fbbbb4cba40519fcb2eed4c04da26dbca3fb2657a165b00808bb97e79822a8b1

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_40920db8991ace6339d2e6ba30cdfca0_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Size 13.3MB
Sample260818-ctcwmacq6s
SHA256 fbbbb4cba40519fcb2eed4c04da26dbca3fb2657a165b00808bb97e79822a8b1
MD5 40920db8991ace6339d2e6ba30cdfca0
SHA1 2914c15353532349ccdedea8c2f287b22c1e9580
SHA512 ba13e040eb377b6b53b395846ae73c2784613fd4977440ae778d61a2074cde8eaa8bb575880604ed48cd1364fade2031308b9cd79815c9f9e58bd647c36784d9
SSDEEP 49152:U+ES+ES+Ek6+ES+ES+Ek6+ES+ES+EkUPB+ES+ES+Ek6+ES+ES+Ek6+ES+ES+EkUV:xKjKWQckVgtev5mnlNLL
TLSH
T1C0E64C0DF9DE00B5D977907049CBC2BEC5B1B921471249EBE649CB2E2A33BE1B834B55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4552	svchost_CACBBACCBBCBCBBAAACAAACCCBBACCBACABCCCCCCBBBBBCCCACBBAB.exe
6508	svchost_CACBBACCBBCBCBBAAACAAACCCBBACCBACABCCCCCCBBBBBCCCACBBAB.exe
2816	svchost_BCBBCACCBACACABAABCBABBABCCBCAAABBACBCAABCBCBACABABBCBB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCCBCBABBCCBBBACAACBACABCCABCABCABAAAABAABCBCCBCCBCABCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBBCACCBACACABAABCBABBABCCBCAAABBACBCAABCBCBACABABBCBB.exe"	svchost_CACBBACCBBCBCBBAAACAAACCCBBACCBACABCCCCCCBBBBBCCCACBBAB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBCCCBCACBBCCBAABAABAABBABCBBBABBABBBCBACBCCCABCCABBCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBBACCBBCBCBBAAACAAACCCBBACCBACABCCCCCCBBBBBCCCACBBAB.exe"	2026-08-18_40920db8991ace6339d2e6ba30cdfca0_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2204	sc.exe
2912	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5012	cmd.exe
3312	cmd.exe
4940	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBBCACCBACACABAABCBABBABCCBCAAABBACBCAABCBCBACABABBCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_40920db8991ace6339d2e6ba30cdfca0_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACBBACCBBCBCBBAAACAAACCCBBACCBACABCCCCCCBBBBBCCCACBBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1388	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3616	2026-08-18_40920db8991ace6339d2e6ba30cdfca0_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
3616	2026-08-18_40920db8991ace6339d2e6ba30cdfca0_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
3616	2026-08-18_40920db8991ace6339d2e6ba30cdfca0_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
3616	2026-08-18_40920db8991ace6339d2e6ba30cdfca0_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
4552	svchost_CACBBACCBBCBCBBAAACAAACCCBBACCBACABCCCCCCBBBBBCCCACBBAB.exe
4552	svchost_CACBBACCBBCBCBBAAACAAACCCBBACCBACABCCCCCCBBBBBCCCACBBAB.exe
4552	svchost_CACBBACCBBCBCBBAAACAAACCCBBACCBACABCCCCCCBBBBBCCCACBBAB.exe
4552	svchost_CACBBACCBBCBCBBAAACAAACCCBBACCBACABCCCCCCBBBBBCCCACBBAB.exe
2816	svchost_BCBBCACCBACACABAABCBABBABCCBCAAABBACBCAABCBCBACABABBCBB.exe
2816	svchost_BCBBCACCBACACABAABCBABBABCCBCAAABBACBCAABCBCBACABABBCBB.exe
