081d0590c639d2452f2b1089bf7642a9fa446e29c7171fbefa77b9ad0d46cb71

Analysis

max time kernel
147s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 09:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_da8d479e4784f92d31c58f78892a3763_elex_glassworm_mafia_remcos.exe
Size 1.2MB
Sample260804-lc998sstgs
SHA256 081d0590c639d2452f2b1089bf7642a9fa446e29c7171fbefa77b9ad0d46cb71
MD5 da8d479e4784f92d31c58f78892a3763
SHA1 2a8424a11661ebc8b662d134128239696cd72a30
SHA512 d7974bbdd1575de57a4beae2b891ecea3c558105bf9a86eea39d5542a49171539f3af330ae200bf4fb4ec51cbd5aa41c2b054b37d29eab29630e1725f561120b
SSDEEP 24576:4hfDc6X3lQM3xr4cQFTj0OZeVJTELKg2x6YAc7g3xg8CR28J/lEp:zul13qcQFTIOZeDQ6eIg3xg8CR28f
TLSH
T19645F12EBAF1C032C12312318E6ED358A2B5E4B248254447BBDD672D2F745D39739BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
1440	alg.exe
704	elevation_service.exe
4672	elevation_service.exe
4752	maintenanceservice.exe
5504	OSE.EXE
3640	GameInputSvc.exe
1216	GameInputSvc.exe
4156	msdtc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_da8d479e4784f92d31c58f78892a3763_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\542783bcb05c2f27.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_da8d479e4784f92d31c58f78892a3763_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_da8d479e4784f92d31c58f78892a3763_elex_glassworm_mafia_remcos.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4844	2026-08-03_da8d479e4784f92d31c58f78892a3763_elex_glassworm_mafia_remcos.exe
Token: SeDebugPrivilege	1440	alg.exe
Token: SeDebugPrivilege	1440	alg.exe
Token: SeTakeOwnershipPrivilege	704	elevation_service.exe
Token: SeTcbPrivilege	3640	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 1216	3640	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-03_da8d479e4784f92d31c58f78892a3763_elex_glassworm_mafia_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_da8d479e4784f92d31c58f78892a3763_elex_glassworm_mafia_remcos.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4844

