80e0619048f6cbd8c72479feb65b66c3b3efd45483f9264d1f106ed1a6fc950a

Analysis

max time kernel
146s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 11:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_4f19cd46543993a5ed1a743f1ab8a40b_amadey_elex_mafia_remcos.exe
Size 999KB
Sample260905-m9fbssdd74
SHA256 80e0619048f6cbd8c72479feb65b66c3b3efd45483f9264d1f106ed1a6fc950a
MD5 4f19cd46543993a5ed1a743f1ab8a40b
SHA1 a33c6317a1b512a20803af376ff40dd3eaa70992
SHA512 ecd0a367e73b7b9798a63dd1b98466b166414d491669e756bd3e1f7b7bca85cdecedc7109af664d8ee79a2cab93f74ab4966439a919c36bc0ff9e0193168ed76
SSDEEP 24576:BNEHd0EKpxtJFtAYYFK89TMFZ2qrTjuBSHsu2UhowloNLQWozSk:BNEHJKrtJFPWK89TMn243Jsu2UCSoN07
TLSH
T1AD25F116B784D037C533023A8E55E7A865B9F5B089214107B7F8AF7E7E701C2EA39B46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
3704	alg.exe
5052	elevation_service.exe
3972	elevation_service.exe
2932	maintenanceservice.exe
2444	OSE.EXE
4820	GameInputSvc.exe
4936	GameInputSvc.exe
6064	msdtc.exe
4980	PerceptionSimulationService.exe
2388	perfhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-04_4f19cd46543993a5ed1a743f1ab8a40b_amadey_elex_mafia_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\42dbaf4ee62f061e.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-04_4f19cd46543993a5ed1a743f1ab8a40b_amadey_elex_mafia_remcos.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_4f19cd46543993a5ed1a743f1ab8a40b_amadey_elex_mafia_remcos.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4936	GameInputSvc.exe
4936	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4980	2026-09-04_4f19cd46543993a5ed1a743f1ab8a40b_amadey_elex_mafia_remcos.exe
Token: SeDebugPrivilege	3704	alg.exe
Token: SeDebugPrivilege	3704	alg.exe
Token: SeTakeOwnershipPrivilege	5052	elevation_service.exe
Token: SeTcbPrivilege	4820	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 4936	4820	GameInputSvc.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-09-04_4f19cd46543993a5ed1a743f1ab8a40b_amadey_elex_mafia_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_4f19cd46543993a5ed1a743f1ab8a40b_amadey_elex_mafia_remcos.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4980

