1fd4a25c1d0b709a29a65f7af2f9d92ad50e476a6dbab9f45f040eef8f7ebb2e

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_c7edc20083064bb27cc8445b73730af6_elex_mafia.exe
Size 873KB
Sample260804-lsd7qssxdx
SHA256 1fd4a25c1d0b709a29a65f7af2f9d92ad50e476a6dbab9f45f040eef8f7ebb2e
MD5 c7edc20083064bb27cc8445b73730af6
SHA1 d326d5d872ec3d83f81ea5ef0739e4a1c498ffce
SHA512 a9a4059001887b81363e8d164be7d6d924e7caaa1a7982c0f7e14be0a36a3c489b2c7b1684f6910598e85e7a631434330f20cc4c83682d575c99a843ca088f59
SSDEEP 24576:Fv/Hb/xc73DZ4qSywz0Tp5IgaMV7iYc+:B/HbKjpq8pvaM0r+
TLSH
T10A15E06173E48072E1B75A74993ADB36487FBC765872C08EA3D9792D4E32BC08474B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
4868	alg.exe
2484	GameInputSvc.exe
2420	GameInputSvc.exe
3936	elevation_service.exe
3904	elevation_service.exe
3156	maintenanceservice.exe
5960	OSE.EXE

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_c7edc20083064bb27cc8445b73730af6_elex_mafia.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c5489922e05f6396.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_c7edc20083064bb27cc8445b73730af6_elex_mafia.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_c7edc20083064bb27cc8445b73730af6_elex_mafia.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_c7edc20083064bb27cc8445b73730af6_elex_mafia.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_c7edc20083064bb27cc8445b73730af6_elex_mafia.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2420	GameInputSvc.exe
2420	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3480	2026-08-03_c7edc20083064bb27cc8445b73730af6_elex_mafia.exe
Token: SeTcbPrivilege	2484	GameInputSvc.exe
Token: SeDebugPrivilege	4868	alg.exe
Token: SeDebugPrivilege	4868	alg.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2420	2484	GameInputSvc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-03_c7edc20083064bb27cc8445b73730af6_elex_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_c7edc20083064bb27cc8445b73730af6_elex_mafia.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3480

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4868

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2420

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3936

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3904

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3156

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e8f7ab59d05a8fdf3c07e1c6958677920958c3e1ef7b755264195029c925371e
MD5 c3283510755a00b9243986f784aef411
SHA1 49752d5c4401af7e3496c84a7f61cc6488e3443a
SHA512 db77a82e513c57f5b154af8b3d1c14553c68f03a1caf1a0cb6ef674258035d1b68b4902bce2be15e6275a2c8c216d1c739c2039f05063c8168f433a38a1a3817
SSDEEP 49152:mb+632BuPkFKRrdE6oh7stBhuXjfS4LWxn7pq8pvaM0r+:Y3q6gjBgg8Qi
TLSH
T1B9D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 f0641fa6da89af43acd63238d8b668c5eea668376c35da71e5c3ffaa4f7df2f4
MD5 868a484e9d584cb6315c7e84f04bd356
SHA1 2b2875734d72820908dbb0de19caa20dd8203387
SHA512 a579ad801da287eea743dee4fbf995b3f738c77c07a459ca2f3c682b2a5e655ce2f7c3a002e4c1b4e407cca359e3ebd3819b7685a2fc9e1678e07824aad60d17
SSDEEP 24576:GXYaEtczAJDZ4qSywz0Tp5IgaMV7iYc+:ltcgpq8pvaM0r+
TLSH
T1CF05F12863E408F9ED6B827CCCB6C516EA3378554760E79B03A495394F237D81D3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 5499a51625c574874307abebb23045b82c98cbb7254d168fdc4a50792ad52159
MD5 6ff0d72172328ed0a3c754444de7aa21
SHA1 0a4dfeb40008ee79deffd67f4bf43bfca7acab89
SHA512 3e36e09a178dd4e42a571201d9984fa7d443759017bcdf642e7b50781b0f05f110ac19c35a0a70a52a947c7d26046a9ebcfb0fc9e972f9a317d12250523862cb
SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+CxJdUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTW:Owu+OWvDZ4qSywz0Tp5IgaMV7iYc+
TLSH
T1B805F14973A80CF9E9A78638859BC536F7B3BC122A31C71F4760C62B5F273606D29761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4194996a1c4add51b132a4321d8b2557acb7a457d59995e2c3867b61e9b89876
MD5 58abc292de8f0014e9a97e795f97704b
SHA1 facb2b77c500cc97a4828eb09b59db465407cf5c
SHA512 88aefa7a3670dec7d9d54a232e1d5e2ff9533c883d2c1aed4a23fa061d2e2b6197fb076fffe8d09301723a79e1aa4a675c63c4ea8f1c51f6ef39fdaf71c1c461
SSDEEP 49152:FB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glqpq8pvaM0r+:ru6JmTxd2dqg8Qi
TLSH
T193D59D13F1DA01E8D06ED478974A9233F962BC490B35B6EF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 884c3495bbde7d74fc33145a0d8fcca52e0697d1a8bf94bd27d8013f64ece42f
MD5 cb300835abfc4d6d8a9576ed7779bdd7
SHA1 88643d039dc279eb650ee6930918282efae04e4f
SHA512 11f9923658e4249e776c00a23e406c888dab14644515d48a12e0379b598c0861d7053f42a9d8771c9c778582456b4e64ea7711ecb6fab960c68df892b29c4bad
SSDEEP 12288:z0GEdUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTd/mTktdSxE4:gGFDZ4qSywz0Tp5IgaMV7iYc+
TLSH
T1B4E4235D21B924E8D47DCABC4879962BB4333AA11731D1FF87E4E1398E55AE03034F9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 ad4a67e0fab59bd2b44fd745ea91e2f6af6319ff2825f16e387e85e1fb441a64
MD5 224406850aaae1daa8d8269077ce1537
SHA1 5911882aeceead999a2ffd48f951d0da489dabdc
SHA512 18a6f751df008599bc8a80ea1896fdc2554af551eca15632a1aef0de1cddc796ed9affa48035329f2120dac1bad798cec8ad1a7e2b393d640d8025599fd6fd15
SSDEEP 12288:p1Hck6j5ZI74IdUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTd/mTktdSxE4:x6DI0DZ4qSywz0Tp5IgaMV7iYc+
TLSH
T18EF4024C237A10F9D06BD03D85974606E1B3B5B1872296DF47A8C57D8EA3ED87838F92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9fe5ed42ebb439467ad1a9219114f89792b1d76db0ad1173bb443014bc5e1949
MD5 72a925f377dfec0773efbbd3b5b2528b
SHA1 356475cac4cfdde9d2eb3e79683f0235e5aaa61c
SHA512 e1e147fad0e6cc648e72843e48e40716d2fe876a7b3ebe976c816bfc74925e199601a846f5be9b6d434c7a28043f14fdf2cfb480d9288a7f93eeb9762cd010a1
SSDEEP 24576:nTkNvNnaFeYhJNtmZBmZDZ4qSywz0Tp5IgaMV7iYc+:nTMwBtOmZpq8pvaM0r+
TLSH
T1D155AF6EB6B806E4D1FEC6B48D238516F6727861073293CB9390C13E0E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2420-88-0x00007FF645C30000-0x00007FF645CF8000-memory.dmp

