5a0b13fe80574a6d854ef867fe1d12a2c20432484dff9d4d72f350d9b1735c0a

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 11:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_6662ba57f7d73e20b8ef66df79cf27a2_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Size 928KB
Sample260804-nqeftsvwds
SHA256 5a0b13fe80574a6d854ef867fe1d12a2c20432484dff9d4d72f350d9b1735c0a
MD5 6662ba57f7d73e20b8ef66df79cf27a2
SHA1 646d8e65c2630f0040e331a73b179b5529c418f4
SHA512 186139de74242e38a7b7f3ec9e907f7773dac43697d0efb35a33370bad342a2f247b0a91cc151862cc158a5d414dca27e8d9ff3fc0b676046fcc539ee448e68e
SSDEEP 12288:sUwSfxL/2Dc3bDLLmt0LDQewsAj6TghfNyhmtyu1TmWXwwhQyjMoMyshchv+t0cQ:9mewsAjLyh67TbhQyOhcJ+dmHqxgj
TLSH
T1F615E031FE74E036C2BB0DB21B36D716547C79204BA11AC7E3A88E9D59702E22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
4232	alg.exe
4104	elevation_service.exe
5292	elevation_service.exe
4640	maintenanceservice.exe
5368	OSE.EXE
4744	GameInputSvc.exe
1308	GameInputSvc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_6662ba57f7d73e20b8ef66df79cf27a2_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3814b58b209659e8.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_6662ba57f7d73e20b8ef66df79cf27a2_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_6662ba57f7d73e20b8ef66df79cf27a2_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1308	GameInputSvc.exe
1308	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4808	2026-08-03_6662ba57f7d73e20b8ef66df79cf27a2_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Token: SeDebugPrivilege	4232	alg.exe
Token: SeDebugPrivilege	4232	alg.exe
Token: SeTakeOwnershipPrivilege	4104	elevation_service.exe
Token: SeTcbPrivilege	4744	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 1308	4744	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-03_6662ba57f7d73e20b8ef66df79cf27a2_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_6662ba57f7d73e20b8ef66df79cf27a2_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4808

