fadabc46b8597c7f6ed94f8fa86ecb6b3df6ebf2abde6ad24f0e332baabd08eb

Analysis

max time kernel
146s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 09:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fadabc46b8597c7f6ed94f8fa86ecb6b3df6ebf2abde6ad24f0e332baabd08eb.exe
Size 2.8MB
Sample261002-lmnh8afa85
SHA256 fadabc46b8597c7f6ed94f8fa86ecb6b3df6ebf2abde6ad24f0e332baabd08eb
MD5 1f3a6111a9defedef99c76ab0b62d8f3
SHA1 e0ac679fb17e21d47b0812129a222c3af5e19db0
SHA512 a78a229b8e4531a131dee193372cd190d766e99ed54acbd5741a66ff7caf5b51728261d624752aa2d3a3f2afd5a8680d789d28d30d80bf1bea672827b3d7adca
SSDEEP 49152:/jqPeMprQMRm12dUV+lGJ6Yd5+rWV6sCOfx2EwCKG+qsaitwCBGDBue+wkfSwAeb:7ZSrQMRm12dUV+lYdGOfx2EwFQhNfeRF
TLSH
T180D5AE217A41C036EAA201719C7CFFAE449CE6640F2545EB63DC0B7F6E306D35A35A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 9 IoCs

pid	Process
3828	alg.exe
4364	elevation_service.exe
2900	elevation_service.exe
2184	maintenanceservice.exe
936	OSE.EXE
5044	GameInputSvc.exe
4308	GameInputSvc.exe
2060	msdtc.exe
1348	PerceptionSimulationService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	alg.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\alg.exe	fadabc46b8597c7f6ed94f8fa86ecb6b3df6ebf2abde6ad24f0e332baabd08eb.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5e4e22e2f1788cf2.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	fadabc46b8597c7f6ed94f8fa86ecb6b3df6ebf2abde6ad24f0e332baabd08eb.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106906\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fadabc46b8597c7f6ed94f8fa86ecb6b3df6ebf2abde6ad24f0e332baabd08eb.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4308	GameInputSvc.exe
4308	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3912	fadabc46b8597c7f6ed94f8fa86ecb6b3df6ebf2abde6ad24f0e332baabd08eb.exe
Token: SeDebugPrivilege	3828	alg.exe
Token: SeDebugPrivilege	3828	alg.exe
Token: SeTakeOwnershipPrivilege	4364	elevation_service.exe
Token: SeTcbPrivilege	5044	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 4308	5044	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\fadabc46b8597c7f6ed94f8fa86ecb6b3df6ebf2abde6ad24f0e332baabd08eb.exe
"C:\Users\Admin\AppData\Local\Temp\fadabc46b8597c7f6ed94f8fa86ecb6b3df6ebf2abde6ad24f0e332baabd08eb.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3912

