020e22de988461840dbc05ddd0c3ee36da7b8301299020e5f848b097f5fc4267

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/08/2026, 00:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_3cfdf84af3aa6b0b3f02c0f7f62624fa_amadey_darkgate_elex_stop.exe
Size 6.2MB
Sample260812-acl2vsfl4s
SHA256 020e22de988461840dbc05ddd0c3ee36da7b8301299020e5f848b097f5fc4267
MD5 3cfdf84af3aa6b0b3f02c0f7f62624fa
SHA1 ed9501031f508a5db30cdffd9deb3fe08ef7f49a
SHA512 82f32b444acd07850342f1cf7c0444a912c8534ea831d2dd8e9de2f35f9c785e868817abdee10016c2b3c016515baf7227f4a9a3541219e35c980151bb1eb7b2
SSDEEP 49152:U+ESm+ES+ESgq+ESm+ES+ESm+ES+ESm+ES+ESgq+ESm+ES+ESm+ES+ESm+ES+ESv:hp76
TLSH
T1E7662B09F98340B1D92B50F04DCFE3BF8A60BB2586128DF7F74DCB5BA932BA15428655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2052	svchost_CCAABBBCABBAAAACBAABBACABCAAACCCCBBBABBBAAAABCACAAACAAA.exe
4228	svchost_BCACACCCBBACAABABBBBBAABCBBBACCCABCBCAACABCCCABAACCBCBA.exe
1692	svchost_CCAABBBCABBAAAACBAABBACABCAAACCCCBBBABBBAAAABCACAAACAAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BBBCABAAABACABACCBBABBCCAACBAACABAAACBCAAABABBCACCAAABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCAABBBCABBAAAACBAABBACABCAAACCCCBBBABBBAAAABCACAAACAAA.exe"	2026-08-11_3cfdf84af3aa6b0b3f02c0f7f62624fa_amadey_darkgate_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_AACCCBBCAACCCAABABCAAACBBBAACACCCCCBCBACBCACBACBBACCCBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCACACCCBBACAABABBBBBAABCBBBACCCABCBCAACABCCCABAACCBCBA.exe"	svchost_CCAABBBCABBAAAACBAABBACABCAAACCCCBBBABBBAAAABCACAAACAAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2164	sc.exe
2236	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5088	cmd.exe
4808	cmd.exe
452	cmd.exe
4712	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCAABBBCABBAAAACBAABBACABCAAACCCCBBBABBBAAAABCACAAACAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCACACCCBBACAABABBBBBAABCBBBACCCABCBCAACABCCCABAACCBCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_3cfdf84af3aa6b0b3f02c0f7f62624fa_amadey_darkgate_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3088	schtasks.exe
772	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2800	2026-08-11_3cfdf84af3aa6b0b3f02c0f7f62624fa_amadey_darkgate_elex_stop.exe
2800	2026-08-11_3cfdf84af3aa6b0b3f02c0f7f62624fa_amadey_darkgate_elex_stop.exe
2800	2026-08-11_3cfdf84af3aa6b0b3f02c0f7f62624fa_amadey_darkgate_elex_stop.exe
2800	2026-08-11_3cfdf84af3aa6b0b3f02c0f7f62624fa_amadey_darkgate_elex_stop.exe
2052	svchost_CCAABBBCABBAAAACBAABBACABCAAACCCCBBBABBBAAAABCACAAACAAA.exe
2052	svchost_CCAABBBCABBAAAACBAABBACABCAAACCCCBBBABBBAAAABCACAAACAAA.exe
2052	svchost_CCAABBBCABBAAAACBAABBACABCAAACCCCBBBABBBAAAABCACAAACAAA.exe
2052	svchost_CCAABBBCABBAAAACBAABBACABCAAACCCCBBBABBBAAAABCACAAACAAA.exe
4228	svchost_BCACACCCBBACAABABBBBBAABCBBBACCCABCBCAACABCCCABAACCBCBA.exe
4228	svchost_BCACACCCBBACAABABBBBBAABCBBBACCCABCBCAACABCCCABAACCBCBA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2800	2026-08-11_3cfdf84af3aa6b0b3f02c0f7f62624fa_amadey_darkgate_elex_stop.exe
Token: SeDebugPrivilege	2052	svchost_CCAABBBCABBAAAACBAABBACABCAAACCCCBBBABBBAAAABCACAAACAAA.exe
Token: SeDebugPrivilege	4228	svchost_BCACACCCBBACAABABBBBBAABCBBBACCCABCBCAACABCCCABAACCBCBA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1760	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 5088	2800	2026-08-11_3cfdf84af3aa6b0b3f02c0f7f62624fa_amadey_darkgate_elex_stop.exe	96
PID 5088 wrote to memory of 772	5088	cmd.exe	98
PID 2052 wrote to memory of 2468	2052	svchost_CCAABBBCABBAAAACBAABBACABCAAACCCCBBBABBBAAAABCACAAACAAA.exe	99
PID 2468 wrote to memory of 2992	2468	notepad.exe	100
PID 2800 wrote to memory of 4808	2800	2026-08-11_3cfdf84af3aa6b0b3f02c0f7f62624fa_amadey_darkgate_elex_stop.exe	105
PID 4808 wrote to memory of 2164	4808	cmd.exe	107
PID 2800 wrote to memory of 452	2800	2026-08-11_3cfdf84af3aa6b0b3f02c0f7f62624fa_amadey_darkgate_elex_stop.exe	108
PID 452 wrote to memory of 2236	452	cmd.exe	110
PID 2052 wrote to memory of 4712	2052	svchost_CCAABBBCABBAAAACBAABBACABCAAACCCCBBBABBBAAAABCACAAACAAA.exe	112
PID 4712 wrote to memory of 3088	4712	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-08-11_3cfdf84af3aa6b0b3f02c0f7f62624fa_amadey_darkgate_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_3cfdf84af3aa6b0b3f02c0f7f62624fa_amadey_darkgate_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAAACBAABCBBCCAACACAABBAAAABAAAACAABACBBCCABBBCBBAAACCABACACCBAACABBACBBBABBACCABABCACBACBBABCABCCBBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBBCABBAAAACBAABBACABCAAACCCCBBBABBBAAAABCACAAACAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAAACBAABCBBCCAACACAABBAAAABAAAACAABACBBCCABBBCBBAAACCABACACCBAACABBACBBBABBACCABABCACBACBBABCABCCBBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBBCABBAAAACBAABBACABCAAACCCCBBBABBBAAAABCACAAACAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAACBCAACACACBCABBCACBCAABCACCCABBCCBBBCCBBCACCCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBBCABBAAAACBAABBACABCAAACCCCBBBABBBAAAABCACAAACAAA.exe" start= auto displayName= "UserDataSvc_CAACBCAACACACBCABBCACBCAABCACCCABBCCBBBCCBBCACCCABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAACBCAACACACBCABBCACBCAABCACCCABBCCBBBCCBBCACCCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBBCABBAAAACBAABBACABCAAACCCCBBBABBBAAAABCACAAACAAA.exe" start= auto displayName= "UserDataSvc_CAACBCAACACACBCABBCACBCAABCACCCABBCCBBBCCBBCACCCABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAACBCAACACACBCABBCACBCAABCACCCABBCCBBBCCBBCACCCABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:452
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAACBCAACACACBCABBCACBCAABCACCCABBCCBBBCCBBCACCCABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2236

