a51501912e7470e8a86baf9d4ed3c57bf7d83c5de130574d7446be18e0f0bfb8

Analysis

max time kernel
150s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 05:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_fcda91b4f9b15438760a4b68c12adfdf_amadey_darkgate_elex_stop.exe
Size 1.1MB
Sample260827-fxvsdsdm2z
SHA256 a51501912e7470e8a86baf9d4ed3c57bf7d83c5de130574d7446be18e0f0bfb8
MD5 fcda91b4f9b15438760a4b68c12adfdf
SHA1 adf6ce91904f67bee44322346e0bc43abdd49742
SHA512 d431fb2d375255838c0d94eff3198d5878cdfc00c6f349026e95ecb6d3b797dfb08416c6232a3c2c03184c26e87248d9871eb5a2d46912c2b14bdf6efa3555ef
SSDEEP 24576:m9+EM0q9+EM0q9+EM0KLF9+EM0q9+EM0q9+EM0KLLafDd70iTWCy:U+ES+ES+Eoj+ES+ES+Eo0Dd79WCy
TLSH
T1E0356C05FA828071E87714714DDFD37E8924BA218B158EDBF78D8B1F6932BE1A834716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2484	svchost_CABAABAACCCCBBACBBAACCACABBAACCACCCBBBBBAAABBBAACACABAC.exe
4344	svchost_BCCABAACBCBCABCCBABBBCBACBBBBCCCBCAAACABABABBBAABBACABC.exe
2528	svchost_CABAABAACCCCBBACBBAACCACABBAACCACCCBBBBBAAABBBAACACABAC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BABAABCAAABCACCBCAACABCCBCCCABACABACCCCCABBCACBCCAACBABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABAABAACCCCBBACBBAACCACABBAACCACCCBBBBBAAABBBAACACABAC.exe"	2026-08-27_fcda91b4f9b15438760a4b68c12adfdf_amadey_darkgate_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BABCCCCABCBACCAACCAACBABBAAAABABACCAAABAAAAAACAAAAABBCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCABAACBCBCABCCBABBBCBACBBBBCCCBCAAACABABABBBAABBACABC.exe"	svchost_CABAABAACCCCBBACBBAACCACABBAACCACCCBBBBBAAABBBAACACABAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4060	sc.exe
3364	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2012	cmd.exe
640	cmd.exe
4052	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABAABAACCCCBBACBBAACCACABBAACCACCCBBBBBAAABBBAACACABAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCABAACBCBCABCCBABBBCBACBBBBCCCBCAAACABABABBBAABBACABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_fcda91b4f9b15438760a4b68c12adfdf_amadey_darkgate_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1328	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1388	2026-08-27_fcda91b4f9b15438760a4b68c12adfdf_amadey_darkgate_elex_stop.exe
1388	2026-08-27_fcda91b4f9b15438760a4b68c12adfdf_amadey_darkgate_elex_stop.exe
1388	2026-08-27_fcda91b4f9b15438760a4b68c12adfdf_amadey_darkgate_elex_stop.exe
1388	2026-08-27_fcda91b4f9b15438760a4b68c12adfdf_amadey_darkgate_elex_stop.exe
2484	svchost_CABAABAACCCCBBACBBAACCACABBAACCACCCBBBBBAAABBBAACACABAC.exe
2484	svchost_CABAABAACCCCBBACBBAACCACABBAACCACCCBBBBBAAABBBAACACABAC.exe
2484	svchost_CABAABAACCCCBBACBBAACCACABBAACCACCCBBBBBAAABBBAACACABAC.exe
2484	svchost_CABAABAACCCCBBACBBAACCACABBAACCACCCBBBBBAAABBBAACACABAC.exe
4344	svchost_BCCABAACBCBCABCCBABBBCBACBBBBCCCBCAAACABABABBBAABBACABC.exe
4344	svchost_BCCABAACBCBCABCCBABBBCBACBBBBCCCBCAAACABABABBBAABBACABC.exe
