0943cf2c299594c49b1b614e03c0718277d9809d94a9eda0ba5e6693262106a1

Analysis

max time kernel
143s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 13:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_7da877187a1704a874ab40e7ab3ca497_elex_redline-stealer_rhadamanthys_stealc_stop.exe
Size 667KB
Sample260814-qjs2ravajd
SHA256 0943cf2c299594c49b1b614e03c0718277d9809d94a9eda0ba5e6693262106a1
MD5 7da877187a1704a874ab40e7ab3ca497
SHA1 e50b505d0d34e3f7d5dbb0daf8703ae24ebedb43
SHA512 c168ea1522bb7d345f8e1ab580bb62e09f7891f47e0eba49202076184ea30e4679b82e632c56eac6bf668b8f70f317d7ee829386c743e7d92d1107c33d728918
SSDEEP 12288:7YmIjEqG7MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:ZqaxIFIyGibdPgHB/eYvu5s2aC+
TLSH
T1A1E42341B2B1D831C4C1083089AA4771D5A6FC7068A2DD4B77D45F3E0EE1B83EA2B79B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
4288	alg.exe
2848	elevation_service.exe
4632	elevation_service.exe
5484	maintenanceservice.exe
5528	OSE.EXE
3180	GameInputSvc.exe
2044	GameInputSvc.exe
4484	msdtc.exe
2668	PerceptionSimulationService.exe
5476	perfhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-14_7da877187a1704a874ab40e7ab3ca497_elex_redline-stealer_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9eec529a8f8562d1.bin	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-14_7da877187a1704a874ab40e7ab3ca497_elex_redline-stealer_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_7da877187a1704a874ab40e7ab3ca497_elex_redline-stealer_rhadamanthys_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2044	GameInputSvc.exe
2044	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1556	2026-08-14_7da877187a1704a874ab40e7ab3ca497_elex_redline-stealer_rhadamanthys_stealc_stop.exe
Token: SeDebugPrivilege	4288	alg.exe
Token: SeDebugPrivilege	4288	alg.exe
Token: SeTakeOwnershipPrivilege	2848	elevation_service.exe
Token: SeTcbPrivilege	3180	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 2044	3180	GameInputSvc.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-08-14_7da877187a1704a874ab40e7ab3ca497_elex_redline-stealer_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_7da877187a1704a874ab40e7ab3ca497_elex_redline-stealer_rhadamanthys_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1556

