392134d32067b708dc8323f1f20645587244a3eec63a2408601df6ebc49d56a5

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_8436b53bcfd96b69efff9fb99f62d2ee_elex_glassworm_mafia_remcos.exe
Size 1.1MB
Sample261110-rf3mfsbs2z
SHA256 392134d32067b708dc8323f1f20645587244a3eec63a2408601df6ebc49d56a5
MD5 8436b53bcfd96b69efff9fb99f62d2ee
SHA1 450d125e05924abc171c40632ebf0b7ae7df31b5
SHA512 4532624b0d9e5f12516a2c1e13dfa7329b7150c45b6922bdcb652949c35cf3051a90fbee4185241bb7b7c4e03e8525615a1b21e6225daf8e23dd6fceba25b95c
SSDEEP 24576:Nt7heIP3N02aRTnQRMNIogDIopcudCcPE9tFoS3zb8CKa:BeIPd0ZTQRND8opnxPEhoL
TLSH
T1CB45E0297EF0D032C03742749D1AD358A5B9F47288264887FBDC676D2F702D29B39B96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
1888	alg.exe
1968	elevation_service.exe
3156	elevation_service.exe
2000	maintenanceservice.exe
2508	OSE.EXE
4460	GameInputSvc.exe
2516	GameInputSvc.exe
5388	msdtc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f52504954b315ee3.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-09_8436b53bcfd96b69efff9fb99f62d2ee_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-09_8436b53bcfd96b69efff9fb99f62d2ee_elex_glassworm_mafia_remcos.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107515\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107515\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-09_8436b53bcfd96b69efff9fb99f62d2ee_elex_glassworm_mafia_remcos.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2516	GameInputSvc.exe
2516	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1716	2026-11-09_8436b53bcfd96b69efff9fb99f62d2ee_elex_glassworm_mafia_remcos.exe
Token: SeDebugPrivilege	1888	alg.exe
Token: SeDebugPrivilege	1888	alg.exe
Token: SeTakeOwnershipPrivilege	1968	elevation_service.exe
Token: SeTcbPrivilege	4460	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 2516	4460	GameInputSvc.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-11-09_8436b53bcfd96b69efff9fb99f62d2ee_elex_glassworm_mafia_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_8436b53bcfd96b69efff9fb99f62d2ee_elex_glassworm_mafia_remcos.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1716

