05476f91cf25714fff4619376d3800fe3883389014a25b3144964c6afca28845

Analysis

max time kernel
150s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 05:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_1f8fe80eccfd19612be40d0be7d74396_amadey_darkgate_elex_stop_vidar.exe
Size 2.4MB
Sample260814-fn643adj9x
SHA256 05476f91cf25714fff4619376d3800fe3883389014a25b3144964c6afca28845
MD5 1f8fe80eccfd19612be40d0be7d74396
SHA1 c45d7b42e5efb87e7af1683918fd740c9de86688
SHA512 0e6c1c9230fcc2acfc5d23c0aac82221d96e78943584b6d5c4742bae4a06e3a800942cd081a03e6de3dee8e710f6994675ae40956a1669a34f9196d11268f6c1
SSDEEP 49152:U+ES+ES+Ek+ES+ES+E2+ES+ES+EpTY5c+ES+ES+Ek+ES+ES+E2+ES+ES+EpTY5RG:55R5Rp74
TLSH
T1FEC55C19FA835071E92750B04DCFD3FE9D207A2187118EEFFB49DB1A6922BE1A439315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5960	svchost_BCACACBCBACCABACACBCCCBCCBACBAABCACCAABCACBCBACAABCABBA.exe
2784	svchost_AACCCABCABAABAAAABACBCBCBCABBCCCACCAACBABCBBCAAACCBBCBC.exe
2864	svchost_BCACACBCBACCABACACBCCCBCCBACBAABCACCAABCACBCBACAABCABBA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCABCBCBCCCBAACBABCABCABAAACBABAACCACBCCCCCCCCBBACABCCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCACACBCBACCABACACBCCCBCCBACBAABCACCAABCACBCBACAABCABBA.exe"	2026-08-14_1f8fe80eccfd19612be40d0be7d74396_amadey_darkgate_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBAACBBABAABCCCBCACCBCAACCBACACAACCBBCCCCCBCABABCAACBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACCCABCABAABAAAABACBCBCBCABBCCCACCAACBABCBBCAAACCBBCBC.exe"	svchost_BCACACBCBACCABACACBCCCBCCBACBAABCACCAABCACBCBACAABCABBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
912	sc.exe
5448	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2588	cmd.exe
4732	cmd.exe
2408	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACCCABCABAABAAAABACBCBCBCABBCCCACCAACBABCBBCAAACCBBCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_1f8fe80eccfd19612be40d0be7d74396_amadey_darkgate_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCACACBCBACCABACACBCCCBCCBACBAABCACCAABCACBCBACAABCABBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5912	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4804	2026-08-14_1f8fe80eccfd19612be40d0be7d74396_amadey_darkgate_elex_stop_vidar.exe
4804	2026-08-14_1f8fe80eccfd19612be40d0be7d74396_amadey_darkgate_elex_stop_vidar.exe
4804	2026-08-14_1f8fe80eccfd19612be40d0be7d74396_amadey_darkgate_elex_stop_vidar.exe
4804	2026-08-14_1f8fe80eccfd19612be40d0be7d74396_amadey_darkgate_elex_stop_vidar.exe
5960	svchost_BCACACBCBACCABACACBCCCBCCBACBAABCACCAABCACBCBACAABCABBA.exe
5960	svchost_BCACACBCBACCABACACBCCCBCCBACBAABCACCAABCACBCBACAABCABBA.exe
5960	svchost_BCACACBCBACCABACACBCCCBCCBACBAABCACCAABCACBCBACAABCABBA.exe
5960	svchost_BCACACBCBACCABACACBCCCBCCBACBAABCACCAABCACBCBACAABCABBA.exe
2784	svchost_AACCCABCABAABAAAABACBCBCBCABBCCCACCAACBABCBBCAAACCBBCBC.exe
