6fea57cacb087be42e639abd73ec81388c9bbc0e4611ef165c4260164c00e015

Analysis

max time kernel
147s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_f9765d70099c8653194b6bbd47b02dd5_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Size 928KB
Sample260804-krypbagd27
SHA256 6fea57cacb087be42e639abd73ec81388c9bbc0e4611ef165c4260164c00e015
MD5 f9765d70099c8653194b6bbd47b02dd5
SHA1 8131a96e5574088197995f3b18b4bb4c2ddd5c39
SHA512 9d4eac7c9e5293a0bd529c23d0206ed2ab77bd26dc10c4caf269f7237cd01f76d7e847d801fa718ba2c7f0a3846ef3dc6cb35a715ffcfbabbf20e9c25b9346a0
SSDEEP 12288:M8wSfxL/2Dc3bDLLmt0LDQewsAjUTghfNyhmtyu1TmWXwwhQyjMoMyshchv+t0cQ:ZmewsAj1yh67TbhQyOhcJ+dmHqxgj
TLSH
T13B15E031FE74E032C2BB0DB21B36D716547C79204BA11AC7E3A89E9D59702E22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
4644	alg.exe
3312	elevation_service.exe
4400	elevation_service.exe
2472	maintenanceservice.exe
2120	OSE.EXE
5980	GameInputSvc.exe
4328	GameInputSvc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_f9765d70099c8653194b6bbd47b02dd5_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8811df238bf42.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_f9765d70099c8653194b6bbd47b02dd5_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_f9765d70099c8653194b6bbd47b02dd5_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4328	GameInputSvc.exe
4328	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2868	2026-08-03_f9765d70099c8653194b6bbd47b02dd5_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Token: SeDebugPrivilege	4644	alg.exe
Token: SeDebugPrivilege	4644	alg.exe
Token: SeTakeOwnershipPrivilege	3312	elevation_service.exe
Token: SeTcbPrivilege	5980	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5980 wrote to memory of 4328	5980	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-03_f9765d70099c8653194b6bbd47b02dd5_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_f9765d70099c8653194b6bbd47b02dd5_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2868

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4644

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3312

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4400

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2472

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2120

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5980
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4328