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1888

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1968

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3156

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2000

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2508

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2516

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5388

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
PID:2796

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:908

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:3512

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7a2bdc3a241b2e3f353a2aba2e360b5dc408b34a929977df8188256cb2bedcba
MD5 e72186870f015a2a3cbc409a7e1412c2
SHA1 c4d3468c2226a8bc53456b6b2a29c7bcae948b0e
SHA512 5706e51616d0b239c75d95f236c7953ad0b6dd98d6db0fb75cefffe540f5a78f12cf4083b7e21bd87e19b3d287e506e5e2998160700dc1ffd3eb453cd43c7981
SSDEEP 49152:0b+632BuPkFKRrdE6oh7stBhuXjfS4LWxnBnxPEhoL:u3q6gjBGOhA
TLSH
T135D59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 a2c29e0faef8ad83cefe9bfe80ab19a24ea49760feb7694dbbd516111e8a4709
MD5 84ef14f60b2f7e179dfef701cfb2a6e4
SHA1 2e87fdefe0235277daffbe95d93c346482ca8358
SHA512 a866a1ceec27e7e09cc80b94b14df5d521ea8848e6f7503afb2fa04796d2a60be4801437296649c7215700333364c78197bc46b64b6e05c49585a9ebda193ac0
SSDEEP 12288:41XLsdALjnxtPvmP2czA6ihp8uLRCosLs0xFOGwPVibJbtwe1oRAH3zpx8pYD+a:+XY+nxvczAZcudCcPE9tFoS3zb8CKa
TLSH
T18805F12867D408FDEC6B827CC8A28415EA73B8514750E78F03F4996A5F237C85E3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 d9ff7999073da579ca91f5a5296e7d63de38a29b47e83d94d4c0a488f1046846
MD5 5e19d5d0797ebb8b723b2067c0522594
SHA1 c253a1dcd402eb3ef3ed6a573dd42b1b2a53c647
SHA512 18fdca2da0c15a73b3ff83d3e2234c813d171f818fac9f54b88a662238fd41265e4a188eca4d617b532c3ce1e3144585066f1ba0e77c9d70a4cd83056b646a99
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+CNihp8uLRCosLs0xFOGwPVibJbtwe1oRAH3zpx8pYDq:uwuuOWncudCcPE9tFoS3zb8CKa
TLSH
T14005F10937A81CFCE96A4639C5578436F7F2B8022A24DB1F47A0C65B5F37351AD2EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b417e0d8f12b222287619e6ce810d5117d1327736cb023930a82976661805b4a
MD5 3da75c19b9e9b4638bed3cbb0aaf17c5
SHA1 bdef88a886f91604daacc5226655e41cc487e5a6
SHA512 abbe14f31c994282cac139db00b3e2a8aa5e7e9003e90922263854b7cd0aa66c36074cf3e63417c41955efcfcfba3f39972655154006c91d6ea196b14c6de85f
SSDEEP 49152:+y+taZ3usBWOBr4tEGp0bqx0z+n217aau1glCnxPEhoL:Du6JmTxd2dCOhA
TLSH
T149D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 bbe7daf614a23725b711fc01182403be969b7477bd8ebfda2810d7314e358594
MD5 23949c21a4e15c122216f89fe7d18294
SHA1 0645ba02992983b42af6d9dc860206b97725a5c6
SHA512 c18f6be0a06ab4ab96cb7f065787982bddfc40f9f77b8698a0a2297cdcbd3df242688984479b9cf289c1b39effc28670bb404f0eeef46377f5bc369944c43a15
SSDEEP 12288:RM76ihp8uLRCosLs0xFOGwPVibJbtwe1oRAH3zpx8pYD+a:SZcudCcPE9tFoS3zb8CKa
TLSH
T130D423295F9C758CE07C0BB0A43B5428A5AFB4125F4497CFC6A825899835BC0ECF5F9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 8f1fa6ef2d05031f7036ade5ec4710ac383c64e0e0bdf3452193470d8f9263f8
MD5 3c01f333e5ea81f084d2f2b9c9ef330b
SHA1 84dab32324433261dd16c6cd7529869b6f16b661
SHA512 448d221ba843d030b0f7a40dfe41d7499d2e8954d90a60d8751a17295d8d483f4038988dc2df55e8cc2a54987271b1e42dfbe1ebbfdff61d66d15522571e3cc8
SSDEEP 12288:XtGcqihp8uLRCosLs0xFOGwPVibJbtwe1oRAH3zpx8pYD+a:dGcpcudCcPE9tFoS3zb8CKa
TLSH
T180E4222C2AE830CCC43C87B9E836541AB9FA70115B0457EF85F4A579CE25BD0B5B9F98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 c131dc6e6cd5ecad076a05b34905863be05018b406404ca4093e358b3a0d8612
MD5 90ba669a20b0e98df917347722ed2d3b
SHA1 2f04b0a315979ed2ade2d35879706ff5826a1601
SHA512 075abe3135cb764f012781f0c0ffe48f57d1bed9eb2b09e76aa74646c2397cc30342c4b7db2ef38026ecb07112cd110aa7b8b29ebb81aefa9f1de55ef76fd208
SSDEEP 12288:wYihp8uLRCosLs0xFOGwPVibJbtwe1oRAH3zpx8pYD+a:wDcudCcPE9tFoS3zb8CKa
TLSH
T1D1D423281E8C70CCD16C0BB5A837581995EEB4036B4457CFC6F835899829BD0A9FAFDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 f8c64ef6d7c9552af3894ef84fb02a15f4770ad6e330e00b267348033206322b
MD5 79edf26ed1c7b056082bba6c9a20a333
SHA1 fd278255c91e63c0ecbe795f1a5d578008511820
SHA512 2639210fb053cf02fa04b75c40613be21dc0abc3031b2a974a80660fca91ee1a76cac4225b90309fad2fa6e8d070cfa84f87cc13faca03b80d1163a7cca33d20
SSDEEP 12288:SHvUrBFrEjwaQMihp8uLRCosLs0xFOGwPVibJbtwe1oRAH3zpx8pYD+a:SPUr+NQfcudCcPE9tFoS3zb8CKa
TLSH
T17E05E12F26EC18E8E67A917D8956461DF772B452170193CF02E0817E4E27ED8BD3EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 4172e53d0c976191de0409255ee5dea77a32676282ef21a512ff6d62a3a6195a
MD5 274d5f69e555e44de54dc9fb6aa0f3bd
SHA1 eb9ea2b260a6cda76182cc5597000710eee83c53
SHA512 a0b41c627b9570920375307095523b327e7cd8d2f6085537c32d2e97d4d4154153ca96b447c3643533db6a76c105651c417ed1c65073eda4b91aafbbcb26b1cc
SSDEEP 49152:TBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjFnxPEhoL:8G05lO43bEOhA
TLSH
T1F5D5C06E62EC11F9D1BBC17CD9C64A0BEBB23415032556CF02A486A91F27FF4A97E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 1486774e0cdd3b6433eb9f25deae32f9d261b144967ee53d5f30bb250a364564
MD5 84e6bb35302b818c5412a24b11458861
SHA1 98915703f8cf881254f5124f5c5fb5bd0f5635fd
SHA512 0b91f198d64f2fd3531da9b6670f13444d3516b035721a601e012a35cd7b15d9a53da48a60288160587ff98a94d1949dab4deeaa3a0583510afa08247be93c24
SSDEEP 12288:N1Hmklj5ZI7jihp8uLRCosLs0xFOGwPVibJbtwe1oRAH3zpx8pYD+a:zlDIacudCcPE9tFoS3zb8CKa
TLSH
T15D05F11C27BA20F9D06B817ED5930416D2F2B06197515ACF47E885BE8E63EC8B93DF81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 933c76642938ef650d741ed945a2e9828e505aba93a395a4814ed8882e091aed
MD5 d2aea0650caa6e07584f6af7aedc945c
SHA1 7feeab396d9822c0ff0a368d039c4395cf70e07f
SHA512 24984960b6eacc9997a62906776ccf449ffd2c113b99ec0ea047efbaf4aa1e51cbc758df27c198f6ea31fae6d2f41c2630298c05563788caf94b1bbda18dea7f
SSDEEP 12288:PG6kyUihp8uLRCosLs0xFOGwPVibJbtwe1oRAH3zpx8pYD+a:+tyncudCcPE9tFoS3zb8CKa
TLSH
T1B4F41208679870CCE5BD0778D93340649EBABC116B0057CF86E0B66E6E36BD0B875F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/696-299-0x00007FF689920000-0x00007FF6899CE000-memory.dmp