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBBCABBAAAACBAABBACABCAAACCCCBBBABBBAAAABCACAAACAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBBCABBAAAACBAABBACABCAAACCCCBBBABBBAAAABCACAAACAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBACCCCCBABCAABACBCCBABACCCCBABCCCAABCCBBBCABBCACCCCBCCACBBCBBCCBBCBBBCABCCBCCCCBBBACCBBBBCCCABCCBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACACCCBBACAABABBBBBAABCBBBACCCABCBCAACABCCCABAACCBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBACCCCCBABCAABACBCCBABACCCCBABCCCAABCCBBBCABBCACCCCBCCACBBCBBCCBBCBBBCABCCBCCCCBBBACCBBBBCCCABCCBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACACCCBBACAABABBBBBAABCBBBACCCABCBCAACABCCCABAACCBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3088

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1760

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACACCCBBACAABABBBBBAABCBBBACCCABCBCAACABCCCABAACCBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACACCCBBACAABABBBBBAABCBBBACCCABCBCAACABCCCABAACCBCBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4228

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBBCABBAAAACBAABBACABCAAACCCCBBBABBBAAAABCACAAACAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBBCABBAAAACBAABBACABCAAACCCCBBBABBBAAAABCACAAACAAA.exe
1⤵
- Executes dropped EXE
PID:1692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5ba9f30095e2e4e0202be30fb499711f6edab38ed5926cb7c319b9514c38db62
MD5 d9474ca31307f72585536f38985809f0
SHA1 6543d52292412f914abdbf31aa3a180ef340c5d9
SHA512 3481778658da1ad9e4d083212d5bb848784ab34ec6d36947ba00f8abd5f611691cf2e6efded979bc86716a576c2b7e0c05d458e8adefffafebcf55565156570d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 82ee685d929f676be9c7af2cc7b3df693d5b2897cd305efa46964d709507341e
MD5 4976c8c617398b76b9371872f322b5e3
SHA1 5666e6a9ddb90056446af83f589c8dce95b93ce1
SHA512 11fdc0dc43a7857ff1abbd4731858fc4ec2e6ad72bda46cff152afb028f9b8cf81d86dc1d603729423c8ebabdc125d9d8cc1dd21a497727aa03f83175984e1d4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0532a55539df0b6b378243397d31114a38f5ad0b2cb1b9898fa81488ef552fc8
MD5 61bbf61dcad2647c8e9865037f93b492
SHA1 4a6a626745a7db206f1958c04efeed22dcda75f2
SHA512 69903077363fdf2b5fc309f20111941cf45d8f41d8920ff93ddeb407af51419f77e35a43e4c744bc69f83efea80d723e5ef8eda3822a9b05ca446ba1f8b03ecf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7c046187dc37199c0c8316179553866ded20d32c3c007f11ae51e838cc3755fb
MD5 7a1d5409be2d9026a2aa5a0f9b5a3ce6
SHA1 342944c857b27de62fd0600bf62f5c43c461caf6
SHA512 bbdebd8d0913d2f5595d3a05397caaf97d658a5082ca2c43139e9fcdf2463ea17df058874af907be310097109146848d9d3d2b697197e44397a5c6dd70c272b6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ad117c6d820044c0bea0b909b6237ac4e6082f1302e61ae93c6dc48284f03b38
MD5 ade57bad84ca86f3fed1e6671ca4adbe
