a57367a9263c71259cb8629e14e5e0ccd2ca53e95d7f989927af649429e6295e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_64e0b6d937d8092296997359ef0e1a11_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Size 5.2MB
Sample260816-e2eraszbrf
SHA256 a57367a9263c71259cb8629e14e5e0ccd2ca53e95d7f989927af649429e6295e
MD5 64e0b6d937d8092296997359ef0e1a11
SHA1 5e0ca6337e212e0678e6f9ec9dcf05bb8c88da81
SHA512 ba874b1284f2f522b81466d56ba2a1c8f560b958ba6705637fa8daed9f6b422652b60b2103de7268c5b4b4c283929867ee723ef52dc1baae0f0c6af0f7e7a33a
SSDEEP 49152:U+ES+ES+EWL9+ES+ES+EWL9+ES+ES+EWL9+ES+ES+EWL9+ES+ES+EWL9+ES+ES+s:3KjKWQckVgtev5mnlNLi
TLSH
T1A746AE06F98780B5D96B10B04DDBD2BF8A30BE2187118DEBF7CD9A1F6932BA06434755
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3340	svchost_CCACCBACABAACBBABBACCBBAABCBCACBACABBAACACAAAAABCCABCCC.exe
4712	svchost_BABBCAABACABABAAAAACBCBACCCAABBBBBABBACABBABBCCACCCBAAC.exe
3764	svchost_CCACCBACABAACBBABBACCBBAABCBCACBACABBAACACAAAAABCCABCCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AABBCABABABABCCCBCBBAAAAABCABACBABABBAAABABCBCBAABCBCCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCACCBACABAACBBABBACCBBAABCBCACBACABBAACACAAAAABCCABCCC.exe"	2026-08-16_64e0b6d937d8092296997359ef0e1a11_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CAACBBBCCBBCBABCBABACABABAAAACCACBBABABAABACCCABACBAABCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABBCAABACABABAAAAACBCBACCCAABBBBBABBACABBABBCCACCCBAAC.exe"	svchost_CCACCBACABAACBBABBACCBBAABCBCACBACABBAACACAAAAABCCABCCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
868	sc.exe
3272	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2648	cmd.exe
2052	cmd.exe
216	cmd.exe
3152	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_64e0b6d937d8092296997359ef0e1a11_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCACCBACABAACBBABBACCBBAABCBCACBACABBAACACAAAAABCCABCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABBCAABACABABAAAAACBCBACCCAABBBBBABBACABBABBCCACCCBAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1856	schtasks.exe
2480	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2592	2026-08-16_64e0b6d937d8092296997359ef0e1a11_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
2592	2026-08-16_64e0b6d937d8092296997359ef0e1a11_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
2592	2026-08-16_64e0b6d937d8092296997359ef0e1a11_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
2592	2026-08-16_64e0b6d937d8092296997359ef0e1a11_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
3340	svchost_CCACCBACABAACBBABBACCBBAABCBCACBACABBAACACAAAAABCCABCCC.exe
3340	svchost_CCACCBACABAACBBABBACCBBAABCBCACBACABBAACACAAAAABCCABCCC.exe
3340	svchost_CCACCBACABAACBBABBACCBBAABCBCACBACABBAACACAAAAABCCABCCC.exe
3340	svchost_CCACCBACABAACBBABBACCBBAABCBCACBACABBAACACAAAAABCCABCCC.exe
4712	svchost_BABBCAABACABABAAAAACBCBACCCAABBBBBABBACABBABBCCACCCBAAC.exe
4712	svchost_BABBCAABACABABAAAAACBCBACCCAABBBBBABBACABBABBCCACCCBAAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2592	2026-08-16_64e0b6d937d8092296997359ef0e1a11_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Token: SeDebugPrivilege	3340	svchost_CCACCBACABAACBBABBACCBBAABCBCACBACABBAACACAAAAABCCABCCC.exe
Token: SeDebugPrivilege	4712	svchost_BABBCAABACABABAAAAACBCBACCCAABBBBBABBACABBABBCCACCCBAAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4588	OpenWith.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 216	2592	2026-08-16_64e0b6d937d8092296997359ef0e1a11_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	107
PID 216 wrote to memory of 1856	216	cmd.exe	109
PID 3340 wrote to memory of 8	3340	svchost_CCACCBACABAACBBABBACCBBAABCBCACBACABBAACACAAAAABCCABCCC.exe	110
PID 8 wrote to memory of 2444	8	notepad.exe	111
PID 2592 wrote to memory of 3152	2592	2026-08-16_64e0b6d937d8092296997359ef0e1a11_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	116
PID 3152 wrote to memory of 868	3152	cmd.exe	118
PID 2592 wrote to memory of 2648	2592	2026-08-16_64e0b6d937d8092296997359ef0e1a11_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	119
PID 3340 wrote to memory of 2052	3340	svchost_CCACCBACABAACBBABBACCBBAABCBCACBACABBAACACAAAAABCCABCCC.exe	123
PID 2052 wrote to memory of 2480	2052	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\2026-08-16_64e0b6d937d8092296997359ef0e1a11_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_64e0b6d937d8092296997359ef0e1a11_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABABBCACBACAAAABBBAACACCABBABBABCACBAAABBACBCAABABABACBBCAACCBAABBAABBAAABAAABAACCCAACABAAAABCACACACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCBACABAACBBABBACCBBAABCBCACBACABBAACACAAAAABCCABCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:216
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABABBCACBACAAAABBBAACACCABBABBABCACBAAABBACBCAABABABACBBCAACCBAABBAABBAAABAAABAACCCAACABAAAABCACACACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCBACABAACBBABBACCBBAABCBCACBACABBAACACAAAAABCCABCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBBCAACBAAACBCABBBBCCBACAABCCAABBBACBBABABBCABCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCBACABAACBBABBACCBBAABCBCACBACABBAACACAAAAABCCABCCC.exe" start= auto displayName= "UserDataSvc_ABBBCAACBAAACBCABBBBCCBACAABCCAABBBACBBABABBCABCABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBBCAACBAAACBCABBBBCCBACAABCCAABBBACBBABABBCABCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCBACABAACBBABBACCBBAABCBCACBACABBAACACAAAAABCCABCCC.exe" start= auto displayName= "UserDataSvc_ABBBCAACBAAACBCABBBBCCBACAABCCAABBBACBBABABBCABCABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBBCAACBAAACBCABBBBCCBACAABCCAABBBACBBABABBCABCABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2648
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBBCAACBAAACBCABBBBCCBACAABCCAABBBACBBABABBCABCABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3272

