57d4c2bd375c92c13f36312399d30215efcc3316efc75d6152555dd76f916524

Analysis

max time kernel
146s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_277b03cc8b4d69dc2f87a58b41b5ad25_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Size 932KB
Sample260905-tf9f4seq3t
SHA256 57d4c2bd375c92c13f36312399d30215efcc3316efc75d6152555dd76f916524
MD5 277b03cc8b4d69dc2f87a58b41b5ad25
SHA1 36a14075819c713feffd18883cbc744fe0aa792a
SHA512 275c4c9f343ea7c96bb57fa1190956568b71e151ee33b150f78e0d1aea3f57ec9a7d63d3c3b5c9048a15755819e8a082e32c2f0fb7d1a027d034cb3dd7f0c7bb
SSDEEP 12288:TfwSfxL/2Dc3bDLLmt0LDQewsAjQLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvz:7mewsAjMILD8F8tEi5klhtKrLlzb6cd
TLSH
T18815E031FE70D036C77B0DB61B39D716156DB9604FA11AC3E3A8899E59342E22336E27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 9 IoCs

pid	Process
5136	alg.exe
4056	elevation_service.exe
1784	elevation_service.exe
5408	maintenanceservice.exe
940	OSE.EXE
2872	GameInputSvc.exe
1660	GameInputSvc.exe
5032	msdtc.exe
5948	PerceptionSimulationService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-04_277b03cc8b4d69dc2f87a58b41b5ad25_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e7355609d744edbe.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-04_277b03cc8b4d69dc2f87a58b41b5ad25_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117390\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117390\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_277b03cc8b4d69dc2f87a58b41b5ad25_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1660	GameInputSvc.exe
1660	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4952	2026-09-04_277b03cc8b4d69dc2f87a58b41b5ad25_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Token: SeDebugPrivilege	5136	alg.exe
Token: SeDebugPrivilege	5136	alg.exe
Token: SeTakeOwnershipPrivilege	4056	elevation_service.exe
Token: SeTcbPrivilege	2872	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 1660	2872	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-09-04_277b03cc8b4d69dc2f87a58b41b5ad25_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_277b03cc8b4d69dc2f87a58b41b5ad25_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4952