Download

memory/696-292-0x000002370E1A0000-0x000002370E206000-memory.dmp

Download

memory/696-293-0x000002370E1A0000-0x000002370E206000-memory.dmp

Download

memory/908-279-0x0000000000910000-0x0000000000979000-memory.dmp

Download

memory/908-274-0x0000000000910000-0x0000000000979000-memory.dmp

Download

memory/908-273-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/1716-0-0x00000000031B0000-0x00000000032C3000-memory.dmp

Download

memory/1716-6-0x0000000003120000-0x0000000003189000-memory.dmp

Download

memory/1716-7-0x0000000003120000-0x0000000003189000-memory.dmp

Download

memory/1716-1-0x0000000003120000-0x0000000003189000-memory.dmp

Download

memory/1888-21-0x0000018D84400000-0x0000018D84466000-memory.dmp

Download

memory/1888-64-0x00007FF6FBB60000-0x00007FF6FBC83000-memory.dmp

Download

memory/1888-15-0x00007FF6FBB60000-0x00007FF6FBC83000-memory.dmp

Download

memory/1888-16-0x0000018D84400000-0x0000018D84466000-memory.dmp

Download

memory/1888-17-0x0000018D84400000-0x0000018D84466000-memory.dmp

Download

memory/1968-29-0x0000019F50D00000-0x0000019F50D66000-memory.dmp

Download

memory/1968-30-0x0000019F50D00000-0x0000019F50D66000-memory.dmp

Download

memory/1968-31-0x0000019F50D00000-0x0000019F50D66000-memory.dmp

Download

memory/1968-28-0x0000019F50B80000-0x0000019F50C27000-memory.dmp

Download

memory/2000-46-0x00007FF63F7A0000-0x00007FF63F908000-memory.dmp

Download

memory/2000-48-0x00000184D7580000-0x00000184D75E6000-memory.dmp

Download

memory/2000-47-0x00000184D7580000-0x00000184D75E6000-memory.dmp

Download

memory/2000-55-0x00007FF63F7A0000-0x00007FF63F908000-memory.dmp

Download

memory/2000-54-0x00000184D7580000-0x00000184D75E6000-memory.dmp

Download

memory/2508-59-0x000001E602FD0000-0x000001E603036000-memory.dmp

Download

memory/2508-60-0x000001E602FD0000-0x000001E603036000-memory.dmp

Download

memory/2508-58-0x000001E602E00000-0x000001E602EA7000-memory.dmp

Download

memory/2516-248-0x000002A2592D0000-0x000002A259336000-memory.dmp

Download

memory/2516-246-0x000002A2592D0000-0x000002A259336000-memory.dmp

Download

memory/2516-244-0x00007FF63BF90000-0x00007FF63C059000-memory.dmp

Download

memory/2796-264-0x00007FF702280000-0x00007FF7023CA000-memory.dmp

Download

memory/2796-266-0x000002A50A4D0000-0x000002A50A536000-memory.dmp

Download

memory/2796-267-0x000002A50A4D0000-0x000002A50A536000-memory.dmp

Download

memory/3156-37-0x00000202F4E70000-0x00000202F4F17000-memory.dmp

Download

memory/3156-38-0x00000202F4F70000-0x00000202F4FD6000-memory.dmp

Download

memory/3156-40-0x00000202F4F70000-0x00000202F4FD6000-memory.dmp

Download

memory/3156-39-0x00000202F4F70000-0x00000202F4FD6000-memory.dmp

Download

memory/3512-285-0x0000024CAE5F0000-0x0000024CAE656000-memory.dmp

Download

memory/3512-286-0x0000024CAE5F0000-0x0000024CAE656000-memory.dmp

Download

memory/3512-298-0x00007FF6537D0000-0x00007FF653F14000-memory.dmp

Download

memory/4460-235-0x00007FF63BF90000-0x00007FF63C059000-memory.dmp

Download

memory/4460-236-0x000001B517BB0000-0x000001B517C16000-memory.dmp

Download

memory/4460-237-0x000001B517BB0000-0x000001B517C16000-memory.dmp

Download

memory/5388-249-0x00007FF689B90000-0x00007FF689CAA000-memory.dmp

Download

memory/5388-254-0x0000020064EF0000-0x0000020064F56000-memory.dmp

Download

memory/5388-253-0x0000020064EF0000-0x0000020064F56000-memory.dmp

Download