a83730229d0025841138e6ed4c443434b618e68ec86a4fe56871f8e30f72119f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 03:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_860fb475a0fa654cb2eaea4576ce5775_amadey_darkgate_elex_stop_vidar.exe
Size 8.6MB
Sample260814-eg7atafa69
SHA256 a83730229d0025841138e6ed4c443434b618e68ec86a4fe56871f8e30f72119f
MD5 860fb475a0fa654cb2eaea4576ce5775
SHA1 08e10e8114d60d13a834f09f6d5b1a4a496b8b65
SHA512 2ff2f32b111b5b34e1cf9f3f71bf6eef37cc87a3fd70a5838ec87bb65ff126deb6aca9bf04131b8437242954d92828fcc46e5a52464266c33a2e1158ed99b791
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+EOM+ES+ES+o:5p7D
TLSH
T15C963B09F94340B1D92B51B04DDBD3BF8A70BB2187128EEBF64DCB1B6933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1752	svchost_CBCACBBBCABAACACABBBBCABBBABBAACAABBBBAACCCAAAACAAABAAB.exe
5112	svchost_ABBBAACBCACCCCCBCBBBBCBCCABBCBCCBACCAAABACCABBCACABCBCB.exe
652	svchost_CBCACBBBCABAACACABBBBCABBBABBAACAABBBBAACCCAAAACAAABAAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BBCCCACAACCACCBACCCBBAAACBCCCBCBCCBBACAACABABBABBCBABBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBAACBCACCCCCBCBBBBCBCCABBCBCCBACCAAABACCABBCACABCBCB.exe"	svchost_CBCACBBBCABAACACABBBBCABBBABBAACAABBBBAACCCAAAACAAABAAB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_ABAAAACCCBBCBCBBBABCBCABBCAACBCACAACBCAAACBCBACCCCABACAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCACBBBCABAACACABBBBCABBBABBAACAABBBBAACCCAAAACAAABAAB.exe"	2026-08-14_860fb475a0fa654cb2eaea4576ce5775_amadey_darkgate_elex_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5052	sc.exe
4236	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4008	cmd.exe
4320	cmd.exe
2920	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCACBBBCABAACACABBBBCABBBABBAACAABBBBAACCCAAAACAAABAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBAACBCACCCCCBCBBBBCBCCABBCBCCBACCAAABACCABBCACABCBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_860fb475a0fa654cb2eaea4576ce5775_amadey_darkgate_elex_stop_vidar.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3100	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4188	2026-08-14_860fb475a0fa654cb2eaea4576ce5775_amadey_darkgate_elex_stop_vidar.exe
4188	2026-08-14_860fb475a0fa654cb2eaea4576ce5775_amadey_darkgate_elex_stop_vidar.exe
4188	2026-08-14_860fb475a0fa654cb2eaea4576ce5775_amadey_darkgate_elex_stop_vidar.exe
4188	2026-08-14_860fb475a0fa654cb2eaea4576ce5775_amadey_darkgate_elex_stop_vidar.exe
1752	svchost_CBCACBBBCABAACACABBBBCABBBABBAACAABBBBAACCCAAAACAAABAAB.exe
1752	svchost_CBCACBBBCABAACACABBBBCABBBABBAACAABBBBAACCCAAAACAAABAAB.exe
1752	svchost_CBCACBBBCABAACACABBBBCABBBABBAACAABBBBAACCCAAAACAAABAAB.exe
1752	svchost_CBCACBBBCABAACACABBBBCABBBABBAACAABBBBAACCCAAAACAAABAAB.exe
5112	svchost_ABBBAACBCACCCCCBCBBBBCBCCABBCBCCBACCAAABACCABBCACABCBCB.exe
5112	svchost_ABBBAACBCACCCCCBCBBBBCBCCABBCBCCBACCAAABACCABBCACABCBCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4188	2026-08-14_860fb475a0fa654cb2eaea4576ce5775_amadey_darkgate_elex_stop_vidar.exe
Token: SeDebugPrivilege	1752	svchost_CBCACBBBCABAACACABBBBCABBBABBAACAABBBBAACCCAAAACAAABAAB.exe
Token: SeDebugPrivilege	5112	svchost_ABBBAACBCACCCCCBCBBBBCBCCABBCBCCBACCAAABACCABBCACABCBCB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5056	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 4008	4188	2026-08-14_860fb475a0fa654cb2eaea4576ce5775_amadey_darkgate_elex_stop_vidar.exe	103
PID 4008 wrote to memory of 3100	4008	cmd.exe	105
PID 1752 wrote to memory of 4276	1752	svchost_CBCACBBBCABAACACABBBBCABBBABBAACAABBBBAACCCAAAACAAABAAB.exe	108
PID 4276 wrote to memory of 4460	4276	notepad.exe	109
PID 4188 wrote to memory of 4320	4188	2026-08-14_860fb475a0fa654cb2eaea4576ce5775_amadey_darkgate_elex_stop_vidar.exe	114
PID 4320 wrote to memory of 5052	4320	cmd.exe	116
PID 4188 wrote to memory of 2920	4188	2026-08-14_860fb475a0fa654cb2eaea4576ce5775_amadey_darkgate_elex_stop_vidar.exe	117
PID 2920 wrote to memory of 4236	2920	cmd.exe	119