2784	svchost_AACCCABCABAABAAAABACBCBCBCABBCCCACCAACBABCBBCAAACCBBCBC.exe
2864	svchost_BCACACBCBACCABACACBCCCBCCBACBAABCACCAABCACBCBACAABCABBA.exe
2864	svchost_BCACACBCBACCABACACBCCCBCCBACBAABCACCAABCACBCBACAABCABBA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4804	2026-08-14_1f8fe80eccfd19612be40d0be7d74396_amadey_darkgate_elex_stop_vidar.exe
Token: SeDebugPrivilege	5960	svchost_BCACACBCBACCABACACBCCCBCCBACBAABCACCAABCACBCBACAABCABBA.exe
Token: SeDebugPrivilege	2784	svchost_AACCCABCABAABAAAABACBCBCBCABBCCCACCAACBABCBBCAAACCBBCBC.exe
Token: SeDebugPrivilege	2864	svchost_BCACACBCBACCABACACBCCCBCCBACBAABCACCAABCACBCBACAABCABBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 2588	4804	2026-08-14_1f8fe80eccfd19612be40d0be7d74396_amadey_darkgate_elex_stop_vidar.exe	92
PID 2588 wrote to memory of 5912	2588	cmd.exe	94
PID 5960 wrote to memory of 2800	5960	svchost_BCACACBCBACCABACACBCCCBCCBACBAABCACCAABCACBCBACAABCABBA.exe	95
PID 4804 wrote to memory of 4732	4804	2026-08-14_1f8fe80eccfd19612be40d0be7d74396_amadey_darkgate_elex_stop_vidar.exe	98
PID 4732 wrote to memory of 912	4732	cmd.exe	100
PID 4804 wrote to memory of 2408	4804	2026-08-14_1f8fe80eccfd19612be40d0be7d74396_amadey_darkgate_elex_stop_vidar.exe	101
PID 2408 wrote to memory of 5448	2408	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-14_1f8fe80eccfd19612be40d0be7d74396_amadey_darkgate_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_1f8fe80eccfd19612be40d0be7d74396_amadey_darkgate_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBBBCBAABCABBCABBABABCBCAABCBCCAAAACBCCBCABBBAAACAABCBBBACACCCCCBABCBACBABBBCCBCBBBBBCBCABAABCCBBCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACACBCBACCABACACBCCCBCCBACBAABCACCAABCACBCBACAABCABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBBBCBAABCABBCABBABABCBCAABCBCCAAAACBCCBCABBBAAACAABCBBBACACCCCCBABCBACBABBBCCBCBBBBBCBCABAABCCBBCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACACBCBACCABACACBCCCBCCBACBAABCACCAABCACBCBACAABCABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBAABBCACCACCBACCBACAAACACCCCAABACBABBAACACCCCAAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACACBCBACCABACACBCCCBCCBACBAABCACCAABCACBCBACAABCABBA.exe" start= auto displayName= "UserDataSvc_BBAABBCACCACCBACCBACAAACACCCCAABACBABBAACACCCCAAABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBAABBCACCACCBACCBACAAACACCCCAABACBABBAACACCCCAAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACACBCBACCABACACBCCCBCCBACBAABCACCAABCACBCBACAABCABBA.exe" start= auto displayName= "UserDataSvc_BBAABBCACCACCBACCBACAAACACCCCAABACBABBAACACCCCAAABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBAABBCACCACCBACCBACAAACACCCCAABACBABBAACACCCCAAABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBAABBCACCACCBACCBACAAACACCCCAABACBABBAACACCCCAAABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5448

