20246fc834038fd1c5e9fdf6a0abc806bd1256c90af228478664b600f97badb5

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/09/2026, 23:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_85cd1cf3419d79ea503952c1f9f825d9_amadey_darkgate_elex_stop.exe
Size 4.5MB
Sample260906-3hlx9sswb1
SHA256 20246fc834038fd1c5e9fdf6a0abc806bd1256c90af228478664b600f97badb5
MD5 85cd1cf3419d79ea503952c1f9f825d9
SHA1 ef302bdae627c2eaf5f8d00476be71d178849a5d
SHA512 2b0505bb64ae3b1683402745bababfe7120743458cd99e02fc997ea4aa1a13937efa5452e794e09d549d75927abc2892c0aea3f58baf807d6e921e6c108f56b7
SSDEEP 49152:U+E7+ES+Em+Es+E7+ES+E2+E7+ES+Em+Es+E7+ES+Em+Es+E7+ES+EQD+E7+ES+d:Zp73
TLSH
T1FB263C09F94340B1D92B50F04DCFD3BF8A60BB2586128DFBF74D8B5BA932BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1832	svchost_AACBCBCBCABBBBACCBAACCCCBBCCBAACBCCBBCBBABBABCBBBCCBACC.exe
1060	svchost_CAAABACCCAABBACABBCCCCBBCCABABABCBCCAAAACBBBCBBBAACCBCC.exe
2580	svchost_AACBCBCBCABBBBACCBAACCCCBBCCBAACBCCBBCBBABBABCBBBCCBACC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABCAACBCACBABBBAAAACAACAABACABAACAAAABBCBBCACACABABAABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACBCBCBCABBBBACCBAACCCCBBCCBAACBCCBBCBBABBABCBBBCCBACC.exe"	2026-09-06_85cd1cf3419d79ea503952c1f9f825d9_amadey_darkgate_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAABACBABCCBAABCABBAACCBBCAABCAAACCBAABBACBCCBACAACAABCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAAABACCCAABBACABBCCCCBBCCABABABCBCCAAAACBBBCBBBAACCBCC.exe"	svchost_AACBCBCBCABBBBACCBAACCCCBBCCBAACBCCBBCBBABBABCBBBCCBACC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1828	sc.exe
3120	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4488	cmd.exe
2796	cmd.exe
3976	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAAABACCCAABBACABBCCCCBBCCABABABCBCCAAAACBBBCBBBAACCBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_85cd1cf3419d79ea503952c1f9f825d9_amadey_darkgate_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACBCBCBCABBBBACCBAACCCCBBCCBAACBCCBBCBBABBABCBBBCCBACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3200	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3576	2026-09-06_85cd1cf3419d79ea503952c1f9f825d9_amadey_darkgate_elex_stop.exe
3576	2026-09-06_85cd1cf3419d79ea503952c1f9f825d9_amadey_darkgate_elex_stop.exe
3576	2026-09-06_85cd1cf3419d79ea503952c1f9f825d9_amadey_darkgate_elex_stop.exe
3576	2026-09-06_85cd1cf3419d79ea503952c1f9f825d9_amadey_darkgate_elex_stop.exe
1832	svchost_AACBCBCBCABBBBACCBAACCCCBBCCBAACBCCBBCBBABBABCBBBCCBACC.exe
1832	svchost_AACBCBCBCABBBBACCBAACCCCBBCCBAACBCCBBCBBABBABCBBBCCBACC.exe
1832	svchost_AACBCBCBCABBBBACCBAACCCCBBCCBAACBCCBBCBBABBABCBBBCCBACC.exe
1832	svchost_AACBCBCBCABBBBACCBAACCCCBBCCBAACBCCBBCBBABBABCBBBCCBACC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3576	2026-09-06_85cd1cf3419d79ea503952c1f9f825d9_amadey_darkgate_elex_stop.exe
Token: SeDebugPrivilege	1832	svchost_AACBCBCBCABBBBACCBAACCCCBBCCBAACBCCBBCBBABBABCBBBCCBACC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 4488	3576	2026-09-06_85cd1cf3419d79ea503952c1f9f825d9_amadey_darkgate_elex_stop.exe	92
PID 4488 wrote to memory of 3200	4488	cmd.exe	94
PID 1832 wrote to memory of 4940	1832	svchost_AACBCBCBCABBBBACCBAACCCCBBCCBAACBCCBBCBBABBABCBBBCCBACC.exe	95
PID 3576 wrote to memory of 2796	3576	2026-09-06_85cd1cf3419d79ea503952c1f9f825d9_amadey_darkgate_elex_stop.exe	98
PID 2796 wrote to memory of 1828	2796	cmd.exe	100
PID 3576 wrote to memory of 3976	3576	2026-09-06_85cd1cf3419d79ea503952c1f9f825d9_amadey_darkgate_elex_stop.exe	101
PID 3976 wrote to memory of 3120	3976	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-06_85cd1cf3419d79ea503952c1f9f825d9_amadey_darkgate_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_85cd1cf3419d79ea503952c1f9f825d9_amadey_darkgate_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCCBBCAABACABBACAACBACAAACCCACAACACBBCABBBABCBAACACBBACBACCBAABBAAACBCCBAABCBCACBCBBBABCBABACBBACCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBCBCBCABBBBACCBAACCCCBBCCBAACBCCBBCBBABBABCBBBCCBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCCBBCAABACABBACAACBACAAACCCACAACACBBCABBBABCBAACACBBACBACCBAABBAAACBCCBAABCBCACBCBBBABCBABACBBACCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBCBCBCABBBBACCBAACCCCBBCCBAACBCCBBCBBABBABCBBBCCBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3200
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACCCBCCBCACCCCABCCAAABBCBCBCCBBCACAACACAAACCBAACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBCBCBCABBBBACCBAACCCCBBCCBAACBCCBBCBBABBABCBBBCCBACC.exe" start= auto displayName= "UserDataSvc_CACCCBCCBCACCCCABCCAAABBCBCBCCBBCACAACACAAACCBAACCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACCCBCCBCACCCCABCCAAABBCBCBCCBBCACAACACAAACCBAACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBCBCBCABBBBACCBAACCCCBBCCBAACBCCBBCBBABBABCBBBCCBACC.exe" start= auto displayName= "UserDataSvc_CACCCBCCBCACCCCABCCAAABBCBCBCCBBCACAACACAAACCBAACCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACCCBCCBCACCCCABCCAAABBCBCBCCBBCACAACACAAACCBAACCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACCCBCCBCACCCCABCCAAABBCBCBCCBBCACAACACAAACCBAACCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3120