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1440

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:704

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4672

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4752

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5504

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:1216

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4156

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
PID:1168

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:5696

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:5360

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:6032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 40bf62dc0d438ca260bbd794ef75c94059f91afb46f0521d16567bdee4994f81
MD5 230beb22c510b1032636636384ca51fb
SHA1 a2da75494704a92509ef79a23cc8932ddd947d2b
SHA512 672728652a270fda3cd61896c1db24b8840b985f19845247f9ed89e83ae699db841db6a9de62b19408f85f93667c1f81f1e7ae7ee64be08c2e92bdf79d172a3d
SSDEEP 49152:Sfc632BuPkFKRrdE6oh7stBhuXjfS4LWxnJQ6eIg3xg8CR28f:+3q6gjB8Wxg1bf
TLSH
T1FCD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 f08d3348fbdc0ea97d497439e05fad1d81bb6f7aac131b9441c56597696b0e80
MD5 b1a386a4f68cb37e73296593684e534c
SHA1 018d14ab0af34707aae334d855cf2a42e8dcb170
SHA512 6878eb5df0e4b13502f0de04d7b9d898aaaf985e59845977b335540fbdffd46202dc51d535ea4fd9367d1e144ca20516bc63accae9d3cda64ee0cf9fab66e636
SSDEEP 24576:iXYfkUczA0ELKg2x6YAc7g3xg8CR28J/lEp:yUclQ6eIg3xg8CR28f
TLSH
T17605012973D449FDED678239CDA28511EA737C9103A4E78B03A498351F237D86E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 826KB
SHA256 7a428da097f54bc64ac180814a404eae570cae2da85bbb41048bcfa276271e89
MD5 5ed34b63b841dd41cb8103b978aafdf6
SHA1 762d8c51ff127cac8cae7f5bad514cf50f666aa9
SHA512 16742918ebb7af074aeea71de148a498c4f7fedbab9e19d54fe56e62bdf05c0ff8383a528071b36419614f2d52b2346d7fb3b29d503024f45193f341b3af2159
SSDEEP 24576:Qwu+OWtELKg2x6YAc7g3xg8CR28J/lEp:QwlOSQ6eIg3xg8CR28f
TLSH
T1A005F14633A40CFDE96746398647C535EBF3BC122A24DB1F1760C62A6F273616E2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a53a6ad1c5d6967838822555cef6f83cd48f75bf2d98bcd989a461bedf43e922
MD5 4167617d25f51969b03d64a8f04a95db
SHA1 36a73b7bba8c788ce2350ce8304ac359e348e2ea
SHA512 e6faf15c4d0ffbd994f4cc6c11b3eefd4800c8eb2e6fdb1123f7bf942de99f4be51439caf2d82d5fa9e43cdcce15e4cd54c91ed4045b3ee4a3d6c46b56f1b255
SSDEEP 49152:tW+taZ3usBWOBr4tEGp0bqx0z+n217aau1glhcQ6eIg3xg8CR28f:8u6JmTxd2dheWxg1bf
TLSH
T167D59D13F1DA01E8D06ED578974A9233FA62BC490B34B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 607KB
SHA256 46d22f6c9a721556e75223bb7912eb70add77dade0723354d73f5c7b65fb9bb3
MD5 0d52cae6235919d3802dbe0528f9a2f2
SHA1 2ba3101e08201fdcc8571213556fd77a20b8bb0c
SHA512 e0bd91bcc807018dfc5837a0236081984e816a37ad596f22d5263e30b02eed88d6ecd336e44945023f6b1d0a54cff65d84568fae7403361fe76f02d733c6207c
SSDEEP 12288:IN7xE8Imbg2x6B6qTJCIQ2MgRx22c068Da7dZfFj2DyvbSOJWg0yFKp/:oxELKg2x6YAc7g3xg8CR28J/lEp
TLSH
T1C7D42373538CCE0DF9170E71890B9B106A7F7D752BA8D4CB7A1464341C19BC86BB9AC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 eed795fef395905cc45a347db45446d7a05840123b83185f3337b2e33508cd5b