2528	svchost_CABAABAACCCCBBACBBAACCACABBAACCACCCBBBBBAAABBBAACACABAC.exe
2528	svchost_CABAABAACCCCBBACBBAACCACABBAACCACCCBBBBBAAABBBAACACABAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1388	2026-08-27_fcda91b4f9b15438760a4b68c12adfdf_amadey_darkgate_elex_stop.exe
Token: SeDebugPrivilege	2484	svchost_CABAABAACCCCBBACBBAACCACABBAACCACCCBBBBBAAABBBAACACABAC.exe
Token: SeDebugPrivilege	4344	svchost_BCCABAACBCBCABCCBABBBCBACBBBBCCCBCAAACABABABBBAABBACABC.exe
Token: SeDebugPrivilege	2528	svchost_CABAABAACCCCBBACBBAACCACABBAACCACCCBBBBBAAABBBAACACABAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
436	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 4052	1388	2026-08-27_fcda91b4f9b15438760a4b68c12adfdf_amadey_darkgate_elex_stop.exe	96
PID 4052 wrote to memory of 1328	4052	cmd.exe	98
PID 2484 wrote to memory of 536	2484	svchost_CABAABAACCCCBBACBBAACCACABBAACCACCCBBBBBAAABBBAACACABAC.exe	99
PID 536 wrote to memory of 612	536	notepad.exe	100
PID 1388 wrote to memory of 2012	1388	2026-08-27_fcda91b4f9b15438760a4b68c12adfdf_amadey_darkgate_elex_stop.exe	104
PID 2012 wrote to memory of 4060	2012	cmd.exe	106
PID 1388 wrote to memory of 640	1388	2026-08-27_fcda91b4f9b15438760a4b68c12adfdf_amadey_darkgate_elex_stop.exe	107
PID 640 wrote to memory of 3364	640	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-27_fcda91b4f9b15438760a4b68c12adfdf_amadey_darkgate_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_fcda91b4f9b15438760a4b68c12adfdf_amadey_darkgate_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBABBBBACABBBAAABCACACACBCBBCABCAAAACBAAABBABBCBAAAAAABABBAAAAABBCBCBCCBBABCCBABCABBACAABBCACBACACCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAABAACCCCBBACBBAACCACABBAACCACCCBBBBBAAABBBAACACABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBABBBBACABBBAAABCACACACBCBBCABCAAAACBAAABBABBCBAAAAAABABBAAAAABBCBCBCCBBABCCBABCABBACAABBCACBACACCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAABAACCCCBBACBBAACCACABBAACCACCCBBBBBAAABBBAACACABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCABABAACCACCBBBCCAACCAACCAABBCAAACBBBCACABABCABCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAABAACCCCBBACBBAACCACABBAACCACCCBBBBBAAABBBAACACABAC.exe" start= auto displayName= "UserDataSvc_BCABABAACCACCBBBCCAACCAACCAABBCAAACBBBCACABABCABCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCABABAACCACCBBBCCAACCAACCAABBCAAACBBBCACABABCABCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAABAACCCCBBACBBAACCACABBAACCACCCBBBBBAAABBBAACACABAC.exe" start= auto displayName= "UserDataSvc_BCABABAACCACCBBBCCAACCAACCAABBCAAACBBBCACABABCABCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCABABAACCACCBBBCCAACCAACCAABBCAAACBBBCACABABCABCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:640
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCABABAACCACCBBBCCAACCAACCAABBCAAACBBBCACABABCABCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3364

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAABAACCCCBBACBBAACCACABBAACCACCCBBBBBAAABBBAACACABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAABAACCCCBBACBBAACCACABBAACCACCCBBBBBAAABBBAACACABAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:536
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:612

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:436

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABAACBCBCABCCBABBBCBACBBBBCCCBCAAACABABABBBAABBACABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABAACBCBCABCCBABBBCBACBBBBCCCBCAAACABABABBBAABBACABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4344

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAABAACCCCBBACBBAACCACABBAACCACCCBBBBBAAABBBAACACABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAABAACCCCBBACBBAACCACABBAACCACCCBBBBBAAABBBAACACABAC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 0164a610758d434376516a1b28f16af0deb5cffe6ab3d1b87fd96d4709fa7798
MD5 8cbec75bb4610992b2113ccbfd0f9988
SHA1 4f7fbee798f853e48ea01ff69d235c70ce733ede
SHA512 ed7b0435fe2fcd2f2c4c90ba14910e1a167e7b8db19ed2411f64c5bbabf11063dedde0d92bf96a5e7d9cb1d87e6f09c89c48954003ff3bc8984610e6740fe4aa
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 1.5MB
SHA256 881c00e6ed94d58e15f300de6fda34fe34bbbe6dd911dc8cfa9899822d6a6d94
MD5 fd1ea9f0f4c3f9b0ae628293b393e70c
SHA1 6f5c872580cac00b2403ce493de51c108f671b39
SHA512 2d1ec7c44545d93d66eb994920bef28d77af448c7393837ba1e2b8277e35826e0349005e67cb488669bec2525425d34ea97775042dbb15a2917e03438268931a
SSDEEP 49152:U+ES+ES+Eoj+ES+ES+Eo0Dd79WCtXpiM4:9p7fpiv
TLSH
T11A756C02F7D28031F5B316714EBBD37A4A79BD218E358A9FE388461E5971AD0E934723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\qap`g`v~dtlq
Size 10B
SHA256 c67a202fbb1511c23e2f2659b080ec4e0e874860f4f516838ef3e08302776bb5
MD5 10adf518fc0680df150b52ee510f35cb
SHA1 b8f1a9b6ddb9c6a5449d76eb5eaa7292bc657aa5
SHA512 e65fd187a73ff9b9d1a54fdade302dc6045d0f8182e56dcc372ca2ca079331343f5ee8de2a4e0c19863e660849e81624e6e89e1323f0575e107f0e268d9cabfe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\INetHistory\qap`g`v~dtlq
Size 10B
SHA256 9ff855b8572938b02aa5361ccbdb8019bcc556a4c07979203fea7c1e55c1fc79
MD5 b203218708d5c15d45794c338b7911ed
SHA1 263e51a38cf1573a2c17c65e95cf7b1cfad7782b
SHA512 93579f9628f616caade16441d23b5b6f2275de0a6d4ad787c4f8e62c6f611476e948774bca3dcae046dd49c3b3d0a2cbf65fd9e394e1a54d137336276ad5bb75
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fd518a0e78856064ef2e4c094bd631de9ce47f43ca5a1aa050d1a8bd9a93886e
MD5 0a43a3697ebc9b39d1406760ad1ae36d
SHA1 e7b43f22e9b70fd1db9ec99577fa4187d851c40e
SHA512 d174cfbb1ddacde0d98ee3f654928b29120c543ec8166553432f20bfe26b22b4485149eaad0c9c248eb79c7a547a44e276d0058cf4dbcbd3b89e7df18a2713e1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b06ac5deb033a7bfadc40f36d4f00a6d2e09a817ca5509a60b9b955b0f2956f0
MD5 43cb1b05d52940e9f56272140c052a8c
SHA1 0389252e24aee57ce46480e3b637a0c3887bbc1e
SHA512 546c71773e773e90b61b39640162ca695876bb7837feb3ee3747e8161873b36db2337fcabe3be9dd69eb1320ed82e1347c64d2b56298ee8a412b97538a4655dc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 be1e3b84b695deb3c0b93d70a07a5a1b643d93918f169d97eaa04c693585da64
MD5 3129722973852c7d5bdb873c44e4a110
SHA1 2b09e0c61081397b77b56c77b48c6d2a16c3ce66
SHA512 043d6c8d6d99abc1c02a11c896d8f283e7aa285b367e07615afb5a934e1155fe456e2e9293f99678b4bf16c093dbbaffc37dd7866280618fd37f14907587542c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 846dc401284526e90e85c863381094490d147758d2da705527c5665c938dc5c0
MD5 fa4deeba9e2bd73bf1dc337d57a3710b
SHA1 3d2c6edc14af2ed8b5dd5ece050c1d836707ac3a
SHA512 1442bb79894ffd440343a4bc79b5c6360d09a057737ccda849440ede76df89f889006e0eeb1a494699da8d304e0117118bfb74db1bc311719f5ca19052efcd23
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 49b536039da1575378f1e63ef9530dc3d4087c4af794e3932a9d389560e5a848
MD5 abdd7ec33f8ecb4e8d59335ff2d98f06
SHA1 d66ffd483f1e7242be3732182b7c1fd33772a874
SHA512 0ce0b0c9409f4a29fc5f190f546693c97e296e84873b2162e31905f2e7ef93b1b8dad07c645c337845fd7e6ab86a57a1b975287173b48924476963fc5d569a46
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3180a05b331ead488aec9c763ec658d49eb4320984dbcc7a90dc2c8aa21b717d
MD5 d548d12b5f83a97bde5e93a93788dddc
SHA1 951f92f9d8545fefb706eacb78d7b5ff90557da3
SHA512 4628ff0226e22b816e0b18679c140f442372e82b28913dacc2a86aad9aeb354844233cb3aeca55a6ddfba364b65fccf822dda27eeedd1cfc7dc0ae43d6002680
MD5 SHA1 SHA512

