24c4ad1f05400c9a43d3814572e0a91fe15008951bfcc28cd6d385d1da0195e3

Analysis

max time kernel
147s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 11:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_a4e9616576dab47544ff3b0e167980d2_elex_redline-stealer_rhadamanthys_stealc_stop.exe
Size 667KB
Sample260827-nd9ffatdrd
SHA256 24c4ad1f05400c9a43d3814572e0a91fe15008951bfcc28cd6d385d1da0195e3
MD5 a4e9616576dab47544ff3b0e167980d2
SHA1 8382fb3a43ed7f6784f21f3d4d5ef4f5ea38c55a
SHA512 b6ca671e0dd46410cd6ad284d460016222c4cdc05978258715a7d8f171bb42e43512d750b647db133afab051e5b386c2922a1f11cfc652367c181c47950a1e1c
SSDEEP 12288:7YmIjEZsXKLX5g9rEl3dcmecaGsX3KKlGPQFckawqe85xbd5nmyXUrIj3t3xgfe0:ZZMKIrEl3MFDX3KKMQWwqlP+Ij3t3o
TLSH
T15FE423063EA0C436D0D1563457BDE2E1947FBC723A96C607B3580BA75FA1788E71B326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
4684	alg.exe
6068	elevation_service.exe
2816	elevation_service.exe
704	maintenanceservice.exe
4808	OSE.EXE
1652	GameInputSvc.exe
4572	GameInputSvc.exe
4192	msdtc.exe
4360	PerceptionSimulationService.exe
4816	perfhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-27_a4e9616576dab47544ff3b0e167980d2_elex_redline-stealer_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a9fa46035387db0e.bin	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-27_a4e9616576dab47544ff3b0e167980d2_elex_redline-stealer_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_a4e9616576dab47544ff3b0e167980d2_elex_redline-stealer_rhadamanthys_stealc_stop.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4572	GameInputSvc.exe
4572	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4124	2026-08-27_a4e9616576dab47544ff3b0e167980d2_elex_redline-stealer_rhadamanthys_stealc_stop.exe
Token: SeDebugPrivilege	4684	alg.exe
Token: SeDebugPrivilege	4684	alg.exe
Token: SeTakeOwnershipPrivilege	6068	elevation_service.exe
Token: SeTcbPrivilege	1652	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 4572	1652	GameInputSvc.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-08-27_a4e9616576dab47544ff3b0e167980d2_elex_redline-stealer_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_a4e9616576dab47544ff3b0e167980d2_elex_redline-stealer_rhadamanthys_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4124

