ad94cb2d31a0f64e185f34d0623087a8e12aefb93be58e4c499d00ae430dc1b9

Analysis

max time kernel
145s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_05b3999f7c987d5032970177a46d4236_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Size 932KB
Sample260714-e927kagx2z
SHA256 ad94cb2d31a0f64e185f34d0623087a8e12aefb93be58e4c499d00ae430dc1b9
MD5 05b3999f7c987d5032970177a46d4236
SHA1 dfdf9a6e63d906e235fdc2f220f52906cc4840c7
SHA512 ba7cc7de80f1e0659515517e9bf645cd0b97ab276ea2ebab10d6af5ae81017fc86f4a97665dd43375d8acfe284311223a304dc3894f09d6c1ad047eea96ae500
SSDEEP 12288:WUwSfxL/2Dc3bDLLmt0LDQewsAjGTkmQYhVu4a1zlRPjVNzBKUoF0vsY8Yh+4e/z:TmewsAjrAGzr55oLGh+3ZZ4OAI
TLSH
T15215E071FA70E036C3BF0DB21B2AC716187DB9604F912AC3E3A84D9D59742D16376A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
3656	alg.exe
4164	elevation_service.exe
3064	elevation_service.exe
5700	maintenanceservice.exe
1512	OSE.EXE
4516	GameInputSvc.exe
5512	GameInputSvc.exe
5848	msdtc.exe
4880	PerceptionSimulationService.exe
1840	perfhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-14_05b3999f7c987d5032970177a46d4236_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-14_05b3999f7c987d5032970177a46d4236_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f8023a14238bf42.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_05b3999f7c987d5032970177a46d4236_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5512	GameInputSvc.exe
5512	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3048	2026-07-14_05b3999f7c987d5032970177a46d4236_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Token: SeDebugPrivilege	3656	alg.exe
Token: SeDebugPrivilege	3656	alg.exe
Token: SeTakeOwnershipPrivilege	4164	elevation_service.exe
Token: SeTcbPrivilege	4516	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 5512	4516	GameInputSvc.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-07-14_05b3999f7c987d5032970177a46d4236_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_05b3999f7c987d5032970177a46d4236_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3048