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCBACABAACBBABBACCBBAABCBCACBACABBAACACAAAAABCCABCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCBACABAACBBABBACCBBAABCBCACBACABBAACACAAAAABCCABCCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCACBABCCBABBAAAABCAAAACCBAABCBABACBACABCCAACBBBBBABBBACCAACCAABCCCCAACCBCAAABCBBABABAABCBABCBCBBBAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCAABACABABAAAAACBCBACCCAABBBBBABBACABBABBCCACCCBAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCACBABCCBABBAAAABCAAAACCBAABCBABACBACABCCAACBBBBBABBBACCAACCAABCCCCAACCBCAAABCBBABABAABCBABCBCBBBAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCAABACABABAAAAACBCBACCCAABBBBBABBACABBABBCCACCCBAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2480

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4588

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCAABACABABAAAAACBCBACCCAABBBBBABBACABBABBCCACCCBAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCAABACABABAAAAACBCBACCCAABBBBBABBACABBABBCCACCCBAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4712

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCBACABAACBBABBACCBBAABCBCACBACABBAACACAAAAABCCABCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCBACABAACBBABBACCBBAABCBCACBACABBAACACAAAAABCCABCCC.exe
1⤵
- Executes dropped EXE
PID:3764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3fbf216f004801c43fd2cfa4f90a06375e112fc057de45fbc6af973af6ab4cfc
MD5 a7ed9e0d8a04459267c6591b61cea762
SHA1 5eae00bac0bfed7f3be466c1dfb4bc9199b6124c
SHA512 e5da63f49f300fcec1b686f0f25b9f2c24d26e922f546c032e5dd5165453ea91ed46164f1e1f3b377cfce5a6a340ff1427ceb8ebb6d71acbba06fb2c9e2b1733
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 815d33d487cecb2a19ddbfc53e8684bb41a8db98cd6c4e2f2445a97ecebe7a54
MD5 f14f5e04a6f8288242b7a5ad911c44d5
SHA1 9b5f9fb30864ed81df8286188d26821fd6b68a09
SHA512 4e1fae77d75df6f4bbd72959f0c532b3a956a3835c398e167d4aec46c3261df37ec3555af3b1dff38914cb2bf5bbe5f32e32968fe0b73b8948a0861ecc7a0346
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3b1f4a24d7883775d5048ebc860664ac0c8c3cba861f76a8738cf4abf2abe9a4
MD5 1f7670685c39954522571aee2321eab8
SHA1 ba6e532f76059d737dea5e94aeff5f5025b8e049
SHA512 b6a52c3b07c0142429f65bf879d71b731df5ed20ab872cdb68b89f7455fe59008746ac62bc5fb802db86aa6bbba62921af9af403f3feb8316e2f79af70c0453d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 458155ff6afa6a512f9cfcd52a225e144721896f1fb34f940833a9fb97f6ce8f
MD5 faaee3e2033c1be8996c1be4fc5a4b58
SHA1 cd4506539425bf85ff23e5d9a050f92a665782bd
SHA512 4e36bf78485c6c483b15e8409abb6e21cc679c30f01b68cb6d49b989098ac18bf651a541b139fdf35510bb926f7b759bd8e7bed20ca68c27c2cac51904684a3e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7b7af6cb7989c9004b4bc39ce5d61748a75e54ade4a8334359ef5adebf34ed99
MD5 233e7778d458d27ac8c0a13e048f2cdd
SHA1 a723afdb9fe03b491dbda4ba474198bc9733c1e1
SHA512 29c59314bd249c0155918143043f125ace5b3fbe163ce8561186dd82bf8b1fbcbb2c77db7230a239efa51769547320051d904efbd6700f834ff11b953fafb9f5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5478cf88469c21bb96df74893a13659afd574aa314a5f7168f9b7cc7a6792544
MD5 990dcc652b300149637fac91c5ea4384
SHA1 e92cc61e6ff39eeebc99cb1787083f3a6fd3c633
SHA512 a60ac3430a684b5e4ef25269bbc3ff6bbac61a1c5fa94d07da13f6d11ccfe2f9dc6a67c0b01a54ebbc77e991c51b0de5d742eaef9080b8a00fb73f766276d098
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8c2e3d5b4e301dab5d2f5e9625d5e84cd9e83b6eda456626d245c7ce18fc5326
MD5 7df556595c17cce2add4107e56937c4d
SHA1 ff242aaadf8ce57dc58efc830903e9e2c77e733a
SHA512 17cf7f96d9f1e53c78cf55db80e42690ae930e8f110695fe9f5447975888fd50a966289f648d3697f63f204098c4e51df3032b1c2c5d57f0a28fd86be13f6708
MD5 SHA1 SHA512