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBCBCBCABBBBACCBAACCCCBBCCBAACBCCBBCBBABBABCBBBCCBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBCBCBCABBBBACCBAACCCCBBCCBAACBCCBBCBBABBABCBBBCCBACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4940

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABACCCAABBACABBCCCCBBCCABABABCBCCAAAACBBBCBBBAACCBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABACCCAABBACABBCCCCBBCCABABABCBCCAAAACBBBCBBBAACCBCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1060

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBCBCBCABBBBACCBAACCCCBBCCBAACBCCBBCBBABBABCBBBCCBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBCBCBCABBBBACCBAACCCCBBCCBAACBCCBBCBBABBABCBBBCCBACC.exe
1⤵
- Executes dropped EXE
PID:2580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2c491363dd233cdb4dca22a39ad20dad8821a6e05c28b16c37ba97412e6db055
MD5 bda9dbc323340371f530314df844c9c3
SHA1 30431f5343b4fcd6339637e193fe6f477e4b77c0
SHA512 56b6b56b61e83dd29329496893eca191a1c3480af77cae7dac404d39357fd0aee33d9af6029f5a6f6ab81102f84fad9dcf9f6c0e762deec7d678450f50a56bb2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 45a60347b6532d29475ea15673a389222e94653abd58a4354e8a82ba353d3b5e
MD5 60025ac0a312ac2c45487d90d91f1ae0
SHA1 e86a73dab6b757e8da102d8170227067c597aeec
SHA512 a195c531dbc603a0d33da3a4d16d221a5e628c133af66ec3037836ebbc758359e28a9a5b0f7576e189a373229abfc16ca1a38baf361a384387bb13fc18f0f9c5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3f18fd8f7682faaefeecab836f38d82e2a651106ea52d4563565b6be939c0f1f
MD5 1b7076221e5b7884f26fc0a31b916233
SHA1 24cab8575782444bb0be549d0a12e4b92eb24311
SHA512 3560559c92976c372388d327c6d03989823ed6fec60c3e7a4180960c6455927b9ee0f740428f256688b4039a608b6e50dcfca626bab67da6ec1c198620603ec1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ad06a637488d09cca545fcdadcab4acd39ef35af3f744916553859735a2b114b
MD5 0d1694a5815296e386f561d6bf1cbf3f
SHA1 e7e157749896f0ecfc14715064aa847ed17388c5
SHA512 2c8ed5374089a9276b4eabb4923109febb3be90b43b4c5706f7a7a535e43c4c2448e6e3d0f6ac3f8be01c304f83ec07a52bbc33a1bd1cbad52511a28eb5282f5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 21e692fe74e96cd446682b6a719422899729c9eb3fb5024779318e0746968b03
MD5 7f8cb6d6aab4e7477a6e961129a20c9b
SHA1 2bd83505c7c034acd5707ea31110d5ada2a4ebb4
SHA512 11f294f0c5a79d3103f7f2f8ef8eab333b543f58d0b38096f410b1f0ae48bd7221171794c81b0de7dbfb4aeaab4b126099bc7f6465c033a9a38ff14af2f3da6e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c2cf09a72ea29be25f292579196831e65d671cc7de3d6a3d7013b45a6bc0eaf9
MD5 d636bb93035000ebb99b2f4d5d63049f
SHA1 bd445cbe04515b64a871f179e5a044f03626e24d
SHA512 0cd4fdc1bcc4d2cea2f408714ab4fc289de4458364e2617b847b4a688af8c2730a5a48cc4ee65588585fa09292696f0df3270320f5ec34346295a19ca89ed77b
MD5 SHA1 SHA512

