41ad02a4764118005dfb0bbd0ecc5d32b235a4b84fae8b5212d2ccbb470a9cdb

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 09:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_ea4da2292eea7ff4394213f07056374b_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Size 859KB
Sample260804-k31ytabp9v
SHA256 41ad02a4764118005dfb0bbd0ecc5d32b235a4b84fae8b5212d2ccbb470a9cdb
MD5 ea4da2292eea7ff4394213f07056374b
SHA1 3e2045079a07c77293232b4d5f78eec468842c57
SHA512 9049742c7c0ce2d903d2af550ed0ded678f63baf68d287da830750686ef43aa8e94cbd2945be4320693400dcd98328d0052fb2d1fa27416d9a9d2ed5abe1cb8d
SSDEEP 24576:LxcVyzEJ2SrGxbRbWRw/PPO6hAnOZfPbWyC9e:CeI2Sr+FqRw3PgnOZfPy
TLSH
T1EB15020176E1C872E6B609360DB99A725EBDBD320831CE7F13D40E1D9E71581D63AB72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
1420	alg.exe
3388	elevation_service.exe
4404	elevation_service.exe
3220	maintenanceservice.exe
4808	OSE.EXE
3436	GameInputSvc.exe
6072	GameInputSvc.exe
2164	msdtc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_ea4da2292eea7ff4394213f07056374b_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_ea4da2292eea7ff4394213f07056374b_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9def5fbb238bf42.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_ea4da2292eea7ff4394213f07056374b_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6072	GameInputSvc.exe
6072	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1312	2026-08-03_ea4da2292eea7ff4394213f07056374b_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	1420	alg.exe
Token: SeDebugPrivilege	1420	alg.exe
Token: SeTakeOwnershipPrivilege	3388	elevation_service.exe
Token: SeTcbPrivilege	3436	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 6072	3436	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-03_ea4da2292eea7ff4394213f07056374b_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_ea4da2292eea7ff4394213f07056374b_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1312

