0d0c452d295746e11e12e970d040ffc6f50e3f0a16f6ac7d7ed464f5d9807284

Analysis

max time kernel
145s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 03:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_3b6cf0fdd73a1736ac5d70839828117c_elex_glassworm_mafia_remcos.exe
Size 1.2MB
Sample260731-dstnesbh73
SHA256 0d0c452d295746e11e12e970d040ffc6f50e3f0a16f6ac7d7ed464f5d9807284
MD5 3b6cf0fdd73a1736ac5d70839828117c
SHA1 b5b1de4ffd521f82cd8a5629a93253e96fa54ae3
SHA512 84c9a809c68556565c8c3b76072dc38afcea9556cf68eb57f5392f7bde7cfb76143323f3369b68ab45d3a3cb926ed019002f9268a6407cbd918bb29762015155
SSDEEP 24576:uhfDc6X3lQM5xr4cQFTj0OZeVJVx1vudUXRpdkrmXMLZHuSwyfy:tul15qcQFTIOZeFadt0zYy
TLSH
T19F45E01EBAF1C032C03312319D6ED358A2B5E4B188264447BBDD672D6FB15D38729BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
4700	alg.exe
4304	elevation_service.exe
4240	elevation_service.exe
4280	maintenanceservice.exe
4440	OSE.EXE
4556	GameInputSvc.exe
3000	GameInputSvc.exe
912	msdtc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-31_3b6cf0fdd73a1736ac5d70839828117c_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-31_3b6cf0fdd73a1736ac5d70839828117c_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\198777835387db0e.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113265\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_3b6cf0fdd73a1736ac5d70839828117c_elex_glassworm_mafia_remcos.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3000	GameInputSvc.exe
3000	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3772	2026-07-31_3b6cf0fdd73a1736ac5d70839828117c_elex_glassworm_mafia_remcos.exe
Token: SeDebugPrivilege	4700	alg.exe
Token: SeDebugPrivilege	4700	alg.exe
Token: SeTakeOwnershipPrivilege	4304	elevation_service.exe
Token: SeTcbPrivilege	4556	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 3000	4556	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-07-31_3b6cf0fdd73a1736ac5d70839828117c_elex_glassworm_mafia_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_3b6cf0fdd73a1736ac5d70839828117c_elex_glassworm_mafia_remcos.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3772