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3656

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4164

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3064

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5700

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1512

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5512

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5848

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4880

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1840

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:4272

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:5576

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:4860

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:5700

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:1304

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:5840

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:4428

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:4988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 004e32958734420e3b0895aa0d094a8c4602104a64d7888ec57d2f7984ff574a
MD5 3731cf245708e357a0b9c67233bcf618
SHA1 9211f3293b2120d24269839c9d7ec01d7874a08b
SHA512 f43cc789a7a66db73594e13be80476425aad65565b77a915744ea35306f216c2e210aa2999306cf0a5ff9eb3a52752796545fcda0648a5a50896779d46aa0b87
SSDEEP 49152:Ob+632BuPkFKRrdE6oh7stBhuXjfS4LWxnqW52LGgp9AI:Q3q6gjBIo
TLSH
T180D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 a6e168207a005e1e65a9dec94272f9d3fd2f102894a369f8cdf3f0f5a69eb813
MD5 d2836c17a9462c1aae949ff7211283eb
SHA1 a21f9f270d26902d729e63542133953b946309d5
SHA512 bb18495fbd1a634e3a6c6b5ed70400b68be966efdae527f0426f402987766cdb83fce96ba290eb82c3eac5df7030a06f967234413fdf89f3a40ec60ebb753e96
SSDEEP 12288:N1XLsyM2pxy2lRq2czAemQYhVu4a1zlRPjVNzBKUoF0vsY8Yh+4e/GmtmY4lzIpj:jXYtqtczAiAGzr55oLGh+3ZZ4OAI
TLSH
T1BB05025CA3E009F9ED67823CC8A68511EB73B8954790F78B03B489291F336D85E3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 33f7922c6a8a6cf31a7cb650dae41b92c3744ce61cc8c641bedeea7ba4c4fa67
MD5 7a135d90468cf98720de1cd3333db3ec
SHA1 8de022c9f28e8070a366cdaddd5b99b0269b59bd
SHA512 731ee391724aae1e5c34f94b4cd0b601d574c5f5e1e68e8fbede8591574e70ea95c19cbf7fb8c0868ff2fed3eaf0da2196d66e5b4ee1aee4fa9847dfe9ce85ac
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+CLmQYhVu4a1zlRPjVNzBKUoF0vsY8Yh+4e/GmtmY4lU:uwuuOWSAGzr55oLGh+3ZZ4OAI
TLSH
T14F05F18977A41CF9E5678238855B8532E7F2B8512B64E71F0360CA1B6F37260BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 81dbf3bbde1d6c5bb309232099c59a2fd04b6f462ef69d2523760db66429e638
MD5 d1c9c79830d50b78db6ed7177e84ff7c
SHA1 495b7e897966ec05ef09817dda09628aedef6256
SHA512 f117ac060661943cf226af49fff95518890c093e58d0705d12cb1d5848a6d4c77305edb92e8700e072c10a044b7ae2d747443430eb5388ba7116f423facedd9e
SSDEEP 49152:DB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl+W52LGgp9AI:1u6JmTxd2dBo
TLSH
T1A9D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 67b7cd7bce90c03c5f4fed2a7fa3785d0ed8488dfd860be193a81655872f1ec5
MD5 5c091e35a8559b645bca7c41ec46a9b8
SHA1 33c98c14725d42f6082004058cfff98889b212d1
