1375759fcb3ec91dcbec4fdf4679b012ad321d430eea0705636247109f356e6f

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 23:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_9493536922acee7a94cacbbe586063b2_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Size 770KB
Sample260818-3bf4fabh86
SHA256 1375759fcb3ec91dcbec4fdf4679b012ad321d430eea0705636247109f356e6f
MD5 9493536922acee7a94cacbbe586063b2
SHA1 4713e34d2acfb2f21fe2d0306c3c053b988f87c8
SHA512 a71c054c680f5d158285d4870bf67b45c280e1d47ef4bbdb12e2ebbb3cef0e188633fbe249ee361971d29b6b4215a4de424d2685a2f090dc72c4a3a6660de616
SSDEEP 24576:Sd60dmCyLTeWaD4+11xxRXd9BTCEggAEGS:S30CyTjaD4+DXDb
TLSH
T12FF41271A281D072DA3720B185A8DEB049B97C3E59B0101F3BD939791E727F0865EB9F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
4548	alg.exe
5072	elevation_service.exe
1988	elevation_service.exe
1108	maintenanceservice.exe
4604	OSE.EXE
1700	GameInputSvc.exe
5936	GameInputSvc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-18_9493536922acee7a94cacbbe586063b2_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\dadefae5e62f061e.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-18_9493536922acee7a94cacbbe586063b2_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_9493536922acee7a94cacbbe586063b2_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe

Modifies data under HKEY_USERS 33 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4692	2026-08-18_9493536922acee7a94cacbbe586063b2_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Token: SeDebugPrivilege	4548	alg.exe
Token: SeDebugPrivilege	4548	alg.exe
Token: SeTakeOwnershipPrivilege	5072	elevation_service.exe
Token: SeTcbPrivilege	1700	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 5936	1700	GameInputSvc.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-08-18_9493536922acee7a94cacbbe586063b2_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_9493536922acee7a94cacbbe586063b2_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4692