Submit Download

svchost_CCACCBACABAACBBABBACCBBAABCBCACBACABBAACACAAAAABCCABCCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCBACABAACBBABBACCBBAABCBCACBACABBAACACAAAAABCCABCCC.exe
Size 5.2MB
SHA256 a57367a9263c71259cb8629e14e5e0ccd2ca53e95d7f989927af649429e6295e
MD5 64e0b6d937d8092296997359ef0e1a11
SHA1 5e0ca6337e212e0678e6f9ec9dcf05bb8c88da81
SHA512 ba874b1284f2f522b81466d56ba2a1c8f560b958ba6705637fa8daed9f6b422652b60b2103de7268c5b4b4c283929867ee723ef52dc1baae0f0c6af0f7e7a33a
SSDEEP 49152:U+ES+ES+EWL9+ES+ES+EWL9+ES+ES+EWL9+ES+ES+EWL9+ES+ES+EWL9+ES+ES+s:3KjKWQckVgtev5mnlNLi
TLSH
T1A746AE06F98780B5D96B10B04DDBD2BF8A30BE2187118DEBF7CD9A1F6932BA06434755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 1ba792fbef2007bdcd6ee8f183b1ee2e83d11a4333319f9d28e178a56fd899e6
MD5 726ed97ebe1fbad1def6d02b0fca9021
SHA1 8350e03717eb48da50df40a6382b9edda9e9e746
SHA512 1747c7b5de5f68c1b02a88f51e321697c0ce4829f9e3554b77d583b0bb4a5975fc56afddc65d68fbcfbc75de613487c2ab0bafb996e149a380629fe46de123e6
TLSH
T1CA11EB60D8E5E853EE33748FA71D4FC20CDD37A7685C6A44130A4218EBD5D30CD594E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 7abdd7534d286df146681d8b2e6e18b22ff0be9edc9cb306a73f51a13cc7cce6
MD5 bc2d09ccab0361ceda33243cfccaaec7
SHA1 d054a8f18c3c09c934cad1f1c346cb8803da5738
SHA512 a254769bf0095d054b62f0e8045858fca5e510263758e1eefd1302e05f205ec2c388c0ede8e3b68bebf27f6f378520e031c3fc4d8ff4e353843ce50cc6203a5e
TLSH
T1CF11C921D8A5E8A3EA3378CFE71D9FC20C9D33AB685C5640530A4208EBD9D30CD494E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/8-59-0x0000000004D10000-0x0000000004D11000-memory.dmp

Download

memory/2592-6-0x00000000002E0000-0x0000000000301000-memory.dmp

Download

memory/3340-35-0x0000000000510000-0x0000000000531000-memory.dmp

Download

memory/3764-91-0x0000000000510000-0x0000000000531000-memory.dmp

Download

memory/4712-71-0x0000000000570000-0x0000000000591000-memory.dmp

Download

memory/4712-89-0x0000000000570000-0x0000000000591000-memory.dmp

Download