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4684

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:6068

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2816

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:704

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4808

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4572

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4192

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4360

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4816

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:3024

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:5164

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:4180

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:4264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8a9f1b2c4f5a0c24e9ef2044ff87ca8d3ffd5b0133c38e42df1337cc503d4150
MD5 ae1e10a852e8141be1e088ced80d2008
SHA1 880b4c983332e75043100994ff6d23ddebf8e56f
SHA512 94e7923ef6f66775ef124f0b0c22c2ed4c37d8145591eada388e7b066d5d795627930b2bc14c119839131ffcec00968efe336bf18e54070dd9aff3e0c7bf2ee9
SSDEEP 49152:wb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnrCJKKMQWwq9+e93:a3q6gjBpKLwZe5
TLSH
T13CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 a94396fd1adc7e90336f6d1a6b5f12a5d0bf4cffc990e0a865691729e6aee184
MD5 7e511a3d6b0841048c375bbc00b675fc
SHA1 0a500ead362e53ef951aacefa43ed04120c8d61d
SHA512 eedbd1527a5c758df1fc2daecc856c9396c2531704c3c022e9fdbdc9b95ecf6dea21a1065aab1f1b660f1acd927520130630fa752c5cb6123dc1302f9c8e607c
SSDEEP 24576:dXYTDPczApIrEl3MFDX3KKMQWwqlP+Ij3t3o:YPc6CJKKMQWwq9+e93
TLSH
T16F05012977E008FDEC67823DCDB2D541E673B8A54760E78B03A489661F236C85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 e08f747c566234919641117c0a01f840db4275c1c35aa3c7fedbcd32c8b53610
MD5 3cc5db9e49d7ecff87b9d785ea7a875d
SHA1 8dfe882d335ed18672e7d1ba7295b301e9c83897
SHA512 fedd43667e5637dbea6acef279495897df1013bcf6f39012bc60da1f4ae8aa02e490d3ddbd648e5db896cd2d8701909c44f260491710bb2ea3b9168032d634da
SSDEEP 24576:uwuuOWBIrEl3MFDX3KKMQWwqlP+Ij3t3o:uwVO8CJKKMQWwq9+e93
TLSH
T17F05F14A36A40CF9E4A692398697D136F7F2B8123B21D71F1760C65B5F33251BE2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f47f624eb5479fa8b52ea5988974d3dee2f5f770059aa9ea3f851454d7b159b6
MD5 0f13172b010b4bb4ca1c5c3f7208ebec
SHA1 9340300189e8a689951fce8ce04d6b1239af4112
SHA512 3b263c2eb5bba35004db38b0980d4c3e9c0d17412dd0627f5a11ed45060eea54bf4d8a65e34f84c1f0734633c60c1d40f272d740315921d11fae0c16c2caf138
SSDEEP 49152:uB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl/CJKKMQWwq9+e93:8u6JmTxd2d2KLwZe5
TLSH
T1FED59D13F1DA01E8D06ED178974AA233E962BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 b04bb2d0c829d67e79611448b6c9a6a47458323c6f487ce15e488065b7782c96
MD5 d649c2c5d2bc1d32007536ec5f14bb5c
SHA1 429710aefb9855fcaaafd6e70247a834fc697d7b
SHA512 65f7179f6332752427ed4212c5a8e9237aa7a93d7cc5a441e976ed27053f73500d4e1599a624d38e34fc66f5acc80d20131b1c68b5d8bdb55ffd0576b31c47f6
SSDEEP 12288:sx7jLX5g9rEl3dcmecaGsX3KKlGPQFckawqe85xbd5nmyXUrIj3t3xgfe0:gjIrEl3MFDX3KKMQWwqlP+Ij3t3o
TLSH
T14BD423066EA40C49F0B8673417FFF1D5A05BB8B53F02C38B76180AD66BA18C96F36725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 40293613aa269e2172b932683d26feb821c8baca86f52f090c43b476c6ded19b
MD5 85c5fe2739f46e937b3de9ff73625e34
SHA1 d767b7c9c10a0e13c8de7d5cb08758487c285b46
SHA512 63c021f54925977e0c1b4596e22e79e95c93f12fd592a5fb3fcfaab02e7e1fe2bf03dc7501e70db4bb04d2cba2e75e60278988220416ef8578239bb2da8fb017
SSDEEP 12288:XFGJ/LX5g9rEl3dcmecaGsX3KKlGPQFckawqe85xbd5nmyXUrIj3t3xgfe0:1GpIrEl3MFDX3KKMQWwqlP+Ij3t3o
TLSH