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4548

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5072

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1988

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1108

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4604

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:5936

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
PID:4712

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
PID:4340

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:1540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3aa8d67981eda24e69062cfddffc6103a033882a111bbc6ff793dc1f6ddb9bfe
MD5 9799df2240c205805a971ab87137c957
SHA1 ba88f3ef7a49cb12a1dddd28f1c10f1851ab3f11
SHA512 a5d842c93ff2cdaab4687752734ffe9ac55d9f156331f7294e302d9366a7c92b8ed350e1f4a3365960931a3b2754213580ae30688dd2897600dab6d4dd52333e
SSDEEP 49152:c4a632BuPkFKRrdE6oh7stBhuXjfS4LWxnsaD4+DXDb:F3q6gjB1aBDX
TLSH
T10ED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 dee6547741d5a76d1839d1b14425088b98477f33ecf039892cd05fcbeab4ff7f
MD5 37957baad209f5ad0768a014e8ed9ae9
SHA1 39a8ee3bf0a58fa608ef655268963234e2ef05a6
SHA512 81ba617236cbfdbd0c5105b7eaba8cf236864fa370feea8a28230156fc1f810faaa7dceba2e1b6bb336e6b0bb544cd0c997a286d07975084c088a6cf2ef83167
SSDEEP 24576:RXYhD3czAVaD4+11xxRXd9BTCEggAEGS:q3cyaD4+DXDb
TLSH
T119050138A3E104F9ED67927CCCA28511E672B85547A0F76B03A489252F337E85E3FB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 548ae9133e359e5bb204bb782fb9b4bace6ea4547365d310dd2f42c87c93907a
MD5 c08b310f50b8e9c439fcd802a7c0e74a
SHA1 9e365d794343aafb09c231a4003b559ccc4731dd
SHA512 af44e488eed4264666ace0e90ac46dd6d012f37f3dcb06b99af17391b33b97570f188736cc34582b37f91af7a1104ad1e858562d9bc5c69a320e4e3203c0a611
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+CYSp/xLS7D4+1ubWFLNEkRLyDKlfPFBUsKLNEg+Q60e:uwuuOWbgaD4+11xxRXd9BTCEggAEGS
TLSH
T17F05014673A508F9EA639238C557D135F7F2B8112A21D72F0760C65B6F37361AE2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3ebc2e7786781820c6251566053bbed9bab8a3ee5a89c9c099d5d316ad987226
MD5 6db0056d2ea775c0e88e8df072720936
SHA1 f47911a10c812e3538b5fecfa9ebb64c303259b5
SHA512 1dabd60f00ec5783e015d9ac45a3d49931e109b1d676aab544d1d8f1caa4477bfdd1a007b771790731db56df3a6bc19f7bcce5f95c53ccd5ad52b1a8db46c956
SSDEEP 49152:qN+taZ3usBWOBr4tEGp0bqx0z+n217aau1glTaD4+DXDb:Iu6JmTxd2dTaBDX
TLSH
T108D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 8b1702c3eeac481ee58843f3d296a944896f20de4e707940f752d05ab4054c84
MD5 6856b4f976b56558ff44553e5f60c21d
SHA1 cbc13d50cb35ac98cc7dbe4cfc34ebcd49757d41
SHA512 a904b0aec44378b488b242efe31bf1da8d0ab16b7e03ad82926f74d4d999d5040a9dd46ae19036ebf57470c1ffbf99b72351c093c2a375fa283ef8325413d6dd
SSDEEP 12288:s777p/xLS7D4+1ubWFLNEkRLyDKlfPFBUsKLNEg+Q60poJfGS:C1aD4+11xxRXd9BTCEggAEGS
TLSH
T162D42372875B5143FF3672F0A459A2A4D178A6398BA03537AE0601447478FF0CFA7B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 6ae8aa4e0e9887919716efd27d97b046742441200a8f1f6d3944cbbd0bf8b1d0
MD5 b411c9d8fcd8ea75bede9ac80453d269
SHA1 d702b554b80bfcc43718be9aa1002d91d660c96b
SHA512 17ffc5897e7271f6830fd4d04c55b876b57987b62f2ff585b32ec6fd70bfbdbce2c20b4fc780aa8a89565654fb2d4378bada968794edc3a0a53b0475989b91df
SSDEEP 12288:w8GTp/xLS7D4+1ubWFLNEkRLyDKlfPFBUsKLNEg+Q60poJfGS:VGNaD4+11xxRXd9BTCEggAEGS
TLSH
T1BDE4227953A73091CE36A3B5D86462E6F0B03570476435FF4E818131AB68BF0AB3EE19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 1e90ecf53d21279b401593b075de4f3b89b0e96834b30773b0d4d1a027ef890e
MD5 e9834e7ca2987cb7188de9ab780e4d0e
SHA1 7519c7fe318ab78fd255bc0ecc7150676b9461e9
SHA512 ed5d7714acb345ca9bf468ac3e743e996223b63857d5909131ac5d71a2ba216c443c4d9726aa9481ea6ec074bb5ca589a21b862e4c6f0fe04e52f7ed35c9b8b3
SSDEEP 12288:WHvUrBFrEjwaQGp/xLS7D4+1ubWFLNEkRLyDKlfPFBUsKLNEg+Q60poJfGS:WPUr+NQUaD4+11xxRXd9BTCEggAEGS
TLSH
T1B605F12F23AD18E5E676F17D89824709E771B4620311A2DF0291817E5F67EE8BD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 fa5494653880d50bf1b0090c00fc05d807a9574b72e7ddfd003cf0cf73ad4b83
MD5 c6dc364c003508b92fc3c2aa53b89b2b
SHA1 e5b8a099e80c28411f54509a0c7215fb2a2a7081
SHA512 5b3d49b6410d7f7ddb68e2a4e86a8bfc486ab372decedbf4fc5d04b7e60c2c64066fe961d055a97403496cd985f5fcf04e188bc05a32d8022b446a0ea9921dde
SSDEEP 12288:i1Hvk6j5ZI7Yp/xLS7D4+1ubWFLNEkRLyDKlfPFBUsKLNEg+Q60poJfGS:v6DISaD4+11xxRXd9BTCEggAEGS
TLSH
T15D05016D237A10F6D177E07EC5830542D2B1B07187622AEF0B94C5795EA3EE8BA3DE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 bbf85d191415272d2b25206c6c703df186616b75d53415e015efb1bacb63d68a
MD5 c21534eebd666a6b11c3500fa1cacb7a
SHA1 0b55ab57e74939e14d79ffea3732b16f0bd1cef6
SHA512 b9aac859f89156faa2cadf6374a7b45812020a3f4c361c19f270857996da02961a9ca2a248b5e9892ebb804dad92a97a7f72314353403e4413c2c33e4ea1557a
SSDEEP 12288:aG6kyCRp/xLS7D4+1ubWFLNEkRLyDKlfPFBUsKLNEg+Q60poJfGS:ztyCDaD4+11xxRXd9BTCEggAEGS
TLSH
T14CF4221153956081EF7622B8D96292D0CA70BC205B6123FF5A81963E3F35BF0AE72F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1108-54-0x000001DB44D20000-0x000001DB44D86000-memory.dmp