6508	svchost_CACBBACCBBCBCBBAAACAAACCCBBACCBACABCCCCCCBBBBBCCCACBBAB.exe
6508	svchost_CACBBACCBBCBCBBAAACAAACCCBBACCBACABCCCCCCBBBBBCCCACBBAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3616	2026-08-18_40920db8991ace6339d2e6ba30cdfca0_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Token: SeDebugPrivilege	4552	svchost_CACBBACCBBCBCBBAAACAAACCCBBACCBACABCCCCCCBBBBBCCCACBBAB.exe
Token: SeDebugPrivilege	2816	svchost_BCBBCACCBACACABAABCBABBABCCBCAAABBACBCAABCBCBACABABBCBB.exe
Token: SeDebugPrivilege	6508	svchost_CACBBACCBBCBCBBAAACAAACCCBBACCBACABCCCCCCBBBBBCCCACBBAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3616 wrote to memory of 5012	3616	2026-08-18_40920db8991ace6339d2e6ba30cdfca0_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	90
PID 5012 wrote to memory of 1388	5012	cmd.exe	92
PID 3616 wrote to memory of 3312	3616	2026-08-18_40920db8991ace6339d2e6ba30cdfca0_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	93
PID 3312 wrote to memory of 2204	3312	cmd.exe	95
PID 4552 wrote to memory of 2952	4552	svchost_CACBBACCBBCBCBBAAACAAACCCBBACCBACABCCCCCCBBBBBCCCACBBAB.exe	96
PID 3616 wrote to memory of 4940	3616	2026-08-18_40920db8991ace6339d2e6ba30cdfca0_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	97
PID 4940 wrote to memory of 2912	4940	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-08-18_40920db8991ace6339d2e6ba30cdfca0_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_40920db8991ace6339d2e6ba30cdfca0_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAAACCBBBBABABBBCBBABCBAACCBABBCBABBCCBBCACCCABCBABBBAAAABBAAABABCBCBBCCAAAAAABBCCACBBBBBACCABAAAABCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBACCBBCBCBBAAACAAACCCBBACCBACABCCCCCCBBBBBCCCACBBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAAACCBBBBABABBBCBBABCBAACCBABBCBABBCCBBCACCCABCBABBBAAAABBAAABABCBCBBCCAAAAAABBCCACBBBBBACCABAAAABCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBACCBBCBCBBAAACAAACCCBBACCBACABCCCCCCBBBBBCCCACBBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBCBCCCCBCBBBACABBBABCCBCBCABACACCBAAABABBAAACCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBACCBBCBCBBAAACAAACCCBBACCBACABCCCCCCBBBBBCCCACBBAB.exe" start= auto displayName= "UserDataSvc_CBBCBCCCCBCBBBACABBBABCCBCBCABACACCBAAABABBAAACCAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBCBCCCCBCBBBACABBBABCCBCBCABACACCBAAABABBAAACCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBACCBBCBCBBAAACAAACCCBBACCBACABCCCCCCBBBBBCCCACBBAB.exe" start= auto displayName= "UserDataSvc_CBBCBCCCCBCBBBACABBBABCCBCBCABACACCBAAABABBAAACCAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2204
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBCBCCCCBCBBBACABBBABCCBCBCABACACCBAAABABBAAACCAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBCBCCCCBCBBBACABBBABCCBCBCABACACCBAAABABBAAACCAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2912

