e0da33fbabc77f4a85b9bea35f148465e40466ea5e76e475fd6cc9b34514dc07

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_b9c3c8b10f050523fb725e29f2240726_darkgate_elex_glassworm_mafia_remcos.exe
Size 1.5MB
Sample260808-dbspss1yft
SHA256 e0da33fbabc77f4a85b9bea35f148465e40466ea5e76e475fd6cc9b34514dc07
MD5 b9c3c8b10f050523fb725e29f2240726
SHA1 b3caa029f9792a772358fa51d219ce4f900ec275
SHA512 8ad6b0733f8566e8bd24565b9260221d3f550cee224888727e0f6cf799888750993c4fdccca159503cd17ce1a49fc2291a50b17ea962bf18cfd725d436fd65c6
SSDEEP 24576:ivrHWdZcy2NKcWzvJQHz4UTMV87BbkjCMvGdLtbT7Jckdwi6i9bNrqq4E41WFpWc:2sGuxQThTb7mGVtn7Jckdwi3N7+WTW3
TLSH
T16075BD1277E58035F2B36731993A931499BABCB29839840E73DC666D2F70691CE74B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
6100	alg.exe
5152	GameInputSvc.exe
2776	GameInputSvc.exe
3904	elevation_service.exe
4816	elevation_service.exe
1096	maintenanceservice.exe
4952	OSE.EXE

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\dbe8fdade05f6396.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_b9c3c8b10f050523fb725e29f2240726_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-08_b9c3c8b10f050523fb725e29f2240726_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_b9c3c8b10f050523fb725e29f2240726_darkgate_elex_glassworm_mafia_remcos.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-08_b9c3c8b10f050523fb725e29f2240726_darkgate_elex_glassworm_mafia_remcos.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-08_b9c3c8b10f050523fb725e29f2240726_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_b9c3c8b10f050523fb725e29f2240726_darkgate_elex_glassworm_mafia_remcos.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2776	GameInputSvc.exe
2776	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	908	2026-08-08_b9c3c8b10f050523fb725e29f2240726_darkgate_elex_glassworm_mafia_remcos.exe
Token: SeTcbPrivilege	5152	GameInputSvc.exe
Token: SeDebugPrivilege	6100	alg.exe
Token: SeDebugPrivilege	6100	alg.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5152 wrote to memory of 2776	5152	GameInputSvc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-08_b9c3c8b10f050523fb725e29f2240726_darkgate_elex_glassworm_mafia_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_b9c3c8b10f050523fb725e29f2240726_darkgate_elex_glassworm_mafia_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:908

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:6100

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5152
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2776