SHA1 f3576d81f0c9bc93176551c2a5fce5bd6b28a272
SHA512 4eb95b4468d660aa81c7aaa8f718a0b6842fd5ba56cc31aa23f46c355a2dc284192c93921b4cf3338526fb0d43186bdc1d71f90fa0fd3238347a780db8785af5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 69e852f3162f512838515901c3065d521e3ef6f07c819d8e6eafa290f0d6b559
MD5 e5fadfbc9484bc510319ea95e59d631b
SHA1 d913d5c9f7a2aa899237095629c05ca51757cfe2
SHA512 209d4c48bf75e4357416aec97592a1883effd937508d6a7a656f9205f494ffff4f09828d6a8a5431f788694b02e2dc10725ccb671baecbe64dbb7d2758d2f2b7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a02ddb77efcb0e479551ac0c722e4720600dde95cd5ecd0bb3ca63ba5c792927
MD5 01eb6c49e45fd96558eb629f1d56c46d
SHA1 e6c6faa574ebc81cc7d5e4608c7058e25db35887
SHA512 36d8abe4479b6549c7b0d6151f24f5c6289f9f7e026b9f5d0e93d50dcb5da7a9cdaa3ad3c745b4f1150712501962ab4c39f0ab0e5a86d20bcefb00e614746319
MD5 SHA1 SHA512

Submit Download

svchost_CCAABBBCABBAAAACBAABBACABCAAACCCCBBBABBBAAAABCACAAACAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBBCABBAAAACBAABBACABCAAACCCCBBBABBBAAAABCACAAACAAA.exe
Size 6.2MB
SHA256 020e22de988461840dbc05ddd0c3ee36da7b8301299020e5f848b097f5fc4267
MD5 3cfdf84af3aa6b0b3f02c0f7f62624fa
SHA1 ed9501031f508a5db30cdffd9deb3fe08ef7f49a
SHA512 82f32b444acd07850342f1cf7c0444a912c8534ea831d2dd8e9de2f35f9c785e868817abdee10016c2b3c016515baf7227f4a9a3541219e35c980151bb1eb7b2
SSDEEP 49152:U+ESm+ES+ESgq+ESm+ES+ESm+ES+ESm+ES+ESgq+ESm+ES+ESm+ES+ESm+ES+ESv:hp76
TLSH
T1E7662B09F98340B1D92B50F04DCFE3BF8A60BB2586128DF7F74DCB5BA932BA15428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 23d3c6011a9a19e9f962b8026b5d88c8d81f564563f0965661f94c1071f6f572
MD5 7c9305b36eb5d2c28864c620704508bb
SHA1 4becf2d35e9b24e5009fa64bbec03bba8b84ab69
SHA512 000257d2ec88030b4e6472332cca663ae9d12a841b7b0dedf73cde2858a33cc7e0c738cef9a81fc5e9c109f403ca63f3e391ed180f4f2c1dba6bc03b27a4a333
TLSH
T13A110B30A8E6D453E933784BE72DEBD71DE8764B5CAC5A0423484108E7C8C31CE094F9
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 f66c5cd1572cb22d403cfc84483832fc40e1351ae05bd8acc75fb9dba26404f3
MD5 357102d8eb925616995956f3cd78fdef
SHA1 d96db3caea479b00f9d4a5513b1e47a695693db9
SHA512 77c2cb5dc4e2582a46d16dcc310dca9a74dbe17d242f5fb7818e3e8bb8661111efeab2546941607dec4ac237d956dd86999589a3e58b174bfc44c2c8b725f2b8
TLSH
T101119830E5E5D853E923B9CBA739EBD619A8775B5CA85604234D4108E7D8C328D094E5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1692-82-0x0000000000110000-0x0000000000131000-memory.dmp

Download

memory/2052-35-0x0000000000110000-0x0000000000131000-memory.dmp

Download

memory/2468-59-0x00000000027E0000-0x00000000027E1000-memory.dmp

Download

memory/2800-6-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/4228-71-0x0000000000E70000-0x0000000000E91000-memory.dmp

Download

memory/4228-95-0x0000000000E70000-0x0000000000E91000-memory.dmp

Download