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:5136

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1784

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5408

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:940

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1660

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5032

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5948

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:4200

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:1856

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:4804

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:2104

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:2252

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:3328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e2fd35f4b528c6881fe6e72e9ede52807e308aefcd1a3a643452a42fc26e88bc
MD5 cf993ab89af9967a76091f603be29dca
SHA1 53495f162ac82c023253e599c3f33fa3b65a858f
SHA512 d83d346efcc7a30b2b945242ddc842ffb47596544b5b1a52375077648df5e65b7f1706124bbf1f5ee5d4b67ced48e42e8c8eba532c190dbb800fb7dc43e502b3
SSDEEP 49152:db+632BuPkFKRrdE6oh7stBhuXjfS4LWxnoIfHSa9fla2:j3q6gjB2flh
TLSH
T14BD59D03F2D901E8E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 a6e7f1cd5493d22304a632ebf18d4d3334d4b5893abd50d8d20c69b37bf624be
MD5 5dd29837ecf485a420bcc4d1e9e6a567
SHA1 68494385e5f959319902fc790909ed27d571948e
SHA512 db1d4e5a424833884cc21a5e57a99277a88acc53ee32a10a6554657e6176ea9e1a6ccd15007d39ad1e2a76ddd2aa2c3476aa6284cb222495116c99233dfc4fa2
SSDEEP 24576:LXYJDtczAuILD8F8tEi5klhtKrLlzb6cd:0tc/IfHSa9fla2
TLSH
T10F05F12977A009F8ED67817CCC719511E773B8804BA0E79B03A4956A1F372E85E3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 828KB
SHA256 8638521eddefa8e2d103407a66ccfab1c80de265ecc099b0da929e3871249229
MD5 4e4bb5b196ec6aca3f5a0d012798d4aa
SHA1 8fedb4ea04a9bd4e86956acc4aa0613ee4abffe6
SHA512 5ac3b2df0b23a46b621bf151c324d4211ef94fa3336ce128d88a28e4bb9b49ef7853f91bc712f916fb3662edbfd7b3d572416f79ab54eccffdf510209bfc047d
SSDEEP 12288:Smw5HEjsChNYBFgl0WEm+CjLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz62:LwuROWVILD8F8tEi5klhtKrLlzb6cd
TLSH
T13F05F14637A40CF9EA665138855B9132F7F2B8412E65CB2F4770C65B2F3B2616D2EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 080d48db502a816eff9b68aad2e940ed43bc1df87df8ee20a1dc552c794cac9d
MD5 c5e73c47097f5ba695d92a6e1c4ba1e3
SHA1 daf13eae4680d68486168febc8222c2ded473d46
SHA512 3251a19c5869fd231d9252e0c5fbeb28d93317bdf13462564059e2221e39bf69fceea94dc0114cbb625a8b6eda7c44704c3f019c6943614aeeab0409b5ff00b2
SSDEEP 49152:fB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glUIfHSa9fla2:hu6JmTxd2d9flh
TLSH
T117D59D13F1D901E8D05ED478974AA233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 c3cbefbc354bfe1c1af77836a614c148e5ed9ca75e338af32ca13f15fab6ff88
MD5 c954ee682572236855bc01b97267c8c6
SHA1 495a03e02b8807d16f5e18d0b0b5a9091a966bff
SHA512 1c60e6fc2186c2d0895e6a3e129fcbd05be4004b00e3cac07069691a7adbd01bca9bca7aaeb358e9d329ef0abcf232f8982c5c47c5fd62275028dbe0f1e4effc
SSDEEP 12288:KT7mrLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:0mxILD8F8tEi5klhtKrLlzb6cd
TLSH
T1EED423232A608704FE6C31B4093C3171636DF4D05EA5C5BBDB6AA1DE2E3E1F14926E79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 a76340694a1d0424e90821821208546fe06ebdd1a6510ca0d25e82c4cf264e5e
MD5 96adcc79edb8732c56179e0835689fb4
SHA1 6dafb2e7f9beebbfd9108c23d1063db17af9dc78
SHA512 0626d118a8751a99f47be0957e60ba5647d3fd9f8b1235c6253bb86c91a95a9ee39b83c73cd443f9d2366a6c0301fb79b5a0f5aa30565717a7445ee1979e130d
SSDEEP 12288:h9G/Lhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:nG1ILD8F8tEi5klhtKrLlzb6cd
TLSH
T191E4122A39B16284DE395178483831A2B7B170D01F6596FF8BE9D0BA5F3D1F05239DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 23d19297bb3417a60e1370fc771e44fd8340c4eade69ada463ce5181dc6652ad
MD5 016acbeac6089aaa392c8a88f302bb60
SHA1 65576aaa4c2f20d2a2c3758bcfe97802cfbf3235