Submit Download

svchost_CABAABAACCCCBBACBBAACCACABBAACCACCCBBBBBAAABBBAACACABAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAABAACCCCBBACBBAACCACABBAACCACCCBBBBBAAABBBAACACABAC.exe
Size 1.1MB
SHA256 a51501912e7470e8a86baf9d4ed3c57bf7d83c5de130574d7446be18e0f0bfb8
MD5 fcda91b4f9b15438760a4b68c12adfdf
SHA1 adf6ce91904f67bee44322346e0bc43abdd49742
SHA512 d431fb2d375255838c0d94eff3198d5878cdfc00c6f349026e95ecb6d3b797dfb08416c6232a3c2c03184c26e87248d9871eb5a2d46912c2b14bdf6efa3555ef
SSDEEP 24576:m9+EM0q9+EM0q9+EM0KLF9+EM0q9+EM0q9+EM0KLLafDd70iTWCy:U+ES+ES+Eoj+ES+ES+Eo0Dd79WCy
TLSH
T1E0356C05FA828071E87714714DDFD37E8924BA218B158EDBF78D8B1F6932BE1A834716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 7a2e127a28558942115d8e857bf8eeab2310b0d75f88dcbb6283f3e784afacac
MD5 14a428306e0a9917e6014f84f3fb4310
SHA1 8be7a6c1014e5e27f7f3e5cb924153c9ab8b2d97
SHA512 a04c0803c866f3e1198242089c15b7de449a8fadf6d69d55f700f820346ac5edf3d9485c0dc0d7c1f3ec44cca3688480acb63da09cefc2cca6413f3879bf35df
TLSH
T1F511AB50A0F6E857F47238DB9725CAC21CD83787AD6C6E141305935DA7D9C31CF5A1E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 7f3f616bbca15a52a2c5dd0ded2e8ecd41cbaaaaaf1dfec25bfe0d3083d47b1d
MD5 8d4e06be148d2866471f2e33a2fc64b8
SHA1 ae609161d15a1f01fc564fdcce242c79ae837b48
SHA512 b68cea988664ccc4ec2d02d733827ab696134eb18c33b3dfad721e89c39cc26fa03c7eac54e4f08c7b9bf0c00fbe4b38a6bb375f7fe62373ee8e094194799113
TLSH
T17221C950D0F6E857F47238DB9725CAC228E8374BAD6C6E1423055359B6D9C31CF4A0F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/536-58-0x0000000005340000-0x0000000005341000-memory.dmp

Download

memory/1388-0-0x0000000000C50000-0x0000000000C71000-memory.dmp

Download

memory/1388-7-0x0000000000C50000-0x0000000000C71000-memory.dmp

Download

memory/2484-34-0x0000000000E10000-0x0000000000E31000-memory.dmp

Download

memory/2528-696-0x0000000000E10000-0x0000000000E31000-memory.dmp

Download

memory/4344-77-0x00000000007D0000-0x00000000007F1000-memory.dmp

Download

memory/4344-1466-0x00000000007D0000-0x00000000007F1000-memory.dmp

Download