eb22b74d3091ced68d5a0367e95de4d9398cc427186ad37db88ffb71067b5945

Analysis

max time kernel
41s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/05/2026, 07:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-06_e69f5e451496a2c95e82de35d07fb6e4_amadey_coinminer_darkgate_elex_smoke-loader_stealc.exe
Size 16.2MB
Sample260506-jvsf2ahs4q
SHA256 eb22b74d3091ced68d5a0367e95de4d9398cc427186ad37db88ffb71067b5945
MD5 e69f5e451496a2c95e82de35d07fb6e4
SHA1 b2bd55471a0d2a9d5691bcd0843d9cc33184579d
SHA512 4a5af421ab0582a37271ee920c8cc09a6199371274c7385957bc46c2cc1886431f626947b5bc193063885ee2bf9473935abe9e8945d89f38cb0592b618518ef2
SSDEEP 393216:2eMvPS/AEzLENCF15yUMlWSKhTPZ5eijmomo1WSb6PC:d/AXoF1UDybmDQWy
TLSH
T1C2072260A963E63FE6B23070C83DA66E51196F248F2724D3F2947D6AFC715D3263850B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery persistence spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4932 created 3128	4932	dllhost.exe	53

Detects executables containing URLs to raw contents of a Github gist 2 IoCs

resource	yara_rule
behavioral2/memory/5300-3929-0x0000000005100000-0x000000000514A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/4740-3935-0x0000000004900000-0x0000000004968000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables packed with Babel 1 IoCs

resource	yara_rule
behavioral2/memory/4932-3926-0x00000000047C0000-0x00000000047FE000-memory.dmp	INDICATOR_EXE_Packed_Babel

Executes dropped EXE 1 IoCs

pid	Process
4828	vlc.exe

Loads dropped DLL 3 IoCs

pid	Process
4828	vlc.exe
4828	vlc.exe
4828	vlc.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
5268	2026-05-06_e69f5e451496a2c95e82de35d07fb6e4_amadey_coinminer_darkgate_elex_smoke-loader_stealc.exe
5268	2026-05-06_e69f5e451496a2c95e82de35d07fb6e4_amadey_coinminer_darkgate_elex_smoke-loader_stealc.exe
5268	2026-05-06_e69f5e451496a2c95e82de35d07fb6e4_amadey_coinminer_darkgate_elex_smoke-loader_stealc.exe

Program crash 8 IoCs

pid	pid_target	Process	procid_target
4912	5268	WerFault.exe	78
4508	5268	WerFault.exe	78
5292	5268	WerFault.exe	78
5844	5268	WerFault.exe	78
912	5268	WerFault.exe	78
4568	5268	WerFault.exe	78
6564	5268	WerFault.exe	78
10356	5268	WerFault.exe	78

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-06_e69f5e451496a2c95e82de35d07fb6e4_amadey_coinminer_darkgate_elex_smoke-loader_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vlc.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\RevokeUninstall\\Logs\\e9c5b638.default-esr"	dllhost.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5268	2026-05-06_e69f5e451496a2c95e82de35d07fb6e4_amadey_coinminer_darkgate_elex_smoke-loader_stealc.exe
5268	2026-05-06_e69f5e451496a2c95e82de35d07fb6e4_amadey_coinminer_darkgate_elex_smoke-loader_stealc.exe
5268	2026-05-06_e69f5e451496a2c95e82de35d07fb6e4_amadey_coinminer_darkgate_elex_smoke-loader_stealc.exe
5268	2026-05-06_e69f5e451496a2c95e82de35d07fb6e4_amadey_coinminer_darkgate_elex_smoke-loader_stealc.exe
5268	2026-05-06_e69f5e451496a2c95e82de35d07fb6e4_amadey_coinminer_darkgate_elex_smoke-loader_stealc.exe
5268	2026-05-06_e69f5e451496a2c95e82de35d07fb6e4_amadey_coinminer_darkgate_elex_smoke-loader_stealc.exe
5268	2026-05-06_e69f5e451496a2c95e82de35d07fb6e4_amadey_coinminer_darkgate_elex_smoke-loader_stealc.exe
5268	2026-05-06_e69f5e451496a2c95e82de35d07fb6e4_amadey_coinminer_darkgate_elex_smoke-loader_stealc.exe
4932	dllhost.exe
4932	dllhost.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
5268	2026-05-06_e69f5e451496a2c95e82de35d07fb6e4_amadey_coinminer_darkgate_elex_smoke-loader_stealc.exe
5268	2026-05-06_e69f5e451496a2c95e82de35d07fb6e4_amadey_coinminer_darkgate_elex_smoke-loader_stealc.exe
5268	2026-05-06_e69f5e451496a2c95e82de35d07fb6e4_amadey_coinminer_darkgate_elex_smoke-loader_stealc.exe
5268	2026-05-06_e69f5e451496a2c95e82de35d07fb6e4_amadey_coinminer_darkgate_elex_smoke-loader_stealc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	5268	2026-05-06_e69f5e451496a2c95e82de35d07fb6e4_amadey_coinminer_darkgate_elex_smoke-loader_stealc.exe
Token: SeDebugPrivilege	4932	dllhost.exe
Token: SeDebugPrivilege	4740	dllhost.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5268 wrote to memory of 3040	5268	2026-05-06_e69f5e451496a2c95e82de35d07fb6e4_amadey_coinminer_darkgate_elex_smoke-loader_stealc.exe	92
PID 5268 wrote to memory of 3040	5268	2026-05-06_e69f5e451496a2c95e82de35d07fb6e4_amadey_coinminer_darkgate_elex_smoke-loader_stealc.exe	92
PID 5268 wrote to memory of 2196	5268	2026-05-06_e69f5e451496a2c95e82de35d07fb6e4_amadey_coinminer_darkgate_elex_smoke-loader_stealc.exe	95
PID 5268 wrote to memory of 2196	5268	2026-05-06_e69f5e451496a2c95e82de35d07fb6e4_amadey_coinminer_darkgate_elex_smoke-loader_stealc.exe	95
PID 5268 wrote to memory of 4932	5268	2026-05-06_e69f5e451496a2c95e82de35d07fb6e4_amadey_coinminer_darkgate_elex_smoke-loader_stealc.exe	98
PID 5268 wrote to memory of 4932	5268	2026-05-06_e69f5e451496a2c95e82de35d07fb6e4_amadey_coinminer_darkgate_elex_smoke-loader_stealc.exe	98
PID 5268 wrote to memory of 5300	5268	2026-05-06_e69f5e451496a2c95e82de35d07fb6e4_amadey_coinminer_darkgate_elex_smoke-loader_stealc.exe	99
PID 5268 wrote to memory of 5300	5268	2026-05-06_e69f5e451496a2c95e82de35d07fb6e4_amadey_coinminer_darkgate_elex_smoke-loader_stealc.exe	99
PID 5268 wrote to memory of 4740	5268	2026-05-06_e69f5e451496a2c95e82de35d07fb6e4_amadey_coinminer_darkgate_elex_smoke-loader_stealc.exe	100
PID 5268 wrote to memory of 4740	5268	2026-05-06_e69f5e451496a2c95e82de35d07fb6e4_amadey_coinminer_darkgate_elex_smoke-loader_stealc.exe	100
PID 4932 wrote to memory of 4828	4932	dllhost.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3128
- C:\Users\Admin\AppData\Local\Temp\2026-05-06_e69f5e451496a2c95e82de35d07fb6e4_amadey_coinminer_darkgate_elex_smoke-loader_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-05-06_e69f5e451496a2c95e82de35d07fb6e4_amadey_coinminer_darkgate_elex_smoke-loader_stealc.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5268 -s 588
    3⤵
    - Program crash
    PID:4912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5268 -s 592
    3⤵
    - Program crash
    PID:4508
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5268 -s 600
    3⤵
    - Program crash
    PID:5292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5268 -s 648
    3⤵
    - Program crash
    PID:5844
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5268 -s 712
    3⤵
    - Program crash
    PID:912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5268 -s 720
    3⤵
    - Program crash
    PID:4568
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    3⤵
    PID:3040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    3⤵
    PID:2196
- - C:\Windows\SysWOW64\dllhost.exe
    "C:\Windows\SysWOW64\dllhost.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4932
- - C:\Windows\SysWOW64\dllhost.exe
    "C:\Windows\SysWOW64\dllhost.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5300
- - C:\Windows\SysWOW64\dllhost.exe
    "C:\Windows\SysWOW64\dllhost.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5268 -s 1208
    3⤵
    - Program crash
    PID:6564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5268 -s 1152
    3⤵
    - Program crash
    PID:10356
- C:\Users\Admin\AppData\Roaming\RevokeUninstall\Logs\e9c5b638.default-esr\vlc.exe
  "C:\Users\Admin\AppData\Roaming\RevokeUninstall\Logs\e9c5b638.default-esr\vlc.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4828
- C:\Users\Admin\AppData\Roaming\RevokeUninstall\Logs\e9c5b638.default-esr\python.exe
  "C:\Users\Admin\AppData\Roaming\RevokeUninstall\Logs\e9c5b638.default-esr\python.exe" "C:\Users\Admin\AppData\Roaming\RevokeUninstall\Logs\e9c5b638.default-esr\helper.py"
  2⤵
  PID:11164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5268 -ip 5268
1⤵
PID:1172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5268 -ip 5268
1⤵
PID:3996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5268 -ip 5268
1⤵
PID:2776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5268 -ip 5268
1⤵
PID:648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5268 -ip 5268
1⤵
PID:4672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5268 -ip 5268
1⤵
PID:3364

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1756

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4044

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5268 -ip 5268
1⤵
PID:3236

C:\Users\Admin\AppData\Roaming\RevokeUninstall\Logs\e9c5b638.default-esr\vlc.exe
C:\Users\Admin\AppData\Roaming\RevokeUninstall\Logs\e9c5b638.default-esr\vlc.exe
1⤵
PID:5884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5268 -ip 5268
1⤵
PID:10340

C:\Users\Admin\AppData\Roaming\RevokeUninstall\Logs\e9c5b638.default-esr\python.exe
C:\Users\Admin\AppData\Roaming\RevokeUninstall\Logs\e9c5b638.default-esr\python.exe
1⤵
PID:6712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dllhost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dllhost.exe.log
Size 42B
SHA256 d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b
MD5 84cfdb4b995b1dbf543b26b86c863adc
SHA1 d2f47764908bf30036cf8248b9ff5541e2711fa2
SHA512 485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce
MD5 SHA1 SHA512

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Roaming\RevokeUninstall\Logs\e9c5b638.default-esr\_ctypes.pyd
Size 122KB
SHA256 ddaf9dcd69a2c34c53e18c53127009c070a8773ee668c975cb0b174ca24b4f11
MD5 84ccbabb336c4b03f905c71e82d87c33
SHA1 5fa3b92edb1a8f79e8b73496f84f6b84c6d82ff3
SHA512 0339170b071f714449447259ccdc10e9c14b7dff3bda4b7a8078c43c7ccde1e8a547c56499e3e4b14cc5550aee510e8aee6c23d773737b373aaa4c1b72e580fc
SSDEEP 3072:6nm6wY1G2qRItE60vgndbnfJtYICGPUIR:HasR2R0vWLPP
TLSH
T168C35A03B6AC8026D6D500FDE3B55A762A2F30B04F66C4E359995C885DE01E3AB7F3D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dfrqwqxjx.zip

Path C:\Users\Admin\AppData\Roaming\RevokeUninstall\Logs\e9c5b638.default-esr\dfrqwqxjx.zip
Size 2.8MB
SHA256 1e663406ce56626f169de287f8747cc05813a7c986707ed3b251e017f4ad2c49
MD5 7530d6b3719795b13cbc45a3f5850f31
SHA1 4715d1086282ac182e641c701d09df9839fbba5b
SHA512 11347eb87f5d526b757ec591f957d9c4f209909aa8533343cca7c3da52341cf6b32c1705752b514aa2d20fae4a36cce4ec6b416a95e082dec6439a6214615741
SSDEEP 49152:SosEjnDJJQ28mX6NZEKrYsu58cq2sXdf0HedWRBAUZLYasUpGaXBuQQ9ur:p9jDQ28mqNSKl0HedWRBAUZLX9
TLSH
T16AD57C45EA8B55F1ED174C708157F77F4B31EE02D920CEB2EE68B989ED33A62100D629
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

helper.py

Path C:\Users\Admin\AppData\Roaming\RevokeUninstall\Logs\e9c5b638.default-esr\helper.py
Size 4.3MB
SHA256 c6268cbb54f05674e28c771f4af4e7277b90bb4b03d30dc10cc09d41d3c7ef9f
MD5 12ab8c13918c60345c43908e196503f6
SHA1 be9056eb7d45772fbc9e1e9324e24cec0968b4ec
SHA512 8db9bd69de2779b62f6bb2d4f0b2f8fe8dc413b2b107ecb02965adc3c2846d37bfa42910c459f0704e1eb7777169ae8ef3e1b9b10a3edddd0102ac652f634d5d
SSDEEP 49152:W8nBILPd6QyOcZizWbj1tyTyMktGHmNivHBMrROqBYSvSrrsFq8mid6Z2rqLtF:y
TLSH
T1DA2633B00E956D71473D9322B1BFED1E9B316B11ED9AB15A12A13DC8049AF809CB7C7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Roaming\RevokeUninstall\Logs\e9c5b638.default-esr\libffi-8.dll
Size 34KB
SHA256 b982741576a050860c3f3608c7b269dbd35ab296429192b8afa53f1f190069c0
MD5 74d2b5e0120a6faae57042a9894c4430
SHA1 592f115016a964b7eb42860b589ed988e9fff314
SHA512 f3c62f270488d224e24e29a078439736fa51c9ac7b0378dd8ac1b6987c8b8942a0131062bd117977a37046d4b1488f0f719f355039692bc21418fdfbb182e231
SSDEEP 768:J4QHHH1n906QVjoPX2onHfQX5YiSyv7JPxWE1f:JDHHH1n28fJU7SyNPxj
TLSH
T18EF29F025F404CA6DEDE993574AA9739CB397B441BD081E3133AE8B50F116E2F5B81DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libvlc.dll

Path C:\Users\Admin\AppData\Roaming\RevokeUninstall\Logs\e9c5b638.default-esr\libvlc.dll
Size 179KB
SHA256 a27fcf98acdaa19cc3363846b6d66a3183fcf1cae778aca1dcc10552f738afb7
MD5 06f7b41d5cb75a23b74b1783d91953dd
SHA1 607223e27545d58a6f6554979816d300b9ccdf88
SHA512 840a01fca1c5ace25d134027cbffc7b67ef29c9195b79f0c1587c4345deeabfb721b08df351c5ca37ce0bb0d46d6667726747a0eb92b1576063fedee52eb10ec
SSDEEP 3072:rnsSO3fxJT5Xg4sgIxhpcRu9+FmTJA1UMBHx7/JSAyAChd9s6dLEs6d8:jsSO3fxJT5aFpcY++JA1U8HxtSAyrVd1
TLSH
T165045A85EA8794F1ED9709B09293FB7F8A329601CB34DEF1DF18F85CDA63A42244951C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libvlccore.dll

Path C:\Users\Admin\AppData\Roaming\RevokeUninstall\Logs\e9c5b638.default-esr\libvlccore.dll
Size 6.9MB
SHA256 46add4a5fb2da6fe12759a06fe1c6bc43e987da3ea7c28bff0a7f2a349088f0d
MD5 4d63c25457d3d5bd37bcf7c3d10154e6
SHA1 b654603260e52faefd9b5b1aad1ca4bd233f9167
SHA512 ee3ffa7a33ddbe854654312ffeb872bbabaceaee1cb966b7d01695701de9202653c76ba361deb151e1f4a31a84963e7790c28b16a91a28d274fa2b9a573e659b
SSDEEP 196608:OVq5kkjg2azNCUPIN8/DzajDDWAdVSKtB/y:Lkk8D4UPSUDza/KAdwI9
TLSH
T1FF76BF2B32228261D8E698FF59E9946F483DBF1F1031484DE314FF28C726611EA9767D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python.exe

Path C:\Users\Admin\AppData\Roaming\RevokeUninstall\Logs\e9c5b638.default-esr\python.exe
Size 101KB
SHA256 cb16aa9359b4070269186f0eed1bf4a6eab51cf93f55340f4694993ccee4d480
MD5 d7021c5120ba9e681816f2d08aeb2d42
SHA1 9260fdd34a836db4fd45fd929f576ac344a63c1d
SHA512 e508cbed8af5d31f83894139528680dc3167680cd2fbe4fb38a5dc467c1c4187606a47c5f313f574cd606d724a3318a04926d7d5e97d8dff159e4f2a42938edc
SSDEEP 1536:ogIksRbuEYE+9z2wp+FavGmhMn+IhzZtzc/DQR3DOy7NsR93TfIL7G8:0RbuAs0FNmhMn+IhNu/DQRzZ28
TLSH
T1BFA3E38A6A4E8191D6709571037787F22B2C1F62A8C3C68DA7C23F5AD57D2C1F60A737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Roaming\RevokeUninstall\Logs\e9c5b638.default-esr\python3.dll
Size 72KB
SHA256 6e18677c3575cc0271644a51d916bc77477085c66bf94532e11388634746a27f
MD5 799ef6a123d8b9dd0b586e818f742ec4
SHA1 85201c0dc892cdd63a833df2603a351960c45725
SHA512 c763a0f27f363316c5cda9305c422b91a85376db8f1cb258033531f76c6246a49275e39c737b2404663824eee07ca08fb2654c3102562921247274aa43965024
SSDEEP 1536:ggeqEMJQaQnnujKALOhtuPucLCFha0Zk30Hxs42yp4K2EIlMVOVhki3/oFVYe3/C:goEMJQIYICG04Co
TLSH
T1AF730A425B54F8E2DAB667FC7893998E6F2B02CC43258C9C647D93D20DDA313A62734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python315._pth

Path C:\Users\Admin\AppData\Roaming\RevokeUninstall\Logs\e9c5b638.default-esr\python315._pth
Size 80B
SHA256 c7f3432f90e8f04c78ff2cef76cf51e50a13ed922f0bcc63fa34aa4decc5770c
MD5 226b7a3e899ba566037018eca15b58f4
SHA1 b495729652c313dae06e06e28d9cf8e6ac065630
SHA512 2ed2aa7ee9b0a00c6deb2b6e42be37b10ff94bb9b1f28fcdbd7ffbd0662d98252ceeaed8d934ed686c52f84339354b903e7487cc698bb7703e516d46471da415
TLSH
T165A0220208A30080002022283FC000F88F32330CCB003A0C8EC82E380200E30ABFA02F
MD5 SHA1 SHA512 TLSH

Submit Download

python315.dll

Path C:\Users\Admin\AppData\Roaming\RevokeUninstall\Logs\e9c5b638.default-esr\python315.dll
Size 6.1MB
SHA256 fe9ea3f981b17e53f1e68d2538fb7238f6219fa02c4ee0dcc41045caa4f36cc0
MD5 49981dcf283f9bcb045aab35e617f68b
SHA1 5075bd90c4d6d8f29a3aabba3e8dfcd2a4602e4d
SHA512 aee8e25ee0e4d8872c7b35231cbc5117d993188daf4dc2cb118991c87a7b993ef87dc7f313685faf9e17313bbe7ccb54999d6ecb83dffd0e0df1403f65f76884
SSDEEP 98304:jOfi43R4uBTwgv625U+ly+qLR1JtIJNHDMdxVbW32U:j343+IOpLRh3dS
TLSH
T1ED566B35A5A68465EDF900F290BB897B1A6D1E04B334C8D3E4807DC91D741E3A3FFA66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python315.zip

Path C:\Users\Admin\AppData\Roaming\RevokeUninstall\Logs\e9c5b638.default-esr\python315.zip
Size 4.5MB
SHA256 4b217540ae27def5a1dd31bdc21d3d6ed5aa94285f44786ddfd9004d02d405e0
MD5 f389ec907802ba6e2adf7234b18a2ffa
SHA1 6f519390a723f3db5dda20c823d27315ed2dda33
SHA512 80f758aa52f4d5a8dc73915b6e220803c86af48e70c351ee9fe033cf1aa9cf454638b90f73bc1d532cf2cbab2a1a11c5eba8ee8b632ea68ec89691f8adecebf2
SSDEEP 98304:U9gtCLbX5CkoZYm1ZQzkAz3TNk1QgzSh1caHjoURqcH3z9LoZRULny:UdLbJCFYm16Rz3TkTzSnHNRqcX9oZ+ny
TLSH
T103263312CE3E8297EDABBEF23855C405491D8B587098A54FFCA888469DC7CDC5A7F42C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Roaming\RevokeUninstall\Logs\e9c5b638.default-esr\select.pyd
Size 28KB
SHA256 3468562603c09fab05de50846ec7f1dbbee8613a2368400d0345f266f2bf89e0
MD5 9f8223b0343eb92cb052a15e4810c058
SHA1 a0e36460a1ad2ae2120372f9f2253f5aefe1538e
SHA512 3b704fb6e727d875d31bf2706f1e35d56a9f579174ea2be350a15daec4f567d10494625437e3a7dcf0801339b8a14bee6f7c027924933ccdf0e08704055b022f
SSDEEP 768:Op06kxnhTiBYICRGfhy5RNLaRYT2Ip4WTxf1mlIJBlw:Op06kxhTiBYICRGpy7NsR9WfIkBC
TLSH
T109D27E869E684073DDD51AB062E5CD83FA3DA79308A4499330EA91891E533C2FF3716E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Roaming\RevokeUninstall\Logs\e9c5b638.default-esr\unicodedata.pyd
Size 721KB
SHA256 d9eeaa4bec45eb76494f36c4df364920b59ed18d11d4c216c368be45329293ca
MD5 466ac2bbef485d8391afac8397bdff97
SHA1 eea7fcf53db60ebb71acb8a78ffaea7d007b751b
SHA512 990e08010d35aaa87650afade10594419b9d6fb425c3c460ef2e1694f8e75c59a66b76cbd6633c0868291a05d04f7761aaa4199ad626a37b81f693dc6d452efe
SSDEEP 12288:6NJsoZcdJhcHnMAURE6+fvPKH4DWBDEZqMxcLK:6NJs/dsHXjvPK1DEZkLK
TLSH
T178F4F45CB4810A12E61DCAB533A37646D06FF37EDE4A8B2B3AD44510D4032F9B9EF619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Roaming\RevokeUninstall\Logs\e9c5b638.default-esr\vcruntime140.dll
Size 88KB
SHA256 bf33857f46e56ea7930c1eea25c5f7175a6aaa3df36bf8301a785e6ca726a0b9
MD5 c33386a6e67be415a24d9c431ffd42ac
SHA1 f2f23860916471bdc332b3bd3e88deef64d4432b
SHA512 bc6d5e908bfaa7a35a8f2e01912412b9460604ea19fd27ee5c6f1a05eb0180a07bf7bc26d430326afc9b81d7f19fb1899e6245196a37710c3e5346d0bc2b4c98
SSDEEP 1536:EbiyVUrqIQsn1xtg6RxkkBGCGHDWbWXaecbGasQLvBrzU6LzNa:eiyLyt/xcRjWaXaecbGzurJBa
TLSH
T100937E5235E482B2DDAF04F0D97AEB076A3DA6900FF129F76B949949DE617C0D73020B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc.exe

Path C:\Users\Admin\AppData\Roaming\RevokeUninstall\Logs\e9c5b638.default-esr\vlc.exe
Size 1009KB
SHA256 a0706de5c6c1b2845c0730135628e05bfcf536fea5f7c64d3681ce289cfa410f
MD5 d697bdacaffcb2a4a7414869a99bd7fd
SHA1 df10ae3b2808f790e9ec9603023cb36865f43053
SHA512 77bcb0a797bda7978ab88461580dbe479557ff4a0423c5db1c0620e24843529e4a01b25dffecae1a02271b882b7c24cfdd33c5739946afbaffba8737a06e1bc3
SSDEEP 24576:WPbKyf/5gTIyWbUjJrNfZz9SOPkV2eUmeOKxOM4HGodidl:Wr/5gJIEOM4HO
TLSH
T16C255B6AF64384F1ED1705F1090BFBBB95349B198020CC6FE6CCDE94FBB2D522569226
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4740-3940-0x0000000004AE0000-0x0000000004AE6000-memory.dmp

Download

memory/4740-3935-0x0000000004900000-0x0000000004968000-memory.dmp

Download

memory/4932-3926-0x00000000047C0000-0x00000000047FE000-memory.dmp

Download

memory/4932-6809-0x0000000005050000-0x0000000005062000-memory.dmp

Download

memory/4932-3961-0x0000000004D40000-0x0000000004D5E000-memory.dmp

Download

memory/4932-3960-0x0000000004940000-0x00000000049B6000-memory.dmp

Download

memory/5268-412-0x000000007F200000-0x000000007F201000-memory.dmp

Download

memory/5268-2525-0x00000000031F0000-0x00000000032B1000-memory.dmp

Download

memory/5268-549-0x0000000002CD0000-0x0000000002D18000-memory.dmp

Download

memory/5268-542-0x0000000002CD0000-0x0000000002D18000-memory.dmp

Download

memory/5268-535-0x0000000002CD0000-0x0000000002D18000-memory.dmp

Download

memory/5268-528-0x0000000002CD0000-0x0000000002D18000-memory.dmp

Download

memory/5268-521-0x0000000002CD0000-0x0000000002D18000-memory.dmp

Download

memory/5268-514-0x0000000002CD0000-0x0000000002D18000-memory.dmp

Download

memory/5268-507-0x0000000002CD0000-0x0000000002D18000-memory.dmp

Download

memory/5268-500-0x0000000002CD0000-0x0000000002D18000-memory.dmp

Download

memory/5268-493-0x0000000002CD0000-0x0000000002D18000-memory.dmp

Download

memory/5268-486-0x0000000002CD0000-0x0000000002D18000-memory.dmp

Download

memory/5268-479-0x0000000002CD0000-0x0000000002D18000-memory.dmp

Download

memory/5268-465-0x0000000002CD0000-0x0000000002D18000-memory.dmp

Download

memory/5268-458-0x0000000002CD0000-0x0000000002D18000-memory.dmp

Download

memory/5268-451-0x0000000002CD0000-0x0000000002D18000-memory.dmp

Download

memory/5268-444-0x0000000002CD0000-0x0000000002D18000-memory.dmp

Download

memory/5268-421-0x0000000002CD0000-0x0000000002D18000-memory.dmp

Download

memory/5268-423-0x000000007F200000-0x000000007F201000-memory.dmp

Download

memory/5268-430-0x0000000002CD0000-0x0000000002D18000-memory.dmp

Download

memory/5268-418-0x000000007F200000-0x000000007F201000-memory.dmp

Download

memory/5268-415-0x000000007F200000-0x000000007F201000-memory.dmp

Download

memory/5268-0-0x0000000002CD0000-0x0000000002D18000-memory.dmp

Download

memory/5268-410-0x000000007F200000-0x000000007F201000-memory.dmp

Download

memory/5268-409-0x000000007F200000-0x000000007F201000-memory.dmp

Download

memory/5268-651-0x000000007F380000-0x000000007F3A0000-memory.dmp

Download

memory/5268-664-0x000000007F3B0000-0x000000007F3B1000-memory.dmp

Download

memory/5268-715-0x0000000003190000-0x00000000031E1000-memory.dmp

Download

memory/5268-852-0x00000000031F0000-0x00000000032B1000-memory.dmp

Download

memory/5268-1182-0x00000000031F0000-0x00000000032B1000-memory.dmp

Download

memory/5268-1512-0x00000000031F0000-0x00000000032B1000-memory.dmp

Download

memory/5268-1842-0x00000000031F0000-0x00000000032B1000-memory.dmp

Download

memory/5268-2195-0x00000000031F0000-0x00000000032B1000-memory.dmp

Download

memory/5268-556-0x0000000002CD0000-0x0000000002D18000-memory.dmp

Download

memory/5268-3145-0x0000000003190000-0x00000000031E1000-memory.dmp

Download

memory/5268-3146-0x0000000003190000-0x00000000031E1000-memory.dmp

Download

memory/5268-3148-0x0000000003190000-0x00000000031E1000-memory.dmp

Download

memory/5268-3149-0x0000000003190000-0x00000000031E1000-memory.dmp

Download

memory/5268-3151-0x0000000003190000-0x00000000031E1000-memory.dmp

Download

memory/5268-3153-0x0000000003190000-0x00000000031E1000-memory.dmp

Download

memory/5268-3155-0x0000000003190000-0x00000000031E1000-memory.dmp

Download

memory/5268-3157-0x0000000003190000-0x00000000031E1000-memory.dmp

Download

memory/5268-3163-0x0000000003190000-0x00000000031E1000-memory.dmp

Download

memory/5268-3161-0x0000000003190000-0x00000000031E1000-memory.dmp

Download

memory/5268-3159-0x0000000003190000-0x00000000031E1000-memory.dmp

Download

memory/5268-563-0x0000000002CD0000-0x0000000002D18000-memory.dmp

Download

memory/5268-4-0x000000007F200000-0x000000007F201000-memory.dmp

Download

memory/5268-570-0x0000000002CD0000-0x0000000002D18000-memory.dmp

Download

memory/5268-577-0x0000000002CD0000-0x0000000002D18000-memory.dmp

Download

memory/5268-584-0x0000000002CD0000-0x0000000002D18000-memory.dmp

Download

memory/5268-591-0x0000000002CD0000-0x0000000002D18000-memory.dmp

Download

memory/5268-598-0x0000000002CD0000-0x0000000002D18000-memory.dmp

Download

memory/5268-605-0x0000000002CD0000-0x0000000002D18000-memory.dmp

Download

memory/5268-612-0x0000000002CD0000-0x0000000002D18000-memory.dmp

Download

memory/5268-623-0x0000000002CD0000-0x0000000002D18000-memory.dmp

Download

memory/5268-630-0x0000000002CD0000-0x0000000002D18000-memory.dmp

Download

memory/5268-645-0x0000000002CD0000-0x0000000002D18000-memory.dmp

Download

memory/5268-646-0x0000000002CD0000-0x0000000002D18000-memory.dmp

Download

memory/5268-472-0x0000000002CD0000-0x0000000002D18000-memory.dmp

Download

memory/5268-437-0x0000000002CD0000-0x0000000002D18000-memory.dmp

Download

memory/5268-1-0x000000007F200000-0x000000007F201000-memory.dmp

Download

memory/5268-6-0x000000007F200000-0x000000007F201000-memory.dmp

Download

memory/5268-7-0x000000007F200000-0x000000007F201000-memory.dmp

Download

memory/5268-9-0x000000007F200000-0x000000007F201000-memory.dmp

Download

memory/5268-23-0x000000007F200000-0x000000007F201000-memory.dmp

Download

memory/5268-15-0x000000007F200000-0x000000007F201000-memory.dmp

Download

memory/5268-11-0x000000007F200000-0x000000007F201000-memory.dmp

Download

memory/5300-3929-0x0000000005100000-0x000000000514A000-memory.dmp

Download