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4288

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2848

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4632

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5484

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5528

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2044

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
PID:4484

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2668

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5476

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:4196

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:5904

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:4304

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:5800

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:6052

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:3252

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:4224

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:6080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0a0be389040ca9844395a4ebe7ccf8b3df2b5a81a304bae8f35fa4d18023b40b
MD5 79aa5b4f7264d6eb94b08809e509dd00
SHA1 d2cb1214c572f2a5d52f7db1f08f2cb87498fa1d
SHA512 642c0b98e6249c2b8eb0f6ca120e2f325faca45314e37a5b464858e92413328775b7b3054444816e26349de22726c72bfee8a460e66b301f6ddd71a4268ef789
SSDEEP 49152:Pb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnsOI5Bh/e44s:N3q6gjBVOUBh2
TLSH
T165D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 375ac9d41ebab2424941f8664b8d1bcfd31f313f29550383b892b1725335eed2
MD5 06dd8b11947658ba81afb204445192e3
SHA1 3fe087178656639f17a7b95a71e17facefed022f
SHA512 d1a3a61965e9d3691c776955a5467f580e1e0cf71fd97036dbd1ef4eb559e5965a18c4c52029605c54197176bb55bd5c8aff5c3dfa7359dd020ac4156d93980f
SSDEEP 24576:UXYZDIczA9xIFIyGibdPgHB/eYvu5s2aC+:dIciOI5Bh/e44s
TLSH
T170050228A3E408F9DD67813CCCB28511E673B8554760EB9F03E49A391F637895E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 3b2dd6f0734c34b535d632c7bf040841f0220171254691e9f9e3728949ebbe37
MD5 04ad93e614f9ce037494b5e97586cf39
SHA1 20b2f49bf77a6e2dc8b16c3616c6d688e00e3f97
SHA512 bf70af4b4938ecd21f01772660cb0d8651026a5cad749790af7e72c878f7f2ddce823636e865eee272ed63f986fa8e7f78990eb1c0b6fc1162f79e2a9ef79f3b
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+Cq7MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxn:uwuuOWHxIFIyGibdPgHB/eYvu5s2aC+
TLSH
T17405F14676E81CF9E9674138C5978536F7F2B8012A21DB1F0760CA6B5F73212BD2EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cf68423659e3f5d38af752187aff8729d7959ba4dfd3b49dd9b6ca19623eb003
MD5 bb34dede0360c858875ee55df5db04e3
SHA1 a92d491f329461b8ecb396900d90c885a5078d68
SHA512 031cb59f1b8586f35875048961c0e158f5054f1eebe6229d4990295962cf6c5088c7d0597a1ddb55657fb242a553f087747b24df8880a9389b97b2201839b42b
SSDEEP 49152:eB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glKGOI5Bh/e44s:ku6JmTxd2dZOUBh2
TLSH
T16CD59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 c50ae2135f474249cec9ee9388b64a413b17c13e98c0706d4c28c2288a2caefe
MD5 bb57c8efa1d5541c1565e4951d117dc1
SHA1 f3ee0699505ee0f23219d6d0b5e3dcfe33b7d124