SHA512 6d42a81d261a68f2938348bd0d2c758461b0a106804f9c060a2627443e846ae381ac7afa5264913a47dac89e9900f821b00e0edb1ece46fd46cea1b5b948d3ca
SSDEEP 12288:R57amQYhVu4a1zlRPjVNzBKUoF0vsY8Yh+4e/GmtmY4lzIpAJy:H2AGzr55oLGh+3ZZ4OAI
TLSH
T104D423CCD7709652E2BF8370442E0A715A3AB4F56F84F6D7E0260C19A978DD0E938B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 74357ece3470ebae2eba09c5d8333ef7983c472a3966944b172253c9fdd52a9a
MD5 8791575fd45c05d68fdb75c1bcabf6a1
SHA1 0d624c64947126fba6fa67c9796f52f350b6a24b
SHA512 2fc166747454eb3640b2f5b2564a98d147fecacf25f3c26cd97e2a74b52b0466ad83b1c769ae6b1f27a7f9e90fd95f3aa1e6ec88cd15028429a4e012220d4f59
SSDEEP 24576:wgb6bmBIi49WNNFpg1rSvFv7bYQAGzr55oLGh+3ZZ4OAI:wgb4mBIBhGFiW52LGgp9AI
TLSH
T19E65AE1E22E802F5E1FAD2B8CDAA4417D6B278161731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 de59dc8c723d7b7cd0ee0c667598fb1f6da34c252adbbc6a5399a891a42ff510
MD5 0ce7d5dd9cbf76cc3288baaf829bed56
SHA1 ea5d784669b1898aa56fb9f6b492f932e69ebcc5
SHA512 c5eee5c0ecb3099b5fa6dd72024f3b46dcce4d1fb0be4c641b932dafdc4d093db2912ba1fe32c5462f481a373da0206cb92c9ecf224931b5a6140b3ccee169ed
SSDEEP 12288:GRG7mQYhVu4a1zlRPjVNzBKUoF0vsY8Yh+4e/GmtmY4lzIpAJy:yGDAGzr55oLGh+3ZZ4OAI
TLSH
T1B1E422DCA2B17194C27BC375842D09B2B9B1B0B16F4477EF40A158399F799E0B238E9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 89c8108bb16b701db4b623de9c68af713cc1cbf70f59d97614e567b9105339d0
MD5 66ed43031fd31cdb7553f0748e6dabc2
SHA1 9b7f7d7b26ae76f361d7218fff00dd5e6dbf209e
SHA512 034da6b19cf08525b7bac60dd70863d216b30197805f3e44628010b8fcbf167365a3397c5ba17cffef6b7fbfabe9ec899c1cacafa44e621bebd37fb12a73731b
SSDEEP 12288:PamQYhVu4a1zlRPjVNzBKUoF0vsY8Yh+4e/GmtmY4lzIpAJy:P2AGzr55oLGh+3ZZ4OAI
TLSH
T17CD423CCD6309686D2AB8371442E0E724A75F0F56FC4B7D790261C1965BDDD0E238BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 1b02d0bbd2b836731ee17548449c3b034ed5f835f6d8a99797aa687e77975a1d
MD5 4b39737eef4b6951c12df64f7df4c8c9
SHA1 8ef98108e31ea8236e12f0cacddb1141d15660c9
SHA512 06a06eafaaeafed88ecc215c4b8c9ee563b7d2e9c875b5aeb27c5afe36b8978febc491b38269d6037130ca5106f4c53c5c7715d82a29583909c29ac30da05b2f
SSDEEP 24576:ViF8u8FpJqH1izria7/mfAGzr55oLGh+3ZZ4OAI:86ZFPqV9a7/LW52LGgp9AI
TLSH
T1B335F1A9B7E101F0D47BD13889464663F6B2B4251364FFDF06A88A551F23AE44B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 c1bb1bc2e0b23b5168ccd65b9d5d80146b692b9a24177e84dc63a938a4fc4ded
MD5 954eca2dc77c883be841db621fefbdd5
SHA1 d0fb2a94a697a137efb292151dff8e4af3a90277
SHA512 774f88118c5536214e4f12f2ce9236a6aa776e16d9ca3633a2061f39c5ea776c068a3cbe6464c373d686f8ac8499eed8ad9ec2fe7269bfbbbd76686feb2b6f45
SSDEEP 12288:1HvUrBFrEjwaQf6mQYhVu4a1zlRPjVNzBKUoF0vsY8Yh+4e/GmtmY4lzIpAJy:1PUr+NQuAGzr55oLGh+3ZZ4OAI
TLSH
T17B05F15E62A818E5E67AE17C89864719E771B4621701F3CF02E1803E4F67EE8BD3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 dc298d08186968277dae52cc9b5e9f0e0bbf95b6b257617ac3f49bac7ef3f383
MD5 68e9ba5f61234efab06e0b2d0d551639
SHA1 e93e2162f66bdf5c979bfc61b5d12f35bc46c28d
SHA512 9ef0dc76324cdcc28341bb87b92225eb0d41dc969551512c9fd635d23dc52c0d10a87365d7e399a92740749ed1069dc482756389695329708a1b851f4cea801d
SSDEEP 49152:yBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjEW52LGgp9AI:9G05lO43bYo
TLSH
