13b8f24de71f61c11b19e4760d93c5312d0de798ad38503a70db6c88b5489847

Analysis

max time kernel
144s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_16c5d182a7ea12bc42723af100aca335_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Size 932KB
Sample260820-tee6waed25
SHA256 13b8f24de71f61c11b19e4760d93c5312d0de798ad38503a70db6c88b5489847
MD5 16c5d182a7ea12bc42723af100aca335
SHA1 a222289c7efee102d71898b2cb6ea9c85343627d
SHA512 f51bc3b96d853d7f85fb859db8dedd105d07196b1d501930113119caa3479df8c122934f0a73587845a0c10cb797fa4e18fff5d272c4f616b8512deb1b4005e5
SSDEEP 12288:fAwSfxL/2Dc3bDLLmt0LDQewsAjSxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3Y:omewsAjY9ePSfPFB9nLSb6LOD/f/o
TLSH
T1D115E031FB74E036C3BB0DB61B3AD31A143DB9604B6119C7E3A84D9E59342D26376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 9 IoCs

pid	Process
1808	alg.exe
1852	elevation_service.exe
2100	elevation_service.exe
2344	maintenanceservice.exe
3300	OSE.EXE
6096	GameInputSvc.exe
2696	GameInputSvc.exe
2020	msdtc.exe
2068	PerceptionSimulationService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-20_16c5d182a7ea12bc42723af100aca335_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\97726b10b05c2f27.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-20_16c5d182a7ea12bc42723af100aca335_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_16c5d182a7ea12bc42723af100aca335_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2696	GameInputSvc.exe
2696	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2212	2026-08-20_16c5d182a7ea12bc42723af100aca335_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Token: SeDebugPrivilege	1808	alg.exe
Token: SeDebugPrivilege	1808	alg.exe
Token: SeTakeOwnershipPrivilege	1852	elevation_service.exe
Token: SeTcbPrivilege	6096	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6096 wrote to memory of 2696	6096	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-20_16c5d182a7ea12bc42723af100aca335_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_16c5d182a7ea12bc42723af100aca335_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2212

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1808

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1852

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2100

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2344

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3300

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6096
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2696