SHA512 e92792c1b8a03c291857d667f700df152ad615f7119db8bc1bdd549bcbce55ea468b1b484b44c1a7b78c8491271fa9273d08d793949f11f84ac2ea9e74d576cf
SSDEEP 12288:sE7J7MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:ttxIFIyGibdPgHB/eYvu5s2aC+
TLSH
T19DD42342C7BDAD18C578153099F72731A082F5986F02E9DF4B519B7811E2987EC3AB8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 3a32815433dd2f60624ddda71504366f2d87a43e22a055312b0e12ee2eecdde9
MD5 e5f41b86a5b834c66fe0a003d2b4dbf1
SHA1 cba3485555e6c0f89e0989b69cb5729feb2d02c1
SHA512 9b13209aa4ce0541fcfe7554ab88fddb7683cb330a02f2e41924fc36279a9b16b60633fcd7623d24f532d0208599af80433b326f5c2e82461eb3315a3909e695
SSDEEP 24576:Wgb6bmBIi49WNNFpg1rSvFv7bYxxIFIyGibdPgHB/eYvu5s2aC+:Wgb4mBIBhGF0OI5Bh/e44s
TLSH
T1CC659E1E22EC02F5E0F9D2B89DA64417D6B278161732D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 8f8270868b00dbefed46ae70ffc46d04cce2fd8af4104a1cbe86bef001223b48
MD5 0afccad09af11a2eb344a5836b954157
SHA1 907790bfa369e74f3dbdb5fd2c6094bae844a612
SHA512 f956737145dacae3a8b705fe732efa9b771fb860df68b0cf83909fd53c00dcc68f2404ac68c2fbd0f575dc6fe1cfe5a5a853c7b1608db0b8cdd696ed7b1aef84
SSDEEP 12288:fqGr7MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:SGfxIFIyGibdPgHB/eYvu5s2aC+
TLSH
T1D6E4235D51F97894C535863498B22632F0E1F4906B11EAFF06E0DA384BD29D3B93EEC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 e5add183590193cccb91ac5e433bf666e1e5aaf28cf1f8f8f48771c04e17f5cb
MD5 c7cee072febf64c6c085f27f926ad4ac
SHA1 8a15619f99d73787e6e947fdc3712ff8ac06dd49
SHA512 7993277bd9e833707e25f8e8c3225164e6a34a8b6b7adeee8b2c2ae43dd8f08b1e6e9970a40265bf8a0a82306877843f7903825b34b7078e34291ab6098965d6
SSDEEP 12288:sna7MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:s+xIFIyGibdPgHB/eYvu5s2aC+
TLSH
T128D4238182BDAD58C264153099F32B31A0C1F4946F53EEDF06919A3902D69C7BD3FBDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 583623efc707e9ea838e20d448da02dd7463db2e0cad9951edf510bbc6e76e67
MD5 c6f3d3080d3cbb39cd3d36d4707ecd47
SHA1 499018c5ada76b75aa1b8fb651a135d78256bd1e
SHA512 3ecdca3069c474695fe2c4aaf9854bd34c56f6ca15688fe6351107b92ee3e8ffe5bca8a8ea29d2502a6466984adf0e25bde218945455360c6ac009763fe747f7
SSDEEP 24576:HG88u8FpJqH1Qzria7/mCxIFIyGibdPgHB/eYvu5s2aC+:m7ZFPqVva7/POI5Bh/e44s
TLSH
T1F035F165A7E501F0D47BD13889920663F6B2B4251360EFDF07A88B651F23AD64B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 3fe9641559ec33b04dd9f024dbb81f224a1215f05a811522cd7f5672b57b1a07
MD5 daac4dcc5c5b936919ec7479b025b749
SHA1 fd163638bc8fa12fef607eac9a4669a034db1aea
SHA512 ae8f103e002df87c23ada76e5762256f000b64f4e30eae04475c5436598f4149406a4c23a74153daa8d1ee996a38919e6435d5020fe075ab10caccf82bee5e81
SSDEEP 24576:vPUr+NQqxIFIyGibdPgHB/eYvu5s2aC+:vJQqOI5Bh/e44s
TLSH
T13105E11F62ED1CE5E676A13D89924719E272B4621712D6CF02E0817E0F63ED9BC3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 710cd1d9b9530156c4bab6d004a142fd7512e22d6452734341715049e487d08c
MD5 f97b5db03e7917762405539fad31452e
SHA1 b6044dc2a706b91c7d7bee21bf22dbb453c8a9f2
SHA512 56314432e86c1e8567be7c66e7abaa0902d21bcddbbd36b62959dc6b7349b8d424e638f77e9b4a59a2d2b426ca8f216c9086432de723ca2b7cb0868302c8a57d
SSDEEP 49152:9BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjIOI5Bh/e44s:GG05lO43bPOUBh2