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3704

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3972

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2932

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2444

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4936

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:6064

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4980

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2388

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:2692

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:5092

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:4160

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:4556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0f7a0d7d85c44c1dfcf8dde718e0eaccb58127f7a0792d50a94a32c696a7aaad
MD5 d598dc290b0b408294e37c55d7b14c5d
SHA1 dff2cc88504ce23e56d28d116f5604e7207fd250
SHA512 bbf900b4028ff0cabbc11e68e7b982541bda429d13908dfd694dbc04878ed2d95effc020274c59c810c604ef6a58fe95dcff03ac9559170e501474e9687a6ed9
SSDEEP 49152:Lb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnqJsu2UCSoN0vzSk:Z3q6gjB1JH287
TLSH
T1E9D59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 8e6919c06ba9cf32499030d4b75c12a891a5e6323c9731152e539a79116d9a55
MD5 30ffbd2fb90b146fdba4d94f7b11ca40
SHA1 85626550ddbd3fa016b61a45f754b87fc1798699
SHA512 89032a230376ac22aa89de2a516736992cf6dcfc40e7d5cb45b66930323ca8aca01eb46caa09f7bff28663d5a161b0dfa102cb2e69b075f1356d12cd47802325
SSDEEP 12288:P1XLsgSgsxy2lRq2czASjFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWjS:tXYdJtczASjuBSHsu2UhowloNLQWozSk
TLSH
T13A05F129B3E409F9ED67813DC9B19511E773B89143A4E78B03F4992A1F232C85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 767415062443407885b0741fb2dc86a7c4d95c5ac0fac865cc1d93670bc23ebf
MD5 01a3472456568c86c3cfd9671e57d2f9
SHA1 baab06adf37bcb293c9079a6588d4d2fbb7a7d28
SHA512 24ec61411909668534fa4cb5c2fc548d97089d096480cd622251a7db134874c1c383677945d743c215d240b8e5e40c7a53a38a6e965f92c73768c40fa545fb27
SSDEEP 12288:5mw5HEjsChNhBFgl0WDm+CgjFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3b:Uwu8OWdjuBSHsu2UhowloNLQWozS
TLSH
T1E805F14A72E40CF9E967413D86A79536E7B2B8512725D71F03B0C61B6F33251BE2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bfe60cfc4c0404c3fe9a04d7b8c7d17ba04f651d0d71a1c191758525b1a26ed6
MD5 c352c0524eef328703c7910711abb098
SHA1 b4b025e389d03b027d46a403edf54ac835765cf9
SHA512 cf1d2c631588b0782e4e4239066b0c33ce63d045f8d80389defc5304f6723a8ac1ed3c46916cc0c89fa1c3b5e84b00c865c34eced4da20fc9a8e6629eb0bb3d3
SSDEEP 49152:QB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gldJsu2UCSoN0vzSk:Ku6JmTxd2ddJH287
TLSH
T131D59D13F1D901E8D06ED478974AA233EA62BC490B35B6DF0B9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 66f245b4688486dc1e24145f579075e61e6fb376c883be2a5469db447dfbc3a1
MD5 f4212cafdab7efd7d227f05de9b02ded
SHA1 b55fab82b0db1c95fa18cce8763315aa982bb840
SHA512 a75ced55c613b47dcda39bcb1c7e58d747cdcbbde8cdd88fab6abc0f7a19606a3189705082086d746b23d4540b5ecc98b7620ebc9eed3fd9d64b75084b411f15
SSDEEP 12288:6n7xjFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5AlC:8xjuBSHsu2UhowloNLQWozSk
TLSH
T1E9D42367E3A8872AED65153E15F874711319B1E05795A347A3B1FA0F20320CCEE7BB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 656KB
SHA256 57b08fa8ac0624ad880cb78fff992769472c5c33b3d90513fc46d21f1fc63ded
MD5 1368c364ba93cf4e7788335cbf8b07ea
SHA1 66654ffc1c4c1b8bfb205b020c4c1fd6135abefb
SHA512 9efc593e0fc8a812ea650e3438af0e032680fab7af5e7a8634c830248f0a5521c4db303230c52ae47c14383e1717eaabb8098b4d739ba9e0f3f0baf274be28a9
SSDEEP 12288:a8GsjFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5AlC:bGsjuBSHsu2UhowloNLQWozSk
TLSH
T1E4E4226E71F562A8CD35823E55B474B2326170E0536563EF43F0E93B5B260D8B63EE28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 620KB