T192D5CF6E62EC11F9D1BBC17CD9C64A0BEBB23425032556CF02A486A91F27FF4A57E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 69be4be0c6a777665f41913f0654a669188b71077309174df8c412ba89d3567a
MD5 8795f234f08bdf86c891be021d60bf89
SHA1 2947dde0511606f04dc1c642a62646b6c308f08f
SHA512 9573e993a8e45b17ed3cce288c79edadd76f39cddbf74f7f7f5ca2522beb70373fd072a64a68d956b7f09fdd0d31c66ae30bc5964aa8b38e0e666eb1f96fd6a6
SSDEEP 24576:TNcwHdjbyQ4nLC18lb/EOjowL7FkEAGzr55oLGh+3ZZ4OAI:TNc/zEOVHFmW52LGgp9AI
TLSH
T157858B5A23E901E4E1BBE1BE897B9546FA717865133096CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 bda4182ae47435813e1540404c27566cc1ae75f8058c076ec37a7b2f9fe3035b
MD5 b4f58bb60991f0c73a632069c4667957
SHA1 573df6f430a242cfeef30d9125f17dad05691e1b
SHA512 2b41e9eaab49ec93a7f2bd8355826e4bff4aecfa407f6b725de74c1d044f35a66fee0cb440e80f3256014b07013070e5d306f7d92ce1152b838635e14632eeac
SSDEEP 12288:Y6HPJnJP6szeCs6Rl28dWmQYhVu4a1zlRPjVNzBKUoF0vsY8Yh+4e/GmtmY4lzIV:ZJnJPbzB4SKAGzr55oLGh+3ZZ4OAI
TLSH
T14515DF6DD2A810E8E4B7C2B4811A1A6AFF31387D2F1579C755B4D4353F12EE0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 6db5136bd5c91e18978ed2e6e0f93f71f5d99accc828521cefc96bd3c3ed2ed0
MD5 7a0e906b724503d3aefb4204ff1d0161
SHA1 2243093bfd9a1815a0a17aa22d2ea0be1c8e1e63
SHA512 501afcb677a5be164bfbf21b6b56de12f5378e071342fff63e27dd28478e530d39c3deface583e58be4285002fdad9c9777468374b4db97826603e166c26c573
SSDEEP 12288:C1Hck6j5ZI7MmQYhVu4a1zlRPjVNzBKUoF0vsY8Yh+4e/GmtmY4lzIpAJy:e6DIYAGzr55oLGh+3ZZ4OAI
TLSH
T11105018C637610F5D1ABD03E85870512D2B2B0B19B517ADF46A4887E9FB3ED8B93CE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 cb34300887da8178619c62fb73f3fb4293b2dead0561c7deb6a5771536393661
MD5 c056afc4a0ce2a7d5a41f27ea430886e
SHA1 095239c234904042675155d27455bb39f3d7c20b
SHA512 15881345e50c3318d5405cac054e842f073ab82e6b10622c5506089b722007df7b309e015c77e59609dc0b94fb4e51674796942568de66b5c6b39e90c2769284
SSDEEP 12288:5G6kycWmQYhVu4a1zlRPjVNzBKUoF0vsY8Yh+4e/GmtmY4lzIpAJy:wtycKAGzr55oLGh+3ZZ4OAI
TLSH
T118F413CC93A061D5E6BA4234896B05A18F35BC706F40B7DF50A1993E2F39BD0B934F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 c4985bb5eb3709056186d89e6d512a1faed41758fc7c2b51f0f75d9b54ee123f
MD5 d6cfdae742c679fe7fd56a725c76dfdd
SHA1 279619f10ca99d8278dd9c09e5cd47794e7832b7
SHA512 b156fc1256d82f33e2993321c838025dde15ec9e31a93e955d066bcfa252df4a74ff77dfb0db00da90179d48710802d42f28582ebf5b68bf361dcabd1ee20980
SSDEEP 12288:pKPmQYhVu4a1zlRPjVNzBKUoF0vsY8Yh+4e/GmtmY4lzIpAJy:MfAGzr55oLGh+3ZZ4OAI
TLSH
T104D423CCD271A291D26B8374442E0AB24675B0F56F84B7EF90A60C399B7D9D0E238F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 fe2e4f34991de1556a32096b211ddf18e17ce7a651bc9330819d9155a38dddb6
MD5 bf77dfb3d951c0c87053ed611745ce06
SHA1 5fd202d03a17465a882df2940ad6586edac7b96f
SHA512 f2e0deb8cfd67838d799c981956122d2c0c98d9c97be6c0d0a3533b0b53409b3fb51ee81db194c27910d0536c6b70edf025003d40a753f41e6c4ecbb5e498ecf
SSDEEP 12288:IDgguZyFDK3tT5Tr7aVLIH9lH3cEmQYhVu4a1zlRPjVNzBKUoF0vsY8Yh+4e/GmP:IDggLoTfaidZrAGzr55oLGh+3ZZ4OAI
TLSH
T159559C1DA7EA05CAE2B2D275D8721493D633B4315772D6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1304-323-0x00007FF730D60000-0x00007FF731003000-memory.dmp