Download

memory/1108-56-0x00007FF784550000-0x00007FF7846B8000-memory.dmp

Download

memory/1108-47-0x00007FF784550000-0x00007FF7846B8000-memory.dmp

Download

memory/1108-48-0x000001DB44D20000-0x000001DB44D86000-memory.dmp

Download

memory/1108-49-0x000001DB44D20000-0x000001DB44D86000-memory.dmp

Download

memory/1540-275-0x0000000000940000-0x00000000009A9000-memory.dmp

Download

memory/1540-274-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/1540-280-0x0000000000940000-0x00000000009A9000-memory.dmp

Download

memory/1700-236-0x00007FF6579D0000-0x00007FF657A99000-memory.dmp

Download

memory/1700-238-0x000001B08D3B0000-0x000001B08D416000-memory.dmp

Download

memory/1700-237-0x000001B08D3B0000-0x000001B08D416000-memory.dmp

Download

memory/1988-40-0x000001D825250000-0x000001D8252B6000-memory.dmp

Download

memory/1988-41-0x000001D825250000-0x000001D8252B6000-memory.dmp

Download

memory/1988-39-0x000001D825250000-0x000001D8252B6000-memory.dmp

Download

memory/1988-38-0x000001D825000000-0x000001D825177000-memory.dmp

Download

memory/4340-267-0x0000026D82CF0000-0x0000026D82D56000-memory.dmp

Download

memory/4340-265-0x00007FF791800000-0x00007FF79194A000-memory.dmp

Download

memory/4340-268-0x0000026D82CF0000-0x0000026D82D56000-memory.dmp

Download

memory/4548-16-0x000001C382410000-0x000001C382476000-memory.dmp

Download

memory/4548-15-0x00007FF7F4B90000-0x00007FF7F4CB3000-memory.dmp

Download

memory/4548-18-0x000001C382410000-0x000001C382476000-memory.dmp

Download

memory/4548-65-0x00007FF7F4B90000-0x00007FF7F4CB3000-memory.dmp

Download

memory/4548-17-0x000001C382410000-0x000001C382476000-memory.dmp

Download

memory/4604-59-0x000001B6D74F0000-0x000001B6D7667000-memory.dmp

Download

memory/4604-61-0x000001B6D7790000-0x000001B6D77F6000-memory.dmp

Download

memory/4604-60-0x000001B6D7790000-0x000001B6D77F6000-memory.dmp

Download

memory/4692-26-0x0000000000400000-0x000000000052C000-memory.dmp

Download

memory/4692-0-0x0000000000400000-0x000000000052C000-memory.dmp

Download

memory/4692-7-0x0000000002F50000-0x0000000002FB9000-memory.dmp

Download

memory/4692-1-0x0000000002F50000-0x0000000002FB9000-memory.dmp

Download

memory/4712-255-0x0000022BF8830000-0x0000022BF8896000-memory.dmp

Download

memory/4712-254-0x0000022BF8830000-0x0000022BF8896000-memory.dmp

Download

memory/4712-253-0x00007FF76F9F0000-0x00007FF76FB0A000-memory.dmp

Download

memory/5072-30-0x000001BBE2DD0000-0x000001BBE2E36000-memory.dmp

Download

memory/5072-29-0x000001BBE2B80000-0x000001BBE2CF7000-memory.dmp

Download

memory/5072-32-0x000001BBE2DD0000-0x000001BBE2E36000-memory.dmp

Download

memory/5072-31-0x000001BBE2DD0000-0x000001BBE2E36000-memory.dmp

Download

memory/5936-245-0x00007FF6579D0000-0x00007FF657A99000-memory.dmp

Download

memory/5936-247-0x00000213C0C10000-0x00000213C0C76000-memory.dmp

Download

memory/5936-246-0x00000213C0C10000-0x00000213C0C76000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads