2c75ee5aaad11687033dbb8b8c94d82bd20e29959537a94efb7ebe410ede2541

Analysis

max time kernel
150s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 10:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_b085170840825e4c7823c9a587e0f9f9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Size 19.5MB
Sample260827-mjebtashph
SHA256 2c75ee5aaad11687033dbb8b8c94d82bd20e29959537a94efb7ebe410ede2541
MD5 b085170840825e4c7823c9a587e0f9f9
SHA1 b9f74f9a87036b7bb08407bd6921f80089bb0377
SHA512 2f7bd701c216ac206679be0765b6286550185b21d2775cf632495b61bfad9df02171d9908d24d537cb4ac4256e253939fc3dfee49ae9b93f74c52fa55d697a39
SSDEEP 49152:U+Eiiw2L+Eiiw2L+Eiiw2L+Eiiw2D/+Eiiw2L+Eiiw2L+Eiiw2L+Eiiw2D/+Eiiz:tOU/jIEeQfoR/IuOFVjUu5k
TLSH
T16427290977ED4854E5B3623489B28669D6B2BC518F32C7DF6284933E1F73AD0AC34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5920	svchost_ACCABAAABCAAAAAAACBBBBBBCCAAAACBABBCABACAABCABCCAAABBBB.exe
2192	svchost_CCABAABABAACCBBBBCBCACCABBCACBCBBBBBCCACCBBAAACBBBABCCB.exe
4128	svchost_ACCABAAABCAAAAAAACBBBBBBCCAAAACBABBCABACAABCABCCAAABBBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCCBBBAAABBBCACCCABBBBCBBCBABCCACACCBABAACAAABBBBCCAACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCABAAABCAAAAAAACBBBBBBCCAAAACBABBCABACAABCABCCAAABBBB.exe"	2026-08-27_b085170840825e4c7823c9a587e0f9f9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCBBACCBABAAABCBCBBBCBABBCACBABBAACAABACBACBABBBACBBABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCABAABABAACCBBBBCBCACCABBCACBCBBBBBCCACCBBAAACBBBABCCB.exe"	svchost_ACCABAAABCAAAAAAACBBBBBBCCAAAACBABBCABACAABCABCCAAABBBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4824	sc.exe
2280	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1732	cmd.exe
4420	cmd.exe
6084	cmd.exe
2232	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_b085170840825e4c7823c9a587e0f9f9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCABAAABCAAAAAAACBBBBBBCCAAAACBABBCABACAABCABCCAAABBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCABAABABAACCBBBBCBCACCABBCACBCBBBBBCCACCBBAAACBBBABCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4112	schtasks.exe
6088	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5936	2026-08-27_b085170840825e4c7823c9a587e0f9f9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
5936	2026-08-27_b085170840825e4c7823c9a587e0f9f9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
5936	2026-08-27_b085170840825e4c7823c9a587e0f9f9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
5936	2026-08-27_b085170840825e4c7823c9a587e0f9f9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
5920	svchost_ACCABAAABCAAAAAAACBBBBBBCCAAAACBABBCABACAABCABCCAAABBBB.exe
5920	svchost_ACCABAAABCAAAAAAACBBBBBBCCAAAACBABBCABACAABCABCCAAABBBB.exe
5920	svchost_ACCABAAABCAAAAAAACBBBBBBCCAAAACBABBCABACAABCABCCAAABBBB.exe
5920	svchost_ACCABAAABCAAAAAAACBBBBBBCCAAAACBABBCABACAABCABCCAAABBBB.exe
2192	svchost_CCABAABABAACCBBBBCBCACCABBCACBCBBBBBCCACCBBAAACBBBABCCB.exe
2192	svchost_CCABAABABAACCBBBBCBCACCABBCACBCBBBBBCCACCBBAAACBBBABCCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5936	2026-08-27_b085170840825e4c7823c9a587e0f9f9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Token: SeDebugPrivilege	5920	svchost_ACCABAAABCAAAAAAACBBBBBBCCAAAACBABBCABACAABCABCCAAABBBB.exe
Token: SeDebugPrivilege	2192	svchost_CCABAABABAACCBBBBCBCACCABBCACBCBBBBBCCACCBBAAACBBBABCCB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5936 wrote to memory of 1732	5936	2026-08-27_b085170840825e4c7823c9a587e0f9f9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	92
PID 1732 wrote to memory of 4112	1732	cmd.exe	94
PID 5920 wrote to memory of 4424	5920	svchost_ACCABAAABCAAAAAAACBBBBBBCCAAAACBABBCABACAABCABCCAAABBBB.exe	95
PID 5936 wrote to memory of 4420	5936	2026-08-27_b085170840825e4c7823c9a587e0f9f9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	98
PID 4420 wrote to memory of 4824	4420	cmd.exe	100
PID 5936 wrote to memory of 6084	5936	2026-08-27_b085170840825e4c7823c9a587e0f9f9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	101
PID 6084 wrote to memory of 2280	6084	cmd.exe	103
PID 5920 wrote to memory of 2232	5920	svchost_ACCABAAABCAAAAAAACBBBBBBCCAAAACBABBCABACAABCABCCAAABBBB.exe	105
PID 2232 wrote to memory of 6088	2232	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-27_b085170840825e4c7823c9a587e0f9f9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_b085170840825e4c7823c9a587e0f9f9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBAABCACACABBCAABCACACBCACCCABBABBCBCABAAABCBAABABBBBCCCBAAACABBCBCBBAACAABBBBCCABABBABCAACBABBBCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABAAABCAAAAAAACBBBBBBCCAAAACBABBCABACAABCABCCAAABBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBAABCACACABBCAABCACACBCACCCABBABBCBCABAAABCBAABABBBBCCCBAAACABBCBCBBAACAABBBBCCABABBABCAACBABBBCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABAAABCAAAAAAACBBBBBBCCAAAACBABBCABACAABCABCCAAABBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAABCBBCACCACBCBBCBBBBABCCBAACABBAACBCCACBCABBCABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABAAABCAAAAAAACBBBBBBCCAAAACBABBCABACAABCABCCAAABBBB.exe" start= auto displayName= "UserDataSvc_BAABCBBCACCACBCBBCBBBBABCCBAACABBAACBCCACBCABBCABBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAABCBBCACCACBCBBCBBBBABCCBAACABBAACBCCACBCABBCABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABAAABCAAAAAAACBBBBBBCCAAAACBABBCABACAABCABCCAAABBBB.exe" start= auto displayName= "UserDataSvc_BAABCBBCACCACBCBBCBBBBABCCBAACABBAACBCCACBCABBCABBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAABCBBCACCACBCBBCBBBBABCCBAACABBAACBCCACBCABBCABBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6084
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAABCBBCACCACBCBBCBBBBABCCBAACABBAACBCCACBCABBCABBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2280

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABAAABCAAAAAAACBBBBBBCCAAAACBABBCABACAABCABCCAAABBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABAAABCAAAAAAACBBBBBBCCAAAACBABBCABACAABCABCCAAABBBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5920
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCACCCCBCBACCCABCAACACBAACBBCAAABCCCCACBABBBCBACAACAACBABAACCACAABAACABBACACBCCBCACBBCCBBCACCCCBBBACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABAABABAACCBBBBCBCACCABBCACBCBBBBBCCACCBBAAACBBBABCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCACCCCBCBACCCABCAACACBAACBBCAAABCCCCACBABBBCBACAACAACBABAACCACAABAACABBACACBCCBCACBBCCBBCACCCCBBBACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABAABABAACCBBBBCBCACCABBCACBCBBBBBCCACCBBAAACBBBABCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6088

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABAABABAACCBBBBCBCACCABBCACBCBBBBBCCACCBBAAACBBBABCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABAABABAACCBBBBCBCACCABBCACBCBBBBBCCACCBBAAACBBBABCCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2192

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABAAABCAAAAAAACBBBBBBCCAAAACBABBCABACAABCABCCAAABBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABAAABCAAAAAAACBBBBBBCCAAAACBABBCABACAABCABCCAAABBBB.exe
1⤵
- Executes dropped EXE
PID:4128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 668b8b711ff6a3ece383c48605a5faf64f66665515bf33aba9eed28aeb83e2c8
MD5 59482f401bebc61ba43d639b21b071c5
SHA1 87a10ecc91a6f739c3eb2c325faa66afb5463cf2
SHA512 c582db06bdb89909fe94b366e4fad8309672764f0f7817bde69521d320e24deb2ff152f6e68ee432b0d34de17c1496c37e5597e3b342ad34160c94932387be0c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 555da2acadf2e3eb2db488b7a2911c7548985a1c09a12b4cfe4821d243cf7eee
MD5 b6096c6e62fbb255fa2fe1af7dac5795
SHA1 386d8bc89b32ab96b8b6d4d7d32959f310386dd6
SHA512 52b323c123b20b866f72a94dca8a1b71c814724296845f550cebb06bce45fec3491d2ad1347291fa3312004e44888983b63e97974c390a2a63fee94de65874cf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 db9d7f1ef65fb7445f6490993747cce34dc37d94ea70e6fe81c4aa9c52953c28
MD5 11d3141d34dd9b12d58c38997970c467
SHA1 5db72cfec5005d8519378138831efe9397cab8eb
SHA512 bb33ee8cae7eae0c6cd75d5071a14c37466a2208596ef150cb50fb0e736b5f85732fb209e563915564ecba82823e1e564a337d15e5db29fddc2a13a05248caec
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 20e4b4cb6fd98d1979962521bcc6235b5b15666c109007c9754f46062a0c8864
MD5 779d3cccda5122744142ddd67e5ca044
SHA1 f720773de02f1e9e0dc6e17540d5b2b694f9cecb
SHA512 50075f7cf7138a1382510e0e19a3e9df6d7f2498c8d88116959a2d44cafb4f021f7072b3cf8e98a0d63e11b5aa7cd31c1b7d5998d88f6227cd823f54627e5845
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d86ebe1c3569c176a467d0cb801ed123e95fcef57e6964e3b3d1eddde5c31f88
MD5 2c12a6b9bcf3360296fe4bf8d266c5a0
SHA1 0deb9b982d57e3c8cbfea6e6100d459e69f482ef
SHA512 384191c2d747c22eec8d5a786fad74ad1656d0f893fc4329db000c8f04d3861707be95f97cb721ca66d5f28c1b7d186736ff2e2ab90df7d8e02bc69277d2c3fd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f8bb50c3565201fcb66450e30ebf4f5ac12db12142be1fd7805e4ea2d8accdec
MD5 927acf3be81d164856742b98a3076519
SHA1 a1ec176f6b400a06eaf609aa20ef529bee326ce9
SHA512 34d61f947bae2241c2171c3b4e7e5073dd500fee7a225ee1b5b0cfb89fb960b59c846884de8295d0275408e20a0f65b24aacf7307feeb06330190fe87706d63c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 911ee8b8c2d52b4856aec8f8ea00a2ea3fa66b76c0f4a92542f368398102bba2
MD5 5300be1cec9d22f584522bda4e137ad7
SHA1 13e335a65a954161fd80ba1be86b96d540df2c65
SHA512 7c4e4ea29dbf60af839eb8498f084160e0799640d1bc250b3bf4336bf9c43ff496c69cd384fd9a5dcceec8e12d82f1c82be154dd2f902ef90fcfe6cde1e9aef3
MD5 SHA1 SHA512

Submit Download

svchost_ACCABAAABCAAAAAAACBBBBBBCCAAAACBABBCABACAABCABCCAAABBBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABAAABCAAAAAAACBBBBBBCCAAAACBABBCABACAABCABCCAAABBBB.exe
Size 19.5MB
SHA256 2c75ee5aaad11687033dbb8b8c94d82bd20e29959537a94efb7ebe410ede2541
MD5 b085170840825e4c7823c9a587e0f9f9
SHA1 b9f74f9a87036b7bb08407bd6921f80089bb0377
SHA512 2f7bd701c216ac206679be0765b6286550185b21d2775cf632495b61bfad9df02171d9908d24d537cb4ac4256e253939fc3dfee49ae9b93f74c52fa55d697a39
SSDEEP 49152:U+Eiiw2L+Eiiw2L+Eiiw2L+Eiiw2D/+Eiiw2L+Eiiw2L+Eiiw2L+Eiiw2D/+Eiiz:tOU/jIEeQfoR/IuOFVjUu5k
TLSH
T16427290977ED4854E5B3623489B28669D6B2BC518F32C7DF6284933E1F73AD0AC34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 583ddbcb48e65a5e422c47aedc0cac1fbfc3571ed1252a058a2050d8b579ce8b
MD5 bb183bbc2d76225d6b10e97948413da4
SHA1 ea83cbd006644a01f62bf362b0800f17ec37f62c
SHA512 134b03f0c5f59e550603dde65f724c9cb8132b4341f706a8c8fd87517f40b6c451f710925165022a4887780abe41351eff5517a8a9363e61771befd1466f0489
TLSH
T16B113A2190F5C863F43268CBB639DDC31DEC3B9F5E9CAA24230950187B86C318DA50F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 96835af4d043f8fd300ecd11b72e9bbf014abdb44c75c3a80edd517e5cec79ea
MD5 2d099321fbd2765d4f07a44bfb81c298
SHA1 59836bfb72f1fc552a0fbf61f05d6209d618b314
SHA512 d828697a41da689b5ff2e8a020f6aaecd73e6e31edd38e58bd3d7c025c28989b822b93eeb6241f90ec2682ddbc47e204bb79924db95081a04f9ee085dbe7628a
TLSH
T19911EB2190F5CC63F53268CBB639DDD31DA83B9F9E9CA914130D51187B96C318D950F1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2192-67-0x0000000000650000-0x0000000000671000-memory.dmp

Download

memory/2192-87-0x0000000000650000-0x0000000000671000-memory.dmp

Download

memory/4128-73-0x0000000000D80000-0x0000000000DA1000-memory.dmp

Download

memory/5920-32-0x0000000000D80000-0x0000000000DA1000-memory.dmp

Download

memory/5936-6-0x0000000000DB0000-0x0000000000DD1000-memory.dmp

Download