef15a
SHA1 2d3f03b6ff3f249a35d1c67aafed4ddab16ff50f
SHA512 4d39772fcf501bf494d17acca2ea557a56cced4b6ef0a612c274aa1158a9d5ea8b5ca427ac7ab06dc1506416050cd4eb994a72c56c5bce673b719de6000303b0
SSDEEP 12288:BA74F8llEdTUZO3ReC7yucYAXraSrwqPnz61QkZYMwZsDiAIpm+CI:W4F83EuUnmtXeuw6BBwD0vC
TLSH
T15DD4231BB38C1844F53C62785C6D0367157AFEA59EA0F28BBE90A1072D31D42DE397DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 4ce17957e62444d0cd50a2fbde66c93cfd38e54a342357b070cfcf3897bb8955
MD5 3116d156656cabd492e1518fe7728b18
SHA1 ff0cd099b6e274d955c6158089faddd962f77f95
SHA512 5b3e6a7fb682dd5f434552aad9e2e9213eb4aa7d1e32df608e505e386f27e9ec44bfe7c392da6c0667340293088e53dc2efd0ae70e5d2c3df9bb8c5295c60ae8
SSDEEP 12288:MOGvHllEdTUZO3ReC7yucYAXraSrwqPnz61QkZYMwZsDiAIpm+CI:fGP3EuUnmtXeuw6BBwD0vC
TLSH
T1A5E4222E32E93094F53992789C7506A734B179A05B60B6EF1EE0E0375F219C1AB3DED4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 e261dbd83bed96838cf6203d8021c8b7dab5c5c3dc6af760328298028868c710
MD5 b4047789aa8e79f7d8cf3efc133793a1
SHA1 3a99abc243188f9d41ca9d9fbe17e426b3fb9f35
SHA512 44bc9009351bfd671e1a0229a42cf223a139091761dda73a2d027d931274b24339cac01018417faef94f1e2fb17a365416edf009048db9c00128b43551a9c8ac
SSDEEP 12288:lollEdTUZO3ReC7yucYAXraSrwqPnz61QkZYMwZsDiAIpm+CI:lo3EuUnmtXeuw6BBwD0vC
TLSH
T19ED4231E72891484F62862789C65079B15B5EE61AFF0F3C77EE0A0071D329C3AE3E6D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 b8a2391ea3904c2c6139243cde62e4a2cb3e00ee8fa825535a077a6aa19ad450
MD5 a20bb0091839e4dfe8ff06ce49c5615e
SHA1 649a41be28063ac99342bd8b5c4639e4544bc895
SHA512 14a2395e522dce0d059b5b87c93711d45ef8fbb03382a48dd5ca9c182d46726770e30af48ba63ed529d316ce0080ee268bd7e686b1af01ba0b60e75f74c044ba
SSDEEP 12288:LHvUrBFrEjwaQfllEdTUZO3ReC7yucYAXraSrwqPnz61QkZYMwZsDiAIpm+CI:LPUr+NQf3EuUnmtXeuw6BBwD0vC
TLSH
T1F005E12F22AD18E4F67AA17D8946471AE771B8621751E2CF02E0813F5E23DD8BD3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 eb727b880f7408c1b9c452e5fb4352fd0bb088ec43533f90b75c771dbb813646
MD5 ebb3fa8ae099f135e0a44a86a178760a
SHA1 485efd29055ef6382a024cdd840916eb61c8fcba
SHA512 25453f32c0c21de84131b982d99d0e25747b11ff4daf2d69f0bdd607092146d983bc70c1911646834010afead13ec6716c425cd3aee74f63e2f4fd1dae7bce4d
SSDEEP 49152:aBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjaAEXeiBw4v:FG05lO43b+EXeiS
TLSH
T1CBD5CF6E62EC11F9D1BBD17CD9C6460BEBB23815033556CB02A486A91F23FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 d61dcba3646c7072dbb20cb7d0688944b77491fba11aad6fff2d525146f95513
MD5 bf5d2e92ba4569b7b1657b439bcca265
SHA1 ae27f6aa632f3c49420602a35b61195184a32d9e
SHA512 5ca6f732a618994638652be9616c2b0d105560346b1cea24b4a56c2805aedaa8fd89baca4db2d765b9e3aa00288bb074079db4d771df1d163789b0b8e70c6300
SSDEEP 12288:V1Hsk6j5ZI7HllEdTUZO3ReC7yucYAXraSrwqPnz61QkZYMwZsDiAIpm+CI:l6DID3EuUnmtXeuw6BBwD0vC
TLSH
T15BF4011D337A10F5E16BD03D88920653D2B2B47197626ADF0BD0C53A5EA3EC9B93DE81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 5b17b2d174b7e87eda9d5443f4013ef2211f2be63b698fef1fd8eb4c160b79b2
MD5 645aea78c8ea012ed9db702dc3631c3c
SHA1 875b04acdb4f047f1459bb1d57553daab6ce1891
SHA512 d0dc25086beacdcde5c140047e89c72f8e0947889a663516445bc5a31ed67b9cf55f764cb08ceb75986c01303bafd3b988d2bb92f5273449a04873c27c5c2b64
SSDEEP 12288:sG6kyxllEdTUZO3ReC7yucYAXraSrwqPnz61QkZYMwZsDiAIpm+CI:ttyx3EuUnmtXeuw6BBwD0vC
TLSH
T1A3F41309739820D4F6795238DC7242A65A75BC205F60E3DF6AD0E22F2F32BC1AD35B95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/528-279-0x00000000009B0000-0x0000000000A19000-memory.dmp