T1CBE4230E3DF41498D07993399AF6B1D6F0B274B03B0553EF16A409B69F618D4733AE60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 d42a64ed8b778666e7c1690bbd2352b67729822b2c0030e67d102fd759fc68b1
MD5 69dbc2dc0184521d4a7055d4a478c9f4
SHA1 a37dbf422c78527cb9788a68ced8b2bbf7ac6a79
SHA512 5df1042d89d8b33e78e23399bf3c6344ff507ea6c01f6d9c9436824f2ed3fca975a4448cbcc273fd09850f16b223feb9b4f0fb609ef05c31c18b5fe707719907
SSDEEP 12288:1XLX5g9rEl3dcmecaGsX3KKlGPQFckawqe85xbd5nmyXUrIj3t3xgfe0:1XIrEl3MFDX3KKMQWwqlP+Ij3t3o
TLSH
T1DED4234A2DA4089DE0B4673A67FBB1C5A096F4B53B4743CB322809D35B928C97737771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 bcbf0802120e8c39fd56e9197e3ef250a7afc8cb7689eb154f5a6e40e7f7228f
MD5 b1cb7cdb8d08e17a1eb8e5e669d6cce6
SHA1 a16dc42764b222e6d02248be0c364e6d2045d7a8
SHA512 5c178dab02622301c50d55a08db4a0baf4028cb7df2f7939ec28931182b2d510653192282dd93132612dd64269f47af9b9b6e3984ea8e780c7810fcba1ed3fcf
SSDEEP 24576:FPUr+NQjiIrEl3MFDX3KKMQWwqlP+Ij3t3o:FJQ8CJKKMQWwq9+e93
TLSH
T15705F11F26E80CE5E576A17D8A969749F272B4621712D3CF02A0417E4F63DD8BD3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 076848b6666987b3126fa6892fd3b8458c0e00061a0f586ddfaae965c005a350
MD5 3b4238d17286c3e1b5bc2716ff0436ab
SHA1 4101b72829610d79a5a3ef49cf9ce4c496f02bc9
SHA512 9e1273ebc1a8bffae8506d56e449a5c3bd4d72f400ee296109510285191ffa9f5ee3f8a46eddbe319f27b4dad871458332ce5f2820f6434c63f1eb4df52355d6
SSDEEP 49152:KBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjDCJKKMQWwq9+e93:1G05lO43bnKLwZe5
TLSH
T1DED5CF6E62EC11F9D0BBD17CDAC6460BEBB23425032556CF02A486A91F27FF4667E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3c86dd0a0678730a2f547a97927cc03af8ea45332cb46a7a338b430d127934ce
MD5 bf5f53e07498a594ace37a684f1135d2
SHA1 a13c0f76a74d3d40e4068c479891bf9e6e680a44
SHA512 0f1f33e4877398bc169ca7400460b5bb8cd8fef32cc3baca2c22943be2f5c85d7efbf4b0c4aa301fc42f4f2d8317f4e8e847df4668ecb9e626540d4622715a8a
SSDEEP 24576:YNcwHdjbyQ4nLC18lb/EOjowL7Fk5IrEl3MFDX3KKMQWwqlP+Ij3t3o:YNc/zEOVHFkCJKKMQWwq9+e93
TLSH
T1CD858C1623E901E4F1BBE1BE89779546FAB17865173086CF0291851B1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 a494cd5f9b36bd28fcb147747bd1a5b06b9bdab96bfff7a7f0cf893f6a86675f
MD5 379414eba1299ce03c6f003054f1703a
SHA1 9e1eae624d2ab6081d4eb83d05bd0e21a39fc252
SHA512 3459465b3378e8de68ad69e2dda5dd9da815bc65005dbf94993926de15096d5be445b3a691d1dd03f9f00709a3502adeb011644cbf081ec77311dffd4822e897
SSDEEP 12288:QYHck6j5ZI7aLX5g9rEl3dcmecaGsX3KKlGPQFckawqe85xbd5nmyXUrIj3t3xgj:d6DI2IrEl3MFDX3KKMQWwqlP+Ij3t3o
TLSH
T17005014D27BA00F9D06BD13E86D30142E1B2B0B197525ACF179485BA5FA3ECCBA39E51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 c6e38c493d82d172a21656ada56f72e7e8e9cc9f98b1bb2ba79c88b694041ba7
MD5 7371188973817eb5fbfd99d292457bfe
SHA1 51229ba31482d1348d6099603d7e72a8eeaea43f
SHA512 d4614c30641a14276820f9be71338cd1b389a776493feb0f9959fe18bf3704e518221f7224561f32d4ec28e6ae5d108cbc23fa5b78cb8370a04d9f33dce9407d
SSDEEP 12288:wG6kypLX5g9rEl3dcmecaGsX3KKlGPQFckawqe85xbd5nmyXUrIj3t3xgfe0:htypIrEl3MFDX3KKMQWwqlP+Ij3t3o
TLSH
T1ADF4120567A414D8E4B953389BF791D5D976BC303B1283CF26A05A7F2F72AC4BA31B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 79d63c552b8f61a321e20c166b09266d7543bad02cd42534a0d9db78b1de8256
MD5 564acbd3237af7aa70e6b9fb5fc552bd
SHA1 7958beee331e1a7d12c2e7acf9d2e8b2362773ee
SHA512 5243593e5bd75b0feae5bb219499744a01fd4ad01bc222b6274c9f0c6dcb77f340d925044ed6c9f5ea75c19ac96add4512007aaf9ffcf1d545dcfd7805d93415
SSDEEP 12288:MgcLX5g9rEl3dcmecaGsX3KKlGPQFckawqe85xbd5nmyXUrIj3t3xgfe0:vcIrEl3MFDX3KKMQWwqlP+Ij3t3o
TLSH
T15FD4234E2DA4089DE0A4677957FBB2C6D0A6B4B53B4743CF36640DF28F528C56736B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/704-47-0x000001FED0F60000-0x000001FED0FC6000-memory.dmp