Download

memory/2420-40-0x000001DE3F5B0000-0x000001DE3F616000-memory.dmp

Download

memory/2420-37-0x000001DE3F5B0000-0x000001DE3F616000-memory.dmp

Download

memory/2420-36-0x00007FF645C30000-0x00007FF645CF8000-memory.dmp

Download

memory/2484-68-0x00007FF645C30000-0x00007FF645CF8000-memory.dmp

Download

memory/2484-30-0x000002A098050000-0x000002A0980B6000-memory.dmp

Download

memory/2484-27-0x00007FF645C30000-0x00007FF645CF8000-memory.dmp

Download

memory/2484-29-0x000002A098050000-0x000002A0980B6000-memory.dmp

Download

memory/2484-28-0x000002A098050000-0x000002A0980B6000-memory.dmp

Download

memory/3156-78-0x00007FF76CD40000-0x00007FF76CEA7000-memory.dmp

Download

memory/3156-76-0x000001A41FB70000-0x000001A41FBD6000-memory.dmp

Download

memory/3156-71-0x000001A41FB70000-0x000001A41FBD6000-memory.dmp

Download

memory/3156-70-0x000001A41FB70000-0x000001A41FBD6000-memory.dmp

Download

memory/3156-69-0x00007FF76CD40000-0x00007FF76CEA7000-memory.dmp

Download

memory/3480-6-0x0000000002600000-0x0000000002669000-memory.dmp

Download

memory/3480-7-0x0000000002600000-0x0000000002669000-memory.dmp

Download

memory/3480-1-0x0000000002600000-0x0000000002669000-memory.dmp

Download

memory/3480-0-0x0000000000BF0000-0x0000000000E9B000-memory.dmp

Download

memory/3480-57-0x0000000000BF0000-0x0000000000E9B000-memory.dmp

Download

memory/3480-23-0x0000000000CE3000-0x0000000000CE4000-memory.dmp

Download

memory/3480-39-0x0000000000BF0000-0x0000000000E9B000-memory.dmp

Download

memory/3904-61-0x00000161FC420000-0x00000161FC486000-memory.dmp

Download

memory/3904-62-0x00000161FC420000-0x00000161FC486000-memory.dmp

Download

memory/3904-60-0x00000161FC1D0000-0x00000161FC2FC000-memory.dmp

Download

memory/3936-47-0x00000201182B0000-0x0000020118316000-memory.dmp

Download

memory/3936-46-0x0000020118060000-0x000002011818C000-memory.dmp

Download

memory/3936-48-0x00000201182B0000-0x0000020118316000-memory.dmp

Download

memory/4868-15-0x00007FF7C3300000-0x00007FF7C3422000-memory.dmp

Download

memory/4868-18-0x000002D011D00000-0x000002D011D66000-memory.dmp

Download

memory/4868-16-0x000002D011D00000-0x000002D011D66000-memory.dmp

Download

memory/4868-52-0x00007FF7C3300000-0x00007FF7C3422000-memory.dmp

Download

memory/4868-17-0x000002D011D00000-0x000002D011D66000-memory.dmp

Download

memory/5960-81-0x0000019020100000-0x000001902022C000-memory.dmp

Download

memory/5960-82-0x0000019020350000-0x00000190203B6000-memory.dmp

Download

memory/5960-83-0x0000019020350000-0x00000190203B6000-memory.dmp

Download