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4232

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4104

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5292

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4640

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5368

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1308

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
PID:4780

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
PID:4832

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:2832

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:2784

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:4168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 21d318feb7761b99a5ffb8d4f806de36b783b520f7927bcbe1de3ba55a0067ad
MD5 8a8a01198f71331fc4dc124978846514
SHA1 a1be0e6e83618ed56e5382b0534474eca958e64b
SHA512 32ccb21c8739e7803bd6e2b090eec163d81987f0f39aee2633a040195490cc280a205fa4e78a29b6902e06e0efcf08d2ff562a67fdf2e8034182ffd750cb406f
SSDEEP 49152:/te632BuPkFKRrdE6oh7stBhuXjfS4LWxn3U7mqhH3j:r3q6gjBD7moXj
TLSH
T1FED59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 808ddcc23854f49fbb2b5e2c66bcb9a7aff567b50d450c85c2d7329e1d746fee
MD5 bcf01948ce8370ea33e7b0b55d7940bb
SHA1 512d58017126ef9969ea7db81551cb3fa3cbbef3
SHA512 240537f985819aa545dc6c1b14d8e3086a9e83d9c685a9d4867055c04aeb6d24c4be85c7602c8ea5cc4bc0816ea17433c068b03739c260319438b0c13975904a
SSDEEP 12288:E1XLsICWkxSIEPumczA2VTghfNyhmtyu1TmWXwwhQyjMoMyshchv+t0cNBKnh2Of:CXYxDSczAhyh67TbhQyOhcJ+dmHqxgj
TLSH
T107050228B7E408F9EC67923DC8B28516E733781187A4E75F03A499255F233E85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 826KB
SHA256 049f51b03a97b5eee604a852355c8fc8ebb644e47382e1c9c385e56cbe3bbd63
MD5 553ee7a9ce4cd2b7d7d6d8640b4310e5
SHA1 8a111c5afc4660b6803676deadd3525b5112afd0
SHA512 3cf5926c4712865fe3844a981ecbd4a829ab2ed5a92eb72fb9dd264208bb0936b4478f4f3faf83fe302ea305fcee30f6e9a494ce7036dcba4522a660087d8eba
SSDEEP 12288:Vmw5HEjsChNnBFgl0WDm+CKTghfNyhmtyu1TmWXwwhQyjMoMyshchv+t0cNBKnh9:Qwu+OWiyh67TbhQyOhcJ+dmHqxgj
TLSH
T1C405F14677A81CF9E9A79139C657D536F3F2B8122A24D71F1360C65B6F33220AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7dacbb4b3c24d34c64101b9a661ceed2d53cf767417d91c2126347d4b28018d2
MD5 3d3350c49e2684dd852af2b69d22a0fc
SHA1 06ad3e0ca0bf6e495c3326be9ea703524c235bb4
SHA512 9fe07ab58c98b17b28edc5e6b5cb05d4ec1b37248ef3eaae3be03257e2148fb80983e72889a043c184d685e9759324d65bd3acaa6bd08385b43dca64dee95ee2
SSDEEP 49152:mr+taZ3usBWOBr4tEGp0bqx0z+n217aau1glBU7mqhH3j:Su6JmTxd2dy7moXj
TLSH
T1FFD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 607KB
SHA256 139a80d2f34a7d92f70c63170714e0cae0a1d1322b50d9e881a30b0b1f65e59c
MD5 e8fc43fc09042c7128635f835c5d5d7d
SHA1 4cc0cc8b878baad134a8dc9bfa8cb067ba21b7de
SHA512 c09288eb68cf5e1244b6e87b597f581cf169e0ecdc01bb2c461734193d7aa19938bf39be94cd7dce63dcb953644e6d79aaa4e0651ad1d8058f6e5870d0de0a59
SSDEEP 12288:IN7aTghfNyhmtyu1TmWXwwhQyjMoMyshchv+t0cNBKnh2OLCrdHgj:oryh67TbhQyOhcJ+dmHqxgj
TLSH
T121D42362A79C3513E4A77571C139663AD32C7032EF5CD0AFB7012A44B9716F8AD38B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 cc09a83b9a2141f18a8173f73eda9a419e6bc584ea8b8491d9e4e469c0ecb38b
