e068b341b16bd4b30eea58c33aa4a29f0ae5c5bb94de06bcfe270d3920bd8704

Analysis

max time kernel
147s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_033db96fd10f525041e673671f7fac67_elex_glassworm_mafia_remcos.exe
Size 1.2MB
Sample260830-2dgmbattdx
SHA256 e068b341b16bd4b30eea58c33aa4a29f0ae5c5bb94de06bcfe270d3920bd8704
MD5 033db96fd10f525041e673671f7fac67
SHA1 133da49e1969789237becf7f01eeed3a7f70b69c
SHA512 38c05801131dea3867658240020a20cc72dd36094aa0c4dbd6ce7b63e5da0362f45e4dcad9fab3a5d87f303572b649e311060688f58418e77d3c968303fce1f3
SSDEEP 24576:YhfDc6X3lQMnxr4cQFTj0OZeVJ2zZOfPg/DewiBO3Mh4UhCJxtv4oO:Tul1nqcQFTIOZecOHg6POXxVo
TLSH
T1DB45E02EBAF1C032C12351319D6AE358A1B5F47188260487BBDD671D2FB15D39B39BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
4448	alg.exe
1240	elevation_service.exe
5464	elevation_service.exe
2564	maintenanceservice.exe
4376	OSE.EXE
5620	GameInputSvc.exe
3816	GameInputSvc.exe
4632	msdtc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-30_033db96fd10f525041e673671f7fac67_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fe04d8b05387db0e.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-30_033db96fd10f525041e673671f7fac67_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113265\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_033db96fd10f525041e673671f7fac67_elex_glassworm_mafia_remcos.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3816	GameInputSvc.exe
3816	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5016	2026-08-30_033db96fd10f525041e673671f7fac67_elex_glassworm_mafia_remcos.exe
Token: SeDebugPrivilege	4448	alg.exe
Token: SeDebugPrivilege	4448	alg.exe
Token: SeTakeOwnershipPrivilege	1240	elevation_service.exe
Token: SeTcbPrivilege	5620	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5620 wrote to memory of 3816	5620	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-30_033db96fd10f525041e673671f7fac67_elex_glassworm_mafia_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_033db96fd10f525041e673671f7fac67_elex_glassworm_mafia_remcos.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5016

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4448

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1240

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5464

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2564

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4376

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5620
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3816