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBACCBBCBCBBAAACAAACCCBBACCBACABCCCCCCBBBBBCCCACBBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBACCBBCBCBBAAACAAACCCBBACCBACABCCCCCCBBBBBCCCACBBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2952

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBACCBBCBCBBAAACAAACCCBBACCBACABCCCCCCBBBBBCCCACBBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBACCBBCBCBBAAACAAACCCBBACCBACABCCCCCCBBBBBCCCACBBAB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6508

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCACCBACACABAABCBABBABCCBCAAABBACBCAABCBCBACABABBCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCACCBACACABAABCBABBABCCBCAAABBACBCAABCBCBACABABBCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 7fafa8aa4bc5936d8506a2bb67c18b091a10de9dea794743bd74b718e38fe8e1
MD5 6d35b50ae89231914f9ab0440bfa2065
SHA1 eb8dc77c0d96216ab2ab057ccc8a9371d50a8253
SHA512 1406709ca5f968b892392d76a91060bfdb079c19126d1efb0c2f74eba9a632240f05fedf44101902ab35df4f74c823bcd70123d7f2aa3865c29c87eba5d2f853
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\qap`g`v~dtlq
Size 10B
SHA256 23be6b0192afc5237fe5cab0a513e14f5ca4ad1379c309271146a64e527edb75
MD5 999e8f520d7a8190fb4959e6acceda37
SHA1 e34f4aec99abd57e94158e4d812182ab20307b37
SHA512 9706c8384b999dd9c0b3b827ef0f5dda94e16797420a0cf44f7807fd155efbfd6b7fa45ceeae2c7f4b796f97168621221c73d9bdb142bfa3a86a0eb297de9831
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 13.9MB
SHA256 275362797ffb605d429a95f526b78e3ed0f8702852b22af2dca83f718a6a95e9
MD5 0fd47d0d99ab48089db84371adb74b13
SHA1 65896db97824a658f4039268718819ef553944c0
SHA512 a8d06d53dd1f83ebec98738d40df1fa1c28afdc201b7a6917de9103f61c83c88b7fdc17b7651e55c4a8069763e9a96406193d9964503b82e0f8c8eea94eb8ee5
SSDEEP 49152:U+ES+ES+Ek6+ES+ES+Ek6+ES+ES+EkUPB+ES+ES+Ek6+ES+ES+Ek6+ES+ES+EkUH:xKjKWQckVgtev5mnlNLugZ2Hb9t+2xS
TLSH
T187E65C0DF9DA00B5D977917089CBC27EC9B1B921471249EFE689CB2E2A33BE17834715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\qap`g`v~dtlq
Size 10B
SHA256 c6f75c45f8736f927c9b35032ffbd35e3b332100cfa8a7ab5452bd449b16535f
MD5 1f8da5090f7a070e320acb61a5a943d4
SHA1 59e9778c7e0299ea11db33b02b9139ae5de382d9
SHA512 b6a1dcae1e1d8526e65616185ed0a8db807a41400fb092ae4d5329cc7493f630f94a065b0126587d30d609b7057713ac0319399ba1c400465744d96f5a7adbd9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a860f0ab448a9f41f97b7e6000685bf1fc20427f0810d0eb77ff14e0d6864607
MD5 b45b6a83d890a5022e12ab54e100640e
SHA1 cbe8f66e51d79c4c5f9b2ad43f54603280b96b62
SHA512 0799ef2ade2dc43e5f472429653abf970a7893db8b39e3fc1d452645839e43b3eb0ce5322b12e29ced4f563edd1848ba056bd212b1096f75c9061a0fe52674d3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 09cebc9ef0c0ad98afdb702c590a935ac033bdf15ac817967e4956e0ea1ac13a
MD5 3ff643c0fd4fdc9882c0601c465fd605
SHA1 66ff2b61c1ecf2c75e9b5497216a4aca24ead6eb
SHA512 439444f5686a5c25884242f4c3d385369ea141ea07539cc4484dfa088abf1d09ef900cda82870fe8bcfe4d1b0608ad7635823ef5a4e079ae819b963b218f0290
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1df5fae9d1963c3232cb609737400edb1f06f6262e427dbd976745d510a83a66
MD5 0a579b7f623b012c81c91a2b5f0d0b27
SHA1 578b5aeeb9955f2527af08665c049970df22ea5a
SHA512 15c42adceb39c94f82df5d6e36bccc4f48c005be086dedfde0ee870a8e85d9685488fe2fba09e40add738042b5c99ca4926e26531935a1ac364ab443b575457c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 89c12f4e73acfa0852b6d2182aa2a24a2da6222995250f2d4260fc3bc96856b0
MD5 2dde613509e4ae32cc06d689fea9e6ef
SHA1 6ff83e0eb890ba4580cdd72e439a6616fb282140
SHA512 11965a9e19779c3a663eb359ed8d5bdbae1cedb1289b23ec371d409f9ff28cb60d4eb4ed0c68a636efc7aabe2683d7bb205d110012c509482009e551ebabccf9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3bf9217cfd37d7132f66b0d42fba8071b72edc5439ac2e92e46e8f582f05563d
MD5 bf8bf3e22de0aa2804b0b7ba09c552b7
SHA1 452721b7cc89abbecb9269865f41bb7231bc291e
SHA512 96487fc937671643590626d6675d64ab69727f862e905039b1ed234bd8c7656e93ece7fdaaa2aa7d7e8ad369a7d8e7520112737206ee64fa21f41a1ad2a96a24
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3af7d4da22d730995afd8a8d2fb99232727fd3c665987bb888e2ad98d8783f0b
MD5 eecfc1ce1a64ad6d18702fab5ef7f6cd
SHA1 79fd79a6c0369b4b54431a07bd98f7659682e4ec
SHA512 8cb2040919b8f2e40ca687a9034e7b57cac382d362a514b34688ce16e38ac8057d99a68b895052294d6752826593e8029396e0c8ae28896a6f12c5511d3a4071
MD5 SHA1 SHA512