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4700

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4304

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4240

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4280

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4440

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3000

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:912

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
PID:3836

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:4356

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:5124

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:2128

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:2912

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:2796

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:4560

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:4384

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:4916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 192cb36c2a8a8ca95e1b84e9e5cc7eed4be304f5baf55ceb18f362be4640c0e1
MD5 77f2e3e5d341074e0108dfcb1151d196
SHA1 6479b29bd68e4890a0809cc2fd286b92eb966302
SHA512 982925be2b0843bb789083f5f3bee441d71caa999a8e0ee280f16cf82bbad677feb3488f675d6734f7dfd9e443b39b47fb82bad6c252829b9de8b9a2a5d0a0cd
SSDEEP 49152:+b+632BuPkFKRrdE6oh7stBhuXjfS4LWxnTadt0zYyC:A3q6gjB8ktUYyC
TLSH
T18CD59D03F29900E9E06ED178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 ab7321abae5f18d337d260f172125b3d76d18ddd084e3240c31b1241124be544
MD5 691668f7865a22fc0f470b1283052ad1
SHA1 5d33d75cb79098276d8ddd256c03b2935881bc6c
SHA512 cab8b2d7345c500f737785a5d3619880ed1217e7376f5a26fbc3139dd6305c945f117ee7adb3df7b3dc4f157309b3920896fcbf1e54c90017497bcc57c22e70d
SSDEEP 24576:jXYxDtczAxx1vudUXRpdkrmXMLZHuSwyfyC:wtccadt0zYyC
TLSH
T10805016963E508FDEC7B813DC8A28111EB73B84043A0F79B03A899754F636D85E3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 198ddc830cf510f55081eb053adb5ebadda9788a690c750b3dc06fd27867c9e7
MD5 42d8201dabff358e9ffa73aa64abcaa4
SHA1 72e4638e4436356592ff11b24deec6764753359c
SHA512 95a95cbcd1cb207244911f03a3dbfc69f5255dc72c24f5648d3b3d378b230cf760bc5c7ddd84ec0fbf04b2d22bd2abb5627399d0254d35b7a475f57ad381d603
SSDEEP 12288:5mw5HEjsChNRBFgl0WDm+CfBNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQE:UwusOW+x1vudUXRpdkrmXMLZHuSwyfy
TLSH
T18C05F18A33A50CFCE9BB5239854B8136F7F3F8012665D71F1360C66A5F67261AD1EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bf01c3650f48696bf07f48f433b5106091f1a962727fa692d76d07d27ac6e653
MD5 432ff0632dc79bd068dd30a76bbb2c40
SHA1 8eae8496ce008359c8fffd43e1602224f6b5aafb
SHA512 604c942bb06ac0b033adc8e278024255cc6cab89daa96b1c39b788f1822624b9fdaa862d584fb14dcdf34830e1cdce88a47a4bdccc007c43097486cb559eb279
SSDEEP 49152:0B+taZ3usBWOBr4tEGp0bqx0z+n217aau1glWadt0zYyC:uu6JmTxd2dWktUYyC
TLSH
T167D59D13F1DA01E8D06ED079974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 9cc25d7cc96ebc6025c29a2d0101ec3a48322519d82d5eaa2cab2ee67966f9fd
MD5 32ce3ebffdb9bf56935927ffbac2c061
SHA1 22c855091e9cafef208dcf56613f0c0702ddd90b