C:\Users\Admin\AppData\Local\Temp\2026-08-14_860fb475a0fa654cb2eaea4576ce5775_amadey_darkgate_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_860fb475a0fa654cb2eaea4576ce5775_amadey_darkgate_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACAAAABCCCBACBAACCABCACBAACBBBCABBBAAABBACCBAAACBBAAACABCAABBACAACABAACAACBBABCBBBCBCCABBBBCCCCCBCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACBBBCABAACACABBBBCABBBABBAACAABBBBAACCCAAAACAAABAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4008
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACAAAABCCCBACBAACCABCACBAACBBBCABBBAAABBACCBAAACBBAAACABCAABBACAACABAACAACBBABCBBBCBCCABBBBCCCCCBCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACBBBCABAACACABBBBCABBBABBAACAABBBBAACCCAAAACAAABAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABBCBBBBCAABBACACBBACCABCBABBAAAACAAAAABCBACAABBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACBBBCABAACACABBBBCABBBABBAACAABBBBAACCCAAAACAAABAAB.exe" start= auto displayName= "UserDataSvc_AABBCBBBBCAABBACACBBACCABCBABBAAAACAAAAABCBACAABBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABBCBBBBCAABBACACBBACCABCBABBAAAACAAAAABCBACAABBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACBBBCABAACACABBBBCABBBABBAACAABBBBAACCCAAAACAAABAAB.exe" start= auto displayName= "UserDataSvc_AABBCBBBBCAABBACACBBACCABCBABBAAAACAAAAABCBACAABBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABBCBBBBCAABBACACBBACCABCBABBAAAACAAAAABCBACAABBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABBCBBBBCAABBACACBBACCABCBABBAAAACAAAAABCBACAABBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4236

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACBBBCABAACACABBBBCABBBABBAACAABBBBAACCCAAAACAAABAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACBBBCABAACACABBBBCABBBABBAACAABBBBAACCCAAAACAAABAAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4460

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5056

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBAACBCACCCCCBCBBBBCBCCABBCBCCBACCAAABACCABBCACABCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBAACBCACCCCCBCBBBBCBCCABBCBCCBACCAAABACCABBCACABCBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5112

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACBBBCABAACACABBBBCABBBABBAACAABBBBAACCCAAAACAAABAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACBBBCABAACACABBBBCABBBABBAACAABBBBAACCCAAAACAAABAAB.exe
1⤵
- Executes dropped EXE
PID:652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PushJoin.exe