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3828

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2900

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2184

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:936

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4308

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2060

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1348

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:5220

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:4440

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:2868

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:3116

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:5328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 dd8226d99b32106a4672e7d7828ce8b3e8d1a694e7391dd8eb91c628c4a443f0
MD5 dab15b49d933650308b60e722ae3ad3e
SHA1 c2437438db4f7cd789cffca9dccb81308442ad99
SHA512 9682c1620ae3230f79b31efce616ee1c1252d240855d7f16a13d101f31cfe9e1d3784276cfaf6e0a477dbef8b85561ec59309ccf0ce9b49f0b27815560de730c
SSDEEP 49152:zb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnXe+wkfSwAeRnkg0Q:R3q6gjBRNfeRn/0Q
TLSH
T1D7D59C03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 c6637189341d6e9e37091a6194d405c7e2b0171415a6a0d4105bceb6101a0cb4
MD5 45a5cac138cc468cacfa48c9136bfac0
SHA1 480c303659a15cc0b341e0a5ebf08b8a9db6e2a7
SHA512 fd3d954a81b826ee99fa8d8fa53aac76b2d6354392dbebe42cddcb4e77ab53782639b1ac70cccfa9497a53702e5a01bc18b4aaa346bed7f4220672c3a74c0901
SSDEEP 24576:fXYkktczAkeyfwkfSwAeROyDcKkUf67xN3Q:ctcje+wkfSwAeRnkg0Q
TLSH
T1B505021977E408F9ED6B827CC8A28516E673BCD54390F74B03E496261F236885F3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 2d69d9f151c998945cefd7c1afb818874d236c0eba9bfa3a726290014dd0584b
MD5 98beb38b2019df7152780e4d61357dee
SHA1 738f9e791b5415e5b33850621ea2e1138acd959d
SHA512 b7b81fb9c2be129029c5178b01275e3c89aaae77dd16c9bc0d4b4f7485834d85c609ab2364525fd0e4d9f24f43eb0833f0a6cee6b58eeb7cd0b4cb232b7a631f
SSDEEP 12288:5mw5HEjsChNRBFgl0WDm+CjMp0yZJwkCnh+M31Yx7oxeROKDMUcHYDybJU/HY3HP:UwusOWxeyfwkfSwAeROyDcKkUf67xN3
TLSH
T10705F14A76E40CF9EAA6823DC5938536F7F3B8522565DB1F0360C75B6F27210AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ee833301d57c0d4082d6243b0894dfac818182b809ca2f656488ac71692cc946
MD5 1d3bcc6a387a6850e16a16efef6c97c5
SHA1 065a91abf09a6f7289849574a8a7e3aee0aa9b4a
SHA512 1449fafe6dcfc4dd6d1edd05ec72666a776ea8e7a217bea6e5ac7f0752f305cebaaefa12bb9725265543b045f7721c9c36f73dd33805034cc97db0014693a8d1
SSDEEP 49152:nB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl5e+wkfSwAeRnkg0Q:pu6JmTxd2dMNfeRn/0Q
TLSH
T1CED59D13F1D901E8D06ED178974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 e3827d034672c29533a02179f7b7a034dfaf0f61cf1b236fd94096c3ec190a0b
MD5 4cd778439b4c0c528fcdc074f579c93c
SHA1 abcf700659940f2c354845d04591134661ab90c3
SHA512 ba1e56991a71c68b702673dc566d182548b76c1d7e66022da8a16fb12ae453fcc4e875ce254b4262cf5e87eb9e05e83bb1e76db9432554458b18c18169dc5e26
SSDEEP 12288:jJ7KMp0yZJwkCnh+M31Yx7oxeROKDMUcHYDybJU/HY3HNkUrsP6xN3Q:9HeyfwkfSwAeROyDcKkUf67xN3Q
TLSH
T17BD42307F5B85806E6BC83FC91D39A3A25BBF9EA04C5264B0149A34F7B578045F3862F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 4e208e40084f9888ef8493f026cff433663f5f565a53e68f82be28896edb3ff1
MD5 fcdc67b3677539d46c90211395dfe67b
SHA1 36ecce1c7550178eec1b83a0e67c6988d0841602
SHA512 c4f248e1fa09615267d26dfa5ab508270e1e46d9806031bd7644d1ee0bc8e58513ccbd1129ce0e4cd1aca5e9ffe288aab2a005fbc4b2ce2abc559eadab77aab2
SSDEEP 12288:EHGrMp0yZJwkCnh+M31Yx7oxeROKDMUcHYDybJU/HY3HNkUrsP6xN3Q:WGweyfwkfSwAeROyDcKkUf67xN3Q
TLSH