Submit Download

svchost_CACBBACCBBCBCBBAAACAAACCCBBACCBACABCCCCCCBBBBBCCCACBBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBACCBBCBCBBAAACAAACCCBBACCBACABCCCCCCBBBBBCCCACBBAB.exe
Size 13.3MB
SHA256 fbbbb4cba40519fcb2eed4c04da26dbca3fb2657a165b00808bb97e79822a8b1
MD5 40920db8991ace6339d2e6ba30cdfca0
SHA1 2914c15353532349ccdedea8c2f287b22c1e9580
SHA512 ba13e040eb377b6b53b395846ae73c2784613fd4977440ae778d61a2074cde8eaa8bb575880604ed48cd1364fade2031308b9cd79815c9f9e58bd647c36784d9
SSDEEP 49152:U+ES+ES+Ek6+ES+ES+Ek6+ES+ES+EkUPB+ES+ES+Ek6+ES+ES+Ek6+ES+ES+EkUV:xKjKWQckVgtev5mnlNLL
TLSH
T1C0E64C0DF9DE00B5D977907049CBC2BEC5B1B921471249EBE649CB2E2A33BE1B834B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 024c1886d42e6ddf5bebf47f6f9973b6c87630807e603293d396c3d02cf11083
MD5 9ad77159ab6738aa61037765c4af1527
SHA1 0ec5b1538937ffaac076abf65eac1f0f9a5d786e
SHA512 94fb109e7138610a93f789a10a47322eae52a1de41039399a1a77f39c6433fbcfbeb36603d4b6e159eded8c9ab505c8b3d9e53723eec4cce77ef09d366215f2b
TLSH
T18A110401E4FBC853E832288B8519FBC24C98B38B995C7AA4530D2318BBC4C31DD118E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 966B
SHA256 760d328907a2f8851d01c000a66d559dc8283799db843b85b8ec22ceae1a0dfb
MD5 f5a0961ffa926b8895ef6f4acb63be09
SHA1 5ec9f45ae8fcd48834e266ed9e4206c37bf78fcf
SHA512 20fb6875b891a4464c594bad1442c23c177f0d8bf13b00c8f2bf9a1cfdc7ab4fbb05b8545411e5eea0ca0b11ae67b2df249c7046a51761aa1bdeeb4cfba2125e
TLSH
T171110841D4FBC853EC32698B9519FBD24C98B78B995C7AA4530D23187FC4C31DE118E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2816-81-0x0000000000940000-0x0000000000961000-memory.dmp

Download

memory/3616-6-0x0000000000A20000-0x0000000000A41000-memory.dmp

Download

memory/4552-35-0x0000000000E20000-0x0000000000E41000-memory.dmp

Download

memory/4552-22-0x0000000000E20000-0x0000000000E41000-memory.dmp

Download

memory/6508-66-0x0000000000E20000-0x0000000000E41000-memory.dmp

Download