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1420

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3388

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4404

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3220

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4808

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:6072

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
PID:2164

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
PID:4992

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:4108

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:4308

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:1692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6eca790d9c2fde36295bd4c6026d6f01e4f32ba575b7da57d2a9d120d1a3c363
MD5 5a5240a862dcae3d7f242902ef36fe9a
SHA1 7272071c87cc37c563d46d09191a6dc6c80d4de0
SHA512 66789c9ce5762d16cf87433d408c26d4d67b5525ff5e006df8ae72f4efbe490940fc8e191a405823fc4897e26e0141e32a93a694010576cc5f522e4875627e35
SSDEEP 49152:ub+632BuPkFKRrdE6oh7stBhuXjfS4LWxnPqRw3PgnOZfPy:w3q6gjBbwo1
TLSH
T1F1D59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 9f86049ba2d2dbbfab5f02b67af39e43d235a93e873386de9e312322a33b71e7
MD5 f6109c95961e19e14a62b47899c3cb6f
SHA1 e92be25aaf70219e698003a27a13549a7b5c3430
SHA512 195150aaac611aaadd4beb960a9e927eca1b10280e0953bf9dad8c7498967163d14c168d56ace978fea3f4323c271753e25194189c3def866521793f1be8b862
SSDEEP 24576:nXYeDAczAfbWRw/PPO6hAnOZfPbWyC9e:BAcGqRw3PgnOZfPy
TLSH
T17805022873E448F9ED6B813DC9B28512EB73B8554760E79B03E489351F236C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 993ad98939576bf2c386a6bbb45e1fadf02f19655d615701cebbfd061678ce52
MD5 ea8b972ddd18e2a4f01e38db2d32297f
SHA1 89835956488bf37cc7e452bb9780b717084c5e66
SHA512 8768bfd69daf2a7c26b775a8c5717f5f0a2cc02f544ec7b2340028114cd3d99ae416e783aed3004f9fdf14b84707e46887ecf3c8c59cbbc0a84102cd0acf3b35
SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+Cyig9rH2FDbfH8jDLw7+POxkeg7hbZcRnOFmCfPbicL:Owu+OWJbWRw/PPO6hAnOZfPbWyC9e
TLSH
T11D05F14573E40CF9EAA685398657C132FBF3BC112A25DB2F1760C65A6F23251AD3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 fcfcec829820592fe05ecdf1e3871dfc2ca41ae506e20fb7091fec00a85b9eb3
MD5 3239835da4064526bfdad0c3ae99acdd
SHA1 6251afb3a015555175eba110bba61861e448ad5d
SHA512 9695eafd39559fc53996a14750b9fe2b7e047cb0131470a3db110a0f75d3d5a8ec75fa0f4e3de65f878490eb98d599debce1ba422e5b350ff36d558694df3b80
SSDEEP 49152:oy+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl8qRw3PgnOZfPy:tu6JmTxd2dnwo1
TLSH
T12DD59D13F1DA01E8D06ED479974A9233EA62BC490B34B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 b8c40a28fd5d0c3f5d9878353d1af230ef0ed19e2747d690678b51b866863904
MD5 1a3f1a2aa6f1734a8b51ade7cc34be17
SHA1 fdb2c27d93334cd161633cec050185679fc26a0e
SHA512 bdd97a6da55c65546e1fa30b310bb531fa6ba1af6aba02d607576488bc393269cfd5f48fc1f97236787971aedfadf567711903108f8da23ca7ffdf3298f687ff
SSDEEP 12288:cH7Qig9rH2FDbfH8jDLw7+POxkeg7hbZcRnOFmCfPbicP6otagxCN/PktD:qQbWRw/PPO6hAnOZfPbWyC9e
TLSH
T113D42345A3F9C856E7AC987F42764032BE5FFB798F04C5F6B7444A183862C858D3A3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 dcb2290b96a2e3ca1c337bf11043d8c4c159103b09a307b05fbc18f5c810bb92
MD5 0af3edf11d92dcd8edda24bbf447b1cd
SHA1 3ca563960ab85b72516ebcf1f6412f5c69971941
SHA512 4d7afa75f7d09d37ea862b6bc2597dadeae72bee35771ab425cccf4521bf99cf1fcf15fd4825413628a93b93655d053a43c99cadb6651a311a27adb2af239a60
SSDEEP 12288:9nGUig9rH2FDbfH8jDLw7+POxkeg7hbZcRnOFmCfPbicP6otagxCN/PktD:tGUbWRw/PPO6hAnOZfPbWyC9e
TLSH
T17BE4234C71F6A4D4C67CC53E85714033BDB67A708B0496FF4AE4CA389E528D19A3EEA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 256KB
SHA256 9c2b7312ab5d5c809dbeff15e84f2b16a6a7a4c5c8175fe78d83d3691abfaa3f
MD5 2683016b654225eca19615e2c0d2cbb6
SHA1 a8a10a95cdc72e48e5a51eb8ec9dc77665289590
SHA512 3f883403e2c43316975bf68098b2663237501f002077657866b1b118ac09b16f2e5c7f8987d4abddb403070d2e51681e07cf14e70c8fe9fbdccfc1d28e1e3037
SSDEEP 6144:ACig9r88k3GiHFGiaocyfHjAjsWLNpYOol+sj8fGz:ACig9rH2FDbfH8jDLw7+Pc
TLSH
T1F444224453A4C886C76AEC772395C233DEB9BE32538103F7B148662868F65C7EE7D198
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 085c996fbc351f968ec47f9d7ff944414607864b26da8d1d614283c17d579276
MD5 7eb0f34993e29855785909df95ec9307
SHA1 2ef28bc500b7f83c7ecccc8f563d9110b19d634b
SHA512 c6064fa164aeb14b2c1a463a0b246df470d33df277f1b6a62ad0cb774dd0f83fd94150297f7221fcc9fa6626f95a3468583059bf55281dcd69f7c47e2a336224
SSDEEP 12288:wHvUrBFrEjwaQ/ig9rH2FDbfH8jDLw7+POxkeg7hbZcRnOFmCfPbicP6otagxCNG:wPUr+NQ/bWRw/PPO6hAnOZfPbWyC9e
TLSH
T1F205F11F22ED18E5E679E17D85828619F772B8620711D2DF03E0817E5E63DD8AD3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 1.7MB
SHA256 1c147a8f1c707020594d05cc8c72d5c04a365928349e75d375bb185f2b7a658d
MD5 ec2db06b9eb6a4356da109acc8e9c998
SHA1 123e9d667c80ef44870a11ac314b43af43f1b0b6
SHA512 9df2c6e1ab0b15b99b01cd065dd53898435a33dc558accdfecc44083ebb6cc93b0603cf763aa43d5b2b5254a766ca92d256bf8271dc6aaa66d93bb4650a8c86b
SSDEEP 49152:LBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTV:UG05lO4A
TLSH
T13F857D6E62EC01F9D1BAD07DCAC68A0BEBF13425132556CB02A486B95F27FF4653E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 87a2c142777a4b56aa0b6a4f168b15ba60ce062578c4d4f0d8e6f705efe0761b
MD5 5fece517b268b25a26c6693a33dd5701
SHA1 5f2a8289164296e6338bde19a5edf66e7a5053f1
SHA512 59b37182db02a15529231decb42e34f839167b3106714c60423f39220f194d086255973f42480f6098494f33f5a4371feff6541aef365f0d2590da0df0730785
SSDEEP 12288:r1Hck6j5ZI7AfFig9rH2FDbfH8jDLw7+POxkeg7hbZcRnOFmCfPbicP6otagxCNG:v6DIgbWRw/PPO6hAnOZfPbWyC9e
TLSH
T1A4F4014C33BA10F5D1ABD03E86930112E6B2B57187525AEF0BD4C5795EA3EC8B93DE90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 bce572392ded43a788b156f053d77362fac09dc3ee185bafb03f1369e1e32550
MD5 f8ede7d3bfaddfdcf7e4662744884863
SHA1 1ac7a4026308d03330342198a550e70259419982
SHA512 1cbf95412f3ad26f2ad9c5bd3296c0dd64590744810b949ebe659e46e6776ef882e1530b8eda9dbcab45e9c8d0852d058c1f233af0c8236d32238753f8dd8383
SSDEEP 12288:NG6kyUig9rH2FDbfH8jDLw7+POxkeg7hbZcRnOFmCfPbicP6otagxCN/PktD:0tyUbWRw/PPO6hAnOZfPbWyC9e
TLSH
T160F4124463E890D5E7BC453D8A738162DE7ABC209B1093EF66D0DA3D2E32AC49D35B64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1312-7-0x0000000002990000-0x00000000029F9000-memory.dmp