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
PID:1620

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
PID:1548

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:5960

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:5544

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:1096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3d8f3325d277899353819f5f72f97612efdbba322cd4b1a87fb638673a144931
MD5 a0d2351b50e8e350449c3a9da9e08b0b
SHA1 cd7afad0cd281828957c004ac92885046afb9876
SHA512 7bebb9ed01e966ed684674968bb58b1c9288dd38299cd7f8f7aeb47dcabb37f97538530968b445b374fc66ff489e2220866f7128d88b6b645fd90cbcb2e227fc
SSDEEP 49152:/te632BuPkFKRrdE6oh7stBhuXjfS4LWxncU7mqhH3j:r3q6gjBi7moXj
TLSH
T129D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 a36b6a2aac22dc04851e98111f80185bcaa434e8ed3898bd353d4a1e72542900
MD5 60c7284d109b80cb9f9f805af8cad628
SHA1 e6faf02bf2ae97f8a38bc0d494027722325ebc74
SHA512 8ca4e3c30c89614199f7e9936094f32d1af1d9fd355620a02d0d3428325a9853ef9cec9afb43384fcc9e3ab7361b47f7796d6f03e23ca7d7344f027d2c40025f
SSDEEP 12288:E1XLsICWkxSIEPumczA8TghfNyhmtyu1TmWXwwhQyjMoMyshchv+t0cNBKnh2OLz:CXYxDSczAdyh67TbhQyOhcJ+dmHqxgj
TLSH
T191050228B7E408F9EC67923DC8B28516E733781187A4E75F03A499255F233E85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 826KB
SHA256 aae61f397435b38fd53621b98ce6e32c80e7a40ebaa9d28c06b0365422963d2e
MD5 08c905567288da36613ca80d0d76551c
SHA1 f9310df9f244f366d4485ba39d02ea096af9403d
SHA512 bca0da8b3e68112638d123e29729fab7ccf351df1096905bebaba3b114a7ea58c6a180a79cac49fe198e850bfa3f1809d4f2c788e88c68e7d75336f6f0d63b7a
SSDEEP 12288:Vmw5HEjsChNnBFgl0WDm+CSTghfNyhmtyu1TmWXwwhQyjMoMyshchv+t0cNBKnh9:Qwu+OWayh67TbhQyOhcJ+dmHqxgj
TLSH
T1A205F14677A81CF9E9A79139C657C536F3B2B8122A24D71F1760C65B6F33320AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 faddae58979e61b351042fbbba6a8f8c28e3212aad7cf3a8e4fc38342f3c48bc
MD5 165cf358089ef9f6a3e88d8614c7363e
SHA1 c5c4030a4efbd6f59c18d3e45e1e1fff05d294dd
SHA512 ced90833af2e45136efcf909d0524106e80946a84d9425419ea4ab80a676e754f994b9644597ca09157853279ec786e6d77fa38c797c9df9463719b1386c7230
SSDEEP 49152:mr+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl3U7mqhH3j:Su6JmTxd2dk7moXj
TLSH
T130D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 607KB
SHA256 4ff1a265de11f6f95a05d877b96c659e479238897c49715a6f79c4e05f85f102
MD5 a2f82d3a5f731806c049fee15fbb5c5a
SHA1 84ea735f8c5ba684777642c3eacb1b5366db5a13
SHA512 1109ee61c579d5ac8b94ef5527a2b9a5791770e556318df5fcc82755f19f7688542fa3b1a9520a2d7334cdcd44a2c123f659922102f3671b5e2758520a23e928
SSDEEP 12288:IN7sATghfNyhmtyu1TmWXwwhQyjMoMyshchv+t0cNBKnh2OLCrdHgj:oshyh67TbhQyOhcJ+dmHqxgj
TLSH
T188D423A2A79C3513E4AB7571C179663AD32C7032EF6CD0AFB7012A44B5715F8AC38B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 567cacbf8907f6cabbed89024acf82c3620571c0825eafab9c752f479e5b0616
MD5 6f7bca8505242f706a0a74e441ee0381
SHA1 9c503b0ba77b0ef6b0019dcbab23bdec08142c4e