SHA512 99f3302750ac8e7e8f4189cc6b067cdc332855260db3732f0433a94b01fa0072fb6afc591e54e573d12f6e3e45c99dd8e6e2f9e88cabf80a7c3248adba99cb79
SSDEEP 12288:vALhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:v8ILD8F8tEi5klhtKrLlzb6cd
TLSH
T160D4236229208744EF4831B4093C31A16765F4C05FEAD6FBDB6EA1DA1A3E1F5013ADB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 192KB
SHA256 fa67370830acde26342b8dcbcb4488dd5719d4d5b8f2a8e5cfe77c24219ab5eb
MD5 2b20cd9b1003671d0d3a04aa8f601ba1
SHA1 48502ebbdfdc2b9e4978669dde7deca338854b1e
SHA512 e1188134bb9b2f4c87d293cdf6a1fed2be1dad315de375784220b2c3842b5f8d4ddaa71930a48dba175afe92bfdbfe0b4c9e95efee8b8d5c1a67afa1a80f0227
SSDEEP 3072:Gfyno818cWSdj81gtvuD88lxBGz1BUpaLCFbLqRt212OQDs6Rs6OeHj:G6J8jSdj81D88zBZhXy20DsyOeHj
TLSH
T1B9146D6665E500F0D47BE13C8ACB9297F6F1F42523287EEF4E608A511F23AE942BD315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 1850dbe4c6fd6edddd0fd5fad8cdcde515f10cb33cd54ca33bd8e3d2328958a4
MD5 b8c8b6703ee8e057641fe11dd028db52
SHA1 be91bb4ea403349ed2ea5be066099e5c53a8cbd1
SHA512 91ed9be2910965b1fe75f6a8ed11b1fffaa7cb20ef343dcedf5b21ac416333b75773f7591526ba8a0a2373d386fa0ea5dd273b767a9cfe60c4689d6845f32791
SSDEEP 49152:tBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjqIfHSa9fla2:2G05lO43bSflh
TLSH
T1C0D5CF6A62EC11F9D1BBD17CCAC6460BEBB23415033556CF02A486A91F27FF4967E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b8038444dc5e388891e9cfd934bb7fe0c05c5ecb95c3d0d233b1aec55cb0a114
MD5 a5dacf1cb39283ad5129528ff49f7f2a
SHA1 7b84fe0b391162adc2653ee26eb81d4fd6c4a862
SHA512 914543944b2fc3c796498cadb48cf0304079b418b4336264aff2a51b5ac538d54f66be75d5e98bf0449421476c96dab018cd9f3400232a551a7f4397bdc25323
SSDEEP 24576:MNcwHdjbyQ4nLC18lb/EOjowL7FkSILD8F8tEi5klhtKrLlzb6cd:MNc/zEOVHFJIfHSa9fla2
TLSH
T113857B1622E901E4F5BBE1BE897B9546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 20481d2e6fde7fa79903c2f296b61c2e0407517f88c1bc8691c80483e1818410
MD5 2545fbe46715464df76e15257455034a
SHA1 5688f555b3fd1d50ed3d31111598ff983e56b212
SHA512 6cc3757010ad9a341f882b396db74f9a2bf110077f87040824090acc2ac48b8ada218cf963e4ecf15784fbfedab7d08c68651af87d57f0d7173c0fa25f38aedd
SSDEEP 12288:h1Hck6j5ZI74Lhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:56DIQILD8F8tEi5klhtKrLlzb6cd
TLSH
T151F4011D337611F5D16BA03D85520112E3B2B0A08B629ADF47A8C0BE5F77EE8B53DE51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 f7f3efb20639ba3a671986240cdcbd6a70abe9757dafa4be8d2b92fda661233a
MD5 ebb15081e67cc74e3d61712383c278e7
SHA1 4e18f0242b7cc10f4d3d93f0b4680cefff6fc716
SHA512 a16f0a15704a146cb76858440cc1236c3f95a558a11e50232aecf2bbfe45b7f15377f279fc7df71092f812578aea14ed6d38ba935d1d01ac946d9521855924a7
SSDEEP 12288:7G6kyBYLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:6ty6ILD8F8tEi5klhtKrLlzb6cd
TLSH
T156F4120127A09284EE6921784A3952A09B35BC505F61C3EF97E1E26F2F3E3F05935F75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 50739dd7a872ca373a9f0352e961ab2162b713b108eb84832913000d832bf29d
MD5 bd52cdc958838df04bf92d62d5a68ee1
SHA1 a038bc7af122841d6c333315c609cc7d18583cd1
SHA512 46fc7c37f4f6b2154594c348bbb7d359f92f2abdbf76a5dd3104fffa2b00697b01574d9710636af6dad60e80c79a36f43822ff47f4db7161b0f5b51765a64317
SSDEEP 12288:4pgLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:ucILD8F8tEi5klhtKrLlzb6cd
TLSH
T1FFD4232629619344EE0871B8093C32A1A375B0D01FAAD6FF9BBAD1EA5F3E1F10135D75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 0fd6bdee2e4ada2e18a613d62de3e9b364ee2f56168fc3835dad044e81948b5f
MD5 f684673a66a2685528db734f4f8b62e8
SHA1 6a32d2c1f30586a9c9c25f9d152e512f791b4c40
SHA512 aafe4332e759e0a0ab863a7be35407a1e220eb7c284f52d0496d51c6a389433b6e4a852ac5b2ba22713449a98b76fdc4404311479e13ee70734640ff92538762
SSDEEP 12288:cHvUrBFrEjwaQTLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:cPUr+NQ5ILD8F8tEi5klhtKrLlzb6cd
TLSH
T17205F12F26A818E4E67AA17C89555719F771B4520712D2DF03E1817E0F37AE8AD3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/940-62-0x000002CE80A30000-0x000002CE80A96000-memory.dmp