Path C:\Users\Admin\Desktop\PushJoin.exe
Size 17.7MB
SHA256 3512ba8ab6624d7cd32caa4c0987f325042f58546de5bffcbc7b0b8ce56c9a48
MD5 25725354233520d9d41ab9ff5da23200
SHA1 3a3faee5f8533a289b0a1c628bce82d327cb614a
SHA512 492d7c690ecd34988553c37595d05508e835e377217e51af6f80ac72aacd822b8243bb3f6544ac0e9b74d97a3ba3b94563a21f52a71340a3e14d44e157c5f151
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+EOM+ES+ES+S:5p71p7ki6lC
TLSH
T13A173B09F94340B1D92B51B04DDBD3BF8A70BB2187128EEBF64DCB1B6933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PushJoin.exe

Path C:\Users\Admin\Desktop\PushJoin.exe
Size 52.1MB
SHA256 07184c92eaf71b091f72008abdc522a7300ffb914cc616eeea108fbb7c3667b8
MD5 d0e6fdbcec58da70cc7d6319e2d5323f
SHA1 d66b1f2772e1c5f8b5bedf454dce635d15b77c27
SHA512 f9b1e5f98b558dfcf9642812d17b1359c9627c6ad3f62c5fb4a00641adc1b3d50faa75ceca0a1646719f2fc6b297e00db188b197e452bda00b4f8cfd2c893d52
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+EOM+ES+ES+g:5p71p71p71p71p71p7ki6lQ
TLSH
T120C73B09F94340B1D92B51B04DDBD3BF8A70BB2187128EEBF64DCB1B6933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WaitRepair.exe

Path C:\Users\Admin\Desktop\WaitRepair.exe
Size 52.2MB
SHA256 fda37483a58afd8950dcdd41217268d9ca67388d1f5571afe5ca807d809576f1
MD5 658f67214dfa2f66e037a65a8539bc7c
SHA1 519279292c4b1c4ccf204d70e5f6ededed272d34
SHA512 7b41219cf13f1f59a0a2c2a756195c83299e57501d6e753b1b90af7583d2dd0bf11b1083d209dd716e7b3564752398404d0f311f629cc3373b952ffcbf3e2051
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+EOM+ES+ES+P:5p71p71p71p71p71p72ULnHYx
TLSH
T114C73B09F94340B1D92B51B04DDBD3BF8A70BB2187128EEBF64DCB1B6933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0171e87fa301e49cfd217aceb201d5a65305809b2977c7227e166bbe9f246b3b
MD5 343d2bf31ceeff53cdd78d393f3099f0
SHA1 20b74f5279823c829b0f6181d646d1e02ad97e45
SHA512 03a4477b37c1a054490b51b0641c724e9fe0c87ef8d6ac621ff00ab7e60cf4cf2b8f523086cb92318fcfa0ac9145ca3c79841f83fd2aac46bfd178940069fb5c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 308b2d3deacd166e742c2fb7dafd9103c2193a50b041201f6c1245ff1e7e4226
MD5 516160e921027626d0d886385f5dbb16
SHA1 1b8a537cc4da3b3c3644cb2e05443de91e0a1cfc
SHA512 ffd62cbf58750806fbc96f1a05e7865ed5ce9cb067a7f904913a518d4775ec485c630a2536ec8b03653eb2149316c24385597cb0ec62f57254b77b0e13575f92
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4a7c9677fc56a79824e20b709531f4cea391548ded1431bb47d8ecfd5582225b
MD5 688df1df943574dd8fc9c534c0057dfb
SHA1 1ae990d2837728b14cd6c193d9177de7a5d2c84a
SHA512 9b80a174042555f3ffab37fb806d93cbb390cf0693da4e3d66ebe4f853ddbe69189d460abd8daad5bebd4075c1ab71d979945c1dabb73fa73fb4d366f48187c3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ccbc2ba6c5b532491f2567af5d3b462993dc5fcf321a1e4b7c87c2a6029a229d
MD5 c25654a5755f289936a873a51c51eab4
SHA1 a1a3d222cdbec4e9247589ec9b73d2a9ebdd4097
SHA512 3d0c5d4dac8b135e5036e78344b3c799e393e937d3e66028ba7c64efbc3aea9fded02e97aab6bc3c6dc9b4d9b72c38d782ebe41d46666db4e58334eaa8db05ae
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f8c0f963529e34544e701d8b4e1bb2403889935d51b77e82943df5b03a80aae1
MD5 c0277d1c9ef3c0b3fc8b1b97730bd256
SHA1 30fc5f7d065c7debef48dd70a2527a6519f2b151
SHA512 417632d778ce6f806e8169d0effef99d1d4e33af48b8cc64463de52b2625f2fbf9c697bd546ce64f46245b03d65491ac7819f297f6e20a1684115c191aed9654
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 767769fdb44ab86ae2f7dd5fccd907a63465f873c6b1c6b19b2d16c0e57a011b
MD5 eb2cc8b14853224139aeaa830e462781
SHA1 5ff426f2f3bc0c1618e8b1b583b8787e86e8db5b
SHA512 ecf788e7f25a7baeedbe95722decdc8007ba90014ef3c3ec3f350375f3275beb7582d27a577597ede0eadf90ca8ad2efe066f0d3435d8ceffb0a3bb55a7c454a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 eb4172a0e5a937d9fa50c2778c84568b00160681e6e67cd94708f8f71bfd3da5
MD5 398a40af7b96d85a6c2768d7da9b2464
SHA1 190f2ca7ade3ef6af9f1b43362e8e9d14d448fee
SHA512 a01502f6d8c8544a1029c1275af849e4f43afa08f9ca11b893cae88a61c11a888aec8c88da5cd39ece7d9f273c865a7c41d99085e5c5943f09c2d7e940df79af
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6827e918de4eef4619756c70ef15766843edd171c4ce37e9b0aaf9b2bece80c2
MD5 146ea72b1927a705aa03cd281e961481
SHA1 48814318cf36375c18d167021bc45934cdff8b4f
SHA512 ed0e80a9f764a23580b6369adf5f7f254bebc6baaae6b90646a4774d50fdf2d2bf248a70a657f05b407fb44dcb938efcd5efb28f2326be24e0a13fad22068784
MD5 SHA1 SHA512

