d254a13a342df3d43846821f80c34d005519f8488b52e82a7c97a569f1262f15

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 02:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_0776c54e22c1f6ec9b2828cdd75447e0_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Size 32.3MB
Sample260818-c3websfa38
SHA256 d254a13a342df3d43846821f80c34d005519f8488b52e82a7c97a569f1262f15
MD5 0776c54e22c1f6ec9b2828cdd75447e0
SHA1 6e6a46e8437694551fe3eb0f96163e1889f08c81
SHA512 a1a90bacbc3d0793d3e3b602fe88ffc94278cb4c661aadba3755c48ac83dff652809b74bdd6d019678ccc97528b6d5f7a267e8bb6c7bfe49ada004cc7cf117c8
SSDEEP 98304:vKRuy5afKRuy5afKRuy5afKRuy5afKRuy5afKRuy5a/KjKWQckVgtev5mnlNLp:vqEqEqEqEqEqTKWQc0gEYnvLp
TLSH
T184778C10FAEA0C22E5B7217149F6D2794D76BA258334C5CFE689871F6D33BC058367A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1460	svchost_ACBBABCAACABCCCACACBBBCBCAAABABABACACABACBBABBAABCACBCA.exe
6120	svchost_CCCCBBBACAABAAACCAACBCCACACCAABAAABBBBAACAAACACABACAABB.exe
4084	svchost_ACBBABCAACABCCCACACBBBCBCAAABABABACACABACBBABBAABCACBCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCBBBAAACCCBCBBCCAAACACBBCAAAABACCCBCACAABCACBBAABABABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBBABCAACABCCCACACBBBCBCAAABABABACACABACBBABBAABCACBCA.exe"	2026-08-18_0776c54e22c1f6ec9b2828cdd75447e0_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAABBCCBBCAACCCCABBABABBACCAABCCABACBCBCBACBBBCAACCCBBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCCBBBACAABAAACCAACBCCACACCAABAAABBBBAACAAACACABACAABB.exe"	svchost_ACBBABCAACABCCCACACBBBCBCAAABABABACACABACBBABBAABCACBCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1076	sc.exe
548	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1552	cmd.exe
4116	cmd.exe
900	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_0776c54e22c1f6ec9b2828cdd75447e0_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBBABCAACABCCCACACBBBCBCAAABABABACACABACBBABBAABCACBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCCBBBACAABAAACCAACBCCACACCAABAAABBBBAACAAACACABACAABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5480	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3132	2026-08-18_0776c54e22c1f6ec9b2828cdd75447e0_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
3132	2026-08-18_0776c54e22c1f6ec9b2828cdd75447e0_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
3132	2026-08-18_0776c54e22c1f6ec9b2828cdd75447e0_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
3132	2026-08-18_0776c54e22c1f6ec9b2828cdd75447e0_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
1460	svchost_ACBBABCAACABCCCACACBBBCBCAAABABABACACABACBBABBAABCACBCA.exe
1460	svchost_ACBBABCAACABCCCACACBBBCBCAAABABABACACABACBBABBAABCACBCA.exe
1460	svchost_ACBBABCAACABCCCACACBBBCBCAAABABABACACABACBBABBAABCACBCA.exe
1460	svchost_ACBBABCAACABCCCACACBBBCBCAAABABABACACABACBBABBAABCACBCA.exe
6120	svchost_CCCCBBBACAABAAACCAACBCCACACCAABAAABBBBAACAAACACABACAABB.exe
6120	svchost_CCCCBBBACAABAAACCAACBCCACACCAABAAABBBBAACAAACACABACAABB.exe