MD5 0f4a7fcb196b5c63cc600edf0d1e3f0c
SHA1 dd372a34e54c7282856aa616bde3f2c1d12722d5
SHA512 09232f093681c5cab662e3da1f04314ec9cb555880d41aede0dadc08a7b3090b43b5a2c4c773cf0e30eedb0085a62983afec99706f68ca4e719e6ea1ff851ce7
SSDEEP 12288:IRGWE8Imbg2x6B6qTJCIQ2MgRx22c068Da7dZfFj2DyvbSOJWg0yFKp/:MGWELKg2x6YAc7g3xg8CR28J/lEp
TLSH
T16DE4233E32E8994CD53B8F3589169A51BDB238B0276865EF1A90E4345E0DBE4337DDC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 d1d94121c08dedca277719cd9f0db5beebfd84668465c4ead664ecff47b4a771
MD5 3b042d1b45c0ca70937b2f4cf03cd7b3
SHA1 5af2eeae926c5c577010c4704ddf9cd8f34e9987
SHA512 4412f62e623b63908024de64a07cf64879d29cd3838e758df95743e39ce535619acd8b2d37a911d6a20f9b30bcc69c655f45699b0b360c7fa408367561e27bee
SSDEEP 12288:Q8E8Imbg2x6B6qTJCIQ2MgRx22c068Da7dZfFj2DyvbSOJWg0yFKp/:Q8ELKg2x6YAc7g3xg8CR28J/lEp
TLSH
T137D423662388CE0DEA070F7289079B10AE7B6D7537A895CB7A1464341C0EFD933B99D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 172829ed98b05f6c15028b625118809f573e1480ab35be5b1efd300c41d0aaf5
MD5 617ea0342db4021b9af9f83b6d8c3939
SHA1 344ea04a0b07095e4ad1d1d99eea46ab21308885
SHA512 5825d3d106a2a596d2e372e1a08d41724abca6bf448065c7faf41e2f91a75d032445b9642d6c3c958d86a1bdfe43dc0a7c7233796c941bc3a3191fb95f27c717
SSDEEP 24576:NPUr+NQvELKg2x6YAc7g3xg8CR28J/lEp:NJQvQ6eIg3xg8CR28f
TLSH
T16905E12F22EC1CE9E676A17D89468709F77278621751D2CF02A0803E5E57EE8BD3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 4d2919e1f24873473342cfc186779e08586ef138a99e24ed2db810f16606b8e3
MD5 03a57b855a7ac58a311c0838ee763c11
SHA1 3b60f6a6f1ff251605617062c2a5b3d7fd6d993e
SHA512 31fd00915ea062c0cf04de13ae1979adc82cbf8928c0871f6c4f5bc8aa807dd518b0f45b286d25bc57d25795b2dc66d21ebe67bad35c67240e3b639cc254ec62
SSDEEP 49152:yBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjAQ6eIg3xg8CR28f:9G05lO43brWxg1bf
TLSH
T114D5C06A62EC11F9D1BBD17CC9C64A0BEBB23815033556CF02A486A91F27FF4667E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 28b2ef546337f671b973d17ac3894c8233b5abc69b2c8bf218014b0b013f5f0e
MD5 ad721af27dd5662cd033db3afe4f2640
SHA1 75878580cdd2469eacde1db8bacf3b97102cdcd4
SHA512 ec28ed5e719f061fc5a99434cbcc0eccacf004f23a28060f563aa52a1f683d5f8bf5d674f54f9daad608918cd0a0620155b80e35287e723598d50d3ed0fee3ae
SSDEEP 12288:aq1Hck6j5ZI7NE8Imbg2x6B6qTJCIQ2MgRx22c068Da7dZfFj2DyvbSOJWg0yFKV:Z6DIJELKg2x6YAc7g3xg8CR28J/lEp
TLSH
T1F4F4016D23BA01B9D16BD03EC6830601E6B2B4B1976559CF1B94C47D4E93EDCBA3CE81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 0112698873bbf63762902bd0a3275d9dac0bbb57510ca56b8f4b59c1fbf2c060
MD5 a07823447618a2031c455b7af7e8f1f5
SHA1 787b050d3a1010c572e9c71d66598360363822a5
SHA512 2d4d7459cfc2dd9cfbd84855605ec4f6f4f40a9bfe098199d1afae6edaacb100796ce4454cfac2e2c30793be411c27a28bc122cca6d7f76dc6e4a143c0413c25
SSDEEP 12288:aG6kyKE8Imbg2x6B6qTJCIQ2MgRx22c068Da7dZfFj2DyvbSOJWg0yFKp/:ztyKELKg2x6YAc7g3xg8CR28J/lEp
TLSH
T18DF4131523D8958CFA7B0A34CE2382509F767C302B6492DF2690F43D2E3ABD47A74B95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/704-28-0x0000021A243E0000-0x0000021A2450C000-memory.dmp

