00a41064e556ae804635fbe5822d8e003a8b78a447fa2bf4f2470abc11a5d3ca

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 03:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_62bd02407adbdb68978d9ea49be32ac8_bkransomware_elex_icedid_maze.exe
Size 2.3MB
Sample260731-dj43ssseqb
SHA256 00a41064e556ae804635fbe5822d8e003a8b78a447fa2bf4f2470abc11a5d3ca
MD5 62bd02407adbdb68978d9ea49be32ac8
SHA1 238cacfbcd94c23333f01388b59889e453735579
SHA512 8181faca5b5deb275c7cf0c83aa5f91ad33caf00b82b0e30aa47e4e84062d2c872b51c04505232645adc35b7b50df82427e0d038d2d8f58c3dce69b30634eb2d
SSDEEP 49152:DDD0FZs/Yl7dYUMQ+fCi6p6O8IFeIL8uxV1XL43dFYXLFj:3D0FZs/U73MQ+fCi6AeeA8uxV1XxR
TLSH
T129B5B033F594907AC53313704E9D636C76A9BB710F36828722E55F2D3EB05C36A296A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
5876	alg.exe
5832	GameInputSvc.exe
4504	GameInputSvc.exe
2772	elevation_service.exe
4872	elevation_service.exe
2424	maintenanceservice.exe
3660	OSE.EXE

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-07-31_62bd02407adbdb68978d9ea49be32ac8_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\290f815e5387db0e.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-31_62bd02407adbdb68978d9ea49be32ac8_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-31_62bd02407adbdb68978d9ea49be32ac8_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113265\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-31_62bd02407adbdb68978d9ea49be32ac8_bkransomware_elex_icedid_maze.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_62bd02407adbdb68978d9ea49be32ac8_bkransomware_elex_icedid_maze.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4504	GameInputSvc.exe
4504	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5248	2026-07-31_62bd02407adbdb68978d9ea49be32ac8_bkransomware_elex_icedid_maze.exe
Token: SeTcbPrivilege	5832	GameInputSvc.exe
Token: SeDebugPrivilege	5876	alg.exe
Token: SeDebugPrivilege	5876	alg.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5248	2026-07-31_62bd02407adbdb68978d9ea49be32ac8_bkransomware_elex_icedid_maze.exe
5248	2026-07-31_62bd02407adbdb68978d9ea49be32ac8_bkransomware_elex_icedid_maze.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
5248	2026-07-31_62bd02407adbdb68978d9ea49be32ac8_bkransomware_elex_icedid_maze.exe
5248	2026-07-31_62bd02407adbdb68978d9ea49be32ac8_bkransomware_elex_icedid_maze.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5248	2026-07-31_62bd02407adbdb68978d9ea49be32ac8_bkransomware_elex_icedid_maze.exe
5248	2026-07-31_62bd02407adbdb68978d9ea49be32ac8_bkransomware_elex_icedid_maze.exe
5248	2026-07-31_62bd02407adbdb68978d9ea49be32ac8_bkransomware_elex_icedid_maze.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5832 wrote to memory of 4504	5832	GameInputSvc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-31_62bd02407adbdb68978d9ea49be32ac8_bkransomware_elex_icedid_maze.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_62bd02407adbdb68978d9ea49be32ac8_bkransomware_elex_icedid_maze.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5248

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5876

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5832
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4504