SHA512 804f67ef4294a37cdeb3b4986ab2a1122af791ed189f1b470e86a87cb18dd07b7bf97aa8d6794b045e8771ef78735da0b0ec9bd944129ba42a88ab294fa3e7fe
SSDEEP 12288:jU7bNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:Ybx1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T101D423CB436B4C3CE4BE2136644D22B5EB7FF50467C5E25B700C2AB4C5E98A4894AB5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 df4470b6a81779e3deffaadb4788e6891c74c6ec51dd5640974834fd47745be8
MD5 4d396a157455c0f56b983174fa315949
SHA1 978b7b9bc3c4fbf26b9643ddfc8e6f568a4acb7e
SHA512 4ebf9051f1bbcb971dba466a181f44848982227e8c30a1a98c8354d0ce0d87ec9eed44e636520281b4ffbc80a66fa55cd25c21dc2b01e0eaa3d3fd2136e0dc94
SSDEEP 24576:Vgb6bmBIi49WNNFpg1rSvFv7bYwx1vudUXRpdkrmXMLZHuSwyfyC:Vgb4mBIBhGF3adt0zYyC
TLSH
T1AA65AE1E22E802F5E0FAE2B89DAA4417D6B378161731D2DF1151423D2F3BDE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 ffccce91c80f3a6a2b521e4b985a60bca8822037f33a59051d63caaa4d7fc7d1
MD5 1f87971e305a3ee729ccc93fe3bd5a30
SHA1 2b09e88b4e296f8ddbfde1bc09d02aa6eec3e9b7
SHA512 756934a318a4d92226bf57c4c1ed2f6ce36f4ed93aaa1206f3379ac419d4bfa33f50d21f3ad58aacc152092a61aa19bcee965fc69699d6ee227ec5c590fe132c
SSDEEP 12288:hbGiNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:VGix1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T143E412DE12A724ACC57E523A645921B6FBB3F0406345E2FF1448A574CBD98F0A23DE9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 552ce9f8c9a12e57b2fe131fa0df8cf25c30073fd1f30aa238b7b13d3e8427d5
MD5 e60764301cf2c8f5b1073b19bf795d97
SHA1 db6c35e32ed7a33cb35903fc29f994cc434eee76
SHA512 ec8920385c4aeac665bb30ad7b1b24b3bfd67384c9297f9e4be6746c6b841e3daf728453e657e191b5587ab8fab858f69b0a0adce868005c3e1de69daf56390c
SSDEEP 12288:0sYoNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:0sFx1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T1AED423CE026B487CD57E2137640D22B5DB6BF50463CAE3DB700C25B0C6DA8E5927AB9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 3b12413bab18a7ecedad6cfc71740d844354093cdfd489a9d7e37479f9e52de3
MD5 8f232452bc5fa1e319b6dfe346bcde81
SHA1 1f730d8dc41b6ad82c6130ff3722593a31190579
SHA512 941b3deea1e91c26654574c24e76259b6f24adead8be2e3bccc6884543fb14cf79f7a166341ca84aa1b6cd4cc8d03f3cb4816f0a42c6e9e35cc0d425f9ec8c8e
SSDEEP 24576:DHq8S8FpJqH1Mzria7/mYx1vudUXRpdkrmXMLZHuSwyfyC:TZ1FPqVra7/jadt0zYyC
TLSH
T18F35F1A663E101F4D47BD138894646A3F7B2F4141364EBDF06AC8B611F23AE44B7EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 68b427196d63382d01dfa6a1e2e6b5afca9da4369fff18a9a1b8abc0a81c91a7
MD5 45233af789ffb0cbd9e4120e337ca6b6
SHA1 006f89dec719c456ba86a70c5cd95a39b75d6503
SHA512 8751c2433bb25547ef4f9edd14a6e07b858ae4da5e48609a4b473c62f0f4b32a67b5177008a46c4416640ebfaa663f6df9a17c7cff2f924365e358f46da27b47
SSDEEP 24576:uPUr+NQ/x1vudUXRpdkrmXMLZHuSwyfyC:uJQ/adt0zYyC
TLSH
T14905F15F22AD18E8E67AA13D85864319F772F4511352E2CF0290817E4FA7DE8BD3EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 f2a353e5959e94d285f23847e35a4ab2cebe2dfeb9b44d0753ac61e9f8e62565
MD5 0c2cd53fdd1703c5991fb64e27915d16