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3904

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4816

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1096

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 638080e72cbfe2d17a40c4cc52bcec276e3befb9772a25e18ae9e4e15ede1df4
MD5 a88003137ad4ab326f935fe5699913cf
SHA1 472b2213f44410c7841aa2a6ee36ab4e0a78bc1a
SHA512 f16f1be071b1a3166179cccd8792cdbb2adfe21bf9dfc3351b05ceef8728580e534bf5a2f0c9ebf055206b74442e2ec41fba3ab3ea903fd0bfcb43119672d79b
SSDEEP 49152:guC632BuPkFKRrdE6oh7stBhuXjfS4LWxna7Jckdwi3N7+WTW3:L3q6gjB7Pdwi3Q
TLSH
T1F7D59D03F2D900E9E06AD178D7469132EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 90fda479a29829eff69fec30b1f0449b3a39e4701f0bb9d504dd701bf51cbbf0
MD5 6068b98839b77dccbb16c8d2c528b8f5
SHA1 a05481dcfbf334ad8eaa86c5813d965707d18d4f
SHA512 6d954cf21882a243f2ef8b69d1d3ea48508ba2cdb1aff63ce2d39ea9fe8ca49276081cdd659c0dba9f2b7a9e626134a145c39fc82caa22cd1d1417fc49839ea1
SSDEEP 24576:TXYHDxczAHT7Jckdwi6i9bNrqq4E41WFpW3oRos:6xcC7Jckdwi3N7+WTW3
TLSH
T181050128A3E409F9ED67C239C9B2C515EA7278514760FB8B03E496751F233846E3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 bc2a711260587ddeea4a8aa31e17b04ff3f85598b803b5fcb58a289e5973ec91
MD5 92f725a7fa10aa33aac411003605ee17
SHA1 6e4296a417467e7cc9cc3a77524dadb09c4269cd
SHA512 9369ebacdcfd7990d7a169f1c0218314b0fdaecf263295fde74bad1d67b2cf8c6495e7f8128bd580ecf4fdc5fd8648c737e8906ea09dd3a6723f9abbc94b3f87
SSDEEP 24576:Owu+OWrT7Jckdwi6i9bNrqq4E41WFpW3oRos:OwlOE7Jckdwi3N7+WTW3
TLSH
T1B705F14972A40CF9E5679239C65BC135F7F2BC022A25DB1F07A0C65A5F27351BE2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 210a6444375c0db40013e699e114f62089a1b2508d17bd5ffa29bbea80ae0bb4
MD5 582317d912b5fb534bf6d1b83b2b3f97
SHA1 ba0d9b0f03a5d3d8b30b6d35948dfe7684b36f22
SHA512 cc784f4321e4acf540da4cc61fd53dcd27707854621298b1eff124afaf21733b1dbf7ecf02ff4c6c8dc890fcf0b8042b35e1ee63474b97dec989aae267722e48
SSDEEP 49152:TH+taZ3usBWOBr4tEGp0bqx0z+n217aau1glF7Jckdwi3N7+WTW3:Hu6JmTxd2dDPdwi3Q
TLSH
T146D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6EF0A9073552A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 d01f57545302c8a028c331bdd1b172638dc6bb41b76bc97277bbe5b01b53c9a9
MD5 f40e4e7d1ccd3e2a6826a4336df519be
SHA1 8a806beebf9ae83de8d2c3c2740f5c948e40b19b
SHA512 f47e0422bd01bbd07501badb6a784c72700d24dc84c5ac237eed544759244f8842cd7b310906e0d2a51a7397e294701ddcff02fcf42ebf469503c1f775af5888
SSDEEP 3072:DguRCDBLFX9HmT8PWAXRODmkntzSSoCclHs1bpcoM6LM58w3/:HuoM6LXw
TLSH
T102F333CA851EC9FB30239AD3C7795C655593364A839E491C23CF82EA7641D03CA2F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 8cc3bbc4b467f8fdc106d99a76c8a2eda6da1b09fd3c011da9102e1fa2aea633
MD5 acc8bf03da1564a8f85cf86d174c9d86
SHA1 69f6e46f17f41a87c33f616fecf37a0576889493
SHA512 2adff89929469d4ae479cbbecd222716f306cb43946918c37d9512d505202006c2eb86a8c683ce55f40cb354cd1632854f3a4ec3108995616ddc14b6d042fd43
SSDEEP 12288:f9GPT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:1GPT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1AAE4230C61AA35E9C637D335853DE5A5F9F03A512B247AEF06D0A2709B193D0737EE28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 83dd1cd5fb84137b679cdb8a7ba157511296af6983647b3080bae2009e0f343c
MD5 d4c968f457350bd2cb67957a769afa6e
SHA1 ca4db29d6645209ff1ef6af108207dda83a66368
SHA512 0f6eecf4a4bdaa6e43032cc2c88be38f0bd52bfe2138010315ef9536787eaf238f187cf44c00fcb7200f2ad50f6c673e444d61db8b316bc9814e8f7dc3236a40
SSDEEP 24576:gLDIUT7Jckdwi6i9bNrqq4E41WFpW3oRos:gLDI27Jckdwi3N7+WTW3
TLSH
T1CBF4014C637A10FAD167D03EC6934151E2B2B57197226ACF07D4C1B99EA3EC8BA3DE50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1113b1a01f694ae542721aab3d89875d68ed376814fd760c5827cf5accdb9ee2
MD5 0146e601b4070b347692e8f3815bc7c3
SHA1 5539647eb62cdbcb3381123abaabbe6a0ae929d6
SHA512 9887dcae3c07c0c0b2e65b36cb4b21f9a2c34a05457b5b299626357c6625b6da38ef8d2a3a222b33d3a8c142ec9c4e578db6658828af9e0425ee276fd7a087df
SSDEEP 24576:/TkNvNnaFeYhJNtmZBmST7Jckdwi6i9bNrqq4E41WFpW3oRos:/TMwBtOmY7Jckdwi3N7+WTW3
TLSH
T13C55AF2EB6B846E4D1FAC675CD238512FA727461173293CB5390C13E0E279D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/908-7-0x0000000002860000-0x00000000028C9000-memory.dmp