T114E4121FB0F46449C67C83BD90A25A6774B2B8E5178526EF01C8E23B7B468D02F3DD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 96d53095554eaabececa5192553db8c50c9387398fb3556e6c31f9e6484970b6
MD5 63cd18464ebef0b9caef70ee2a4b78c8
SHA1 cf12e1af38e92d96c3140e19e6769a8148eb6135
SHA512 fe05eb9e50dbf2a3d51d4f50c6efdf12830d6f7d025b771b19c92c9dae003ce2d11c6f7fdf1d0c3c5dc439c2a16c35abc35fbb821b604e23e7b8892fa76f85b5
SSDEEP 12288:CjMp0yZJwkCnh+M31Yx7oxeROKDMUcHYDybJU/HY3HNkUrsP6xN3Q:CoeyfwkfSwAeROyDcKkUf67xN3Q
TLSH
T16BD4234BF4B45806D7AC83BD91D35A6A15B7E9EA13C516D7018DA30B374B8C42F3922B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 2ce8c17799de4ec8b450416cfc8ab7aaa183004e76a005bf7d1219ff1c20080a
MD5 5015a7e9177322d58abd4ca50c895261
SHA1 3214c17f0100c5374cb36ca8e4b984164bea8063
SHA512 901995629aa36aaf3e245adeb6901ce86a00a9ad4d4cbfe58a0ef3f10ff375825ca42547941080b829487384ba2b413b057285a657bca7262e60c78628ecf4b9
SSDEEP 24576:dPUr+NQdeyfwkfSwAeROyDcKkUf67xN3Q:dJQde+wkfSwAeRnkg0Q
TLSH
T16C05E11F72E818E5E679E17D85828719E772B8A20342A2CF02D0817E5F57DD8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 a79c614eacd15d5db5fd50292f9fed1b9978b2e29b8edf52887859c9840f0cfd
MD5 ac9fe1f64fec4dd8e7372b0b4efe2706
SHA1 e6b6ac69571c239f23709a7bab1f7aa1d1cacef4
SHA512 9dbc49b3cb5bab7e84a382f4d2381c19419e04eee6da1de55c073ec519c2ee4e529c69ad22b214470cad4d3719a88164303e38bb9c530208086efa93a6433b5c
SSDEEP 49152:LBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjze+wkfSwAeRnkg0Q:UG05lO43bjNfeRn/0Q
TLSH
T1A0D5C06E62EC11F9D1BBC17CD9C64A0BEBB23415032556CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6d53885ec3de25972feed425e0ef4cd81d768c15945aeb19d67cfd9840a607aa
MD5 dc6fa9dec41c9e3d4065196522019621
SHA1 518cfb1b906f1539ed4d0d36a4800f1436b6e1f8
SHA512 0930de0cf1fbc0425480692f7ea9873c58b9ca03f9ec06dca95fbe5555ee269d39af6201ebe1067e63a7ff10ef2e319ebd802fc1f1d7229dd88c49e8698dc48d
SSDEEP 24576:TNcwHdjbyQ4nLC18lb/EOjowL7Fk+eyfwkfSwAeROyDcKkUf67xN3Q:TNc/zEOVHF/e+wkfSwAeRnkg0Q
TLSH
T18F858C1622E901E4F5BBE1BE89779546FAB1786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 28e3dd83842773fb25faf3c502a2af13e80be1d18f3be35150045295f2204da4
MD5 939bd56a232f1e08d6fb2ae77c5dc676
SHA1 4d8aa6b71ed9ea4ef99401fd6009e9455a56b330
SHA512 0fef0be842e964937a3d2a783a277d91adb3fe16ce154525ecda111fc9ce9c7b41fc43ab094e89c7d9de306defcb93f36ec82ae286293dffc059a0f8859574b4
SSDEEP 12288:M1Hck6j5ZI7EMp0yZJwkCnh+M31Yx7oxeROKDMUcHYDybJU/HY3HNkUrsP6xN3Q:k6DIheyfwkfSwAeROyDcKkUf67xN3Q
TLSH
T17CF4F15D73BA10B6D1BAD17DC1830616E1B2B4B183521ADF0698C57E6F93DC8BE3CA12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 51145fe80a3bfed2a6f25c1653aea89e8088093c77d46bc95c7efc7712f813d9
MD5 95a67e9c90297203154cadae8c5f1da0
SHA1 7299e29c2bc08974d700da859c25955bd967a3b5
SHA512 1578a2e5d821ffa8e85d08926a1b3b7f37f0c8a35f7173b4dd6461c3e26f6e25c99d793e8f128ca085246624f40892f02f90ba832156ad5862dd428b7611d28a
SSDEEP 12288:DG6kyUMp0yZJwkCnh+M31Yx7oxeROKDMUcHYDybJU/HY3HNkUrsP6xN3Q:Sty1eyfwkfSwAeROyDcKkUf67xN3Q
TLSH
T163F41206B3A46085E6BC43BC96A346A55A76FCA0579113DF01D0E72F3F37AC46E34B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 512KB
SHA256 d16da743817c7f950eec3793ce4e882e79d626d616a1591c8d7f3b65f455d58c
MD5 a027c457dee2afd6328df6a9e8100f51
SHA1 3907cf6e225c8a9802ce71002ed4cd024a6c82a4
SHA512 9e627a4dd4b7530f3733c14753bd4c8d86d049dddfbbfeb550dcecf11ce18c1535ef83fabc0849118d1fd351504ec925f5d1475cfe9b882bed34404f8dd93e6d
SSDEEP 12288:c9iMp0yZJwkCnh+M31Yx7oxeROKDMUcHYDybJU/HY3B:CfeyfwkfSwAeROyDcKkUfo
TLSH
T16EB4235EF2B8345AEA3C92FC821217A65072F8F6175A12EF06C9A22F5F5B4C44F35E11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/936-59-0x000001F3B62E0000-0x000001F3B6346000-memory.dmp