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4872

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2424

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c8354ca428af17c8324ba96edb0dd5825c08ca624bebcece8c93780d5d3864b1
MD5 f0ea2afcfc994dd389bf9f52509dc88e
SHA1 84b10b8501763d6a74e5b5da623d3be81f72176f
SHA512 50ba5992a9cdbac2973fc580a934ef158d036d29c248ba25cd2a92035bc622702b9f60752f46d5f8a3be0f880a2c77df5d818b822bd5db2dcb089c22429a19c5
SSDEEP 49152:Rb+632BuPkFKRrdE6oh7stBhuXjfS4LWxn4FYXLFj:X3q6gjBkR
TLSH
T1ADD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 d6c81d4737a4b8a9f693e52dfd3160e5544e71bc6036c66677f5787019a9f166
MD5 2f442d72fb16d4f5d0e9a4d52227436f
SHA1 5e8571bbcea77e18e3ea8d29f423c8b657c3b535
SHA512 937e354d87b5bb38a8290c6e4b6b13ec7dd8a2b54b57784f2fa9c8c3781f2f26dd761267bc4c7b89bc64468a6c448265866c7805d2e31ab917ad012f33406c75
SSDEEP 24576:2XYzDtczALzRTTxH2qjYXzGAiGFn4w7z:ZtcoFYXLFj
TLSH
T1CB05011973E408FDECA7827CCDA28902E63378554364FB8B03E489665F636D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 d85d51e1d397e4e0fb916e1fe79fde57c0cc8a40105517f8264ce169584720cc
MD5 058b2ba834c28f6cc30f67dac6456743
SHA1 72d7bbb47087df78110ecc1862643731f765d7bf
SHA512 ab3accf13d0e35f1b3ac35d98b4092dfddd384660092882ac0f6db25949b42be34ffb3fda0f166f21968c8358531425dfd7988eecc71891dc012feea8c9fbe3d
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+CBfk98ersqKzRTTyeH2qjYXz2qsCHD+GFFp9txp0xpu:uwuuOWwzRTTxH2qjYXzGAiGFn4w7z
TLSH
T15505F10673A80CFDE9A7823CC9578532F7B3B8112625DB1F1760CA576F77251AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 dbb95be01bb905592ee6fb3e5a37b8d60df57af0dc1712b9fdc5c45893b21450
MD5 6913978c1ac25e5dce6a83a2af2fcb83
SHA1 6333b225c0118c8d314e17c86894bc656de50feb
SHA512 b5b494b3d5d97acbc299ee3cffda9a9bde2ddf08e0e44d7fca169617fb83bce05b8f48246b19ac5084ded257574b22283afb691cd92ab1026ca9036736a4b30e
SSDEEP 49152:IB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glbFYXLFj:Cu6JmTxd2dMR
TLSH
T174D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 4afc5e3885c47f61cc915fafb3bd594fe9e4ec12eb83b2328af8b260c9db5bd9
MD5 b1f7318ccd566d97d22000edf4aea1a4
SHA1 a0c55a29941b9a45f0465c4ce2cf8c2cdc0e114c
SHA512 aae360cd60008ddc19d4b8c89fb4dcab6135901228d088d1f774d4575d8e6296d73a1088f72f55be694da93c7e7d257e3846f84e3a9437e0ef5e784d4ea12492
SSDEEP 12288:j0Gffk98ersqKzRTTyeH2qjYXz2qsCHD+GFFp9txp0xpU1x3Z1OFu9z:gGLzRTTxH2qjYXzGAiGFn4w7z
TLSH
T1BBE4120B62B934ECD4BBC7BC8D261942F47234742715EDEF19E04972EBD89E0A236D58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 712b8ecf0ba2748c5265afa8c7ea0a0ffdd61164d9f99c27f23bb6073926c02d
MD5 c67fee60082675428f37a7db256b2adb
SHA1 a103a048fb07bce04e966558c3165845cc6293d2
SHA512 5cb87e406f3ced8d776c22c29f40d7f33e0cc8029f1937966bade860a2801aee0ad8e3b4baba9f7dd5ea54f81c5eaef702138d5ce6add9e8a4091961279a9887
SSDEEP 12288:r1Hck6j5ZI7Efk98ersqKzRTTyeH2qjYXz2qsCHD+GFFp9txp0xpU1x3Z1OFu9z:v6DI2zRTTxH2qjYXzGAiGFn4w7z
TLSH
T1B205F10E237A10FDD0ABD17DCA830502E1B270719352E9DF169489BA9FE3ED8B539E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9427c19c134d590fe74a6914b388d3272dfadf6a0243f6ec987869006121ab66
MD5 39c9880ae73d14e9c295f6edb6cbdd88
SHA1 a30080fc964338333e8607b77b5dbc6f0474275e
SHA512 9f1a95e02c8420cb203c62449b261c41f7913a5cb503d6274972578392f4d16a407c4e09f919438200d18d7d307749f110b0a5513dbd610122ad3c355fab60cd
SSDEEP 24576:CTkNvNnaFeYhJNtmZBmpzRTTxH2qjYXzGAiGFn4w7z:CTMwBtOmHFYXLFj
TLSH
T19955AF2EBAB806E4D1FEC6B4CD238512F6727461173292CB5290C13F5E679D89E36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2424-73-0x0000019663DD0000-0x0000019663E36000-memory.dmp