Download

memory/1304-324-0x000001D874C00000-0x000001D874C66000-memory.dmp

Download

memory/1304-325-0x000001D874C00000-0x000001D874C66000-memory.dmp

Download

memory/1512-59-0x00000265BD4D0000-0x00000265BD64D000-memory.dmp

Download

memory/1512-60-0x00000265BD770000-0x00000265BD7D6000-memory.dmp

Download

memory/1512-61-0x00000265BD770000-0x00000265BD7D6000-memory.dmp

Download

memory/1840-274-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/1840-275-0x00000000009B0000-0x0000000000A19000-memory.dmp

Download

memory/1840-280-0x00000000009B0000-0x0000000000A19000-memory.dmp

Download

memory/3048-7-0x00000000028A0000-0x0000000002909000-memory.dmp

Download

memory/3048-6-0x00000000028A0000-0x0000000002909000-memory.dmp

Download

memory/3048-1-0x00000000028A0000-0x0000000002909000-memory.dmp

Download

memory/3048-0-0x00000000003C0000-0x0000000000567000-memory.dmp

Download

memory/3048-26-0x00000000003C0000-0x0000000000567000-memory.dmp

Download

memory/3064-41-0x00000161CE650000-0x00000161CE6B6000-memory.dmp

Download

memory/3064-39-0x00000161CE650000-0x00000161CE6B6000-memory.dmp

Download

memory/3064-40-0x00000161CE650000-0x00000161CE6B6000-memory.dmp

Download

memory/3064-38-0x00000161CE3B0000-0x00000161CE52D000-memory.dmp

Download

memory/3656-65-0x00007FF734C70000-0x00007FF734D93000-memory.dmp

Download

memory/3656-17-0x000001548AAB0000-0x000001548AB16000-memory.dmp

Download

memory/3656-15-0x00007FF734C70000-0x00007FF734D93000-memory.dmp

Download

memory/3656-16-0x000001548AAB0000-0x000001548AB16000-memory.dmp

Download

memory/3656-18-0x000001548AAB0000-0x000001548AB16000-memory.dmp

Download

memory/4164-29-0x000001F5A0A50000-0x000001F5A0BCD000-memory.dmp

Download

memory/4164-31-0x000001F5A0BD0000-0x000001F5A0C36000-memory.dmp

Download

memory/4164-32-0x000001F5A0BD0000-0x000001F5A0C36000-memory.dmp

Download

memory/4164-30-0x000001F5A0BD0000-0x000001F5A0C36000-memory.dmp

Download

memory/4272-287-0x0000026F77F90000-0x0000026F77FF6000-memory.dmp

Download

memory/4272-286-0x0000026F77F90000-0x0000026F77FF6000-memory.dmp

Download

memory/4272-298-0x00007FF72E810000-0x00007FF72EF54000-memory.dmp

Download

memory/4428-347-0x00000237B5F20000-0x00000237B5F86000-memory.dmp

Download

memory/4428-343-0x00000237B5F20000-0x00000237B5F86000-memory.dmp

Download

memory/4428-341-0x00007FF6E2C00000-0x00007FF6E2F21000-memory.dmp

Download

memory/4428-342-0x00000237B5F20000-0x00000237B5F86000-memory.dmp

Download

memory/4428-349-0x00007FF6E2C00000-0x00007FF6E2F21000-memory.dmp

Download

memory/4516-238-0x0000021244460000-0x00000212444C6000-memory.dmp

Download

memory/4516-236-0x00007FF6CBE10000-0x00007FF6CBED9000-memory.dmp

Download

memory/4516-237-0x0000021244460000-0x00000212444C6000-memory.dmp

Download

memory/4516-322-0x00007FF6CBE10000-0x00007FF6CBED9000-memory.dmp

Download

memory/4860-303-0x00007FF75CB60000-0x00007FF75CF77000-memory.dmp

Download

memory/4860-305-0x000002759D910000-0x000002759D976000-memory.dmp

Download

memory/4860-304-0x000002759D910000-0x000002759D976000-memory.dmp

Download

memory/4880-267-0x0000023869BF0000-0x0000023869C56000-memory.dmp

Download

memory/4880-268-0x0000023869BF0000-0x0000023869C56000-memory.dmp

Download

memory/4880-265-0x00007FF67A3E0000-0x00007FF67A52A000-memory.dmp

Download

memory/4880-352-0x00007FF67A3E0000-0x00007FF67A52A000-memory.dmp

Download

memory/4988-353-0x000001D089E40000-0x000001D089EA6000-memory.dmp

Download

memory/4988-355-0x000001D089E40000-0x000001D089EA6000-memory.dmp

Download

memory/4988-354-0x00007FF7FAD80000-0x00007FF7FB00B000-memory.dmp

Download

memory/5512-245-0x00007FF6CBE10000-0x00007FF6CBED9000-memory.dmp

Download

memory/5512-246-0x000001A8748D0000-0x000001A874936000-memory.dmp

Download

memory/5512-247-0x000001A8748D0000-0x000001A874936000-memory.dmp

Download

memory/5512-331-0x00007FF6CBE10000-0x00007FF6CBED9000-memory.dmp

Download

memory/5576-294-0x00000263C66B0000-0x00000263C6716000-memory.dmp

Download

memory/5576-299-0x00007FF7104E0000-0x00007FF71058E000-memory.dmp

Download

memory/5576-293-0x00000263C66B0000-0x00000263C6716000-memory.dmp

Download

memory/5700-49-0x0000026F39E00000-0x0000026F39E66000-memory.dmp

Download

memory/5700-47-0x00007FF6A0870000-0x00007FF6A09D8000-memory.dmp

Download

memory/5700-313-0x00007FF7EB480000-0x00007FF7EB534000-memory.dmp

Download

memory/5700-314-0x000002109CDE0000-0x000002109CE46000-memory.dmp

Download

memory/5700-315-0x000002109CDE0000-0x000002109CE46000-memory.dmp

Download

memory/5700-48-0x0000026F39E00000-0x0000026F39E66000-memory.dmp

Download

memory/5700-56-0x00007FF6A0870000-0x00007FF6A09D8000-memory.dmp

Download

memory/5700-54-0x0000026F39E00000-0x0000026F39E66000-memory.dmp

Download

memory/5840-332-0x0000023D7E440000-0x0000023D7E4A6000-memory.dmp

Download

memory/5840-334-0x0000023D7E440000-0x0000023D7E4A6000-memory.dmp

Download

memory/5840-333-0x00007FF604580000-0x00007FF604715000-memory.dmp

Download

memory/5848-254-0x000001B0BBE00000-0x000001B0BBE66000-memory.dmp

Download

memory/5848-340-0x00007FF78CB00000-0x00007FF78CC1A000-memory.dmp

Download

memory/5848-255-0x000001B0BBE00000-0x000001B0BBE66000-memory.dmp

Download

memory/5848-253-0x00007FF78CB00000-0x00007FF78CC1A000-memory.dmp

Download