Download

memory/528-272-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/528-273-0x00000000009B0000-0x0000000000A19000-memory.dmp

Download

memory/1264-235-0x0000029D19090000-0x0000029D190F6000-memory.dmp

Download

memory/1264-236-0x0000029D19090000-0x0000029D190F6000-memory.dmp

Download

memory/1264-234-0x00007FF60B290000-0x00007FF60B358000-memory.dmp

Download

memory/2368-28-0x000001F5C4AD0000-0x000001F5C4B36000-memory.dmp

Download

memory/2368-30-0x000001F5C4AD0000-0x000001F5C4B36000-memory.dmp

Download

memory/2368-29-0x000001F5C4AD0000-0x000001F5C4B36000-memory.dmp

Download

memory/2368-27-0x000001F5C48E0000-0x000001F5C49F6000-memory.dmp

Download

memory/2700-57-0x0000017213B40000-0x0000017213C56000-memory.dmp

Download

memory/2700-59-0x0000017213D30000-0x0000017213D96000-memory.dmp

Download

memory/2700-58-0x0000017213D30000-0x0000017213D96000-memory.dmp

Download

memory/3292-36-0x0000029151640000-0x0000029151756000-memory.dmp

Download

memory/3292-38-0x0000029151880000-0x00000291518E6000-memory.dmp

Download

memory/3292-37-0x0000029151880000-0x00000291518E6000-memory.dmp

Download

memory/3292-39-0x0000029151880000-0x00000291518E6000-memory.dmp

Download

memory/3360-266-0x000002C1499E0000-0x000002C149A46000-memory.dmp

Download

memory/3360-265-0x000002C1499E0000-0x000002C149A46000-memory.dmp

Download

memory/3360-263-0x00007FF675250000-0x00007FF675399000-memory.dmp

Download

memory/3776-252-0x0000022210680000-0x00000222106E6000-memory.dmp

Download

memory/3776-251-0x00007FF63E860000-0x00007FF63E979000-memory.dmp

Download

memory/3776-253-0x0000022210680000-0x00000222106E6000-memory.dmp

Download

memory/3936-6-0x0000000000B80000-0x0000000000BE9000-memory.dmp

Download

memory/3936-0-0x0000000000950000-0x0000000000A43000-memory.dmp

Download

memory/3936-1-0x0000000000B80000-0x0000000000BE9000-memory.dmp

Download

memory/4484-16-0x000001C2617B0000-0x000001C261816000-memory.dmp

Download

memory/4484-17-0x000001C2617B0000-0x000001C261816000-memory.dmp

Download

memory/4484-14-0x00007FF7E40F0000-0x00007FF7E4212000-memory.dmp

Download

memory/4484-63-0x00007FF7E40F0000-0x00007FF7E4212000-memory.dmp

Download

memory/4484-15-0x000001C2617B0000-0x000001C261816000-memory.dmp

Download

memory/4744-46-0x000002666BAB0000-0x000002666BB16000-memory.dmp

Download

memory/4744-45-0x00007FF7ED1A0000-0x00007FF7ED307000-memory.dmp

Download

memory/4744-47-0x000002666BAB0000-0x000002666BB16000-memory.dmp

Download

memory/4744-54-0x00007FF7ED1A0000-0x00007FF7ED307000-memory.dmp

Download

memory/4744-52-0x000002666BAB0000-0x000002666BB16000-memory.dmp

Download

memory/5868-286-0x000001AB78750000-0x000001AB787B6000-memory.dmp

Download

memory/5868-285-0x000001AB78750000-0x000001AB787B6000-memory.dmp

Download

memory/5868-284-0x00007FF681A70000-0x00007FF6821B3000-memory.dmp

Download

memory/5944-244-0x000002647BF60000-0x000002647BFC6000-memory.dmp

Download

memory/5944-245-0x000002647BF60000-0x000002647BFC6000-memory.dmp

Download

memory/5944-243-0x00007FF60B290000-0x00007FF60B358000-memory.dmp

Download

memory/6068-292-0x00007FF6BF0C0000-0x00007FF6BF16D000-memory.dmp

Download

memory/6068-294-0x000001D7886F0000-0x000001D788756000-memory.dmp

Download

memory/6068-293-0x000001D7886F0000-0x000001D788756000-memory.dmp

Download