Submit Download

PingSync.exe

Path C:\Users\Admin\Downloads\PingSync.exe
Size 14.2MB
SHA256 cec3f974155fcc587994ae7e9e7ecb5de1e9f2b8647f450ebfc61bbd779b6414
MD5 70bbc978c06aa380fc499c269d9aede6
SHA1 beb075d252fa93c8dfd6f333a76773c501550d4f
SHA512 9f89938e1918b3176abd0f20bae3f3252982b55fb7a61be5e09d724395fd49181e304a879fcf5c28085dadadaa5123babdf32cf59c9b2723f0c2ffaebce4a16f
SSDEEP 49152:U+E7+ES+Em+Es+E7+ES+E2+E7+ES+Em+Es+E7+ES+Em+Es+E7+ES+EQD+E7+ES+W:Zp7Jp7Jp79GIqjA2AI
TLSH
T171E64C09F94340B1D92B50F04DCFD3BF8A60BB2586128DFBF74D8B5BA932BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PingSync.exe

Path C:\Users\Admin\Downloads\PingSync.exe
Size 1.3MB
SHA256 4fea03fffd04e7dc835cfb4cdc1f219c042ec95741b057ad74cedb835bc8fb78
MD5 2abedf43accb1124ea625eba5f7babfa
SHA1 d078b08147e67ca98db59e58b04cb89c98ea03f3
SHA512 19ea5f963b25dfe0c725d8baaa5f2ae167ade92d51a5bb4b6598fec09bc73b14d60fd00c1935d3e1234fcf7c697073dbe8659d6ef64e10ba9b2723ac36b1d79a
SSDEEP 24576:m9+EM0v9+EM0q9+EM0qT9+EM0qH9+EM0v9+EM0q9+EM0qZ9+EM0v9+EM0q9+EM06:U+E7+ES+Em+Es+E7+ES+E2+E7+ES+EmP
TLSH
T10A551A09F94340B1D92B50F04DCFE3BF8A60BB2586128DF7FB4DCB5BA523BA16428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PingSync.exe

Path C:\Users\Admin\Downloads\PingSync.exe
Size 448KB
SHA256 f44c7d060a0414a9b296223cde3c0ca702083cebb46c383fa05a2c5b9dbb0fa4
MD5 7b7dcee8e7156ff66b93649fce45da33
SHA1 0ac14690622fa981ab9d737bdd103d1a7e0352ea
SHA512 cc7a0917d05cfb12801a72f0e516aee0347f3ff36de150208a9de112277d6fe46b138ea7b649adfa7551ab7b973db2dfdf1469295bcc9f75b21671d557be30a2
SSDEEP 12288:mgUFgEsnojAKgUFgEsnojA9gUFgEsnojA9gDigUFgEsnojA9gcA:m9+EM0v9+EM0q9+EM0qT9+EM0qHA
TLSH
T162A40909F94340B1DD2B50F04DCFE3BF8A60BB25C6128DF7FB4D8B5BA522BA16428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PingSync.exe

Path C:\Users\Admin\Downloads\PingSync.exe
Size 192KB
SHA256 e138601899a1a70f0b784da64138e0bbb89708f97b5b15f8c9f064ca5c4b9ef9
MD5 d684776a75dc53888e54efbd3f93a95a
SHA1 d82296b2789eb201d80a99bd3137af28e940d4a2
SHA512 660cc3029dc85335d875332ed33c02c9b967a4c9df024ceb0703a8c6e4723d3bdc4a26d1257b8d251a26a9133be9d9ac785a9a3330d56ecf018dba20fad900f6
SSDEEP 3072:PdtpUtI9vTTLoFpmEY13XojAdoyldtpUtI9vTTLoFpmEY13XojAdoNdtpUtI7:m+dTTUFgEs3XojAdI+dTTUFgEs3XojAg
TLSH
T13E141909F94340B1DD2B51B04CCFE3BF8A60BB2586128DF7FB4ECB5BA523BA16428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PingSync.exe