Download

memory/908-1-0x0000000002860000-0x00000000028C9000-memory.dmp

Download

memory/908-6-0x0000000002860000-0x00000000028C9000-memory.dmp

Download

memory/908-0-0x00000000028E0000-0x00000000029F5000-memory.dmp

Download

memory/1096-84-0x00000147986C0000-0x0000014798726000-memory.dmp

Download

memory/1096-83-0x00007FF7BCE00000-0x00007FF7BCF67000-memory.dmp

Download

memory/1096-85-0x00000147986C0000-0x0000014798726000-memory.dmp

Download

memory/1096-92-0x00007FF7BCE00000-0x00007FF7BCF67000-memory.dmp

Download

memory/1096-90-0x00000147986C0000-0x0000014798726000-memory.dmp

Download

memory/2776-51-0x00007FF7345D0000-0x00007FF734698000-memory.dmp

Download

memory/2776-52-0x0000027770670000-0x00000277706D6000-memory.dmp

Download

memory/2776-54-0x0000027770670000-0x00000277706D6000-memory.dmp

Download

memory/2776-53-0x0000027770670000-0x00000277706D6000-memory.dmp

Download

memory/2776-101-0x00007FF7345D0000-0x00007FF734698000-memory.dmp

Download

memory/3904-62-0x00000266E5340000-0x00000266E53A6000-memory.dmp

Download

memory/3904-61-0x00000266E5340000-0x00000266E53A6000-memory.dmp

Download

memory/3904-60-0x00000266E51F0000-0x00000266E52EB000-memory.dmp

Download

memory/4816-74-0x000002C0DB5E0000-0x000002C0DB6DB000-memory.dmp

Download

memory/4816-75-0x000002C0DB800000-0x000002C0DB866000-memory.dmp

Download

memory/4816-76-0x000002C0DB800000-0x000002C0DB866000-memory.dmp

Download

memory/4952-96-0x0000017688160000-0x00000176881C6000-memory.dmp

Download

memory/4952-97-0x0000017688160000-0x00000176881C6000-memory.dmp

Download

memory/4952-95-0x0000017687F90000-0x000001768808B000-memory.dmp

Download

memory/5152-45-0x00000270A2D20000-0x00000270A2D86000-memory.dmp

Download

memory/5152-44-0x00000270A2D20000-0x00000270A2D86000-memory.dmp

Download

memory/5152-43-0x00000270A2D20000-0x00000270A2D86000-memory.dmp

Download

memory/5152-42-0x00007FF7345D0000-0x00007FF734698000-memory.dmp

Download

memory/5152-80-0x00007FF7345D0000-0x00007FF734698000-memory.dmp

Download

memory/6100-15-0x00007FF71F1C0000-0x00007FF71F2E2000-memory.dmp

Download

memory/6100-17-0x0000021510DC0000-0x0000021510E26000-memory.dmp

Download

memory/6100-66-0x00007FF71F1C0000-0x00007FF71F2E2000-memory.dmp

Download

memory/6100-16-0x0000021510DC0000-0x0000021510E26000-memory.dmp

Download

memory/6100-18-0x0000021510DC0000-0x0000021510E26000-memory.dmp

Download