SHA512 3eae41d6b2124c49aab67ef568483fd15d3f94549c3ce5737422a2a3517325368c4518a80d9e58b59b5d0421885ae3c231b173112044a278a09aa1fff43efb4b
SSDEEP 12288:f8GvTghfNyhmtyu1TmWXwwhQyjMoMyshchv+t0cNBKnh2OLCrdHgj:UGcyh67TbhQyOhcJ+dmHqxgj
TLSH
T1BAE4226936F93095C47BA276C4356567F2B83021AB28A1FF0790A934EB656F07E3CF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 e8b274feed7e2ce13e813f7ee21dc8322cf109a6b2b6940be0d42d9d8d934bf9
MD5 1126b546f863379043be5ab6e2495a44
SHA1 7d11af077dc81ba59f954fbf6d38733e81e91770
SHA512 12e7d9c60d22de147326eb2fcab8568946b75cbc8ef2a7b842fc9ee5e70cefbdeff07d44a8f05a8e584edb2b275e3649b334de1b3f17678f3fcc24d9fe1fc386
SSDEEP 12288:2UTghfNyhmtyu1TmWXwwhQyjMoMyshchv+t0cNBKnh2OLCrdHgj:21yh67TbhQyOhcJ+dmHqxgj
TLSH
T1ADD423D1B7AC3143D5977572C1323A2AD36C3022EBACA1EF77116900B5A65F8AD3CB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 a1d943e9d052408d0a90f3e8af09e1177084644ed8ea5d36c318912870fd7eff
MD5 a5f4062b00d663f067fe20acc25118b0
SHA1 837c410cc5323607507e78f48ae371fb5e4101dc
SHA512 417b0d6870a33c7d2bfe699954ae77a9d6f6021dbc6fbc18627ba7abb58bb2808d97180f43581524cf5df22f3a196ab946ee70acfba56b993464558b6aa80391
SSDEEP 12288:WHvUrBFrEjwaQiTghfNyhmtyu1TmWXwwhQyjMoMyshchv+t0cNBKnh2OLCrdHgj:WPUr+NQTyh67TbhQyOhcJ+dmHqxgj
TLSH
T1CB05E12F66AC18E5E67AF17DC5828719E371B4221711D2DF03A0817E5E67AE8BC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 aaf18e68a1225fea1f156526d4ca86b39dd3fc99e735590c01c7de498e4e25f8
MD5 8215a38443695b36a45a7e536ab52a8c
SHA1 b1512606fb067d8ef13e394fcea927ae12305ae0
SHA512 1dc49fd7dd036e950f5adb4b569b6bb4f31380ef98081f65191953bd7986f8a2d708881d892bbed41671d6c9c9284531e1e01122c26b7b751de6e3f161db7fb5
SSDEEP 49152:+BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjUU7mqhH3j:BG05lO43bg7moXj
TLSH
T1FBD5C06A62EC11F9D1BBD17CCAC64A0BEBB23415033556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 1a73f4c1b77aaa3eb7b307a4a3ea610adf1fc3864dd666521bc4dae44cf76730
MD5 67a073a32f29fdd78656d5331f7fe5fd
SHA1 a8470b42ac790296fed6f586798620061ee81a6d
SHA512 4b54823d35d15f8f81a85ddc32bca62abdce1cc63c7e046a5ac162ef537d2cbaedf60e551eaff8b3c3aca6369b1829d33607077036240cd5c3d20609e0b98f90
SSDEEP 12288:f1HRk6j5ZI7jTghfNyhmtyu1TmWXwwhQyjMoMyshchv+t0cNBKnh2OLCrdHgj:k6DIEyh67TbhQyOhcJ+dmHqxgj
TLSH
T173F4015D337A20B6D06BE03EC6930516D2B2B031972656DF0B94C5799EA3EE8B93CF41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 79d13af5a44ed55ab5403965615c020da43a838b32454a6f48340cbb830a0a44
MD5 77c9c9c57c58d626caaab1277c9d01b7
SHA1 e09cd7d2578bd2bf52b166a8ec5f25fe0fc69b45
SHA512 c21a20ae2535ce69c7454dac2b547db56e76ffb7cdc03faa47acbd4d73241dc6387519ec555788a7e0711c4ccc71a1efc09918ef9233a675ee153d06dc45fdce
SSDEEP 12288:EG6kyHTghfNyhmtyu1TmWXwwhQyjMoMyshchv+t0cNBKnh2OLCrdHgj:Vty0yh67TbhQyOhcJ+dmHqxgj
TLSH
T153F4234163983095E5BB2234CA724265C7387821AB2593EF2751EA3D7F367F4BC34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1096-294-0x000001745E4D0000-0x000001745E536000-memory.dmp

