c583a8920f7950f92648042d14ce5a0172cd0abb6346862f92ae32acef5be388

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_780d42c420a92f1d2a26fbc28b52d114_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Size 9.5MB
Sample260828-rbfbcsdb65
SHA256 c583a8920f7950f92648042d14ce5a0172cd0abb6346862f92ae32acef5be388
MD5 780d42c420a92f1d2a26fbc28b52d114
SHA1 6d9a45d73095e040c2c29be77db7b4a4539001c2
SHA512 c4ef6f418a6a6605153dbcaf3f978b3e2dfe0138ff129518e02b9c0f45454fdaebc1e7418884815e66acbd068c8912fc59f7468e234799fa719a142a948b2719
SSDEEP 49152:U+Es+E7+ES+EQHiw2J+Es+E7+ES+EQHiw2J+Es+E7+ES+EQHiw2J+Es+E7+ES+EB:FOU/jIEeQfoR/IuOFVjUu5u
TLSH
T181A65C05F6DA4471E87761704DA7C27A8A71B9618732CADFF28C862E5F33BD09834B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4496	svchost_AAACCBACBABCBBACACCBBAABBCAAAABACCAACBBCABCACBBAAABAAAB.exe
3180	svchost_BBCAACAACBBACCBCACABAABBCCAAAAACCCCBBABAABACBBCBACCBBCB.exe
3384	svchost_AAACCBACBABCBBACACCBBAABBCAAAABACCAACBBCABCACBBAAABAAAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABCACCBACCABABBAABBBBCAABACACBCCAAAAABBCAACCAACACCACAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAACCBACBABCBBACACCBBAABBCAAAABACCAACBBCABCACBBAAABAAAB.exe"	2026-08-28_780d42c420a92f1d2a26fbc28b52d114_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAABBABCCCACBCCACAACACABBACBABBAAAABBBAACACCABACCBBBBAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCAACAACBBACCBCACABAABBCCAAAAACCCCBBABAABACBBCBACCBBCB.exe"	svchost_AAACCBACBABCBBACACCBBAABBCAAAABACCAACBBCABCACBBAAABAAAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5876	sc.exe
920	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
996	cmd.exe
4284	cmd.exe
6008	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACCBACBABCBBACACCBBAABBCAAAABACCAACBBCABCACBBAAABAAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCAACAACBBACCBCACABAABBCCAAAAACCCCBBABAABACBBCBACCBBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-28_780d42c420a92f1d2a26fbc28b52d114_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6604	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1572	2026-08-28_780d42c420a92f1d2a26fbc28b52d114_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
1572	2026-08-28_780d42c420a92f1d2a26fbc28b52d114_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
1572	2026-08-28_780d42c420a92f1d2a26fbc28b52d114_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
1572	2026-08-28_780d42c420a92f1d2a26fbc28b52d114_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
4496	svchost_AAACCBACBABCBBACACCBBAABBCAAAABACCAACBBCABCACBBAAABAAAB.exe
4496	svchost_AAACCBACBABCBBACACCBBAABBCAAAABACCAACBBCABCACBBAAABAAAB.exe
4496	svchost_AAACCBACBABCBBACACCBBAABBCAAAABACCAACBBCABCACBBAAABAAAB.exe
4496	svchost_AAACCBACBABCBBACACCBBAABBCAAAABACCAACBBCABCACBBAAABAAAB.exe
3384	svchost_AAACCBACBABCBBACACCBBAABBCAAAABACCAACBBCABCACBBAAABAAAB.exe
3384	svchost_AAACCBACBABCBBACACCBBAABBCAAAABACCAACBBCABCACBBAAABAAAB.exe
3180	svchost_BBCAACAACBBACCBCACABAABBCCAAAAACCCCBBABAABACBBCBACCBBCB.exe
3180	svchost_BBCAACAACBBACCBCACABAABBCCAAAAACCCCBBABAABACBBCBACCBBCB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1572	2026-08-28_780d42c420a92f1d2a26fbc28b52d114_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Token: SeDebugPrivilege	4496	svchost_AAACCBACBABCBBACACCBBAABBCAAAABACCAACBBCABCACBBAAABAAAB.exe
Token: SeDebugPrivilege	3384	svchost_AAACCBACBABCBBACACCBBAABBCAAAABACCAACBBCABCACBBAAABAAAB.exe
Token: SeDebugPrivilege	3180	svchost_BBCAACAACBBACCBCACABAABBCCAAAAACCCCBBABAABACBBCBACCBBCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 4284	1572	2026-08-28_780d42c420a92f1d2a26fbc28b52d114_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	93
PID 4284 wrote to memory of 6604	4284	cmd.exe	95
PID 4496 wrote to memory of 4492	4496	svchost_AAACCBACBABCBBACACCBBAABBCAAAABACCAACBBCABCACBBAAABAAAB.exe	96
PID 1572 wrote to memory of 6008	1572	2026-08-28_780d42c420a92f1d2a26fbc28b52d114_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	99
PID 6008 wrote to memory of 920	6008	cmd.exe	101
PID 1572 wrote to memory of 996	1572	2026-08-28_780d42c420a92f1d2a26fbc28b52d114_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	102
PID 996 wrote to memory of 5876	996	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-08-28_780d42c420a92f1d2a26fbc28b52d114_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_780d42c420a92f1d2a26fbc28b52d114_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCCCCABCACBCBCCCCBCCABACCCCBBCCCBACAACAABCCBABCABBACCAACAABAACBCCBABBCBCABABBBABACACCACABCBBABBCBCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCBACBABCBBACACCBBAABBCAAAABACCAACBBCABCACBBAAABAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCCCCABCACBCBCCCCBCCABACCCCBBCCCBACAACAABCCBABCABBACCAACAABAACBCCBABBCBCABABBBABACACCACABCBBABBCBCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCBACBABCBBACACCBBAABBCAAAABACCAACBBCABCACBBAAABAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCCABBCBBCABCBCAAACCACBBACBABACACBBCCBABBCBACCBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCBACBABCBBACACCBBAABBCAAAABACCAACBBCABCACBBAAABAAAB.exe" start= auto displayName= "UserDataSvc_CBCCABBCBBCABCBCAAACCACBBACBABACACBBCCBABBCBACCBCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6008
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCCABBCBBCABCBCAAACCACBBACBABACACBBCCBABBCBACCBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCBACBABCBBACACCBBAABBCAAAABACCAACBBCABCACBBAAABAAAB.exe" start= auto displayName= "UserDataSvc_CBCCABBCBBCABCBCAAACCACBBACBABACACBBCCBABBCBACCBCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCCABBCBBCABCBCAAACCACBBACBABACACBBCCBABBCBACCBCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCCABBCBBCABCBCAAACCACBBACBABACACBBCCBABBCBACCBCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5876

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCBACBABCBBACACCBBAABBCAAAABACCAACBBCABCACBBAAABAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCBACBABCBBACACCBBAABBCAAAABACCAACBBCABCACBBAAABAAAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4492

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACAACBBACCBCACABAABBCCAAAAACCCCBBABAABACBBCBACCBBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACAACBBACCBCACABAABBCCAAAAACCCCBBABAABACBBCBACCBBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3180

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCBACBABCBBACACCBBAABBCAAAABACCAACBBCABCACBBAAABAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCBACBABCBBACACCBBAABBCAAAABACCAACBBCABCACBBAAABAAAB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 559706b43ac1ad93b0efecc01ab413ed042b81f338e1231b0abf6e6fa22141f4
MD5 ae20cd4f995f99298d4c83b617ff01f6
SHA1 bad1ead9a0269774f220b02f0b9514e776ce62df
SHA512 6b032dcd1d01c53fda29fc27acaebaa49522aecb2390e4a4e7f06a49edb24598a1a8f41c2430dfa30489db11e4a7ad1f316f3775f041b67dc526ee2ccda420d2
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 10.1MB
SHA256 984f7278662b27fe22f3523293b9d630910ecf11524426c9eef47a8a519d62aa
MD5 924cb4ebe0232ef8883bec4dbcb3b530
SHA1 01bd1793319e4cb846ec3efdcd26d8df8a29f757
SHA512 b412a52e16369f22f3fef0bae3a9b72b00e93ecd78bec43374b80de113f6717c5632aebfd3f7ac967e49e8c6141e6878cd7607905caf4fddd35042a618095e31
SSDEEP 98304:FOU/jIEeQfoR/IuOFVjUu5xgZ2Hb9t+2x2:FFIF0wuvgZ2j2
TLSH
T133B67D05F6DA4471E4B721704DA7C27A8A71B9618731CAEFF28C862E5F33BD09934B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\qap`g`v~dtlq
Size 10B
SHA256 cd13841de87e006d4b2b5337b2631c3ac185ee70d229de9ebf4f2e78f07fb6d4
MD5 15389a99131d241d75f3c96884b55d17
SHA1 5eaecac45625d24ee768ca32bfbbbc1ef3c34fb3
SHA512 cd01147ac87f9cc172530f43dcb936966f5ab0b5888b29d181a810c9e06fc6545fc6f7a7c1248f9dc3af0d634cea6f361bdf52767101939c5b31c33092ec041b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\pl\qap`g`v~dtlq
Size 10B
SHA256 cd9755ef8cd0c05b80b3f9ed926038cba0ad37275d216ae6aa1fa15038abe88a
MD5 76435cc8fd6f9e45a799d7ea1d5a4107
SHA1 0970dd91a0ab0650ba625e56ebcb7368666fd2a8
SHA512 a03d5289a99c5dd0998e5e850d8b04100a14c163c782bc8dfe0a83095851270e06ce06e3a934cce7cbca3964864ea0438c2e12ba33f8137639e251dc1bc66911
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 673469a9b75a6af9e87de70a1c98214d9f819e4a4e1c012876e4a50c13494287
MD5 3360799fdcf18bad2af92784a36dd903
SHA1 56d18ec915e2a71720794bd75cb1374db5d35034
SHA512 4cb2428fc192ddc4366b5f246f72824e3706ecc6f0698a0622acfbf92a7ce282c8d2e8ae735fb3ce82d39a98532640fd1bd1c37e1741465e920c3572a7ce4c76
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 717ae2f480b801a518390eaeea849c45511fbfbf206abf0dcdfe4c6032254881
MD5 90a1df4a4a5321a7d907f7f5068f6df0
SHA1 7458d5d70d4e8ef9bdf22453221eea99650f29ee
SHA512 a2fbaa6b5fa69e365f83b43c7a4c4c007887ac814e7e911b5fda6ae869fdd7e7834650825011d55c1f9a772b421326324bcbaea42169ec8444b7b6c27a4964b4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ee64955de98116735fb9a27926d7b7614314b928b8e2687ed1778af8f339a37f
MD5 5d3e5795c6e90c440dfd8bfa25e6e9d5
SHA1 bcbb6eb7a3e16fc16d790ba4c99fb74d8ce75da0
SHA512 ed88e67f63eb201347d14d2dbdcb09022c61e2b673faa23ca5c3050d8c4a7b3b1d342db7c7a7d054036bd34618bd2b327316d80fa97d916c2f39ef396f39807e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bdbd7065d698dae4f1956b3e8f61349636ae3a2ff45ba45052536943cceeb5f3
MD5 cb235893a7c3236a9bee9fee28e85aa7
SHA1 a18cbd406260a7d948a6e6e8ca9cdfd4a7030344
SHA512 7ef10cb9ffb352275ba7b4d9ce2867f4916e7a4e245cf16616363afc837f38cb246de19eeaf800b3908e2c7ecbbb9e986151d945e7f7e6193d6e86e56f32f524
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f4927469efb43b21de010c7e233cdcb96b145b93f040d6e9813b69544725397c
MD5 164a87560f84ef7cfd0c2649fbe642b8
SHA1 4778f7a9ebbbe0031c45bf8704d8410018263b93
SHA512 767e122934bbe07f27c99b08652b3ba8e4b5850d69697e4a7b8a1880b2d03bed70e7911e41f4481eed9c754a7fc1740d39652c95e844ac7dc7b270bf6c20974d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 76874f13e5dcd3e2322d252e255863fbcdce0007a3260f05af596ef9a7af8040
MD5 24d97ba02848c56fe93bc383f058dc54
SHA1 c24842e3015f0049ca4912d64268842d6500e41a
SHA512 559c8ff210973cef56f265995e8b00e80086d9d2d63f1ef4537cae2e15e3cc5a1222cfd386058bc6c60c70cc309a91271f73f901f73e93c71b109ee49424ac36
MD5 SHA1 SHA512