4084	svchost_ACBBABCAACABCCCACACBBBCBCAAABABABACACABACBBABBAABCACBCA.exe
4084	svchost_ACBBABCAACABCCCACACBBBCBCAAABABABACACABACBBABBAABCACBCA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3132	2026-08-18_0776c54e22c1f6ec9b2828cdd75447e0_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Token: SeDebugPrivilege	1460	svchost_ACBBABCAACABCCCACACBBBCBCAAABABABACACABACBBABBAABCACBCA.exe
Token: SeDebugPrivilege	6120	svchost_CCCCBBBACAABAAACCAACBCCACACCAABAAABBBBAACAAACACABACAABB.exe
Token: SeDebugPrivilege	4084	svchost_ACBBABCAACABCCCACACBBBCBCAAABABABACACABACBBABBAABCACBCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 1552	3132	2026-08-18_0776c54e22c1f6ec9b2828cdd75447e0_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	92
PID 1552 wrote to memory of 5480	1552	cmd.exe	94
PID 1460 wrote to memory of 4620	1460	svchost_ACBBABCAACABCCCACACBBBCBCAAABABABACACABACBBABBAABCACBCA.exe	95
PID 3132 wrote to memory of 4116	3132	2026-08-18_0776c54e22c1f6ec9b2828cdd75447e0_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	98
PID 4116 wrote to memory of 1076	4116	cmd.exe	100
PID 3132 wrote to memory of 900	3132	2026-08-18_0776c54e22c1f6ec9b2828cdd75447e0_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	101
PID 900 wrote to memory of 548	900	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-18_0776c54e22c1f6ec9b2828cdd75447e0_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_0776c54e22c1f6ec9b2828cdd75447e0_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACACABCACABCBBBCACBBBCBABABABACCBCBAAACCCBCCCCCCBAACACABCCBBBACCAACBBBCCBBBAABBABCAACBCBACACBABACBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBABCAACABCCCACACBBBCBCAAABABABACACABACBBABBAABCACBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1552
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACACABCACABCBBBCACBBBCBABABABACCBCBAAACCCBCCCCCCBAACACABCCBBBACCAACBBBCCBBBAABBABCAACBCBACACBABACBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBABCAACABCCCACACBBBCBCAAABABABACACABACBBABBAABCACBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCAACCCCBABABCABABAAAACACAABACCCCBBACBBCCBCABACCCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBABCAACABCCCACACBBBCBCAAABABABACACABACBBABBAABCACBCA.exe" start= auto displayName= "UserDataSvc_BCAACCCCBABABCABABAAAACACAABACCCCBBACBBCCBCABACCCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCAACCCCBABABCABABAAAACACAABACCCCBBACBBCCBCABACCCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBABCAACABCCCACACBBBCBCAAABABABACACABACBBABBAABCACBCA.exe" start= auto displayName= "UserDataSvc_BCAACCCCBABABCABABAAAACACAABACCCCBBACBBCCBCABACCCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCAACCCCBABABCABABAAAACACAABACCCCBBACBBCCBCABACCCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:900
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCAACCCCBABABCABABAAAACACAABACCCCBBACBBCCBCABACCCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:548