Download

memory/936-58-0x000001F3B62E0000-0x000001F3B6346000-memory.dmp

Download

memory/936-57-0x000001F3B6140000-0x000001F3B620D000-memory.dmp

Download

memory/1348-266-0x0000022112680000-0x00000221126E6000-memory.dmp

Download

memory/1348-265-0x0000022112680000-0x00000221126E6000-memory.dmp

Download

memory/1348-263-0x00007FF7FC160000-0x00007FF7FC2A9000-memory.dmp

Download

memory/2060-252-0x000002A0960D0000-0x000002A096136000-memory.dmp

Download

memory/2060-253-0x000002A0960D0000-0x000002A096136000-memory.dmp

Download

memory/2060-246-0x00007FF6FDC00000-0x00007FF6FDD19000-memory.dmp

Download

memory/2184-54-0x00007FF7BE240000-0x00007FF7BE3A8000-memory.dmp

Download

memory/2184-46-0x00000138E3CF0000-0x00000138E3D56000-memory.dmp

Download

memory/2184-52-0x00000138E3CF0000-0x00000138E3D56000-memory.dmp

Download

memory/2184-47-0x00000138E3CF0000-0x00000138E3D56000-memory.dmp

Download

memory/2184-45-0x00007FF7BE240000-0x00007FF7BE3A8000-memory.dmp

Download

memory/2868-293-0x000001F1C9470000-0x000001F1C94D6000-memory.dmp

Download

memory/2868-294-0x000001F1C9470000-0x000001F1C94D6000-memory.dmp

Download

memory/2868-292-0x00007FF734850000-0x00007FF7348FD000-memory.dmp

Download

memory/2900-36-0x000002333F790000-0x000002333F85D000-memory.dmp

Download

memory/2900-40-0x000002333F980000-0x000002333F9E6000-memory.dmp

Download

memory/2900-38-0x000002333F980000-0x000002333F9E6000-memory.dmp

Download

memory/2900-37-0x000002333F980000-0x000002333F9E6000-memory.dmp

Download

memory/3116-301-0x00007FF6DD3F0000-0x00007FF6DD806000-memory.dmp

Download

memory/3116-303-0x0000024611040000-0x00000246110A6000-memory.dmp

Download

memory/3116-302-0x0000024611040000-0x00000246110A6000-memory.dmp

Download

memory/3828-17-0x0000026FEB850000-0x0000026FEB8B6000-memory.dmp

Download

memory/3828-63-0x00007FF6448C0000-0x00007FF6449E2000-memory.dmp

Download

memory/3828-16-0x0000026FEB850000-0x0000026FEB8B6000-memory.dmp

Download

memory/3828-15-0x0000026FEB850000-0x0000026FEB8B6000-memory.dmp

Download

memory/3828-14-0x00007FF6448C0000-0x00007FF6449E2000-memory.dmp

Download

memory/3912-6-0x0000000003130000-0x0000000003199000-memory.dmp

Download

memory/3912-1-0x0000000003130000-0x0000000003199000-memory.dmp

Download

memory/3912-0-0x00000000031B0000-0x000000000324D000-memory.dmp

Download

memory/4308-248-0x000002C44E150000-0x000002C44E1B6000-memory.dmp

Download

memory/4308-243-0x00007FF635BA0000-0x00007FF635C68000-memory.dmp

Download

memory/4308-247-0x000002C44E150000-0x000002C44E1B6000-memory.dmp

Download

memory/4364-30-0x0000016A3E040000-0x0000016A3E0A6000-memory.dmp

Download

memory/4364-28-0x0000016A3E040000-0x0000016A3E0A6000-memory.dmp

Download

memory/4364-29-0x0000016A3E040000-0x0000016A3E0A6000-memory.dmp

Download

memory/4364-27-0x0000016A3DE20000-0x0000016A3DEED000-memory.dmp

Download

memory/4440-285-0x00007FF77D270000-0x00007FF77D9B3000-memory.dmp

Download

memory/4440-284-0x00000235E70E0000-0x00000235E7146000-memory.dmp

Download

memory/4440-286-0x00000235E70E0000-0x00000235E7146000-memory.dmp

Download

memory/5044-236-0x000001F2C2A90000-0x000001F2C2AF6000-memory.dmp

Download

memory/5044-235-0x000001F2C2A90000-0x000001F2C2AF6000-memory.dmp

Download

memory/5044-310-0x00007FF635BA0000-0x00007FF635C68000-memory.dmp

Download

memory/5044-234-0x00007FF635BA0000-0x00007FF635C68000-memory.dmp

Download

memory/5220-278-0x0000000000810000-0x0000000000879000-memory.dmp

Download

memory/5220-273-0x0000000000810000-0x0000000000879000-memory.dmp

Download

memory/5220-272-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5328-313-0x000001A1189B0000-0x000001A118A16000-memory.dmp

Download

memory/5328-312-0x000001A1189B0000-0x000001A118A16000-memory.dmp

Download

memory/5328-311-0x00007FF7F56B0000-0x00007FF7F5763000-memory.dmp

Download