Download

memory/1312-0-0x0000000002760000-0x0000000002856000-memory.dmp

Download

memory/1312-6-0x0000000002990000-0x00000000029F9000-memory.dmp

Download

memory/1312-1-0x0000000002990000-0x00000000029F9000-memory.dmp

Download

memory/1420-16-0x000002AF08BC0000-0x000002AF08C26000-memory.dmp

Download

memory/1420-17-0x000002AF08BC0000-0x000002AF08C26000-memory.dmp

Download

memory/1420-18-0x000002AF08BC0000-0x000002AF08C26000-memory.dmp

Download

memory/1420-46-0x00007FF674EF0000-0x00007FF675012000-memory.dmp

Download

memory/1420-15-0x00007FF674EF0000-0x00007FF675012000-memory.dmp

Download

memory/1692-292-0x000002008F040000-0x000002008F0A6000-memory.dmp

Download

memory/1692-293-0x000002008F040000-0x000002008F0A6000-memory.dmp

Download

memory/2164-253-0x000001D361BF0000-0x000001D361C56000-memory.dmp

Download

memory/2164-254-0x000001D361BF0000-0x000001D361C56000-memory.dmp

Download

memory/2164-252-0x00007FF6626B0000-0x00007FF6627C9000-memory.dmp

Download

memory/3220-56-0x00007FF7E5F70000-0x00007FF7E60D7000-memory.dmp

Download

memory/3220-48-0x000001753CA20000-0x000001753CA86000-memory.dmp

Download

memory/3220-49-0x000001753CA20000-0x000001753CA86000-memory.dmp

Download

memory/3220-54-0x000001753CA20000-0x000001753CA86000-memory.dmp

Download

memory/3220-47-0x00007FF7E5F70000-0x00007FF7E60D7000-memory.dmp

Download

memory/3388-28-0x000002165CAE0000-0x000002165CC0C000-memory.dmp

Download

memory/3388-29-0x000002165CD20000-0x000002165CD86000-memory.dmp

Download

memory/3388-31-0x000002165CD20000-0x000002165CD86000-memory.dmp

Download

memory/3388-30-0x000002165CD20000-0x000002165CD86000-memory.dmp

Download

memory/3436-235-0x00007FF76FAB0000-0x00007FF76FB78000-memory.dmp

Download

memory/3436-236-0x0000023D16890000-0x0000023D168F6000-memory.dmp

Download

memory/3436-237-0x0000023D16890000-0x0000023D168F6000-memory.dmp

Download

memory/4108-274-0x0000000000970000-0x00000000009D9000-memory.dmp

Download

memory/4108-273-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4108-280-0x0000000000970000-0x00000000009D9000-memory.dmp

Download

memory/4308-285-0x000001314F7D0000-0x000001314F836000-memory.dmp

Download

memory/4308-286-0x000001314F7D0000-0x000001314F836000-memory.dmp

Download

memory/4404-38-0x000001C034920000-0x000001C034986000-memory.dmp

Download

memory/4404-37-0x000001C0346D0000-0x000001C0347FC000-memory.dmp

Download

memory/4404-39-0x000001C034920000-0x000001C034986000-memory.dmp

Download

memory/4404-40-0x000001C034920000-0x000001C034986000-memory.dmp

Download

memory/4808-61-0x000001E6A6580000-0x000001E6A65E6000-memory.dmp

Download

memory/4808-60-0x000001E6A6580000-0x000001E6A65E6000-memory.dmp

Download

memory/4808-59-0x000001E6A6330000-0x000001E6A645C000-memory.dmp

Download

memory/4992-266-0x0000021F55230000-0x0000021F55296000-memory.dmp

Download

memory/4992-267-0x0000021F55230000-0x0000021F55296000-memory.dmp

Download

memory/4992-264-0x00007FF72B190000-0x00007FF72B2D9000-memory.dmp

Download

memory/6072-246-0x0000018880A80000-0x0000018880AE6000-memory.dmp

Download

memory/6072-245-0x0000018880A80000-0x0000018880AE6000-memory.dmp

Download

memory/6072-244-0x00007FF76FAB0000-0x00007FF76FB78000-memory.dmp

Download