SHA1 0b7a882abb322a68ae764490edd89838a13eff41
SHA512 ea3f73bc7498ee33f13949b3e91dd486f004d82467c7de554526cb55c785dcd69e4ac624c1a06ea106d982b2047f8283faf5309312693e9d773f1dd5eb108ed5
SSDEEP 49152:fBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjiadt0zYyC:QG05lO43bfktUYyC
TLSH
T1A4D5CF6E62EC01F9D0BBD17CD9C6460BEBB23415032596CF02A486A91F67FF4967E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 60e2aae82c91e21b3cc5e7387364621d92699890f5ba8dd5da30d890f506358e
MD5 5d97dac8ce67efec171a039e4fb81953
SHA1 18a55c21af04895c01693b0b753fe95ecf1d1148
SHA512 28371a3aa2995b8030c178a2fa7d621e71f11410171979b05f10c64618f51e4b8dd4558a91512a5121edb5740e056625d3b7482e05b4cb81b766b1d219bb3830
SSDEEP 24576:QNcwHdjbyQ4nLC18lb/EOjowL7FkBx1vudUXRpdkrmXMLZHuSwyfyC:QNc/zEOVHFKadt0zYyC
TLSH
T169858C5623E901E4F1BBE1BE896B9546FAB17864533086CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 d6c9d938c8d7edd266b7912dd2052d3e0d15626de0ba26d47b81441d5e9e3f18
MD5 f4008879f1d6cf07e0038dd8098f4e58
SHA1 fa67d7b5f8989186426abac4e37aa37936e1478c
SHA512 a5d849115485268deb9e07b0e0e370418e229a5b16ef91b663678dfd908fb64b4f8487ff27b3d14fd91c2e356e71247fab42e2f5bac63ede2f523b3a3053ce2c
SSDEEP 24576:0JnJPbzB4SPx1vudUXRpdkrmXMLZHuSwyfyC:0JnJv6SPadt0zYyC
TLSH
T18415E17DD2A810E8D4B7C2B4811A1769FF32746C2F26A9C719B4D5343F52EE0A939F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 a564a64f66524800b437b1be5a831fa984c8167bb31a17f7fed61f65bd92353a
MD5 44de32c220b91cea17bf99cc70c8f4b7
SHA1 2f76406a589575c3f8e6244b0f48fe4dd67f36b7
SHA512 f4c34d6e97b2cb94e631c6c93ed939a6dd749c304bd12194c2624525a0585780b7f9054bf90b9b61287be1892d463947d83287ede2c445ca7724c35e29e7fd56
SSDEEP 12288:b1Hck6j5ZI7MNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo3:/6DI4x1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T1A0F4019D237B00F9D0BB903E95820152E7B3F0609352A6DF169885B98FE3DD8B93DE45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 99149fdc8659aa356f593a1575cab3d344c8c703e78ea19ce78f739bd7571e4d
MD5 b6bab70b4c3ac5f90c5cfa146aa99369
SHA1 b7e664679f73367d4b359e7c840d28674e6a442c
SHA512 a108a82e16950496bd9f003cc2aa3821825ca1dcbb9b418b6b74a449917a28fdf96134194c4d1c8330f2ca502644558c183923fa9407735a3e1a515120c8a0a0
SSDEEP 12288:xG6kyGNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:4tyGx1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T17BF42289139950ACE5BE1239981602B0CF77FC106752E3EF2044AA3D4FFAAE4A535F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 1f8ddf805cfd456c53b449347c189d668fa73ca707a84cfba5a7f8b6e1fc2778
MD5 3668e2ce3e76f5195c6e6f3b48d9833c
SHA1 0627b3a9bc4ace4e9c9eae3279f00fe9501abdc4
SHA512 78e2ddd16585b598d994cd0d19d32e6c7d72ba4f7a563b1cdeb3aed4e8e39513db1d553189309d2b80b8e956773559b778f5e486dcc756ec2dfaaad0d5162705
SSDEEP 12288:mS8NDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:T8x1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T1EED422CE022B587CD57E213A640D22B5D77BF014638AE3EF34486970C6DA8E4927AF5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/912-340-0x00007FF62F510000-0x00007FF62F629000-memory.dmp