MD5 7ac61ffeec3c3972965226be89007556
SHA1 c56086ed0d74baee6691aa43aff1f240f962692e
SHA512 7152b7932dca81b2029d3af36328b6781b20150da83e3b9eca9583bb71e389b549faf7192432327be3fe27c966d12462f0d1bba815e275ef8afc62ba091b2438
SSDEEP 12288:f8GLTghfNyhmtyu1TmWXwwhQyjMoMyshchv+t0cNBKnh2OLCrdHgj:UGoyh67TbhQyOhcJ+dmHqxgj
TLSH
T101E4226A36F93095C47BE236C431656BF2743021AB28A1FF0791A934AB656F07E3CF54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 f81d042d5766a0d868d6fa5692e35025683e2537229172d0af7e3ead1a43b484
MD5 d6b2491d9b008c57767d24fbd3e1370b
SHA1 93e62035ed5adfecf4030fd7643a9cb8258a95af
SHA512 3992a91178e4c371df23345730c328f95b5ce5aa21942897e0c6d6a58d90eec1a8312394690b7ed7b62a019f3444ff0fcc67a16f245b71ea1569ba11130a5e2a
SSDEEP 12288:2xTghfNyhmtyu1TmWXwwhQyjMoMyshchv+t0cNBKnh2OLCrdHgj:2eyh67TbhQyOhcJ+dmHqxgj
TLSH
T16AD42392779C3143C5977572C2366A2AD36C7023EBACE1EF77112900B9A66F86D3CB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 b4ffa4155ecafa5f5ef3118589ae71a3ab5ad9fb79d2e1c02cf4aa42e666a9f9
MD5 c132a8364a001510f96df52434c7a7bb
SHA1 f525477155b8f5d1a86acb64e95dce70a6d7de9e
SHA512 6e8c0ff30fcf8d7b423df61341ce05856a276a07e392450183d2f8eb2b4a29ce504289e32e89e3f97188e066e39ba8332c11efa07235bee38229e4e137bbb7b3
SSDEEP 12288:WHvUrBFrEjwaQCTghfNyhmtyu1TmWXwwhQyjMoMyshchv+t0cNBKnh2OLCrdHgj:WPUr+NQzyh67TbhQyOhcJ+dmHqxgj
TLSH
T1E405E12F62AC18E5E67AB17DC5928719E371B4221711D2DF03A0817E5F67AE8BC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 1.6MB
SHA256 c86178801a848d71b9a3595f1f8aed11da99f213a71959f1132d6e0bdda2bdb2
MD5 eb406a9c7b10937c80b83974598a9ad3
SHA1 cae8a80a4b2006128ceaaa1b67c62a14fdfd1215
SHA512 6e82f3c6345434f88131b9f3a4f2b2df44ad2cff047339d6d7a325ac3f9e9ba086a973773f3cbe193956552d915748d571565d3596e226a47600cfd70cca184b
SSDEEP 49152:+BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTA:BG05lO45
TLSH
T12D757E6E62EC01F9D1BED06DCAC68A0BEBF13416132556CB02A486B91F27FF5653E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 607d4e13dacf671922c38a331f609369c7c5f75747fbd1de29240f8abdbbbf6e
MD5 38864d700f1960f75dcaa83b399a99c0
SHA1 f401d5db0202c64fbf50ba6e1aaed653b7d36ecf
SHA512 ab2070694fb03396921fd7538df54f09bab844f7ac0a5a3a502eaa392ff649a5d0a6e98159020c0dea4b6465a054abcd707120ea9e2961a9d49c54d2ce841ff2
SSDEEP 12288:f1HRk6j5ZI7wTghfNyhmtyu1TmWXwwhQyjMoMyshchv+t0cNBKnh2OLCrdHgj:k6DI1yh67TbhQyOhcJ+dmHqxgj
TLSH
T1BEF4015D337A20B6D0ABE03EC6920512D2B2B031D76656DF0794C5799EA3EE8B93CF41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 8b697b05982aa7e5fc4e581e65ee94c4f1f5c18b30c0709ac16358d9295a4dc3
MD5 0922c4b4bdb240e276044a24d8ae2af0
SHA1 ed14e79d2c59c4b4b15351f6a3c9f1094b37a66a
SHA512 e4fd38956546cc8ec68ff9ea72921586ba1487eb4c07e6ba418ef26f480bd81d839527bd7daa2ab69abe8c52828c8428f831ba276d1e06829f73103502a51060
SSDEEP 12288:EG6kyhTghfNyhmtyu1TmWXwwhQyjMoMyshchv+t0cNBKnh2OLCrdHgj:Vtyuyh67TbhQyOhcJ+dmHqxgj
TLSH
T19BF4224163983095E5BB6234CA734265C738B821AB2592EF2750EA3E6F367F4BC34F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1308-245-0x00007FF61F630000-0x00007FF61F6F8000-memory.dmp