SHA256 b9b11a16bccb54214f1988b28fd766f00da4de143a25731bfe19596bd85a15fb
MD5 d7ee95ba472cf90706841052402e8ff4
SHA1 f52976a82222e8ab64871ce1849d191f4e8a96e3
SHA512 1576ad722eff656774d3d7ab2135df9c944ff7647f8f460a8d84caf6765f6ffcf5599cee2538aa2d779202aee188023585c995c42404541e573a9e3f453af814
SSDEEP 12288:g+jFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5AlC:g+juBSHsu2UhowloNLQWozSk
TLSH
T128D42367A1A8876EDE51153E12F474711305A1E0A3AA73C7A3F1FA0F11670CCFA7BA25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 824KB
SHA256 0077422bcaab8bdc0630689fd2a9caafd385b6a3e8de22bbd3deaf78410add1e
MD5 603996459d66d98f4bfca17936970eee
SHA1 489bf0648421ed3b10dda536da3343733dbff937
SHA512 952b00b8173f720f667d520be2e51f4bdb305ad1a1325addd3f7e0cf69eb2840f12b0720a0b32ebb17b34d6be1864da4c42741fa07b7f746fe248a7ac22b309e
SSDEEP 12288:eHvUrBFrEjwaQ1jFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5Ak:ePUr+NQ1juBSHsu2UhowloNLQWozSk
TLSH
T16705E12F62EC18E9E676A13D85955619E371B4621312E3CF03E0817F1E679D8BD3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 21bab5c68122c6693260713abc010067653c79d2cfaeaa2ca7a4f8ec676298d3
MD5 7cbc122ff757962df97572af26ebcdf0
SHA1 94b73175de7b0c40b95b10e18900940092ad68b3
SHA512 f56548a258dd2c09599b61ad792652bd7b0f523db5c046f2a27ac2dd6e7fa10a1704f6448c30357f1168f73ade3a90eae9a77d4728e22b2ff7a831f1ddf478c8
SSDEEP 49152:fBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjhJsu2UCSoN0vzSk:QG05lO43bMJH287
TLSH
T135D5CF6A62EC11F9D1BBC17CDAC6460BEBB23415033556CF02A486A91F27FF4A97E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 682b0e3ec55fe66bcb29f69dce85996b6a4cd6418be42b83738318cad14f973a
MD5 23311de352de45506caca34f8e149a5b
SHA1 3d604450bb01f92c8073e60b6df8d44abb073a5f
SHA512 6d5b6d481742a94b1414ef0f71e8ad3207bb91fcb7aeb885f09e3e74ff28adcfcb7401d9ee765d3209a447c9b521bc1ddcf638bb1a87ad83fd715e1a7aa34b93
SSDEEP 24576:7NcwHdjbyQ4nLC18lb/EOjowL7FkfjuBSHsu2UhowloNLQWozSk:7Nc/zEOVHF0Jsu2UCSoN0vzSk
TLSH
T120857B2623E901E4E5BBE1BE89779546FA717865133086CF0391851F1E73BE46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 772KB
SHA256 469108e1e3d019ae48b8ece45b98331fcdbdb41ce3926a3ca7bc202a1d938912
MD5 cdd0c486ccdc2b383ef682ceb8707410
SHA1 d51dbac86670e96b469f24c3095829dab5025604
SHA512 d716774eabb3edae7fce37cad633c322b32fba57de243118098267a610fb5ecd7941f3680df73cdba6abb64d70159bb9274dc2312a6febcf4077701e7412bae4
SSDEEP 12288:I1Hck6j5ZI7rjFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5AlC:I6DI/juBSHsu2UhowloNLQWozSk
TLSH
T1FCF4015D63BA11BAD167D03E86920512D2B2B0B0836267DF07E4C57E5EA3ECCB93DE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 756KB
SHA256 c1ad20eb1ab5b11b418987bdca359ef1a5f310b6c02f5c212dcded38f269344b
MD5 e949a7db262487b84f2c307acd134e0c
SHA1 44ce1e70fc18b1396dd92364219456331e280aef
SHA512 c91a73b650ba77327939108507cb5e7186ed2616a8d02df0cb6ec4f8d78fb94137808ff89b7b90c9df43ff821b14c6a208197f63179878b9821d8ad063e2e8c9
SSDEEP 12288:aG6kyZjFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5AlC:ztyZjuBSHsu2UhowloNLQWozSk
TLSH
T1BFF4120563A861A9EA75013D9AB161A04B35BC60576163DF53F0FA2F2F332C8BD35F25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 628KB
SHA256 10bb7f19e4b0799a207bfa901b53078e783b1a8067d3bd7c74204eb3986156a3
MD5 aeca97f354edd39674220d9c4d65c4e2
SHA1 003a548e468986ddd7798ebcb4b969d313e34e64
SHA512 85dfd456809c71767abfa62017a74cc1b77195e4e4afbea6803e88e9406116f402f1da79940d56b46869938935e73504575efb2974c4d4880c8ee05b5459a401
SSDEEP 12288:FTNZPjFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5AlC:5jjuBSHsu2UhowloNLQWozSk
TLSH
T19BD423AAA2B8673DDD11553E11B834B10215B0F053AA73DF63F0E92B56370C8BA7BE15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2388-277-0x0000000000970000-0x00000000009D9000-memory.dmp