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2020

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2068

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:3360

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:4400

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:4464

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:4336

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:6064

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:3824

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:2248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9cd861700c9a0a763c083345e21bd74f1ea8673f3337294d69d5b2411928473d
MD5 00b27bf6bc9f46554214b748eb0db799
SHA1 aefce62ef0eba79d4826976fce989273ff23c6eb
SHA512 852039dba999eb0ac33351a5d411b93230155f66a70c0e2f2093513b73b8b54b9a98d5cd3bbcf88fabbe30e77fd91b51c8097c8c37bd5a2c7b8ec9c435f00c23
SSDEEP 49152:Sb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnEB9gSFjwTb:03q6gjBl/gujw
TLSH
T110D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 f5fb137faf78a2de454f602ec3df5b6baf68907ffe8611631663e647e7c0656a
MD5 5e25798648493a6a998404669fd822ee
SHA1 502e9a433baa34b7706ecbccc8b6e35ef50ce440
SHA512 a9ee6d8c017f04f8073b933f0985ecf8b6a62221fa0fe07ebf5b3d8b44b563bb80a0d9177586c5459a56e4bbd609f9df583cd7b3877858d7088a437793973788
SSDEEP 12288:01XLsfwWkxy2lRq2czAuxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:SXYIDtczAc9ePSfPFB9nLSb6LOD/f/o
TLSH
T194050228A39509F9ED67823CC9B28116E733BC954760E68F03E499291F337D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 98de30e33a4e6e968e07f999ed56694c6a81fb7ea671fffc65c291fab6c619b6
MD5 480e80a9b42b91a8eea98260375d51a9
SHA1 5a05a4e5e5f5882e5ceeb1746bee5a0d05f685f2
SHA512 c4b6cd6e8b21f98d2f9d005a3468763e7ee6bdc50d5bf464587d604555c183afd7d3e84ad90471f472568f7be1f94b86e7b42011b8336dfec9af384df66595b7
SSDEEP 12288:Ymw5HEjsChNYBFgl0WTm+CZxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:VwuROWQ9ePSfPFB9nLSb6LOD/f/o
TLSH
T14105F14A73941CF9EA6782388597D136F7B3BC521A21CB0F1760C65B5F37361AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4c78ae29e527263a3e76374cbe25d774d17e677a31ec02232c3b9e5cb1dfc5c6
MD5 07a8d03cc7ca4cf784ba0de427d9bb8a
SHA1 dde1a4489437c424761cb2cdf65095d16d1f6a35
SHA512 4e7a60ced3189b05134cfaa7ebf09819261c832f2a4a8634fe07b986e27c506b3f61a41f949045b062c2d1adb914f451f88c768f15d1b07f2ee2a9d5918f998d
SSDEEP 49152:jB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glS9gSFjwTb:Vu6JmTxd2dGgujw
TLSH
T170D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0B9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 c2af0e1f27af46c6ea5a974ae8359482ea916ae0037847fbf82ed2ca67a65cbb
MD5 06deb141915f53aa46312ced4e212e49
SHA1 901edd7df50b81f2e1470e7fc10058f3fb17b594
SHA512 460de1adb35263c1c08921036c8b6deef800e8d9e6e0680bdad01ca620cb7d21914bc50ed35d15a3cb85ff4991b2477c9db233b3ec8e5ca624527effc2651221
SSDEEP 12288:sY7LxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:Bt9ePSfPFB9nLSb6LOD/f/o
TLSH
T12BD42339C3059A7BE673563815FEA03E132FBCEA0A21C84FB709191D1237BD6C671666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 cf5a99c7833608f396fd74358d395937a9da2ae2ff40511d795f626056433e77
MD5 19204623c5d1f6c63080745cc11c8027
SHA1 28a26716586b378cd7dc6fab6ac155019401a7a1
SHA512 f1cd8cd3cd3577f8eac3e839650566187b18fbccdbb4a66fdc01a1301943b94af546fad0b9988b6acb1f97a80ad9694d056333ac598f2b7da000947ad3949dbe
SSDEEP 12288:GZGFbxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:+GF99ePSfPFB9nLSb6LOD/f/o
TLSH
T16FE4223D934672F9C637823944B9A06B363378F1072098DF5B99983D473ABE1A339D91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 b23cc4eb188da909ee8ff8ecc148db3da565b9caa2e1afd788b3810ac821f7bc
MD5 db03154b70d510f6b12af1cb225baa5a
SHA1 0e1a27211aa51876a6d8622322e7afb414f6390c
SHA512 c5ac38218ed6e9adb851b2636af401527fa820bd2fac20d8ad6ad1c45521d5fd9d2c5b4aecd7d7a696781f208a237c7a96dd3365932abe400a65e1924e6bbe17