Submit Download

svchost_CBCACBBBCABAACACABBBBCABBBABBAACAABBBBAACCCAAAACAAABAAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACBBBCABAACACABBBBCABBBABBAACAABBBBAACCCAAAACAAABAAB.exe
Size 8.6MB
SHA256 a83730229d0025841138e6ed4c443434b618e68ec86a4fe56871f8e30f72119f
MD5 860fb475a0fa654cb2eaea4576ce5775
SHA1 08e10e8114d60d13a834f09f6d5b1a4a496b8b65
SHA512 2ff2f32b111b5b34e1cf9f3f71bf6eef37cc87a3fd70a5838ec87bb65ff126deb6aca9bf04131b8437242954d92828fcc46e5a52464266c33a2e1158ed99b791
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+EOM+ES+ES+o:5p7D
TLSH
T15C963B09F94340B1D92B51B04DDBD3BF8A70BB2187128EEBF64DCB1B6933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 69ed5ef7d6caa9959a6e03cb1afb885b7e143c4034a9b92e59aaa9d86bad4478
MD5 82229637e9e5f992fb79f88f3df85b57
SHA1 3dd9057a53f69f8a7803560bfd4b1f25759ee2b8
SHA512 5f07a2d65a49b40642f13cc37b293f501005060ff0d80c1e620eb0576781a7a4288a32fdc7bd132e1defa70c30cd512372d4bacd36e9231b149e0916cea8dff8
TLSH
T17711EB60E8E5DC53E93379CF151ADBE30CF4779B58D86A65124442287FA4C23CE194E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1752-85-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/1752-60-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/1752-135-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/4188-66-0x0000000000600000-0x0000000000621000-memory.dmp

Download

memory/4188-94-0x0000000000600000-0x0000000000621000-memory.dmp

Download

memory/4188-0-0x0000000000600000-0x0000000000621000-memory.dmp

Download

memory/4188-32-0x0000000000600000-0x0000000000621000-memory.dmp

Download

memory/4188-16-0x0000000000600000-0x0000000000621000-memory.dmp

Download

memory/4276-96-0x0000000002D50000-0x0000000002D51000-memory.dmp

Download

memory/5112-126-0x0000000000E40000-0x0000000000E61000-memory.dmp

Download