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
PID:4632

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
PID:1692

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:1572

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:2172

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:3040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 65211c58783bbf5a00fd3ee6b1d340f2ca8d598ca44b5547196953c5a8ca4563
MD5 b6d30be0bc27b1c76dfae50ab6e9f714
SHA1 7bf4d2d4a270a1981dd2b6fbf0208e4715342a57
SHA512 e163178dde79c50f3727caa28555c541aa5c577100f9922e785b6f9f403d42e8896136e3bd7ce55fbd226241696535021e26dcc1d117f9c3b2f9ae29db142f62
SSDEEP 49152:4qm632BuPkFKRrdE6oh7stBhuXjfS4LWxnHOHg6POXxVo:v3q6gjBJA6Wr
TLSH
T1DFD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 8d32fe43817cafd59e20acba44c2a559851343342967b62a75be77de053152d0
MD5 b6f70a93f8aab6a7a871963706df988c
SHA1 19ff3b3f3c3c0069ecec2ec6e7e03c444192fd30
SHA512 de91451d77ba3e8783f18b193132499e567efc2e801c271770e0f012537f96c03c004bf31718a0ecc6ec08f040df6c7a5d405e6b879d712172856c79fb37710a
SSDEEP 24576:SXYyDSczACzZOfPg/DewiBO3Mh4UhCJxtv4oO:OScVOHg6POXxVo
TLSH
T17C05F128A7E109F9ED67813DCDB28501DA73B8158770E7DB03E496660E237C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 8b63c4a421c2197ce1e25ee61ae446a3cb8aef18b04c47a15b257786a25bacfa
MD5 108b3074b64d2ccf04a5d93b57ece686
SHA1 c57d9f2ba840f4ac315c4b256ccde5b1e54f1645
SHA512 1e64054669845943e37dc8faf424296c1e2e0d85631da0d1d8559639ae2d25b3b31189956bddd87cb3c5830bb77b2f49b34a6bb16b78810ad57bf4c4c782235e
SSDEEP 24576:uwuuOWmzZOfPg/DewiBO3Mh4UhCJxtv4oO:uwVO/OHg6POXxVo
TLSH
T17A05F14966A41CF9EA67853986A78136E7F3B8112A31D71F13A0C35B5F33351AE3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 455c247ccedd419d41ea049262c8eb2896328253221772f473da4b7352a340b4
MD5 756fccc7fdbfe15e079b76267f15bfc2
SHA1 fdfabdaa7e6c8588dc2aacbad2ce5a3b936669b8
SHA512 1674d06e558679b6714243c707b3fff3af2861ba2f454b32503253861bc7c65c7c6fff21d161f8d608a8a5c12ae71292d9e08c48adb99653156abfd486f5a2fd
SSDEEP 49152:95+taZ3usBWOBr4tEGp0bqx0z+n217aau1glhOHg6POXxVo:nu6JmTxd2dwA6Wr
TLSH
T1DDD5AE13F1DA01E8D06ED479974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 19eb796912569020c05e907f996aa88e8560e277506035388a4eedf5a2760827
MD5 c6a88dff61fdccd1d3eddf5b5d8bbd43
SHA1 894e524de1998f44724a487f2adc343691be007d
SHA512 f1ada10390d651aeb5447b7081d7f8b0fc5f987e0f693c6d02dc658fcf54e00b678b4a2639ea9ee5e199010a7c025fe568e7b34743e62a47ee833412ebc397b6
SSDEEP 12288:s77UzZOX0MDIyg/wUewNoBO3Mh4UcYxgJxjJwy4odphNW:WUzZOfPg/DewiBO3Mh4UhCJxtv4oO
TLSH
T124D423688692A746F727A83349FD6214C4AFF538CE3062C3F25863670472EC59E7A347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 6a445dee21b040aadad392c5108f83dbb218777018c48e541c826fa59b7791b4
MD5 eff116a82fd278293c8b415998f2656f
SHA1 64f3c95baa3f409cdbe3042851f4de29d84f0e2c
SHA512 61b771c2795249354d142c55c8462ac4bc43473ed998043e88181153fcc62467326e479c4b7093706f1731581039f08eb20d3950549c0aeb82750f0379badf13
SSDEEP 12288:dwGszZOX0MDIyg/wUewNoBO3Mh4UcYxgJxjJwy4odphNW:GGszZOfPg/DewiBO3Mh4UhCJxtv4oO
TLSH
T10AE4227C55F27299D637C63B88F86511E4B3F0349B3022EF41E4A2764962AD0AE3DF85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 a71d9189167cab05665595fab6040a2b905853cab40d481bdc48e96beb2a4902
MD5 2b6adce64fc5f632d15eee325864e011
SHA1 8be6737a71676006a501931705d1a58c4ee2b1f5
SHA512 f74747b24756f874d2161bc83d2d8c7536131e5611873193e27ac8f96b6600177872c55188ee246a832018194084ed321634657268e7d2faabca8cc2303749c4
SSDEEP 12288:7KzZOX0MDIyg/wUewNoBO3Mh4UcYxgJxjJwy4odphNW:7KzZOfPg/DewiBO3Mh4UhCJxtv4oO
TLSH
T1A0D423AC85929396E713DC3749F97504C4ABF438DB3523D3B158726304A3EC69E7A392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 c564ea8cb734ddddcf8c5f314c99d56b96d642035fbf22a08d4984b0c82c9860
MD5 b8474680ecec4a812268c0184d2f00da
SHA1 8ac902a7d44dc113bb1fd51e32cc622bd0aa079f
SHA512 0279e10832cba0b46a3bb1f6fbf341aa9d280ae25f7233d05736fbb224c03fd2502a4f3f7436c90b6d2aa8aa86b6d8236948d35e56ab599f2fb021678f3551db
SSDEEP 24576:8PUr+NQkzZOfPg/DewiBO3Mh4UhCJxtv4oO:8JQ6OHg6POXxVo
TLSH
T16F05F12F66E918E5F676E17D89964709E772B422471292CF02E0817F0E63ED8BD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 e1a14742e4010324e5201adb2b39d60b32af7f1812f4742e55c7edc811047ef7
MD5 a2f1963fc4f5682d517439abd7dbf758
SHA1 722e603c09a7c3580f9a8f440dd80a1d31f711bc
SHA512 5cf998e8da4c97b868495953a6066c3820c5385f51a9b3bb1aa3b2f941e48f09a58b37df7a55dda93cca9c88b1dc14538f82f3eb10441e71f9dc4a0ee2829387
SSDEEP 49152:LBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj7OHg6POXxVo:UG05lO43bXA6Wr
TLSH
T118D5C06E62EC11F9D1BBD17CDAC6460BEBB23425033556CB02A486A91F23FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 def8193f6ab29e70d86bd66aceafb6610077b9de65c606d7c5b110ea3e2fa077
MD5 1b5285a44c1c4beefe47cb99a43afa9f
SHA1 4c02da586213db33b4f7834bb6d0f38971e28918
SHA512 29f9844ced398b9d781d4394ef6fa065ed28f7435466639182a53ea40654ecc329a3929865a0323f6234efb376888aa230d6838d26bd47d4e6260dba1b3c6f66
SSDEEP 24576:46DITSzZOfPg/DewiBO3Mh4UhCJxtv4oO:46DI8OHg6POXxVo
TLSH
T1B105F15C63B611FAE267D03E86D20501D1B2F434C72226DF56D8D5BA4EA3EC8BD3DA81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 863908f5492eea2d442b6fec085bfcd36ce55b2252a68cb8ba0b9f9ad5221f36
MD5 4b81e03ce06f8b55dfeddd74f9bdb810
SHA1 79923bae4b98ced4196ad09b1147d8e635f2b2d7
SHA512 36c9d12fc4b7ed6c55c3131c73a9d95be51f17e78c1a1d83696628fe881d3a47ad5b76c87d38eb4fcc68342a28312f944bbe5e6867d2ad97df1f4f0ab80b50ad
SSDEEP 12288:LG6ky6zZOX0MDIyg/wUewNoBO3Mh4UcYxgJxjJwy4odphNW:qty6zZOfPg/DewiBO3Mh4UhCJxtv4oO
TLSH
T1A0F412489390A2D5EB7655398AB65210CA7AFC349B3163DF62D0E33F0E32BC4AD35752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1240-29-0x000001DE9AC40000-0x000001DE9ACA6000-memory.dmp