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBABCAACABCCCACACBBBCBCAAABABABACACABACBBABBAABCACBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBABCAACABCCCACACBBBCBCAAABABABACACABACBBABBAABCACBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4620

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBBBACAABAAACCAACBCCACACCAABAAABBBBAACAAACACABACAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBBBACAABAAACCAACBCCACACCAABAAABBBBAACAAACACABACAABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6120

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBABCAACABCCCACACBBBCBCAAABABABACACABACBBABBAABCACBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBABCAACABCCCACACBBBCBCAAABABABACACABACBBABBAABCACBCA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 6ed85570419b8ec090f3c8ec8ba4338a763e2b37aaa5f698da0ae621e2a7f4bf
MD5 6d27f999c99ee7a61aefe56a815606fa
SHA1 db8ce8e5bc47028cfe4e29f175946ffc7a5074c4
SHA512 ba4ad87a22d85efee05c920f674ae414d5d7de383b651adf56598cd7fb40f9c1be0aa020109cca8bf3c50044d954ce706f8943c137907688786ade1dfebd47df
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 19.2MB
SHA256 387c2afaca045fd214c72fee3ec3e5ac1698209eacc6b832eddace491855e3a6
MD5 14aeb0b216d5321f6949473fb13c98c6
SHA1 935a0da9a19493016a25dc386fdb0afca86dbae0
SHA512 92b8cd2cbcd93ec9731d04e54cbdf3afbe68d7dadd9a6f439839d3d7c814d7b397227bbb5eef7e537ef2f636a4f3099aebc64476c38d8bda06536630f5031d9a
SSDEEP 49152:U+ES+ES+E7+ES+ES+ES+E8iw2Lwqp+ES+ES+E7+ES+ES+ES+E8iw2Lwqp+ES+ESV:vKRuy5afKRuy5afKRuy5ag
TLSH
T156178C14FAEA0C22E5B7217149F6D27A4D71BA258334C5CFE689871F6D33BC058367A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\qap`g`v~dtlq
Size 10B
SHA256 9cb70e26683b5d7b581eed86e351267575859ad696e5ef417b13dd9928b46d4b
MD5 cb613e30143a05cf332f89b6d074d4d9
SHA1 493dd44425b36fac34f5844e6e9affa8dfe497f2
SHA512 b99ae5c6946749464d489e9d792810ff4930908e0daa794488bafb8501160b79fdd601604cfdb9ff328f970c2b74f7a489b8ce4a182c118ebd655768f0732e77
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments\qap`g`v~dtlq
Size 10B
SHA256 a681dc6d93bb33080e5e3c7ef5655f2255ec47d2dbd4b2c0e5473bdbbe6029ac
MD5 13215eea53ae95f20ca229f4d24e3003
SHA1 cb6a4b612c6076c4523a24b289ef043dc3f1837f
SHA512 f161369b8d812251b2febf2d07d6819a9022ed7b3ac2a3e234bc69746efd0b1f2abf000c44224082bc016ab17281f97f717c73d2fdeb7c6aa9b448a814fd2aa6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e8ae5e4e464c440dbcc743467dc66c1abe2ad794d9560bd12c10ac4434ccdddd
MD5 2c4d566c0582490e69c435d05dd531ad
SHA1 991b0eee7bfa376591f142a44c2f30a727270680
SHA512 ba57c9666c5b2659390ae2598988c55dc2fc0c29312869477c7210acaa0fa4e9eb72c3cf43c6510de89dc389254f8cec74174baabd1679fd16af060c8922c873
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ac97c72997eb2c2a39bb3f2b17b5953aff5e71e7608fe18a1e8fc50e7f774c0f
MD5 a1237af277097e27c998bf7db5e10c49
SHA1 98c2d9d4898a87de8e65315a77d7942c162d173d
SHA512 67f1951b1427de5b352037e50dc70077fd1926c0dbb78eb9d639716da08efd4ee353ade5a75f2ae97d7681ffcf34982f58d4d5d67207d633072df5cbfd2ed92d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dd3c6bc3b88daf7d12d2367202589ed42cad0e1449c2af63b708f9e81e4d4399
MD5 994a4eb6ce59da48cedf79e3b5bd65fb
SHA1 6621a97dacc25ff53a1026948291f7c417d92853
SHA512 c03aa8d8a741979824beb239ad923fdbef356c71ffabb12cc6999e3faee352df171394801195ac98d7042c87d50d32f41734c6cd66bda122e55fd98f342b45b6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 285533222845f00d6c7454220cd835e54b1f75a5573b859330982aad9cfefed5
MD5 4500c8b96ce14490d36b4dcdc04f4f03
SHA1 d2b4872e29e70525a1f3df1e62f444220fb21cb1
SHA512 148d4ee9ef037f1f7d3fd4766325cb5667948c01fe2cff3a39564f54d1d88cab029bba97977f4f839cdbc1d20be01ebdadd4a255a5adf86c8e9aae9f0eec8c23
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 36a88ef7a699be04e87183bfc2a031b60c5b3df3c46931858d6bb64d4a44690a
MD5 ebe1f2491710da59a9c268ff999bdeab
SHA1 1171aafe717963ea7e9c7e530cf84cae6186c9f7
SHA512 edff68778e2ef160f8a64c42301b45ff4c4852ad9a6d5a323f7e9d1e1f9cc1b6b47e9166cc930e03c0f6b6c6e03fb7b95c2210d4b818ce8ee239f53f1c94a2b3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 aa80b84e14a053c27f0de3e22437df23b4ed5c613fc128038e2523c319daba25
MD5 78599b9bee312b1a490a8aaece2da93f
SHA1 44f4393520e98c06a5c495d26fb87ba9b42cb73a
SHA512 53976ffb9cd19ac0cc2ffcc798f862f41e67901cd418af7ad2c97e110a3a41730d2ed933a85549842b61ec71aa5d13ca9dd502ec96a746f34e64d38a42de0d4b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5aa7f1d506ff01421198669ee7daf36a0777d9b9aa13356063c3963665c86ca0
MD5 edc7447ff5eb27875390d4b0d1886c66
SHA1 1f58932d5390fe0d7f049182c093ba9abbce7719
SHA512 faf4ec8fc069587ce26730551aa3b14b9308996990ff803543f41813384b84309232266d8d916653506d7c0929676180a050b9bde95efa75eb9a298141ba0621
MD5 SHA1 SHA512

