9d85dbdc63df7d71429b1047ce94c7435d27a6203a245472fc7afed4324eb144

Analysis

max time kernel
143s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-25_e3b9aa240cd453cd7a843ad899cbbd1c_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_.exe
Size 4.4MB
Sample260925-wxezyage57
SHA256 9d85dbdc63df7d71429b1047ce94c7435d27a6203a245472fc7afed4324eb144
MD5 e3b9aa240cd453cd7a843ad899cbbd1c
SHA1 3204526ceb0cb060bc37053b1eabe00ffc422f3f
SHA512 25e8ba5beaacc1dfd800958e5e06166a6811ab6b390caf03eed6bcdfc1bf44b6b5f8845c292df2ef5b68f8a158dcce2110d87e55549700869899fac7499c1f75
SSDEEP 98304:JNlIB3RNBYGABDJNFOOd0TPmeRILdNfeRn/0Q:2B3RM4meOLb8nF
TLSH
T191267C31FE8B4C73D5910236446B76669AAFAE10072147C7A2D82BE96F301D13E3779E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
5972	alg.exe
4876	elevation_service.exe
2612	elevation_service.exe
2480	maintenanceservice.exe
108	OSE.EXE
2288	GameInputSvc.exe
3984	GameInputSvc.exe
1172	msdtc.exe
3652	PerceptionSimulationService.exe
4704	perfhost.exe
3896	ReFsDedupSvc.exe
5416	locator.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	alg.exe

Drops file in System32 directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1253362f7465cd71.bin	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-25_e3b9aa240cd453cd7a843ad899cbbd1c_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-25_e3b9aa240cd453cd7a843ad899cbbd1c_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\java.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-25_e3b9aa240cd453cd7a843ad899cbbd1c_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3984	GameInputSvc.exe
3984	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3304	2026-09-25_e3b9aa240cd453cd7a843ad899cbbd1c_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_.exe
Token: SeDebugPrivilege	5972	alg.exe
Token: SeDebugPrivilege	5972	alg.exe
Token: SeTakeOwnershipPrivilege	4876	elevation_service.exe
Token: SeTcbPrivilege	2288	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 3984	2288	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-09-25_e3b9aa240cd453cd7a843ad899cbbd1c_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-25_e3b9aa240cd453cd7a843ad899cbbd1c_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3304