Download

memory/1096-293-0x000001745E4D0000-0x000001745E536000-memory.dmp

Download

memory/1096-299-0x00007FF6C5B70000-0x00007FF6C5C1D000-memory.dmp

Download

memory/1548-262-0x00007FF656E40000-0x00007FF656F89000-memory.dmp

Download

memory/1548-268-0x000001A9E1750000-0x000001A9E17B6000-memory.dmp

Download

memory/1548-267-0x000001A9E1750000-0x000001A9E17B6000-memory.dmp

Download

memory/1620-254-0x0000014F87B30000-0x0000014F87B96000-memory.dmp

Download

memory/1620-255-0x0000014F87B30000-0x0000014F87B96000-memory.dmp

Download

memory/1620-253-0x00007FF60EA00000-0x00007FF60EB19000-memory.dmp

Download

memory/2120-60-0x00000241B9050000-0x00000241B90B6000-memory.dmp

Download

memory/2120-59-0x00000241B8E00000-0x00000241B8F2C000-memory.dmp

Download

memory/2120-61-0x00000241B9050000-0x00000241B90B6000-memory.dmp

Download

memory/2472-56-0x00007FF63F280000-0x00007FF63F3E7000-memory.dmp

Download

memory/2472-48-0x0000017FC2550000-0x0000017FC25B6000-memory.dmp

Download

memory/2472-54-0x0000017FC2550000-0x0000017FC25B6000-memory.dmp

Download

memory/2472-47-0x00007FF63F280000-0x00007FF63F3E7000-memory.dmp

Download

memory/2472-49-0x0000017FC2550000-0x0000017FC25B6000-memory.dmp

Download

memory/2868-6-0x00000000032C0000-0x0000000003329000-memory.dmp

Download

memory/2868-0-0x00000000004C0000-0x0000000000666000-memory.dmp

Download

memory/2868-26-0x00000000004C0000-0x0000000000666000-memory.dmp

Download

memory/2868-1-0x00000000032C0000-0x0000000003329000-memory.dmp

Download

memory/2868-7-0x00000000032C0000-0x0000000003329000-memory.dmp

Download

memory/3312-30-0x00000276923B0000-0x0000027692416000-memory.dmp

Download

memory/3312-32-0x00000276923B0000-0x0000027692416000-memory.dmp

Download

memory/3312-29-0x0000027692150000-0x000002769227C000-memory.dmp

Download

memory/3312-31-0x00000276923B0000-0x0000027692416000-memory.dmp

Download

memory/4328-247-0x000001C370F80000-0x000001C370FE6000-memory.dmp

Download

memory/4328-245-0x000001C370F80000-0x000001C370FE6000-memory.dmp

Download

memory/4328-244-0x00007FF719D90000-0x00007FF719E58000-memory.dmp

Download

memory/4400-38-0x000001A385E40000-0x000001A385F6C000-memory.dmp

Download

memory/4400-39-0x000001A3870D0000-0x000001A387136000-memory.dmp

Download

memory/4400-41-0x000001A3870D0000-0x000001A387136000-memory.dmp

Download

memory/4400-40-0x000001A3870D0000-0x000001A387136000-memory.dmp

Download

memory/4644-65-0x00007FF63E7C0000-0x00007FF63E8E2000-memory.dmp

Download

memory/4644-16-0x000001D015B90000-0x000001D015BF6000-memory.dmp

Download

memory/4644-18-0x000001D015B90000-0x000001D015BF6000-memory.dmp

Download

memory/4644-17-0x000001D015B90000-0x000001D015BF6000-memory.dmp

Download

memory/4644-15-0x00007FF63E7C0000-0x00007FF63E8E2000-memory.dmp

Download

memory/5544-295-0x00007FF7297D0000-0x00007FF729F13000-memory.dmp

Download

memory/5544-286-0x00000194B8300000-0x00000194B8366000-memory.dmp

Download

memory/5544-287-0x00000194B8300000-0x00000194B8366000-memory.dmp

Download

memory/5960-275-0x0000000000940000-0x00000000009A9000-memory.dmp

Download

memory/5960-280-0x0000000000940000-0x00000000009A9000-memory.dmp

Download

memory/5960-274-0x0000000000400000-0x0000000000548000-memory.dmp

Download

memory/5980-237-0x000001F7E0350000-0x000001F7E03B6000-memory.dmp

Download

memory/5980-238-0x000001F7E0350000-0x000001F7E03B6000-memory.dmp

Download

memory/5980-236-0x00007FF719D90000-0x00007FF719E58000-memory.dmp

Download