Download

memory/704-29-0x0000021A24350000-0x0000021A243B6000-memory.dmp

Download

memory/704-31-0x0000021A24350000-0x0000021A243B6000-memory.dmp

Download

memory/704-30-0x0000021A24350000-0x0000021A243B6000-memory.dmp

Download

memory/1168-264-0x00007FF63D530000-0x00007FF63D679000-memory.dmp

Download

memory/1168-266-0x000001F1C72F0000-0x000001F1C7356000-memory.dmp

Download

memory/1168-267-0x000001F1C72F0000-0x000001F1C7356000-memory.dmp

Download

memory/1216-253-0x000002D892F40000-0x000002D892FA6000-memory.dmp

Download

memory/1216-254-0x000002D892F40000-0x000002D892FA6000-memory.dmp

Download

memory/1216-244-0x00007FF63D410000-0x00007FF63D4D8000-memory.dmp

Download

memory/1440-64-0x00007FF7AD6F0000-0x00007FF7AD812000-memory.dmp

Download

memory/1440-15-0x00007FF7AD6F0000-0x00007FF7AD812000-memory.dmp

Download

memory/1440-16-0x000001F3F0830000-0x000001F3F0896000-memory.dmp

Download

memory/1440-18-0x000001F3F0830000-0x000001F3F0896000-memory.dmp

Download

memory/1440-17-0x000001F3F0830000-0x000001F3F0896000-memory.dmp

Download

memory/3640-236-0x000001FB2C2D0000-0x000001FB2C336000-memory.dmp

Download

memory/3640-235-0x00007FF63D410000-0x00007FF63D4D8000-memory.dmp

Download

memory/3640-237-0x000001FB2C2D0000-0x000001FB2C336000-memory.dmp

Download

memory/4156-248-0x0000013E355A0000-0x0000013E35606000-memory.dmp

Download

memory/4156-249-0x0000013E355A0000-0x0000013E35606000-memory.dmp

Download

memory/4156-247-0x00007FF62BE30000-0x00007FF62BF49000-memory.dmp

Download

memory/4672-40-0x0000018463AB0000-0x0000018463B16000-memory.dmp

Download

memory/4672-39-0x0000018463AB0000-0x0000018463B16000-memory.dmp

Download

memory/4672-38-0x0000018463AB0000-0x0000018463B16000-memory.dmp

Download

memory/4672-37-0x0000018463860000-0x000001846398C000-memory.dmp

Download

memory/4752-54-0x0000022D70210000-0x0000022D70276000-memory.dmp

Download

memory/4752-48-0x0000022D70210000-0x0000022D70276000-memory.dmp

Download

memory/4752-55-0x00007FF6DE430000-0x00007FF6DE597000-memory.dmp

Download

memory/4752-47-0x0000022D70210000-0x0000022D70276000-memory.dmp

Download

memory/4752-46-0x00007FF6DE430000-0x00007FF6DE597000-memory.dmp

Download

memory/4844-6-0x0000000002C50000-0x0000000002CB9000-memory.dmp

Download

memory/4844-0-0x0000000002BA0000-0x0000000002C43000-memory.dmp

Download

memory/4844-2-0x0000000002C50000-0x0000000002CB9000-memory.dmp

Download

memory/4844-7-0x0000000002C50000-0x0000000002CB9000-memory.dmp

Download

memory/5360-291-0x00007FF78DDC0000-0x00007FF78E503000-memory.dmp

Download

memory/5360-286-0x00000281DBA80000-0x00000281DBAE6000-memory.dmp

Download

memory/5360-285-0x00000281DBA80000-0x00000281DBAE6000-memory.dmp

Download

memory/5504-58-0x000002A2FC920000-0x000002A2FCA4C000-memory.dmp

Download

memory/5504-59-0x000002A2FCB20000-0x000002A2FCB86000-memory.dmp

Download

memory/5504-60-0x000002A2FCB20000-0x000002A2FCB86000-memory.dmp

Download

memory/5696-274-0x0000000000A50000-0x0000000000AB9000-memory.dmp

Download

memory/5696-279-0x0000000000A50000-0x0000000000AB9000-memory.dmp

Download

memory/5696-273-0x0000000000400000-0x0000000000548000-memory.dmp

Download

memory/6032-293-0x00007FF65AFF0000-0x00007FF65B09D000-memory.dmp

Download

memory/6032-294-0x0000022F4BAB0000-0x0000022F4BB16000-memory.dmp

Download

memory/6032-295-0x0000022F4BAB0000-0x0000022F4BB16000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads