c06cf19d94a069a6b8e270e04d7d8368c0807a7e1c7024bb040e47454e30757f

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 00:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_56bfe1c6fc197737384f336ff79c6b31_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
Size 15.9MB
Sample260802-a3bc2szzht
SHA256 c06cf19d94a069a6b8e270e04d7d8368c0807a7e1c7024bb040e47454e30757f
MD5 56bfe1c6fc197737384f336ff79c6b31
SHA1 0ae0aead71d8c41926f62a89c95a66548303b802
SHA512 0e2e539d447fb53d20b5d15a85fbf3241da8fc4dcf4177e8de6c828be57066f8fd6eee18c7257b0e04d222fba0ebbf5041fe156120e1de635b4852f98d51a40e
SSDEEP 393216:dVep4qVxIYZiUhx7Le5j2zm13oJMqQt9XdipZ3M7Lp5QXl:3O4XYZiUhZO2GqgXYpZ87Vi
TLSH
T1B9F633137382C036FFAB91335B5AF14616BDAA164233892F27D82D79BDB0261532D673
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 19 IoCs

pid	Process
2520	CL_Debug_Log.txt
2108	HackCM.exe
4208	HackCM.exe
5960	HackCM.exe
5984	HackCM.exe
3360	HackCM.exe
4828	HackCM.exe
3320	HackCM.exe
2540	HackCM.exe
2796	HackCM.exe
3552	HackCM.exe
4784	HackCM.exe
2416	HackCM.exe
2636	HackCM.exe
3512	HackCM.exe
2708	HackCM.exe
3936	HackCM.exe
5996	HackCM.exe
1484	HackCM.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000c00000001c5a2-20.dat	autoit_exe
behavioral2/files/0x000e00000001c59a-23.dat	autoit_exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 4208 set thread context of 5984	4208	HackCM.exe	97
PID 4208 set thread context of 3360	4208	HackCM.exe	99
PID 4208 set thread context of 4828	4208	HackCM.exe	101
PID 4208 set thread context of 3320	4208	HackCM.exe	104
PID 4208 set thread context of 2540	4208	HackCM.exe	106
PID 4208 set thread context of 2796	4208	HackCM.exe	108
PID 4208 set thread context of 2416	4208	HackCM.exe	112
PID 4208 set thread context of 2636	4208	HackCM.exe	114
PID 4208 set thread context of 3512	4208	HackCM.exe	116
PID 4208 set thread context of 5996	4208	HackCM.exe	120
PID 4208 set thread context of 1484	4208	HackCM.exe	122

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2364	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_56bfe1c6fc197737384f336ff79c6b31_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CL_Debug_Log.txt
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	HackCM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	HackCM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	HackCM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	HackCM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	HackCM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	HackCM.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4384	schtasks.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2520	CL_Debug_Log.txt
Token: 35	2520	CL_Debug_Log.txt
Token: SeSecurityPrivilege	2520	CL_Debug_Log.txt
Token: SeSecurityPrivilege	2520	CL_Debug_Log.txt

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
244	2026-08-01_56bfe1c6fc197737384f336ff79c6b31_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
244	2026-08-01_56bfe1c6fc197737384f336ff79c6b31_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
244	2026-08-01_56bfe1c6fc197737384f336ff79c6b31_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
2108	HackCM.exe
2108	HackCM.exe
2108	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
3552	HackCM.exe
3552	HackCM.exe
3552	HackCM.exe
4784	HackCM.exe
4784	HackCM.exe
4784	HackCM.exe
2708	HackCM.exe
2708	HackCM.exe
2708	HackCM.exe
3936	HackCM.exe
3936	HackCM.exe
3936	HackCM.exe

Suspicious use of SendNotifyMessage 21 IoCs

pid	Process
244	2026-08-01_56bfe1c6fc197737384f336ff79c6b31_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
244	2026-08-01_56bfe1c6fc197737384f336ff79c6b31_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
244	2026-08-01_56bfe1c6fc197737384f336ff79c6b31_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
2108	HackCM.exe
2108	HackCM.exe
2108	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
4208	HackCM.exe
3552	HackCM.exe
3552	HackCM.exe
3552	HackCM.exe
4784	HackCM.exe
4784	HackCM.exe
4784	HackCM.exe
2708	HackCM.exe
2708	HackCM.exe
2708	HackCM.exe
3936	HackCM.exe
3936	HackCM.exe
3936	HackCM.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 244 wrote to memory of 2520	244	2026-08-01_56bfe1c6fc197737384f336ff79c6b31_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	89
PID 244 wrote to memory of 2364	244	2026-08-01_56bfe1c6fc197737384f336ff79c6b31_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	91
PID 2364 wrote to memory of 4384	2364	cmd.exe	93
PID 2108 wrote to memory of 4208	2108	HackCM.exe	95
PID 4208 wrote to memory of 5960	4208	HackCM.exe	96
PID 4208 wrote to memory of 5984	4208	HackCM.exe	97
PID 4208 wrote to memory of 5984	4208	HackCM.exe	97
PID 4208 wrote to memory of 5984	4208	HackCM.exe	97
PID 4208 wrote to memory of 3360	4208	HackCM.exe	99
PID 4208 wrote to memory of 3360	4208	HackCM.exe	99
PID 4208 wrote to memory of 3360	4208	HackCM.exe	99
PID 4208 wrote to memory of 4828	4208	HackCM.exe	101
PID 4208 wrote to memory of 4828	4208	HackCM.exe	101
PID 4208 wrote to memory of 4828	4208	HackCM.exe	101
PID 4208 wrote to memory of 3320	4208	HackCM.exe	104
PID 4208 wrote to memory of 3320	4208	HackCM.exe	104
PID 4208 wrote to memory of 3320	4208	HackCM.exe	104
PID 4208 wrote to memory of 2540	4208	HackCM.exe	106
PID 4208 wrote to memory of 2540	4208	HackCM.exe	106
PID 4208 wrote to memory of 2540	4208	HackCM.exe	106
PID 4208 wrote to memory of 2796	4208	HackCM.exe	108
PID 4208 wrote to memory of 2796	4208	HackCM.exe	108
PID 4208 wrote to memory of 2796	4208	HackCM.exe	108
PID 3552 wrote to memory of 4784	3552	HackCM.exe	111
PID 4208 wrote to memory of 2416	4208	HackCM.exe	112
PID 4208 wrote to memory of 2416	4208	HackCM.exe	112
PID 4208 wrote to memory of 2416	4208	HackCM.exe	112
PID 4208 wrote to memory of 2636	4208	HackCM.exe	114
PID 4208 wrote to memory of 2636	4208	HackCM.exe	114
PID 4208 wrote to memory of 2636	4208	HackCM.exe	114
PID 4208 wrote to memory of 3512	4208	HackCM.exe	116
PID 4208 wrote to memory of 3512	4208	HackCM.exe	116
PID 4208 wrote to memory of 3512	4208	HackCM.exe	116
PID 2708 wrote to memory of 3936	2708	HackCM.exe	119
PID 4208 wrote to memory of 5996	4208	HackCM.exe	120
PID 4208 wrote to memory of 5996	4208	HackCM.exe	120
PID 4208 wrote to memory of 5996	4208	HackCM.exe	120
PID 4208 wrote to memory of 1484	4208	HackCM.exe	122
PID 4208 wrote to memory of 1484	4208	HackCM.exe	122
PID 4208 wrote to memory of 1484	4208	HackCM.exe	122

C:\Users\Admin\AppData\Local\Temp\2026-08-01_56bfe1c6fc197737384f336ff79c6b31_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_56bfe1c6fc197737384f336ff79c6b31_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:244
- C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
  C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt" -o"C:\Users\Admin\AppData\Local\Temp\"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\hack.xml" /TN "System\hack"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\hack.xml" /TN "System\hack"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4384

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\HackCM.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\HackCM.exe" -SystemCheck
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\HackCM.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\HackCM.exe" -SystemCheck95224
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\HackCM.exe
    7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
    3⤵
    - Executes dropped EXE
    PID:5960
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\HackCM.exe
    7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
    3⤵
    - Executes dropped EXE
    PID:5984
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\HackCM.exe
    7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
    3⤵
    - Executes dropped EXE
    PID:3360
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\HackCM.exe
    7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
    3⤵
    - Executes dropped EXE
    PID:4828
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\HackCM.exe
    7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
    3⤵
    - Executes dropped EXE
    PID:3320
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\HackCM.exe
    7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
    3⤵
    - Executes dropped EXE
    PID:2540
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\HackCM.exe
    7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
    3⤵
    - Executes dropped EXE
    PID:2796
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\HackCM.exe
    7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
    3⤵
    - Executes dropped EXE
    PID:2416
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\HackCM.exe
    7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
    3⤵
    - Executes dropped EXE
    PID:2636
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\HackCM.exe
    7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
    3⤵
    - Executes dropped EXE
    PID:3512
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\HackCM.exe
    7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
    3⤵
    - Executes dropped EXE
    PID:5996
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\HackCM.exe
    7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
    3⤵
    - Executes dropped EXE
    PID:1484

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\HackCM.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\HackCM.exe" -SystemCheck
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\HackCM.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\HackCM.exe" -SystemCheck95224
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4784

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\HackCM.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\HackCM.exe" -SystemCheck
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\HackCM.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\HackCM.exe" -SystemCheck95224
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

32.exe

Path C:\Users\Admin\AppData\Local\Temp\32.exe
Size 7.4MB
SHA256 0c6115ed440e90e277cd8151dc54d7e8ad27d8a46fddc609e6ebd2b0dd32b2a2
MD5 3bbaa1b730914ca3386679d544761332
SHA1 76a5e2a5799a2627c8ee2cce421cfe2c3a1e214d
SHA512 ad44369e9a9d85f9ba781f678bfeb6611075941ac2eb0c8406a33a5787fd300fbaeb74a0986fbd911f58150d1ed71c4e29ca107177496e23e5ea15b911569ae9
SSDEEP 196608:DCKzMio/d3NRixG/++c3y53p/yIqkD35dzFcV4dBOXMX6Zo50j:GEK1SxG/eq3pUIrpguQXMKZi
TLSH
T189762302B3D5D036FFABA2739B26F6059A7D79294033962F13982D787D306B1172D623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64.exe

Path C:\Users\Admin\AppData\Local\Temp\64.exe
Size 8.4MB
SHA256 cdaf00cf4538e9d8f0690becf2273fe1ecac9b3f3652fc62de6d398b7439e38a
MD5 fd8b905686e9740f3601a22efaefefa0
SHA1 b9a44b2458b80a5624db921ae2fae1cad1126a0c
SHA512 0c5709afd58cec5e40186634a9a5ee4d063a34d98940510f1d3b6182718213f193ea025b889f45cdfbe1e5d5ef579c981af37bf9ccf60afe1b97e723397ec434
SSDEEP 196608:7bB8drM5spYTpktWkMipwqEvZxh/mniAWM:HB8dgOGTpktWa2Zj/Ac
TLSH
T1BD96235A23A851A9FF77E076CA52C647C3B1B88E467B872F02E049726F337711A1E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CL_Debug_Log.txt

Path C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
Size 722KB
SHA256 ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d
MD5 43141e85e7c36e31b52b22ab94d5e574
SHA1 cfd7079a9b268d84b856dc668edbb9ab9ef35312
SHA512 9119ae7500aa5cccf26a0f18fd8454245347e3c01dabba56a93dbaaab86535e62b1357170758f3b3445b8359e7dd5d37737318a5d8a6047c499d32d5b64126fc
SSDEEP 12288:AwAxBpwU5gU+2/9dB5XlH1YAEa5OLW0TjLWG3rn0Yf5ogmn9X9Rf6TIALr22DIVM:AhY2gUfVH5XlVYzagW4/3rn0Y5zmzRfq
TLSH
T177F48D227BF6C0B7C64211318A1C6BF690F6F3190B3059C367908F6D6B399D5D63AE1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CR_Debug_Log.txt

Path C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt
Size 14.6MB
SHA256 162f221a180e8d0f0c08e68e34f7c6af98afd71533965160a922e360e27944fd
MD5 cb397fc5e19b4fc8edf8398266f3d563
SHA1 3dfa12ba0782b717f225dada2e2978862b591439
SHA512 87ac00f287eaee1d75834df0fe78bc3776a07a879e0e100e4c878fb6eaa4c0d9d16a0f04ba88b00ecb40e9dd625b85f17fdca3004d41f54e9bd5c0da5957a091
SSDEEP 393216:nEmkdeGdmZMf9o8gCawFli/ss8hWvLgROaFs:nERpdggo8gCz0f8MgRC
TLSH
T196F6337C309CC0ADDDC7A842024C505794791BFC8EB40AE425A979F93D6BC6BD39EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hack.xml

Path C:\Users\Admin\AppData\Local\Temp\hack.xml
Size 1KB
SHA256 9226324f71858e48edd0b5fb98b230bc0c491d610095aec00fdc0bda112514bb
MD5 ba42dea33bb5303b3de25455f168b9de
SHA1 2d0c4c6cf12a118894e7996d122bf1e7192a3600
SHA512 5b70c28fbcec2149ab734ffd1cf1e0ac26c64f26237cc0555b03eb6563dc928dfa69771be862a0bbb327141767966ccd67101a2f36a0febcc969d2577dfa0d6b
TLSH
T17A41F0686DC0B307A577413AD76092C2FE32876342574030F5CC076F2FFA646911392A
MD5 SHA1 SHA512 TLSH

Submit Download

Tor.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp
Size 2.5MB
SHA256 9a78c80e93bd1ed3d71eb090465e39a69470cd1812fc5e169d8b412e8c665963
MD5 54183220aa6c777f8228474ff5b5df01
SHA1 ed438f17bffb37d42afd61d8dcef0c50d554c65c
SHA512 70b1e22449c5264bed46b62595206e3ad36e2a9c33fa9589acb792d499dcbbae5ebdbf3b35c140e72a7d594f807a6ce1ab925736b5e1a07c17a26445a2591987
SSDEEP 49152:xBzi9LdDLYmoYJ6uNXGT3jxWQTPyB9pC6tOpJMvPyc+r:x8j7NJ6ulGLjxR+B9ostk
TLSH
T1E4C5338C6FD0FB23D8F5C96856A03800D2C83A72AD8F0512ABDD9DAC89D9677C3754D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TorConfig

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorData\TorConfig
Size 201B
SHA256 69d57bfb46ef8097c1cfca65885790421d0e0965b7778f165cd7df9368807776
MD5 b9d2fe9cfa840518fa39039c928d4938
SHA1 0561516b7cfa784cf400349983817c8b18817256
SHA512 894510d39a044a37325d73b8348860960b3a78c54e7cdf81357f4b50e8dcf5d47ab98c768e6439949ba835802b2a5e98314441127d9655b027caf246e09e013d
TLSH
T1A3D012184AFCCE0DE8A3A95301B686C85320EFD33B88BA154779D89C7AA1D48B5B1486
MD5 SHA1 SHA512 TLSH

Submit Download

memory/244-19-0x00000000042D0000-0x00000000042D1000-memory.dmp

Download

memory/244-21-0x00000000042E0000-0x00000000042E1000-memory.dmp

Download

memory/244-17-0x00000000042B0000-0x00000000042B1000-memory.dmp

Download

memory/244-18-0x00000000042C0000-0x00000000042C1000-memory.dmp

Download

memory/1484-85-0x00000217ABF30000-0x00000217AC053000-memory.dmp

Download

memory/2416-63-0x000002DC48800000-0x000002DC48923000-memory.dmp

Download

memory/2540-51-0x000001C23F900000-0x000001C23FA23000-memory.dmp

Download

memory/2636-68-0x000001C153540000-0x000001C153663000-memory.dmp

Download

memory/2796-56-0x0000022B2A410000-0x0000022B2A533000-memory.dmp

Download

memory/3320-46-0x000001C0F3680000-0x000001C0F37A3000-memory.dmp

Download

memory/3360-36-0x000001BBED630000-0x000001BBED753000-memory.dmp

Download

memory/3512-73-0x0000012A704D0000-0x0000012A705F3000-memory.dmp

Download

memory/4828-41-0x000001E91B030000-0x000001E91B153000-memory.dmp

Download

memory/5984-31-0x00000258636E0000-0x0000025863803000-memory.dmp

Download

memory/5996-80-0x00000184AB9D0000-0x00000184ABAF3000-memory.dmp

Download