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:5972

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2612

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2480

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:108

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3984

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1172

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3652

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4704

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
PID:3896

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5416

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:2480

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:4280

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:1512

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:4948

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:5376

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:5408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4a2fd320bd978832f2de786d5048f841ff1c0605220c77d9d810fe8d4e1a303a
MD5 270212c875386d64f83b56ccc90e86d2
SHA1 5ad3a4573fa7084d8be0b9380151fe1afa0fd86b
SHA512 7037af22da1aff8b019adc715003117bd57ecccccc1b9902549a67282894b83dd39bc77696d62dbacd6b92f14021f0bf98687437186f1a9b8d31a0b3eb04fc8d
SSDEEP 49152:Sb+632BuPkFKRrdE6oh7stBhuXjfS4LWxn3e+wkfSwAeRnkg0Q:03q6gjBlNfeRn/0Q
TLSH
T152D59C03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 56f3b4adf9d15d23834eddb218ac4c68cb84d6b775391d3a388ae23d2f29bfbd
MD5 013675d11d2c29e21580c77e08f9552b
SHA1 5a37e8c0d6f97d578481659af63b69d4863cd218
SHA512 3819276e41648ebd9b5d8506c0f35f619d3e49f9a1d0862ebfa15e6bb5ea5e65b77b0db37a03bbce5b6de509d84aed2496a660a797e98e4f074023e7298c171d
SSDEEP 24576:EXYQDtczAneyfwkfSwAeROyDcKkUf67xN3Q:utcQe+wkfSwAeRnkg0Q
TLSH
T1E9050219B3E408F9ED6B827CC8A28516E673BC954790F74F03E495261F136885F3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 5b3e03ddcb59e3e10b3361e5dd80cf22018adda2195f78597af88bfb1ccaadca
MD5 34f2839cad6834de6e7a2fe4a27c23d5
SHA1 69aa260e182797e90740cbfea06f32c15ef00786
SHA512 cbd3eb1703b33774c8c722d0d0a359d425c91c38f5127ad075853c96c9e7c3d57ae4ad6c0809b10a4a5064523bbd477d96e775abefebddca8f3aa3fa0a97f538
SSDEEP 24576:UwusOWlbeyfwkfSwAeROyDcKkUf67xN3:UwfOwbe+wkfSwAeRnkg0
TLSH
T16305F14A76E40CF9EAAA823D8593C536F7F3BC5225659B1F0360C75B6F272106E2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ff04b0dff56dab8af71f5222f2ba19c43d79d48aadc91f4e5937db9d0209f37e
MD5 00b161230f5ffeb9ae01524968100217
SHA1 c283158cd6506b35c7c79c6c6d9ef827aad553c9
SHA512 32ef07f1c407fefebec3d3d5e78b1e309c4b29bbed18792d907e88a0e88e46228e3bfbf620c402b9cba607249feadf1e533d8df05ec9c0673dc1aa4d98576045
SSDEEP 49152:jB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl5e+wkfSwAeRnkg0Q:Vu6JmTxd2dMNfeRn/0Q
TLSH
T1A4D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 abf1b171af2f1178100422910799a7b5bf8b279ade237083a728d14c3c68370a
MD5 9304ed4adaabd6e81d2001a2ddbc0599
SHA1 bc672e31ca59a0dcab4c3e1b895dc15855bec26c
SHA512 87b744e06d12454e279bc184b04e4728ca561ffd01554e1273d4bbce80ba695685a2e9be3a8c716ebee27d8132649583848748dbc669c0f0e7c530986a52f06f
SSDEEP 12288:K27KMp0yZJwkCnh+M31Yx7oxeROKDMUcHYDybJU/HY3HNkUrsP6xN3Q:ZHeyfwkfSwAeROyDcKkUf67xN3Q
TLSH
T1EFD42307F5B85806E6BC83BC91D39A3A25BBF9EA18C5254B014CA34F7A578045F3822F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c8d6b20f1848bb2db58c970aea44384b79a27f0adfd4d8801e83409a6ffddbbc
MD5 7b3bada2d69fcbcdf01fbb18c213e076
SHA1 23d04736b07875aaecc6fbc54b0d11a92214fd44
SHA512 e5d4255a0ac700b55a097a322055fb011ab6438f82b2ec23f9ae5087590d2b462da7d83961e74dece8e3acbf70378d4cd2567db21f0742d007e74a8ff924093e
SSDEEP 24576:7gb6bmBIi49WNNFpg1rSvFv7bYdeyfwkfSwAeROyDcKkUf67xN3Q:7gb4mBIBhGF0e+wkfSwAeRnkg0Q
TLSH
T1BE65AE1E32E802F5E1F9D2B8DDA64417D6B378160732D2DF1151422D2F2BEE89E39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 9d7430df8fd192be04c0e200a1549e4ad7754f10416850c759eabada4353aa20
MD5 9da9e01086995fc3ebb17ed96009f0da
SHA1 b9fdc88c17060bc734f749d20fe9a2e13ef05897
SHA512 a8842842359006abab0f97f0281ec2afa0ca4dd79d0fbbfc2ffbf564574c4b5e293430c21e8f928098c31e821344a9b5ce770d5a0d85715029958e0866f9e943
SSDEEP 12288:6FGbMp0yZJwkCnh+M31Yx7oxeROKDMUcHYDybJU/HY3HNkUrsP6xN3Q:SGAeyfwkfSwAeROyDcKkUf67xN3Q
TLSH
T19FE4121EB0F46449C67C83BD90A35A6774B2B4E5178526EF01D8E23B7F468D06F38D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 f5067c623e691d0d83401ef21242a3b6509ce51488b33a0313ca5cd68ad7a647
MD5 1169f5fc5d1954777befce19b54d2332
SHA1 c17a068b9007ceed028696f45d5f313ad2c63b61
SHA512 9bf58c9213f555299c91f4cac0dca355730363a5bc55474ab8f65763407dddd2f4533078b349b205eda86f541eb7a339006c6d156e2753b9e503eea5a1810eaa
SSDEEP 12288:VxnMp0yZJwkCnh+M31Yx7oxeROKDMUcHYDybJU/HY3HNkUrsP6xN3Q:VxMeyfwkfSwAeROyDcKkUf67xN3Q
TLSH
T138D4234BF4B45806D7AC83FD91D35A2A25B7E9E913C526D7018DA30B774B8C42F3862B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 87c69cfd1c4b6e3d1f6876fd36a5529bb1435acf7101f0ad45dea99e630f3bd2
MD5 224cb43048f127a7f77e8d35fa91bc99
SHA1 a5fa27d2fbb7f23b7e8f1dfed34602da42a764fc
SHA512 16270ba6304e7b586b004d046037500b45811b740b63d84a7055f2ebf9a6388dec9685c579514fd7427d834c0761c2570d88e399279efc7e8075afada1b58c42
SSDEEP 24576:CUM8TpcpJqH1Mzria7/mbeyfwkfSwAeROyDcKkUf67xN3Q:brtcPqVra7/Se+wkfSwAeRnkg0Q
TLSH
T1DA35F166B6E001F1D47BD13889824667F6B2F4650364EBDF06AC8B562F13AD44F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 bb13302de2b9ed04b6b79c7c6641deac2dbf6e92574f8d49e50ffd98d56ad647
MD5 e8c02bb921dc21966ffe042951710b76
SHA1 16161f9daf70f6867de902d83f5352471e24b51d
SHA512 eb872ffe3a58a03563d0d170873e8b66663089257aba3acbedb26a6734372d24990b9d5ea106c2d00275e6b121c44309eb106b8d9d5f91232674fb94b7c8872f
SSDEEP 24576:GPUr+NQq7eyfwkfSwAeROyDcKkUf67xN3Q:GJQq7e+wkfSwAeRnkg0Q
TLSH
T13305E11F72E818E5E679E17D85828719E772B8A20342A2CF02D0817E5F57DD8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 3a29a985296b513e411ea376863730d8a9c7f9e334870c180b42fd03b49a11f2
MD5 7e24ff99f28bf40a0fb5a3fab36416f9
SHA1 cde2a36ce7b29baa16b5bc2174a4bf28aad97f4c
SHA512 0403c1617fbdad6817b4399ae1d3764682ed6314b46057c86d838bf2c8bf2ebb4e752b7f0351a07bffafb7cc5f08f0ec3434f25a8ae21868123eabf3d164a581
SSDEEP 49152:hBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj4e+wkfSwAeRnkg0Q:CG05lO43beNfeRn/0Q
TLSH