Path C:\Users\Admin\Downloads\PingSync.exe
Size 36.6MB
SHA256 ed845b41118956785a14aea7d7f343a5dd8e3de3205599a4a8fc4667dfc56640
MD5 ba4a8cd3bd34130fa716596901c59a4b
SHA1 4907f5b7e7c1b072df5e5c3f5b85aa473f0033cf
SHA512 e6f8b395235dfc4646347e8eaf687f35879b28bc3fa52c8c7d9ebd41d6d798f489904f2424acca9c65be0c201816dc7a9e83a237498316a8b54d29aec2bf1ecc
SSDEEP 98304:Zp7Jp7Jp7Jp7Jp7Jp7Jp7Jp79GIqjA2AE:/vvvvvvvEIqr
TLSH
T12A873C09F94340B1D92B50F04DCFD3BF8A60BB2586128DFBF74D8B5BA932BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PingSync.exe

Path C:\Users\Admin\Downloads\PingSync.exe
Size 512KB
SHA256 10165ac3a2fbada359fd26c6b9a9d49826db6d40147fd24cab4404667dfdf7ed
MD5 f37875403c381701edeac1133657ce5e
SHA1 052a6347d111f57139627798be456719297b0dd4
SHA512 f8be142577eab6309a65c904df26c768f5e6ea90c505aceeb297242107a2f269b7ac13411c85beb56bcb1902024045cddd61f9c4273f9f4c3c0697d0fc376875
SSDEEP 12288:mgUFgEsnojAKgUFgEsnojA9gUFgEsnojA9gDigUFgEsnojA9gcgUFgEsnojAT:m9+EM0v9+EM0q9+EM0qT9+EM0qH9+EMp
TLSH
T138B41909F94340B1D92B50F04DCFE3BF8A60BB2586128EF7FB4DCB5BA523B616428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PingSync.exe

Path C:\Users\Admin\Downloads\PingSync.exe
Size 45.5MB
SHA256 65ae3a6530d67bed9784835e5e90b5b9959f8a8f241fddbc0048a85bef24d1ee
MD5 6d3dafe1d7cd6b0a56231f3446bd824d
SHA1 762bb2cab42f8a9d392a81abb0e747d39b12de93
SHA512 bc13d0e2f5f12be04e8b318be6df0d312b6ad37440363af5ce86c4774f75c893a80b89eb6f3de40a32446f3c87011fd237d1b1604a683db69e833a4e7bd50dac
SSDEEP 98304:Zp7Jp7Jp7Jp7Jp7Jp7Jp7Jp7Jp7Jp79GIqjA2Aa:/vvvvvvvvvEIqR
TLSH
T159A73C09F94340B1D92B50F04DCFD3BF8A60BB2586128DFBF74D8B5BA932BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_AACBCBCBCABBBBACCBAACCCCBBCCBAACBCCBBCBBABBABCBBBCCBACC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBCBCBCABBBBACCBAACCCCBBCCBAACBCCBBCBBABBABCBBBCCBACC.exe
Size 4.5MB
SHA256 20246fc834038fd1c5e9fdf6a0abc806bd1256c90af228478664b600f97badb5
MD5 85cd1cf3419d79ea503952c1f9f825d9
SHA1 ef302bdae627c2eaf5f8d00476be71d178849a5d
SHA512 2b0505bb64ae3b1683402745bababfe7120743458cd99e02fc997ea4aa1a13937efa5452e794e09d549d75927abc2892c0aea3f58baf807d6e921e6c108f56b7
SSDEEP 49152:U+E7+ES+Em+Es+E7+ES+E2+E7+ES+Em+Es+E7+ES+Em+Es+E7+ES+EQD+E7+ES+d:Zp73
TLSH
T1FB263C09F94340B1D92B50F04DCFD3BF8A60BB2586128DFBF74D8B5BA932BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1060-85-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/1832-70-0x0000000000650000-0x0000000000671000-memory.dmp

Download

memory/1832-48-0x0000000000650000-0x0000000000671000-memory.dmp

Download

memory/1832-94-0x0000000000650000-0x0000000000671000-memory.dmp

Download

memory/3576-71-0x00000000007F0000-0x0000000000811000-memory.dmp

Download

memory/3576-0-0x00000000007F0000-0x0000000000811000-memory.dmp

Download

memory/3576-49-0x00000000007F0000-0x0000000000811000-memory.dmp

Download

memory/3576-23-0x00000000007F0000-0x0000000000811000-memory.dmp

Download

memory/3576-12-0x00000000007F0000-0x0000000000811000-memory.dmp

Download