SSDEEP 12288:4dxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:4X9ePSfPFB9nLSb6LOD/f/o
TLSH
T1D4D4232DC305A6BBD763563915BE702E172BBCE6076288CFB70D181D023BBE6D271562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 4a606538dca94c942f3a2bd793107d2e788cd556b2333268fefd0a6f014f95bb
MD5 41e5900ed7921da543c406505c294d16
SHA1 f6471e0e0d64ed41f82cad54ed12e8bac687e733
SHA512 c644184a1b77b07894a8b6ed296786bdc289a35d795a2a744a8454ab50c1714d9fbbb4015772ce53b6e6101e72d2cda3e0399caa179f938e1ee67f7971dc873d
SSDEEP 24576:y4d838y2JqH1Mzria7/m39ePSfPFB9nLSb6LOD/f/o:zSMyyqVra7/w9gSFjwTb
TLSH
T18A350165A3E102F1D477D1388A964267F672B8250360EFDF07AC8A551F23BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 51132a89d9ec448844175b52c9988b20eef4223a19ef4246e070f8a8cf749b26
MD5 51865fa998576a9c7c17ec757575b047
SHA1 293c07c81fb13787d95b90e607afd38afa87589a
SHA512 d9710b1168ae0252cf72be57c3bd31023a394d40e2b3fb0df0a06dccdf45e069b898058de55d329aef902d9ce667dd17d21688a966936011e6255c6504f85234
SSDEEP 12288:SHvUrBFrEjwaQLyxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:SPUr+NQc9ePSfPFB9nLSb6LOD/f/o
TLSH
T19205F12F639918E5E677E13D8596921DF732B8620712D6CF0391417E0B27EE8BD39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 3463619cf3c4f0670bc302cf9d236cfd12bc28b3cf6f29ab9000be7b32fea212
MD5 747d39bf3aacff511ddb1e72d2079d75
SHA1 fe73ef9690259407397958e504a2981f7c17e465
SHA512 0c57c9376f26c0ea662268f944be224cbb1fc05eaf24403434f411f899680291d1afe38665976ed031042211f9e5e44b53fb0d4de488a2fdf89a544e6ee0bffc
SSDEEP 49152:VBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj99gSFjwTb:eG05lO43bAgujw
TLSH
T150D5CF6E62EC11F9D1BBC17CDAC6460BEBB23815032556CF02A486A91F27FF4967E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f7fcb45c8bc4e5eb1bef85a0b470830fe87018ac500f9e7924efa624896a5cff
MD5 a0df2c709921238075e3dd04dbfac532
SHA1 d69589ed4b588ce28c0ba4dd4038d62638a6d1e6
SHA512 b2f22c398fc317e16a56ef79d09a0c4bf614842d623f20001f4cf700c27a56ee7cbb8fd27d247687237a651dbc3a5e078e6535dc206536c83bb126c42bdf7ef5
SSDEEP 24576:PNcwHdjbyQ4nLC18lb/EOjowL7FkRp9ePSfPFB9nLSb6LOD/f/o:PNc/zEOVHFE9gSFjwTb
TLSH
T120857B2663E901E4E1BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 b588c015bc15d105b37993673d6c7f3fe491a5965abe24a1f0044192b8a84b4c
MD5 0d8cff9f5ac2c45a2d6fd80513960abd
SHA1 c76b8bd6b6536ca28c54dff3a602deddb10c3460
SHA512 4931a16ef66f7ebf70b7476b80aea745f002eb7af7654109fa5c83c1f98e93082042d47316239d2edd41b3470cc87e3abc21f17831784bef975a4049f96aab95
SSDEEP 12288:61Hck6j5ZI7rxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:G6DIp9ePSfPFB9nLSb6LOD/f/o
TLSH
T12405012C636A11FAD167D03E86930116E273B4B1872259CF5B98C87E4FB3ED8B539E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 879b5335bb8d96c5ff8609c966ace99e5b00124509eca9d42c21df8761938b15
MD5 9e9e29a1619f3580c6c350bbb7ce3c97
SHA1 e5b686be3fb05666ac641d47454a66d28c3b3ed0
SHA512 29fd6827bc025d0862e46e66359f39be32103cc7022bba0d7bd21b09d658749576b053b747fcd08bdd7dd71611abed87773700f81ab29da0d8d85a36dc486ddf
SSDEEP 12288:UG6kyYxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:Ftym9ePSfPFB9nLSb6LOD/f/o
TLSH
T190F42318934461E9E7B7423C4AB790694B3BBC714B2186CF6790AA3E1F37BD1E531B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 1b7921af7d857f1b93326b44d24a9237c73648dc20283a5a8e8c01e2cde68aa5
MD5 187b3f636f73c1e12f6dbb466cff99e9
SHA1 8c813afce2d9a1944f55d3377e233be8c54cefc8
SHA512 fdff4165118ec85da7fef69ab28b579abf2f10978d8195da5b2526c55106cf3b23a2690ef811ac308421c18779c7ee548f68eac00cf987c4aabb9f654b290d86
SSDEEP 12288:CN6xeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:YQ9ePSfPFB9nLSb6LOD/f/o
TLSH
T198D4232CC30566BAD653963901BE606F133BB8F60B2298CFBB99583D433B7D69231951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1808-47-0x00007FF641F50000-0x00007FF642073000-memory.dmp