T18BD5C06E62EC11F9D1BBC17CD9C64A0BEBB23415032556CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4a5efa45a5b98b6ed851e8c25db1ce25d3836a6a4c7cc18f9e4593dea2a17299
MD5 78a701877933f529e7bcfc1a7e51e8ab
SHA1 e14cb65686fb7ff68a4b986a79d40a0763f98a37
SHA512 cdcaa7ff045caf46f8b9f43ea3c036ea58ec11f819b6de39081553af746a65090069ae4542e0bb1e89f1b25dc42ab90f4fbe64b120945ef54ea874e9e53f8774
SSDEEP 24576:hNcwHdjbyQ4nLC18lb/EOjowL7Fk7eyfwkfSwAeROyDcKkUf67xN3Q:hNc/zEOVHFWe+wkfSwAeRnkg0Q
TLSH
T16A858C1622E901E4F5BBE1BE89779546FAB1786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 8391b531c6831d043b7087de005f0d81b03fa0730ab1b856f133bb996be2508a
MD5 69911cda45bfd73fbec96e60d9535786
SHA1 9c0fe20d1862391d976116c6d73194d40fbb0510
SHA512 7d4f8404f673d479fb0a754ddd63b417119b981372411974fcfaf6c01f022b39c9bde707068a93ab0c71c6403363cfcecec7a647157222b6e6a37f583e617ac6
SSDEEP 24576:vJnJPbzB4SreyfwkfSwAeROyDcKkUf67xN3Q:vJnJv6Sre+wkfSwAeRnkg0Q
TLSH
T10B15E13DD2A810E8E4B7C2B481561B5AFF7238BD2B1269C715B4D5353F02ED0AA39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 ae137a838aa3dcdfd150418d08cd2148544d523680e13a2a98c6d3a42cc05609
MD5 90e06180376b9f3c246ff32062a380a3
SHA1 94d5e49b2db699fa8914af7f66dc38c57e2a982b
SHA512 2ce64cfd05c99b743de34049e9a909c92db13dd75c570c00d4535f3a273738e4f144b839dc6accf3705e6b707400563c175b3bf646c0e1bfd0354e7a282e7d44
SSDEEP 12288:o1Hck6j5ZI7MMp0yZJwkCnh+M31Yx7oxeROKDMUcHYDybJU/HY3HNkUrsP6xN3Q:o6DI5eyfwkfSwAeROyDcKkUf67xN3Q
TLSH
T13DF4F15D73BA10B5D1AAD17D81830612E1B2F4B583521ADF06D8C57E6FA3DC8BE3CA12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 0bf209c0e2e07c45989cdfd8728fad62cc5291be351d5939975b458e85c7bb11
MD5 1cb8261797fb09656eb79ff4dadc0163
SHA1 53a618e5fa8aea58c03206ee134d2d3103f003de
SHA512 e092bb7e60a84b6556e89f1f15e1354c7a4a8267153cfd6d66b427417876a9488ba0008b56421039b4dd8dab90b4abd2751026be89dcb3de07d7ebc35ef7046e
SSDEEP 12288:3G6kyMMp0yZJwkCnh+M31Yx7oxeROKDMUcHYDybJU/HY3HNkUrsP6xN3Q:2tyNeyfwkfSwAeROyDcKkUf67xN3Q
TLSH
T1CFF41206B3A46485E6BC43BC96A346A55A76FCA05B5113DF01C0E72F3F37AC46E34B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 7f929f9a0be3431f6f24abd8223f2aed57181188c736c65fe3f3aaf9033ecf4c
MD5 4c2501c9b6224596ee0a63c34b278fd2
SHA1 15af275c6a7fab79ca654744669987ad8e81f9f0
SHA512 c2e49683a9797599a86f979d86f9d13b4a4bfef699aeecd56b95f9dc206638f250229af555cddee5b5846ca608b4802c5deb1603191f10a51f953ae0df6dc215
SSDEEP 12288:I0sMp0yZJwkCnh+M31Yx7oxeROKDMUcHYDybJU/HY3HNkUrsP6xN3Q:/teyfwkfSwAeROyDcKkUf67xN3Q
TLSH
T175D4234FB1B46406D6AC93BD51931B6B10B7F8F917C626DF01C8A62B7B474C42F38A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 9afd2669f6587d1c3dbf57eba5f7c491ee960b4a4576f05f916577b8565ae22a
MD5 30933326a3509306185c1f05b6932e9a
SHA1 e13c7dd412633feed26712650cc84f6aaf206207
SHA512 8710f3fe8e1decfeb3d7a45e3c34abf8f5ac197ed92a4c6b0505533f5f8b1d36b2b6a0bcc1b730354427f0ab2ababc059363c734821c53c6d88663303491e946
SSDEEP 24576:jjgILoTfaidZzeyfwkfSwAeROyDcKkUf67xN3Q:PgHTrZze+wkfSwAeRnkg0Q
TLSH
T1C0558C1DB7E905CAE2B2D279D8621493D633B4711772D6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/108-57-0x000002C1ED0C0000-0x000002C1ED1F0000-memory.dmp