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACACBCBACCABACACBCCCBCCBACBAABCACCAABCACBCBACAABCABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACACBCBACCABACACBCCCBCCBACBAABCACCAABCACBCBACAABCABBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5960
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2800

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCABCABAABAAAABACBCBCBCABBCCCACCAACBABCBBCAAACCBBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCABCABAABAAAABACBCBCBCABBCCCACCAACBABCBBCAAACCBBCBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2784

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACACBCBACCABACACBCCCBCCBACBAABCACCAABCACBCBACAABCABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACACBCBACCABACACBCCCBCCBACBAABCACCAABCACBCBACAABCABBA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 c3c85b9d7340ce6dfe2f2c795b2d87e979efac94f358f51f1b547100068236d1
MD5 8d10a120af535c0f62c7bb85ea1db3b3
SHA1 3351545a09bd94f94e80be93d124a79061ccf4d1
SHA512 caa5d9328898c4ea62d076a52a5f5cb32df5a42b5a13f925a610fe9908582dc3356d92cfe2e1aef1884d366bbe6700dd37042bd88a248d18d153f9d9fc6a038a
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 3.0MB
SHA256 d6a4dc48e353f6fc561f715e09a81f55610f12366f3895f94c69808a3d55ddef
MD5 9752c997e721dce12b975deb226f0c25
SHA1 ab279202ed6b5a36e447d1b42e74a617fc0aae2e
SHA512 022af5ce4e6108f39975eef58fad6d6e1f83f3a101fc994353c9eef16200c909989b8ab3a502a9d8d9a91b4cbc3daa73eadce0b571dc42e0b23f258c07bc9b25
SSDEEP 49152:U+ES+ES+Ek+ES+ES+E2+ES+ES+EpTY5c+ES+ES+Ek+ES+ES+E2+ES+ES+EpTY5R0:55R5Rp73gZ2Hb9t+2xu
TLSH
T1E1E58E19FA834071EA7750B14CDFD3BA5D30BA2047118EEFF789DB1A6D22AD1A43A315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 b5d187d62f3454549547424e7ae2f8af69f76e299914b73ba88fdde2b51a7c93
MD5 2b6128e9e2eda8fcaed565f59962c61f
SHA1 3b29d0b01a69232cd6c25ba3ef9860a024b24dab
SHA512 65205e5b4f073c9409de9d9545f9428d5b9c38372633042419277d9f4a3f9f1608e30c714726801bfe53087893ee3ea3174c8987d004705f8ac2bcc3eefa7fc3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 9d13921b740be97f4d4be5171219e38bc252fbd90c2c880f7448f9f79c633457
MD5 a5b84b9f58022d57a5df7ea9ca647406
SHA1 31bb4fd38c8fcc63e93ee2a0866cce8f08590e1d
SHA512 6fddddff1758b282634a8d3b18b3061d854f3d6364f5c71b86eca2ded84b9195eb62c69c20d0ecc118ad6d9b754e918a9b361bfd9c23b65e83f5d408cdcf0bac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 09a00b31e92c8adb1077931330f34c9f4c40224d930960ef26f36c2d5ce036f9
MD5 ce2ce605ad94cc9e3877fe331b61e924
SHA1 195bfb414dc15ab451f0a5c114efdafb59e39176
SHA512 1e038536af61e32adcca6067ab4bcd9caac23beeffcbe9afb0233be077ddbcea59f614e427de4ee196dd0da765d71a75979531e5537fb07ab9e230c4834d7db8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b40fc2dc8e7db0e33d72e2267cae28a453d4fe6f039455fdd2c1986abe44c2c2
MD5 2ec3bdbcd554eefc793fc48cbce6e907
SHA1 72b229463b03fc12e55afa4a0fdadbf32734abe4
SHA512 6d29d1f7456802ea41a2c8ff8e9c100e7cf73fe3ccca4e4839167cb24bfa62dc06cd524ede77729a3ca13a439d74c7b253e39ea92264e0f79ad3ba5dad0a3bd1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cd9998e96dd9b34eb8316f8ccd124a82e1f06817398c5cd31517e7d5dd0a947e
MD5 5707e7022ea10da94ca7925c30021009
SHA1 45691897747917003258ba3a931856091ea6ab17
SHA512 4587468c3f2fef4aac6335bc9da027c9de787be9faf81dc8306a778aec86f96c4812ff1a10bd17772c9aba085f8cfc83200326b86998a29d72237bf4641924ed
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ff028e188dd093022b9ad6208f0571076296292c7d8b70cc0c34cb00d5108938
MD5 4f4c7d5df3179eb3e8347bd570d8638d
SHA1 c6d263a3f465b30cf408b264c2373460de58425d
SHA512 76e0b7d5e42a44782df454ce23f9385e743ef0b9cc01d1ee4418271c3ccda28ef5c3a68e68571479f1aae11774e4c19907303ca3278349940600dc3fc4510bf2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 cd023e782f2d0d9354973e0705eca854db3aa021f2f4552e2c36bea37efc746d
MD5 39f1bb9b83ec31c676e15522344c4f40
SHA1 0e9f714c87ff73692575feb625c5f2c66bdad6d8
SHA512 373af70fb09ff2930f7b972f5d63715df371d1ea872b17e8acf71cd5519d8835fd4593022a9707739e7b28829fe9007538326a274ffff86dd26b29e5dca9e86a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c676f29d16dcfbb2c4adc84f58fa419cc191d4e64942b6c626b53e91f00135b2
MD5 f34a66af73ebb574b0ecb0f026b9ffed
SHA1 639b83f7998436b7ce47951ecff1d45cd7724b6b
SHA512 393890ba2e8b25eb72640fd82de9c3d2d2ce567814ed99b7e1d60deec33c427ae9058160ada5db727de54812aaaa6673275348b810bcb05557e77cb61dc6826c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 63c56bc48501306c4cd60895031d571b16ee57c1e83afc94fad9eaded0336a57
MD5 c4964bfb98a1277089fdb64a2787b925
SHA1 fa8a57ecd59d9a8480da8d45b5fa76efdb38d589
SHA512 b2ef654e4e782309717c06fa621d8db303eeb8b6618f92ec544d17e7beca969e563524a41c4cbd07796576b095f4129284227cb4d1aacafd2dcae1590df6d116
MD5 SHA1 SHA512