Download

memory/2424-75-0x00007FF692850000-0x00007FF6929B8000-memory.dmp

Download

memory/2424-66-0x00007FF692850000-0x00007FF6929B8000-memory.dmp

Download

memory/2424-68-0x0000019663DD0000-0x0000019663E36000-memory.dmp

Download

memory/2424-67-0x0000019663DD0000-0x0000019663E36000-memory.dmp

Download

memory/2772-45-0x000002B31AD20000-0x000002B31AD86000-memory.dmp

Download

memory/2772-44-0x000002B31AC10000-0x000002B31AD1D000-memory.dmp

Download

memory/2772-46-0x000002B31AD20000-0x000002B31AD86000-memory.dmp

Download

memory/3660-79-0x000001C177A90000-0x000001C177AF6000-memory.dmp

Download

memory/3660-78-0x000001C1778B0000-0x000001C1779BD000-memory.dmp

Download

memory/3660-80-0x000001C177A90000-0x000001C177AF6000-memory.dmp

Download

memory/4504-35-0x00007FF75D1A0000-0x00007FF75D269000-memory.dmp

Download

memory/4504-38-0x000001B719CC0000-0x000001B719D26000-memory.dmp

Download

memory/4504-36-0x000001B719CC0000-0x000001B719D26000-memory.dmp

Download

memory/4504-85-0x00007FF75D1A0000-0x00007FF75D269000-memory.dmp

Download

memory/4872-58-0x000001F6BC3B0000-0x000001F6BC416000-memory.dmp

Download

memory/4872-57-0x000001F6BC180000-0x000001F6BC28D000-memory.dmp

Download

memory/4872-59-0x000001F6BC3B0000-0x000001F6BC416000-memory.dmp

Download

memory/5248-7-0x00000000011D0000-0x0000000001239000-memory.dmp

Download

memory/5248-0-0x00000000029F0000-0x0000000002B4D000-memory.dmp

Download

memory/5248-1-0x00000000011D0000-0x0000000001239000-memory.dmp

Download

memory/5248-6-0x00000000011D0000-0x0000000001239000-memory.dmp

Download

memory/5832-27-0x000002798FAF0000-0x000002798FB56000-memory.dmp

Download

memory/5832-65-0x00007FF75D1A0000-0x00007FF75D269000-memory.dmp

Download

memory/5832-28-0x000002798FAF0000-0x000002798FB56000-memory.dmp

Download

memory/5832-29-0x000002798FAF0000-0x000002798FB56000-memory.dmp

Download

memory/5832-26-0x00007FF75D1A0000-0x00007FF75D269000-memory.dmp

Download

memory/5876-16-0x0000028B06650000-0x0000028B066B6000-memory.dmp

Download

memory/5876-15-0x00007FF7DC230000-0x00007FF7DC353000-memory.dmp

Download

memory/5876-17-0x0000028B06650000-0x0000028B066B6000-memory.dmp

Download

memory/5876-18-0x0000028B06650000-0x0000028B066B6000-memory.dmp

Download

memory/5876-50-0x00007FF7DC230000-0x00007FF7DC353000-memory.dmp

Download