Download

memory/1808-17-0x00000242051B0000-0x0000024205216000-memory.dmp

Download

memory/1808-15-0x00007FF641F50000-0x00007FF642073000-memory.dmp

Download

memory/1808-16-0x00000242051B0000-0x0000024205216000-memory.dmp

Download

memory/1808-18-0x00000242051B0000-0x0000024205216000-memory.dmp

Download

memory/1852-29-0x0000020787490000-0x00000207875E9000-memory.dmp

Download

memory/1852-30-0x0000020787730000-0x0000020787796000-memory.dmp

Download

memory/1852-31-0x0000020787730000-0x0000020787796000-memory.dmp

Download

memory/1852-32-0x0000020787730000-0x0000020787796000-memory.dmp

Download

memory/2020-250-0x00000221F6F50000-0x00000221F6FB6000-memory.dmp

Download

memory/2020-249-0x00000221F6F50000-0x00000221F6FB6000-memory.dmp

Download

memory/2020-248-0x00007FF689710000-0x00007FF68982A000-memory.dmp

Download

memory/2068-265-0x00007FF721CE0000-0x00007FF721E2A000-memory.dmp

Download

memory/2068-268-0x0000026A53150000-0x0000026A531B6000-memory.dmp

Download

memory/2068-267-0x0000026A53150000-0x0000026A531B6000-memory.dmp

Download

memory/2100-40-0x000001945DF70000-0x000001945DFD6000-memory.dmp

Download

memory/2100-39-0x000001945DF70000-0x000001945DFD6000-memory.dmp

Download

memory/2100-41-0x000001945DF70000-0x000001945DFD6000-memory.dmp

Download

memory/2100-38-0x000001945F000000-0x000001945F159000-memory.dmp

Download

memory/2212-6-0x00000000025C0000-0x0000000002629000-memory.dmp

Download

memory/2212-26-0x0000000000B20000-0x0000000000CC7000-memory.dmp

Download

memory/2212-7-0x00000000025C0000-0x0000000002629000-memory.dmp

Download

memory/2212-0-0x0000000000B20000-0x0000000000CC7000-memory.dmp

Download

memory/2212-1-0x00000000025C0000-0x0000000002629000-memory.dmp

Download

memory/2344-48-0x00007FF6936B0000-0x00007FF693818000-memory.dmp

Download

memory/2344-57-0x00007FF6936B0000-0x00007FF693818000-memory.dmp

Download

memory/2344-55-0x000002D7B08F0000-0x000002D7B0956000-memory.dmp

Download

memory/2344-50-0x000002D7B08F0000-0x000002D7B0956000-memory.dmp

Download

memory/2344-49-0x000002D7B08F0000-0x000002D7B0956000-memory.dmp

Download

memory/2696-260-0x00000157D3280000-0x00000157D32E6000-memory.dmp

Download

memory/2696-245-0x00007FF7AC170000-0x00007FF7AC239000-memory.dmp

Download

memory/2696-322-0x00007FF7AC170000-0x00007FF7AC239000-memory.dmp

Download

memory/2696-259-0x00000157D3280000-0x00000157D32E6000-memory.dmp

Download

memory/3300-61-0x0000026D35820000-0x0000026D35886000-memory.dmp

Download

memory/3300-60-0x0000026D35570000-0x0000026D356C9000-memory.dmp

Download

memory/3300-62-0x0000026D35820000-0x0000026D35886000-memory.dmp

Download

memory/3360-274-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3360-275-0x0000000000900000-0x0000000000969000-memory.dmp

Download

memory/3360-280-0x0000000000900000-0x0000000000969000-memory.dmp

Download

memory/3824-325-0x000001D6DB660000-0x000001D6DB6C6000-memory.dmp

Download

memory/3824-323-0x00007FF7E7300000-0x00007FF7E75A3000-memory.dmp

Download

memory/3824-326-0x000001D6DB660000-0x000001D6DB6C6000-memory.dmp

Download

memory/4336-303-0x00007FF6C9300000-0x00007FF6C9717000-memory.dmp

Download

memory/4336-304-0x0000016373A80000-0x0000016373AE6000-memory.dmp

Download

memory/4336-305-0x0000016373A80000-0x0000016373AE6000-memory.dmp

Download

memory/4400-288-0x00007FF78A210000-0x00007FF78A954000-memory.dmp

Download

memory/4400-287-0x0000023D691A0000-0x0000023D69206000-memory.dmp

Download

memory/4400-286-0x0000023D691A0000-0x0000023D69206000-memory.dmp

Download

memory/4464-296-0x0000015732560000-0x00000157325C6000-memory.dmp

Download

memory/4464-295-0x0000015732560000-0x00000157325C6000-memory.dmp

Download

memory/4464-294-0x00007FF7EC160000-0x00007FF7EC20E000-memory.dmp

Download

memory/6064-314-0x000002B7A7450000-0x000002B7A74B6000-memory.dmp

Download

memory/6064-315-0x000002B7A7450000-0x000002B7A74B6000-memory.dmp

Download

memory/6064-313-0x00007FF6703E0000-0x00007FF670494000-memory.dmp

Download

memory/6096-312-0x00007FF7AC170000-0x00007FF7AC239000-memory.dmp

Download

memory/6096-236-0x00007FF7AC170000-0x00007FF7AC239000-memory.dmp

Download

memory/6096-237-0x000001B259B40000-0x000001B259BA6000-memory.dmp

Download

memory/6096-238-0x000001B259B40000-0x000001B259BA6000-memory.dmp

Download