Download

memory/940-61-0x000002CE80A30000-0x000002CE80A96000-memory.dmp

Download

memory/940-60-0x000002CE80940000-0x000002CE809D5000-memory.dmp

Download

memory/1660-244-0x00007FF6074B0000-0x00007FF607578000-memory.dmp

Download

memory/1660-246-0x0000010DB5090000-0x0000010DB50F6000-memory.dmp

Download

memory/1660-245-0x0000010DB5090000-0x0000010DB50F6000-memory.dmp

Download

memory/1784-39-0x0000020521790000-0x00000205217F6000-memory.dmp

Download

memory/1784-41-0x0000020521790000-0x00000205217F6000-memory.dmp

Download

memory/1784-40-0x0000020521790000-0x00000205217F6000-memory.dmp

Download

memory/1784-38-0x00000205215D0000-0x0000020521665000-memory.dmp

Download

memory/1856-298-0x00007FF74F010000-0x00007FF74F753000-memory.dmp

Download

memory/1856-287-0x0000022794E10000-0x0000022794E76000-memory.dmp

Download

memory/1856-286-0x0000022794E10000-0x0000022794E76000-memory.dmp

Download

memory/2104-305-0x000001ADE05F0000-0x000001ADE0656000-memory.dmp

Download

memory/2104-304-0x000001ADE05F0000-0x000001ADE0656000-memory.dmp

Download

memory/2104-303-0x00007FF7D2E50000-0x00007FF7D3266000-memory.dmp

Download

memory/2252-313-0x00007FF680C70000-0x00007FF680D23000-memory.dmp

Download

memory/2252-314-0x0000014DE8B80000-0x0000014DE8BE6000-memory.dmp

Download

memory/2252-315-0x0000014DE8B80000-0x0000014DE8BE6000-memory.dmp

Download

memory/2872-236-0x00007FF6074B0000-0x00007FF607578000-memory.dmp

Download

memory/2872-237-0x0000019C8C6C0000-0x0000019C8C726000-memory.dmp

Download

memory/2872-238-0x0000019C8C6C0000-0x0000019C8C726000-memory.dmp

Download

memory/4056-30-0x000001F9F32A0000-0x000001F9F3306000-memory.dmp

Download

memory/4056-31-0x000001F9F32A0000-0x000001F9F3306000-memory.dmp

Download

memory/4056-32-0x000001F9F32A0000-0x000001F9F3306000-memory.dmp

Download

memory/4056-29-0x000001F9F31B0000-0x000001F9F3245000-memory.dmp

Download

memory/4200-274-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4200-280-0x0000000000750000-0x00000000007B9000-memory.dmp

Download

memory/4200-275-0x0000000000750000-0x00000000007B9000-memory.dmp

Download

memory/4804-299-0x00007FF72C6B0000-0x00007FF72C75D000-memory.dmp

Download

memory/4804-293-0x000002EF87140000-0x000002EF871A6000-memory.dmp

Download

memory/4804-294-0x000002EF87140000-0x000002EF871A6000-memory.dmp

Download

memory/4952-0-0x00000000009F0000-0x0000000000B97000-memory.dmp

Download

memory/4952-26-0x00000000009F0000-0x0000000000B97000-memory.dmp

Download

memory/4952-7-0x0000000003010000-0x0000000003079000-memory.dmp

Download

memory/4952-1-0x0000000003010000-0x0000000003079000-memory.dmp

Download

memory/4952-6-0x0000000003010000-0x0000000003079000-memory.dmp

Download

memory/5032-255-0x000001F2D29D0000-0x000001F2D2A36000-memory.dmp

Download

memory/5032-254-0x000001F2D29D0000-0x000001F2D2A36000-memory.dmp

Download

memory/5032-253-0x00007FF7C9930000-0x00007FF7C9A49000-memory.dmp

Download

memory/5136-18-0x00000221B7B30000-0x00000221B7B96000-memory.dmp

Download

memory/5136-16-0x00000221B7B30000-0x00000221B7B96000-memory.dmp

Download

memory/5136-17-0x00000221B7B30000-0x00000221B7B96000-memory.dmp

Download

memory/5136-15-0x00007FF6D9F20000-0x00007FF6DA042000-memory.dmp

Download

memory/5136-47-0x00007FF6D9F20000-0x00007FF6DA042000-memory.dmp

Download

memory/5408-48-0x00007FF6E8AE0000-0x00007FF6E8C48000-memory.dmp

Download

memory/5408-49-0x0000015697740000-0x00000156977A6000-memory.dmp

Download

memory/5408-50-0x0000015697740000-0x00000156977A6000-memory.dmp

Download

memory/5408-55-0x0000015697740000-0x00000156977A6000-memory.dmp

Download

memory/5408-57-0x00007FF6E8AE0000-0x00007FF6E8C48000-memory.dmp

Download

memory/5948-268-0x0000020F15A40000-0x0000020F15AA6000-memory.dmp

Download

memory/5948-267-0x0000020F15A40000-0x0000020F15AA6000-memory.dmp

Download

memory/5948-265-0x00007FF60A6C0000-0x00007FF60A809000-memory.dmp

Download