Download

memory/912-249-0x00007FF62F510000-0x00007FF62F629000-memory.dmp

Download

memory/912-250-0x000001B487940000-0x000001B4879A6000-memory.dmp

Download

memory/912-251-0x000001B487940000-0x000001B4879A6000-memory.dmp

Download

memory/2128-293-0x00007FF695260000-0x00007FF69530D000-memory.dmp

Download

memory/2128-294-0x0000024860170000-0x00000248601D6000-memory.dmp

Download

memory/2128-295-0x0000024860170000-0x00000248601D6000-memory.dmp

Download

memory/2796-311-0x00007FF6F06B0000-0x00007FF6F0763000-memory.dmp

Download

memory/2796-314-0x000001E00AF00000-0x000001E00AF66000-memory.dmp

Download

memory/2796-312-0x000001E00AF00000-0x000001E00AF66000-memory.dmp

Download

memory/2912-302-0x0000029EB2460000-0x0000029EB24C6000-memory.dmp

Download

memory/2912-304-0x0000029EB2460000-0x0000029EB24C6000-memory.dmp

Download

memory/2912-303-0x00007FF6FFCD0000-0x00007FF7000E6000-memory.dmp

Download

memory/3000-244-0x00007FF7BF4D0000-0x00007FF7BF598000-memory.dmp

Download

memory/3000-245-0x000002AEADD70000-0x000002AEADDD6000-memory.dmp

Download

memory/3000-330-0x00007FF7BF4D0000-0x00007FF7BF598000-memory.dmp

Download

memory/3000-246-0x000002AEADD70000-0x000002AEADDD6000-memory.dmp

Download

memory/3772-0-0x0000000002AC0000-0x0000000002C1D000-memory.dmp

Download

memory/3772-8-0x00000000029A0000-0x0000000002A09000-memory.dmp

Download

memory/3772-1-0x00000000029A0000-0x0000000002A09000-memory.dmp

Download

memory/3772-6-0x00000000029A0000-0x0000000002A09000-memory.dmp

Download

memory/3836-267-0x000001E1DC970000-0x000001E1DC9D6000-memory.dmp

Download

memory/3836-264-0x00007FF6B9750000-0x00007FF6B9899000-memory.dmp

Download

memory/3836-266-0x000001E1DC970000-0x000001E1DC9D6000-memory.dmp

Download

memory/4240-38-0x0000011AAEE70000-0x0000011AAEED6000-memory.dmp

Download

memory/4240-37-0x0000011AAEC40000-0x0000011AAED4D000-memory.dmp

Download

memory/4240-40-0x0000011AAEE70000-0x0000011AAEED6000-memory.dmp

Download

memory/4240-39-0x0000011AAEE70000-0x0000011AAEED6000-memory.dmp

Download

memory/4280-46-0x00007FF71F930000-0x00007FF71FA98000-memory.dmp

Download

memory/4280-47-0x000001D808E80000-0x000001D808EE6000-memory.dmp

Download

memory/4280-55-0x00007FF71F930000-0x00007FF71FA98000-memory.dmp

Download

memory/4280-48-0x000001D808E80000-0x000001D808EE6000-memory.dmp

Download

memory/4280-53-0x000001D808E80000-0x000001D808EE6000-memory.dmp

Download

memory/4304-31-0x00000220078D0000-0x0000022007936000-memory.dmp

Download

memory/4304-28-0x0000022007990000-0x0000022007A9D000-memory.dmp

Download

memory/4304-29-0x00000220078D0000-0x0000022007936000-memory.dmp

Download

memory/4304-30-0x00000220078D0000-0x0000022007936000-memory.dmp

Download

memory/4356-273-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4356-274-0x00000000008F0000-0x0000000000959000-memory.dmp

Download

memory/4356-279-0x00000000008F0000-0x0000000000959000-memory.dmp

Download

memory/4384-332-0x0000012C97980000-0x0000012C979E6000-memory.dmp

Download

memory/4384-331-0x00007FF653540000-0x00007FF6536D4000-memory.dmp

Download

memory/4384-333-0x0000012C97980000-0x0000012C979E6000-memory.dmp

Download

memory/4440-60-0x000001FA20BB0000-0x000001FA20C16000-memory.dmp

Download

memory/4440-59-0x000001FA20BB0000-0x000001FA20C16000-memory.dmp

Download

memory/4440-58-0x000001FA209D0000-0x000001FA20ADD000-memory.dmp

Download

memory/4556-237-0x0000020533490000-0x00000205334F6000-memory.dmp

Download

memory/4556-236-0x0000020533490000-0x00000205334F6000-memory.dmp

Download

memory/4556-235-0x00007FF7BF4D0000-0x00007FF7BF598000-memory.dmp

Download

memory/4556-321-0x00007FF7BF4D0000-0x00007FF7BF598000-memory.dmp

Download

memory/4560-322-0x00007FF7C45B0000-0x00007FF7C4853000-memory.dmp

Download

memory/4560-323-0x0000021B848E0000-0x0000021B84946000-memory.dmp

Download

memory/4560-324-0x0000021B848E0000-0x0000021B84946000-memory.dmp

Download

memory/4700-18-0x000001DB32440000-0x000001DB324A6000-memory.dmp

Download

memory/4700-15-0x00007FF6E3CF0000-0x00007FF6E3E12000-memory.dmp

Download

memory/4700-17-0x000001DB32440000-0x000001DB324A6000-memory.dmp

Download

memory/4700-16-0x000001DB32440000-0x000001DB324A6000-memory.dmp

Download

memory/4700-64-0x00007FF6E3CF0000-0x00007FF6E3E12000-memory.dmp

Download

memory/4916-341-0x00007FF6FA080000-0x00007FF6FA3A0000-memory.dmp

Download

memory/4916-339-0x0000021C4F300000-0x0000021C4F366000-memory.dmp

Download

memory/4916-343-0x0000021C4F300000-0x0000021C4F366000-memory.dmp

Download

memory/4916-346-0x0000021C4F300000-0x0000021C4F366000-memory.dmp

Download

memory/4916-348-0x00007FF6FA080000-0x00007FF6FA3A0000-memory.dmp

Download

memory/5124-287-0x00007FF770800000-0x00007FF770F43000-memory.dmp

Download

memory/5124-285-0x000001C699220000-0x000001C699286000-memory.dmp

Download

memory/5124-286-0x000001C699220000-0x000001C699286000-memory.dmp

Download