Download

memory/2388-282-0x0000000000970000-0x00000000009D9000-memory.dmp

Download

memory/2388-276-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/2444-62-0x000001D7DFAE0000-0x000001D7DFB46000-memory.dmp

Download

memory/2444-63-0x000001D7DFAE0000-0x000001D7DFB46000-memory.dmp

Download

memory/2444-61-0x000001D7DF8B0000-0x000001D7DFA08000-memory.dmp

Download

memory/2692-290-0x0000025B9DAD0000-0x0000025B9DB36000-memory.dmp

Download

memory/2692-288-0x00007FF70D880000-0x00007FF70DFC2000-memory.dmp

Download

memory/2692-289-0x0000025B9DAD0000-0x0000025B9DB36000-memory.dmp

Download

memory/2932-49-0x00007FF7BDAF0000-0x00007FF7BDC57000-memory.dmp

Download

memory/2932-50-0x0000027EBC6C0000-0x0000027EBC726000-memory.dmp

Download

memory/2932-51-0x0000027EBC6C0000-0x0000027EBC726000-memory.dmp

Download

memory/2932-58-0x00007FF7BDAF0000-0x00007FF7BDC57000-memory.dmp

Download

memory/2932-56-0x0000027EBC6C0000-0x0000027EBC726000-memory.dmp

Download

memory/3704-17-0x000001CE158A0000-0x000001CE15906000-memory.dmp

Download

memory/3704-18-0x000001CE158A0000-0x000001CE15906000-memory.dmp

Download

memory/3704-67-0x00007FF6F21A0000-0x00007FF6F22C1000-memory.dmp

Download

memory/3704-16-0x000001CE158A0000-0x000001CE15906000-memory.dmp

Download

memory/3704-15-0x00007FF6F21A0000-0x00007FF6F22C1000-memory.dmp

Download

memory/3972-41-0x000001A595D40000-0x000001A595DA6000-memory.dmp

Download

memory/3972-40-0x000001A595AC0000-0x000001A595C18000-memory.dmp

Download

memory/3972-43-0x000001A595D40000-0x000001A595DA6000-memory.dmp

Download

memory/3972-42-0x000001A595D40000-0x000001A595DA6000-memory.dmp

Download

memory/4160-307-0x000002D572D30000-0x000002D572D96000-memory.dmp

Download

memory/4160-306-0x000002D572D30000-0x000002D572D96000-memory.dmp

Download

memory/4160-305-0x00007FF7A3B60000-0x00007FF7A3F75000-memory.dmp

Download

memory/4556-317-0x0000020675040000-0x00000206750A6000-memory.dmp

Download

memory/4556-315-0x00007FF7AA400000-0x00007FF7AA4B2000-memory.dmp

Download

memory/4556-316-0x0000020675040000-0x00000206750A6000-memory.dmp

Download

memory/4820-238-0x00007FF68B850000-0x00007FF68B917000-memory.dmp

Download

memory/4820-314-0x00007FF68B850000-0x00007FF68B917000-memory.dmp

Download

memory/4820-240-0x000001D462400000-0x000001D462466000-memory.dmp

Download

memory/4820-239-0x000001D462400000-0x000001D462466000-memory.dmp

Download

memory/4936-256-0x000001A03DC20000-0x000001A03DC86000-memory.dmp

Download

memory/4936-258-0x000001A03DC20000-0x000001A03DC86000-memory.dmp

Download

memory/4936-247-0x00007FF68B850000-0x00007FF68B917000-memory.dmp

Download

memory/4980-7-0x0000000002D40000-0x0000000002DA9000-memory.dmp

Download

memory/4980-269-0x0000021584E70000-0x0000021584ED6000-memory.dmp

Download

memory/4980-28-0x00000000008A0000-0x0000000000A7C000-memory.dmp

Download

memory/4980-1-0x0000000002D40000-0x0000000002DA9000-memory.dmp

Download

memory/4980-267-0x00007FF707180000-0x00007FF7072C8000-memory.dmp

Download

memory/4980-0-0x00000000008A0000-0x0000000000A7C000-memory.dmp

Download

memory/4980-270-0x0000021584E70000-0x0000021584ED6000-memory.dmp

Download

memory/5052-34-0x000001350C5F0000-0x000001350C656000-memory.dmp

Download

memory/5052-32-0x000001350C5F0000-0x000001350C656000-memory.dmp

Download

memory/5052-33-0x000001350C5F0000-0x000001350C656000-memory.dmp

Download

memory/5052-31-0x000001350C490000-0x000001350C5E8000-memory.dmp

Download

memory/5092-296-0x00007FF6FABE0000-0x00007FF6FAC8C000-memory.dmp

Download

memory/5092-297-0x00000253B1960000-0x00000253B19C6000-memory.dmp

Download

memory/5092-298-0x00000253B1960000-0x00000253B19C6000-memory.dmp

Download

memory/6064-251-0x0000020F5C8B0000-0x0000020F5C916000-memory.dmp

Download

memory/6064-252-0x0000020F5C8B0000-0x0000020F5C916000-memory.dmp

Download

memory/6064-250-0x00007FF730450000-0x00007FF730568000-memory.dmp

Download