Download

memory/704-55-0x00007FF727BA0000-0x00007FF727D08000-memory.dmp

Download

memory/704-53-0x000001FED0F60000-0x000001FED0FC6000-memory.dmp

Download

memory/704-48-0x000001FED0F60000-0x000001FED0FC6000-memory.dmp

Download

memory/704-46-0x00007FF727BA0000-0x00007FF727D08000-memory.dmp

Download

memory/1652-237-0x000002BFE0BE0000-0x000002BFE0C46000-memory.dmp

Download

memory/1652-236-0x000002BFE0BE0000-0x000002BFE0C46000-memory.dmp

Download

memory/1652-235-0x00007FF6FB6A0000-0x00007FF6FB769000-memory.dmp

Download

memory/2816-40-0x0000019AFA330000-0x0000019AFA396000-memory.dmp

Download

memory/2816-37-0x0000019AFA100000-0x0000019AFA202000-memory.dmp

Download

memory/2816-39-0x0000019AFA330000-0x0000019AFA396000-memory.dmp

Download

memory/2816-38-0x0000019AFA330000-0x0000019AFA396000-memory.dmp

Download

memory/3024-286-0x0000027F3DC20000-0x0000027F3DC86000-memory.dmp

Download

memory/3024-285-0x0000027F3DC20000-0x0000027F3DC86000-memory.dmp

Download

memory/3024-289-0x00007FF6813E0000-0x00007FF681B24000-memory.dmp

Download

memory/4124-7-0x0000000002350000-0x00000000023B9000-memory.dmp

Download

memory/4124-1-0x0000000002350000-0x00000000023B9000-memory.dmp

Download

memory/4124-0-0x0000000002420000-0x0000000002504000-memory.dmp

Download

memory/4124-6-0x0000000002350000-0x00000000023B9000-memory.dmp

Download

memory/4180-302-0x000001EEBCDE0000-0x000001EEBCE46000-memory.dmp

Download

memory/4180-303-0x00007FF78E0A0000-0x00007FF78E4B7000-memory.dmp

Download

memory/4180-304-0x000001EEBCDE0000-0x000001EEBCE46000-memory.dmp

Download

memory/4192-252-0x00007FF7C7F40000-0x00007FF7C805A000-memory.dmp

Download

memory/4192-253-0x0000021A2AB80000-0x0000021A2ABE6000-memory.dmp

Download

memory/4192-254-0x0000021A2AB80000-0x0000021A2ABE6000-memory.dmp

Download

memory/4264-312-0x00007FF783D70000-0x00007FF783E24000-memory.dmp

Download

memory/4264-313-0x0000019363F90000-0x0000019363FF6000-memory.dmp

Download

memory/4264-314-0x0000019363F90000-0x0000019363FF6000-memory.dmp

Download

memory/4360-264-0x00007FF6EA530000-0x00007FF6EA67A000-memory.dmp

Download

memory/4360-266-0x0000028C7FB90000-0x0000028C7FBF6000-memory.dmp

Download

memory/4360-267-0x0000028C7FB90000-0x0000028C7FBF6000-memory.dmp

Download

memory/4572-244-0x00000204DD3F0000-0x00000204DD456000-memory.dmp

Download

memory/4572-243-0x00007FF6FB6A0000-0x00007FF6FB769000-memory.dmp

Download

memory/4572-246-0x00000204DD3F0000-0x00000204DD456000-memory.dmp

Download

memory/4684-17-0x0000018DFB990000-0x0000018DFB9F6000-memory.dmp

Download

memory/4684-16-0x0000018DFB990000-0x0000018DFB9F6000-memory.dmp

Download

memory/4684-18-0x0000018DFB990000-0x0000018DFB9F6000-memory.dmp

Download

memory/4684-15-0x00007FF67AF10000-0x00007FF67B033000-memory.dmp

Download

memory/4684-64-0x00007FF67AF10000-0x00007FF67B033000-memory.dmp

Download

memory/4808-60-0x0000022B057F0000-0x0000022B05856000-memory.dmp

Download

memory/4808-59-0x0000022B057F0000-0x0000022B05856000-memory.dmp

Download

memory/4808-58-0x0000022B05610000-0x0000022B05712000-memory.dmp

Download

memory/4816-274-0x00000000009A0000-0x0000000000A09000-memory.dmp

Download

memory/4816-279-0x00000000009A0000-0x0000000000A09000-memory.dmp

Download

memory/4816-273-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5164-294-0x000002E0496C0000-0x000002E049726000-memory.dmp

Download

memory/5164-295-0x000002E0496C0000-0x000002E049726000-memory.dmp

Download

memory/5164-293-0x00007FF6FF850000-0x00007FF6FF8FE000-memory.dmp

Download

memory/6068-29-0x000002167F380000-0x000002167F3E6000-memory.dmp

Download

memory/6068-28-0x000002167F440000-0x000002167F542000-memory.dmp

Download

memory/6068-31-0x000002167F380000-0x000002167F3E6000-memory.dmp

Download

memory/6068-30-0x000002167F380000-0x000002167F3E6000-memory.dmp

Download