TLSH
T15BD5C06A62EC11F8D1BBD17CD9C6460BEBB23415033556CF02A486A91F27FF4A97E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e8d04525f04ac0719858b10052f0c9503eff52130782de8dd3a833eff08d91d1
MD5 af1f8284e36c5fd2a83f8ba75ed2b30c
SHA1 34dd67f8b5734de2160fc208b77ba5dc21ccae4a
SHA512 51dfa02c5ad860bad97488821a295bfa6ba97f64025a791acdaf98d8eb429d867a7298b9372020dda731f0a3adf389da59c333a15c56a51258e9562e77ef0c4b
SSDEEP 24576:cNcwHdjbyQ4nLC18lb/EOjowL7FklxIFIyGibdPgHB/eYvu5s2aC+:cNc/zEOVHFcOI5Bh/e44s
TLSH
T1A0858C1623E901E4E1BBE1BE89779546FAB1786517308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 5458418acfe75e30a73fdfd106dd96f433959b072a5a5b6ea975df4d08949f3f
MD5 95dbde75e15a2b7467d361cc8a5e370a
SHA1 74a4b79d4d887825ba0b68f3d2492c2fe8d3f2ee
SHA512 2f807c2ca6ef65e3eeda6294054a8aed096025c636f03c93156ac176bb29b52096bfb77e04df150e0f413a1eabd1793bc08346fb9baebe9cce0450aeda3be217
SSDEEP 24576:ZJnJPbzB4SoxIFIyGibdPgHB/eYvu5s2aC+:ZJnJv6SoOI5Bh/e44s
TLSH
T17015E13DD2A810E8D4B7C274815A1B6AFE71387C2F2269CB19B4D5343F52ED0A939F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 8164ecb55b1f9364a7b6557ac2d3d0759e40be1e0821c867b3fb1bc708ab5d0e
MD5 33aba97fc75d1507dfa327ef356eb3c8
SHA1 3a3d686518a4dba8d05191ca1375a77d335f1a08
SHA512 b0443f486df65ead77b6cc8a95cd0b233af1b4ee74629be83a3ae8b004053a5f98c811dd1e6c412e1b786b48c231155251748796470e0528de5e0e2658cdd47e
SSDEEP 12288:41HKk5j5ZI7HW7MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:m5DIjKxIFIyGibdPgHB/eYvu5s2aC+
TLSH
T15F05F15D63BA10B5C16B903DC6930612E1B2F4B097129ADF0B94C97D4EE3EC9B93DE81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 23a89d7471c86183093b2f37bdd9751dfa756bd153d45a03849784df56ae4685
MD5 4dd7d41a981e3e98348e4c5d11bcc3be
SHA1 88eb4f90f8eb768e8c2f7959ab868675208fb96a
SHA512 74852e6203a296ccbf9d709a31da1f08e15eaa974bcf61aabe21f1ab367837dda98d8718138c02e5e424b203571c807106325ee6904a96caea550b4fe2862a78
SSDEEP 12288:aG6ky8g7MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:zty9xIFIyGibdPgHB/eYvu5s2aC+
TLSH
T1B0F4120593A86494D67905349AB30271D971FC206B12D7DF06E0EB3E1FB2BC6BC35B96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 1f16a82ab588246582a3b582d4f2f9ac90843978a168157844285e990d3393ea
MD5 f7b1eeb0632cf984e0a16ef6f4eef77e
SHA1 82c09fccf21c1db52817405da23a456a9d2b9c9d
SHA512 d15bcb8e567dd5a702b28cd8bd755a1434d5230becb038720c09df9c7c2c58e441ee748b7890bf2192ad690bfd1a3ef0b91d8e5a91ee7e9928730178fc3b3e82
SSDEEP 12288:/M+7MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:0CxIFIyGibdPgHB/eYvu5s2aC+
TLSH
T1FBD4234982BDB954C514153495B31B32D091F4A42F53EEEF0AE09E3846E69C3BD3AFCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 b7f19566b1a37e05b908d441d14e39cb97882d47c939ee9c57dee04e3a091f24
MD5 286339deef39ada248a475788fe56fb6
SHA1 b4dde0a2bd7737f6f4e0075a28a054929caeb527
SHA512 5c6a2c1f88feec63dfd4697d66573b18582b5b2f04cd63409e1fbccb25d947f84139439e3945c18a6121eca2b14b2fc482bfcf9cc08bb298c64f45d11eaf161a
SSDEEP 24576:3agTioTfaidZcxIFIyGibdPgHB/eYvu5s2aC+:KgDTrZcOI5Bh/e44s
TLSH
T1EC558D1DA3EA05CAE2B2D635D8721493D633B4315772D6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1556-7-0x0000000002FF0000-0x0000000003059000-memory.dmp

Download

memory/1556-1-0x0000000002FF0000-0x0000000003059000-memory.dmp

Download

memory/1556-6-0x0000000002FF0000-0x0000000003059000-memory.dmp

Download

memory/1556-0-0x0000000001600000-0x0000000001755000-memory.dmp

Download

memory/2044-334-0x00007FF77ADD0000-0x00007FF77AE99000-memory.dmp

Download

memory/2044-257-0x00007FF77ADD0000-0x00007FF77AE99000-memory.dmp

Download

memory/2044-258-0x0000015924430000-0x0000015924496000-memory.dmp

Download

memory/2044-259-0x0000015924430000-0x0000015924496000-memory.dmp

Download

memory/2668-277-0x0000021895C00000-0x0000021895C66000-memory.dmp

Download

memory/2668-276-0x0000021895C00000-0x0000021895C66000-memory.dmp

Download

memory/2668-274-0x00007FF769E20000-0x00007FF769F6A000-memory.dmp

Download

memory/2668-354-0x00007FF769E20000-0x00007FF769F6A000-memory.dmp

Download

memory/2848-28-0x0000023AD1800000-0x0000023AD18BA000-memory.dmp

Download

memory/2848-30-0x0000023AD1A00000-0x0000023AD1A66000-memory.dmp

Download

memory/2848-31-0x0000023AD1A00000-0x0000023AD1A66000-memory.dmp

Download

memory/2848-29-0x0000023AD1A00000-0x0000023AD1A66000-memory.dmp

Download

memory/2848-71-0x0000023AD10C0000-0x0000023AD1301000-memory.dmp

Download

memory/3180-325-0x00007FF77ADD0000-0x00007FF77AE99000-memory.dmp

Download

memory/3180-249-0x0000021081FD0000-0x0000021082036000-memory.dmp

Download

memory/3180-248-0x00007FF77ADD0000-0x00007FF77AE99000-memory.dmp

Download

memory/3180-250-0x0000021081FD0000-0x0000021082036000-memory.dmp

Download

memory/3252-351-0x00007FF6903C0000-0x00007FF690555000-memory.dmp

Download

memory/3252-345-0x000001DB38320000-0x000001DB38386000-memory.dmp

Download

memory/3252-347-0x000001DB38320000-0x000001DB38386000-memory.dmp

Download

memory/4196-299-0x00000210AF860000-0x00000210AF8C6000-memory.dmp

Download

memory/4196-300-0x00007FF7AB040000-0x00007FF7AB784000-memory.dmp

Download

memory/4196-298-0x00000210AF860000-0x00000210AF8C6000-memory.dmp

Download

memory/4224-357-0x00000279885C0000-0x0000027988626000-memory.dmp

Download

memory/4224-355-0x00007FF6F0490000-0x00007FF6F07B1000-memory.dmp

Download

memory/4224-356-0x00000279885C0000-0x0000027988626000-memory.dmp

Download

memory/4224-361-0x00000279885C0000-0x0000027988626000-memory.dmp

Download

memory/4224-363-0x00007FF6F0490000-0x00007FF6F07B1000-memory.dmp

Download

memory/4288-16-0x0000023CC71D0000-0x0000023CC7236000-memory.dmp

Download

memory/4288-18-0x0000023CC71D0000-0x0000023CC7236000-memory.dmp

Download

memory/4288-17-0x0000023CC71D0000-0x0000023CC7236000-memory.dmp

Download

memory/4288-15-0x00007FF780E80000-0x00007FF780FA3000-memory.dmp

Download

memory/4288-64-0x00007FF780E80000-0x00007FF780FA3000-memory.dmp

Download

memory/4304-321-0x00007FF6F3C20000-0x00007FF6F4037000-memory.dmp

Download

memory/4304-316-0x0000027D25E10000-0x0000027D25E76000-memory.dmp

Download

memory/4304-317-0x0000027D25E10000-0x0000027D25E76000-memory.dmp

Download

memory/4484-266-0x0000025239370000-0x00000252393D6000-memory.dmp

Download

memory/4484-346-0x00007FF6AC150000-0x00007FF6AC26A000-memory.dmp

Download

memory/4484-265-0x00007FF6AC150000-0x00007FF6AC26A000-memory.dmp

Download

memory/4484-267-0x0000025239370000-0x00000252393D6000-memory.dmp

Download

memory/4632-38-0x00000240DD560000-0x00000240DD5C6000-memory.dmp

Download

memory/4632-40-0x00000240DD560000-0x00000240DD5C6000-memory.dmp

Download

memory/4632-39-0x00000240DD560000-0x00000240DD5C6000-memory.dmp

Download

memory/4632-37-0x00000240DD380000-0x00000240DD43A000-memory.dmp

Download

memory/5476-283-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5476-284-0x0000000000920000-0x0000000000989000-memory.dmp

Download

memory/5476-289-0x0000000000920000-0x0000000000989000-memory.dmp

Download

memory/5476-366-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5484-47-0x0000028259EA0000-0x0000028259F06000-memory.dmp

Download

memory/5484-46-0x00007FF6F08F0000-0x00007FF6F0A58000-memory.dmp

Download

memory/5484-53-0x0000028259EA0000-0x0000028259F06000-memory.dmp

Download

memory/5484-55-0x00007FF6F08F0000-0x00007FF6F0A58000-memory.dmp

Download

memory/5484-48-0x0000028259EA0000-0x0000028259F06000-memory.dmp

Download

memory/5528-60-0x000002691C750000-0x000002691C7B6000-memory.dmp

Download

memory/5528-59-0x000002691C750000-0x000002691C7B6000-memory.dmp

Download

memory/5528-58-0x000002691C540000-0x000002691C5FA000-memory.dmp

Download

memory/5800-328-0x000002464BD00000-0x000002464BD66000-memory.dmp

Download

memory/5800-326-0x00007FF76F1A0000-0x00007FF76F254000-memory.dmp

Download

memory/5800-327-0x000002464BD00000-0x000002464BD66000-memory.dmp

Download

memory/5904-306-0x00007FF628990000-0x00007FF628A3E000-memory.dmp

Download

memory/5904-307-0x000001BA31920000-0x000001BA31986000-memory.dmp

Download

memory/5904-308-0x000001BA31920000-0x000001BA31986000-memory.dmp

Download

memory/6052-337-0x000001724FF60000-0x000001724FFC6000-memory.dmp

Download

memory/6052-338-0x00007FF730FB0000-0x00007FF731396000-memory.dmp

Download

memory/6052-336-0x000001724FF60000-0x000001724FFC6000-memory.dmp

Download

memory/6080-368-0x000001BCFBBD0000-0x000001BCFBC36000-memory.dmp

Download

memory/6080-367-0x000001BCFBBD0000-0x000001BCFBC36000-memory.dmp

Download

memory/6080-372-0x00007FF741040000-0x00007FF7412CB000-memory.dmp

Download