Submit Download

svchost_AAACCBACBABCBBACACCBBAABBCAAAABACCAACBBCABCACBBAAABAAAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCBACBABCBBACACCBBAABBCAAAABACCAACBBCABCACBBAAABAAAB.exe
Size 9.5MB
SHA256 c583a8920f7950f92648042d14ce5a0172cd0abb6346862f92ae32acef5be388
MD5 780d42c420a92f1d2a26fbc28b52d114
SHA1 6d9a45d73095e040c2c29be77db7b4a4539001c2
SHA512 c4ef6f418a6a6605153dbcaf3f978b3e2dfe0138ff129518e02b9c0f45454fdaebc1e7418884815e66acbd068c8912fc59f7468e234799fa719a142a948b2719
SSDEEP 49152:U+Es+E7+ES+EQHiw2J+Es+E7+ES+EQHiw2J+Es+E7+ES+EQHiw2J+Es+E7+ES+EB:FOU/jIEeQfoR/IuOFVjUu5u
TLSH
T181A65C05F6DA4471E87761704DA7C27A8A71B9618732CADFF28C862E5F33BD09834B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 b96e7ae65fcc39e1db2c78dae380613e2a09b0446f811b1d07fe9dc70e69e3ad
MD5 11175e0c62ea502afbf43d7a1216fc39
SHA1 4aed80d93d05b5cadc74dc82c92e1acef25ca9c7
SHA512 c553e1f63ad929494014f61daf3078cbe6931865904e49e260720a207b14d7553d5e9e114610ea6f94ededbd3be1ba7881ff941a7e1481c9de9aee0e45ee2ffd
TLSH
T1A7212B62F9F59C13F53368C78325AB873CE0365BAC9C6A592348C218B7D5831CE995F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 776B
SHA256 fd65365e9d6e2a1f04cc1872a73b1e49a4ec4bacc2cbce5c0e107ddaf2ed1419
MD5 b835374f080135df1c91eed9c38ee502
SHA1 770c8c57bf3d86b3b7f7fcff03b21ccd8205499c
SHA512 3c4084e7d4393d9b4ef43087db8cbe64eba6f986e5db80a3cb73e342e560b13b8d9670778b9d0e477b88edb74d019cc5f540230d63a3c79bac67a6b356ca8ac1
TLSH
T145012D52B5F9DC13F53368C682256F473CD0365BACDC6E492388821CB7E48358E995F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1572-0-0x0000000000E20000-0x0000000000E41000-memory.dmp

Download

memory/1572-7-0x0000000000E20000-0x0000000000E41000-memory.dmp

Download

memory/3180-64-0x0000000000EF0000-0x0000000000F11000-memory.dmp

Download

memory/3384-75-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/4496-33-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download