Download

memory/108-58-0x000002C1ED2C0000-0x000002C1ED326000-memory.dmp

Download

memory/108-60-0x000002C1ED2C0000-0x000002C1ED326000-memory.dmp

Download

memory/1172-322-0x00007FF6D6980000-0x00007FF6D6A99000-memory.dmp

Download

memory/1172-252-0x00000217675D0000-0x0000021767636000-memory.dmp

Download

memory/1172-251-0x00007FF6D6980000-0x00007FF6D6A99000-memory.dmp

Download

memory/1172-253-0x00000217675D0000-0x0000021767636000-memory.dmp

Download

memory/1512-323-0x00007FF7B0080000-0x00007FF7B0323000-memory.dmp

Download

memory/1512-325-0x000002910E600000-0x000002910E666000-memory.dmp

Download

memory/1512-324-0x000002910E600000-0x000002910E666000-memory.dmp

Download

memory/2288-310-0x00007FF6E70E0000-0x00007FF6E71A8000-memory.dmp

Download

memory/2288-235-0x000001F89D0B0000-0x000001F89D116000-memory.dmp

Download

memory/2288-236-0x000001F89D0B0000-0x000001F89D116000-memory.dmp

Download

memory/2288-234-0x00007FF6E70E0000-0x00007FF6E71A8000-memory.dmp

Download

memory/2480-52-0x0000020521C40000-0x0000020521CA6000-memory.dmp

Download

memory/2480-46-0x0000020521C40000-0x0000020521CA6000-memory.dmp

Download

memory/2480-301-0x0000018E2BE20000-0x0000018E2BE86000-memory.dmp

Download

memory/2480-303-0x0000018E2BE20000-0x0000018E2BE86000-memory.dmp

Download

memory/2480-302-0x00007FF6FB350000-0x00007FF6FB766000-memory.dmp

Download

memory/2480-54-0x00007FF6704D0000-0x00007FF670638000-memory.dmp

Download

memory/2480-45-0x00007FF6704D0000-0x00007FF670638000-memory.dmp

Download

memory/2480-47-0x0000020521C40000-0x0000020521CA6000-memory.dmp

Download

memory/2612-38-0x0000027F28460000-0x0000027F284C6000-memory.dmp

Download

memory/2612-37-0x0000027F28210000-0x0000027F28340000-memory.dmp

Download

memory/2612-39-0x0000027F28460000-0x0000027F284C6000-memory.dmp

Download

memory/3304-0-0x0000000003260000-0x000000000337E000-memory.dmp

Download

memory/3304-1-0x00000000031E0000-0x0000000003249000-memory.dmp

Download

memory/3304-7-0x00000000031E0000-0x0000000003249000-memory.dmp

Download

memory/3304-6-0x00000000031E0000-0x0000000003249000-memory.dmp

Download

memory/3652-263-0x00007FF6CC8F0000-0x00007FF6CCA39000-memory.dmp

Download

memory/3652-266-0x0000024648B00000-0x0000024648B66000-memory.dmp

Download

memory/3652-265-0x0000024648B00000-0x0000024648B66000-memory.dmp

Download

memory/3652-330-0x00007FF6CC8F0000-0x00007FF6CCA39000-memory.dmp

Download

memory/3896-286-0x0000018AA33C0000-0x0000018AA3426000-memory.dmp

Download

memory/3896-285-0x00007FF66E6B0000-0x00007FF66EDF3000-memory.dmp

Download

memory/3896-284-0x0000018AA33C0000-0x0000018AA3426000-memory.dmp

Download

memory/3896-357-0x00007FF66E6B0000-0x00007FF66EDF3000-memory.dmp

Download

memory/3984-312-0x00007FF6E70E0000-0x00007FF6E71A8000-memory.dmp

Download

memory/3984-246-0x00000163CCEA0000-0x00000163CCF06000-memory.dmp

Download

memory/3984-245-0x00000163CCEA0000-0x00000163CCF06000-memory.dmp

Download

memory/3984-243-0x00007FF6E70E0000-0x00007FF6E71A8000-memory.dmp

Download

memory/4280-313-0x0000022E0B4F0000-0x0000022E0B556000-memory.dmp

Download

memory/4280-314-0x0000022E0B4F0000-0x0000022E0B556000-memory.dmp

Download

memory/4280-311-0x00007FF776FF0000-0x00007FF7770A3000-memory.dmp

Download

memory/4704-273-0x0000000000920000-0x0000000000989000-memory.dmp

Download

memory/4704-332-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4704-278-0x0000000000920000-0x0000000000989000-memory.dmp

Download

memory/4704-272-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4876-30-0x0000022E28FB0000-0x0000022E29016000-memory.dmp

Download

memory/4876-31-0x0000022E28FB0000-0x0000022E29016000-memory.dmp

Download

memory/4876-29-0x0000022E28FB0000-0x0000022E29016000-memory.dmp

Download

memory/4876-28-0x0000022E29030000-0x0000022E29160000-memory.dmp

Download

memory/4948-334-0x0000023801600000-0x0000023801666000-memory.dmp

Download

memory/4948-335-0x0000023801600000-0x0000023801666000-memory.dmp

Download

memory/4948-333-0x00007FF6FCB40000-0x00007FF6FCCD4000-memory.dmp

Download

memory/5376-341-0x00007FF76EF30000-0x00007FF76F250000-memory.dmp

Download

memory/5376-349-0x00007FF76EF30000-0x00007FF76F250000-memory.dmp

Download

memory/5376-347-0x00000295BF970000-0x00000295BF9D6000-memory.dmp

Download

memory/5376-343-0x00000295BF970000-0x00000295BF9D6000-memory.dmp

Download

memory/5376-342-0x00000295BF970000-0x00000295BF9D6000-memory.dmp

Download

memory/5408-353-0x0000026941920000-0x0000026941986000-memory.dmp

Download

memory/5408-352-0x0000026941920000-0x0000026941986000-memory.dmp

Download

memory/5408-358-0x00007FF63F470000-0x00007FF63F6FA000-memory.dmp

Download

memory/5416-293-0x0000027EAD3A0000-0x0000027EAD406000-memory.dmp

Download

memory/5416-292-0x00007FF6CF300000-0x00007FF6CF3AD000-memory.dmp

Download

memory/5416-294-0x0000027EAD3A0000-0x0000027EAD406000-memory.dmp

Download

memory/5972-18-0x00000271C8E20000-0x00000271C8E86000-memory.dmp

Download

memory/5972-16-0x00000271C8E20000-0x00000271C8E86000-memory.dmp

Download

memory/5972-15-0x00007FF7268B0000-0x00007FF7269D2000-memory.dmp

Download

memory/5972-17-0x00000271C8E20000-0x00000271C8E86000-memory.dmp

Download

memory/5972-63-0x00007FF7268B0000-0x00007FF7269D2000-memory.dmp

Download