Download

memory/1308-247-0x0000011DBE9C0000-0x0000011DBEA26000-memory.dmp

Download

memory/1308-246-0x0000011DBE9C0000-0x0000011DBEA26000-memory.dmp

Download

memory/2784-288-0x00007FF6401F0000-0x00007FF640933000-memory.dmp

Download

memory/2784-287-0x000001F8CC060000-0x000001F8CC0C6000-memory.dmp

Download

memory/2784-286-0x000001F8CC060000-0x000001F8CC0C6000-memory.dmp

Download

memory/2832-271-0x0000000000400000-0x0000000000548000-memory.dmp

Download

memory/2832-272-0x00000000009F0000-0x0000000000A59000-memory.dmp

Download

memory/2832-277-0x00000000009F0000-0x0000000000A59000-memory.dmp

Download

memory/4104-31-0x0000029D1D010000-0x0000029D1D076000-memory.dmp

Download

memory/4104-29-0x0000029D1CDC0000-0x0000029D1CEEC000-memory.dmp

Download

memory/4104-30-0x0000029D1D010000-0x0000029D1D076000-memory.dmp

Download

memory/4104-32-0x0000029D1D010000-0x0000029D1D076000-memory.dmp

Download

memory/4168-294-0x00007FF64D830000-0x00007FF64D8DD000-memory.dmp

Download

memory/4232-17-0x0000022C57450000-0x0000022C574B6000-memory.dmp

Download

memory/4232-65-0x00007FF69DE70000-0x00007FF69DF92000-memory.dmp

Download

memory/4232-18-0x0000022C57450000-0x0000022C574B6000-memory.dmp

Download

memory/4232-16-0x0000022C57450000-0x0000022C574B6000-memory.dmp

Download

memory/4232-15-0x00007FF69DE70000-0x00007FF69DF92000-memory.dmp

Download

memory/4640-56-0x00007FF61E780000-0x00007FF61E8E7000-memory.dmp

Download

memory/4640-54-0x0000024AA9850000-0x0000024AA98B6000-memory.dmp

Download

memory/4640-49-0x0000024AA9850000-0x0000024AA98B6000-memory.dmp

Download

memory/4640-48-0x0000024AA9850000-0x0000024AA98B6000-memory.dmp

Download

memory/4640-47-0x00007FF61E780000-0x00007FF61E8E7000-memory.dmp

Download

memory/4744-237-0x00000199FE200000-0x00000199FE266000-memory.dmp

Download

memory/4744-236-0x00007FF61F630000-0x00007FF61F6F8000-memory.dmp

Download

memory/4744-239-0x00000199FE200000-0x00000199FE266000-memory.dmp

Download

memory/4780-254-0x0000016AA7400000-0x0000016AA7466000-memory.dmp

Download

memory/4780-255-0x0000016AA7400000-0x0000016AA7466000-memory.dmp

Download

memory/4780-253-0x00007FF63AAC0000-0x00007FF63ABD9000-memory.dmp

Download

memory/4808-0-0x0000000000990000-0x0000000000B36000-memory.dmp

Download

memory/4808-1-0x0000000002410000-0x0000000002479000-memory.dmp

Download

memory/4808-7-0x0000000002410000-0x0000000002479000-memory.dmp

Download

memory/4808-26-0x0000000000990000-0x0000000000B36000-memory.dmp

Download

memory/4832-265-0x000001D7D4020000-0x000001D7D4086000-memory.dmp

Download

memory/4832-264-0x000001D7D4020000-0x000001D7D4086000-memory.dmp

Download

memory/4832-262-0x00007FF60FE40000-0x00007FF60FF89000-memory.dmp

Download

memory/5292-39-0x0000019249AE0000-0x0000019249B46000-memory.dmp

Download

memory/5292-40-0x0000019249AE0000-0x0000019249B46000-memory.dmp

Download

memory/5292-41-0x0000019249AE0000-0x0000019249B46000-memory.dmp

Download

memory/5292-38-0x0000019249890000-0x00000192499BC000-memory.dmp

Download

memory/5368-60-0x000001E86F300000-0x000001E86F366000-memory.dmp

Download

memory/5368-61-0x000001E86F300000-0x000001E86F366000-memory.dmp

Download

memory/5368-59-0x000001E86F390000-0x000001E86F4BC000-memory.dmp

Download