Download

memory/1240-28-0x000001DE9AA00000-0x000001DE9AB1C000-memory.dmp

Download

memory/1240-31-0x000001DE9AC40000-0x000001DE9ACA6000-memory.dmp

Download

memory/1572-273-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/1572-274-0x0000000000980000-0x00000000009E9000-memory.dmp

Download

memory/1572-279-0x0000000000980000-0x00000000009E9000-memory.dmp

Download

memory/1692-267-0x000002827B280000-0x000002827B2E6000-memory.dmp

Download

memory/1692-264-0x00007FF755040000-0x00007FF75518A000-memory.dmp

Download

memory/1692-266-0x000002827B280000-0x000002827B2E6000-memory.dmp

Download

memory/2172-285-0x00007FF7A1DC0000-0x00007FF7A2504000-memory.dmp

Download

memory/2172-288-0x000002473A5E0000-0x000002473A646000-memory.dmp

Download

memory/2172-286-0x000002473A5E0000-0x000002473A646000-memory.dmp

Download

memory/2564-47-0x000001EB3B990000-0x000001EB3B9F6000-memory.dmp

Download

memory/2564-48-0x000001EB3B990000-0x000001EB3B9F6000-memory.dmp

Download

memory/2564-46-0x00007FF6705F0000-0x00007FF670758000-memory.dmp

Download

memory/2564-55-0x00007FF6705F0000-0x00007FF670758000-memory.dmp

Download

memory/2564-53-0x000001EB3B990000-0x000001EB3B9F6000-memory.dmp

Download

memory/3040-293-0x00007FF649A80000-0x00007FF649B2E000-memory.dmp

Download

memory/3040-294-0x0000021662300000-0x0000021662366000-memory.dmp

Download

memory/3040-295-0x0000021662300000-0x0000021662366000-memory.dmp

Download

memory/3816-246-0x0000016E015B0000-0x0000016E01616000-memory.dmp

Download

memory/3816-245-0x0000016E015B0000-0x0000016E01616000-memory.dmp

Download

memory/3816-244-0x00007FF6AD490000-0x00007FF6AD559000-memory.dmp

Download

memory/4376-60-0x000001F0C93C0000-0x000001F0C9426000-memory.dmp

Download

memory/4376-59-0x000001F0C93C0000-0x000001F0C9426000-memory.dmp

Download

memory/4376-58-0x000001F0C9460000-0x000001F0C957C000-memory.dmp

Download

memory/4448-64-0x00007FF623350000-0x00007FF623473000-memory.dmp

Download

memory/4448-17-0x000001E67ADC0000-0x000001E67AE26000-memory.dmp

Download

memory/4448-15-0x00007FF623350000-0x00007FF623473000-memory.dmp

Download

memory/4448-16-0x000001E67ADC0000-0x000001E67AE26000-memory.dmp

Download

memory/4448-18-0x000001E67ADC0000-0x000001E67AE26000-memory.dmp

Download

memory/4632-253-0x0000020A529A0000-0x0000020A52A06000-memory.dmp

Download

memory/4632-252-0x00007FF7D6740000-0x00007FF7D685A000-memory.dmp

Download

memory/4632-254-0x0000020A529A0000-0x0000020A52A06000-memory.dmp

Download

memory/5016-1-0x0000000002BB0000-0x0000000002C19000-memory.dmp

Download

memory/5016-6-0x0000000002BB0000-0x0000000002C19000-memory.dmp

Download

memory/5016-7-0x0000000002BB0000-0x0000000002C19000-memory.dmp

Download

memory/5016-0-0x0000000002940000-0x00000000029E5000-memory.dmp

Download

memory/5464-40-0x000002DE06320000-0x000002DE06386000-memory.dmp

Download

memory/5464-37-0x000002DE060E0000-0x000002DE061FC000-memory.dmp

Download

memory/5464-38-0x000002DE06320000-0x000002DE06386000-memory.dmp

Download

memory/5464-39-0x000002DE06320000-0x000002DE06386000-memory.dmp

Download

memory/5620-235-0x00007FF6AD490000-0x00007FF6AD559000-memory.dmp

Download

memory/5620-237-0x000001FF63770000-0x000001FF637D6000-memory.dmp

Download

memory/5620-236-0x000001FF63770000-0x000001FF637D6000-memory.dmp

Download