Submit Download

svchost_ACBBABCAACABCCCACACBBBCBCAAABABABACACABACBBABBAABCACBCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBABCAACABCCCACACBBBCBCAAABABABACACABACBBABBAABCACBCA.exe
Size 32.3MB
SHA256 d254a13a342df3d43846821f80c34d005519f8488b52e82a7c97a569f1262f15
MD5 0776c54e22c1f6ec9b2828cdd75447e0
SHA1 6e6a46e8437694551fe3eb0f96163e1889f08c81
SHA512 a1a90bacbc3d0793d3e3b602fe88ffc94278cb4c661aadba3755c48ac83dff652809b74bdd6d019678ccc97528b6d5f7a267e8bb6c7bfe49ada004cc7cf117c8
SSDEEP 98304:vKRuy5afKRuy5afKRuy5afKRuy5afKRuy5afKRuy5a/KjKWQckVgtev5mnlNLp:vqEqEqEqEqEqTKWQc0gEYnvLp
TLSH
T184778C10FAEA0C22E5B7217149F6D2794D76BA258334C5CFE689871F6D33BC058367A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 256eb979d6a75bf39d9128366d25391e85431260008078524b11a243e794ae69
MD5 4b6c9b3dfa075c4bbfb3842550ee9b49
SHA1 6b48bff1f189730d56a9236c92ad0063119c590e
SHA512 8a324dc156bc05b1ccbdbcc570e35005bc3bd6490d4f9d58157a71dbf376d7152883f8c1cbfe416cb357764dd3fdd154b47ddc097a712c853e6c74d7a21c690f
TLSH
T19A11A77194E7D8A7F93329D6A21DAB428CB8369FAD5CBA1422444318BFC5C31CD154B2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 61c286b97f6051e896795177877e621e5a6156cac32fbfd761beb6398b611287
MD5 a613c4033cfbb2018e171da854b7bf19
SHA1 f09444dd02edca345fdc9a760c7e03a2b47cf980
SHA512 136920e0d5b000603c3df58094ae65cc1d6526d2c8a22d74f5c1d735b71811f68a3736af1285b061731ae56543cf931272daa55a5eb058b8da3116d274bc9a1c
TLSH
T1C221D86194E7C8A7F83329D7E21DEB428CB4369FAD5CBA1422454318BFC9C31CD154B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1460-33-0x0000000000640000-0x0000000000661000-memory.dmp

Download

memory/3132-0-0x0000000000BD0000-0x0000000000BF1000-memory.dmp

Download

memory/3132-7-0x0000000000BD0000-0x0000000000BF1000-memory.dmp

Download

memory/4084-74-0x0000000000640000-0x0000000000661000-memory.dmp

Download

memory/6120-64-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download