Submit Download

svchost_BCACACBCBACCABACACBCCCBCCBACBAABCACCAABCACBCBACAABCABBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACACBCBACCABACACBCCCBCCBACBAABCACCAABCACBCBACAABCABBA.exe
Size 2.4MB
SHA256 05476f91cf25714fff4619376d3800fe3883389014a25b3144964c6afca28845
MD5 1f8fe80eccfd19612be40d0be7d74396
SHA1 c45d7b42e5efb87e7af1683918fd740c9de86688
SHA512 0e6c1c9230fcc2acfc5d23c0aac82221d96e78943584b6d5c4742bae4a06e3a800942cd081a03e6de3dee8e710f6994675ae40956a1669a34f9196d11268f6c1
SSDEEP 49152:U+ES+ES+Ek+ES+ES+E2+ES+ES+EpTY5c+ES+ES+Ek+ES+ES+E2+ES+ES+EpTY5RG:55R5Rp74
TLSH
T1FEC55C19FA835071E92750B04DCFD3FE9D207A2187118EEFFB49DB1A6922BE1A439315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 ac6fa8b25869b36785303ec290c24359cc7b5dc87eae0acd416c3b2ce90472fc
MD5 ab28cff8870318728e20f9f3c688ee78
SHA1 01f99fab58ddaab0318f09e0119654bdc3eba08e
SHA512 1749123542f718d1e4bd4122ae25825775d29990dd6e52c24ebe1527fafb08f50cf5683a1fda12e0b7d2ae9cf5a9314662a23637813bccc9b3bea2a838db58f9
TLSH
T18A119361F4E6DC73FC63688B5A298BE31CB0769F9C5C6A146304C229EB49C318D124E6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 1eae79f2af2b03f5a983ad25d67f6ca6257e0cc79224533f968d3e6a72609e93
MD5 45e64ba8ca512032bc1b8529b207dc2b
SHA1 5431a9dd8c6db39145e6b66efff961df746a5b00
SHA512 4c57d1f523ee61fb4c81555381f16e14c4c57fed9b356e83cd01c8aa6fc86448d282f7897865985c5bd9f7749cd69dc3bbd24c48d86ad2ae91f7568cb9b4a381
TLSH
T121218661F4E6CCB3FC6228CB9A198BE31CB076DF9C5C6A146308C129EB49C318D134E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2784-64-0x00000000002A0000-0x00000000002C1000-memory.dmp

Download

memory/2864-75-0x0000000000820000-0x0000000000841000-memory.dmp

Download

memory/4804-0-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/4804-7-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/5960-33-0x0000000000820000-0x0000000000841000-memory.dmp

Download