6c68225d3a5d16de24f9059120141819498c5b973b260dbe249bd64bf210089b

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_cb99a2b365fa30dc8ee656745f897eaf_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Size 18.6MB
Sample260910-c7grqseg77
SHA256 6c68225d3a5d16de24f9059120141819498c5b973b260dbe249bd64bf210089b
MD5 cb99a2b365fa30dc8ee656745f897eaf
SHA1 7695dc6ac3e7630e45eee6e3474c4a713e880a3d
SHA512 285c2ee50b9e133335e8a91bb2379aa8a66391716e91d73fcbf0d9f522ae2a7e06c09736db19bc5eba489eb8c4ed4763bfa029a82e878dfddb8ab20d0ad6dffd
SSDEEP 98304:/KRuy5aaKRuy5aaKRuy5aaKRuy5aaKRuy5aaKRuy5aaKRuy5aaKRuy5aaKRuy5ae:/q7q7q7q7q7q7q7q7q4KWQc0gEYnvLg
TLSH
T1BE17BF02F68600B1E9B72570099BE37A997DBF2047318DDFD3885A3F5A32AD0593875B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2548	svchost_BCBCCBABBCBAACABBBACBBBCBACAAAABAAACACCABACACABCCCCBCAC.exe
3580	svchost_BBBACBAABBBCBBCBCCCACCBBBCBBBBAACCACABBACCCCBCBCCCAACCA.exe
2816	svchost_BCBCCBABBCBAACABBBACBBBCBACAAAABAAACACCABACACABCCCCBCAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABCBABABACCBCBACACBAACCBBBACCCCCCABBCABAABACAACABBBBCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBCCBABBCBAACABBBACBBBCBACAAAABAAACACCABACACABCCCCBCAC.exe"	2026-09-08_cb99a2b365fa30dc8ee656745f897eaf_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBACBBCAABBCBBBBBAAACCBABBACBABBBACBBCCABBABAACACCBCBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBACBAABBBCBBCBCCCACCBBBCBBBBAACCACABBACCCCBCBCCCAACCA.exe"	svchost_BCBCCBABBCBAACABBBACBBBCBACAAAABAAACACCABACACABCCCCBCAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5208	sc.exe
4508	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1288	cmd.exe
1204	cmd.exe
4912	cmd.exe
4284	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_cb99a2b365fa30dc8ee656745f897eaf_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBACBAABBBCBBCBCCCACCBBBCBBBBAACCACABBACCCCBCBCCCAACCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBCCBABBCBAACABBBACBBBCBACAAAABAAACACCABACACABCCCCBCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2144	schtasks.exe
5276	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4212	2026-09-08_cb99a2b365fa30dc8ee656745f897eaf_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
4212	2026-09-08_cb99a2b365fa30dc8ee656745f897eaf_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
4212	2026-09-08_cb99a2b365fa30dc8ee656745f897eaf_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
4212	2026-09-08_cb99a2b365fa30dc8ee656745f897eaf_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
2548	svchost_BCBCCBABBCBAACABBBACBBBCBACAAAABAAACACCABACACABCCCCBCAC.exe
2548	svchost_BCBCCBABBCBAACABBBACBBBCBACAAAABAAACACCABACACABCCCCBCAC.exe
2548	svchost_BCBCCBABBCBAACABBBACBBBCBACAAAABAAACACCABACACABCCCCBCAC.exe
2548	svchost_BCBCCBABBCBAACABBBACBBBCBACAAAABAAACACCABACACABCCCCBCAC.exe
3580	svchost_BBBACBAABBBCBBCBCCCACCBBBCBBBBAACCACABBACCCCBCBCCCAACCA.exe
3580	svchost_BBBACBAABBBCBBCBCCCACCBBBCBBBBAACCACABBACCCCBCBCCCAACCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4212	2026-09-08_cb99a2b365fa30dc8ee656745f897eaf_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Token: SeDebugPrivilege	2548	svchost_BCBCCBABBCBAACABBBACBBBCBACAAAABAAACACCABACACABCCCCBCAC.exe
Token: SeDebugPrivilege	3580	svchost_BBBACBAABBBCBBCBCCCACCBBBCBBBBAACCACABBACCCCBCBCCCAACCA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 1204	4212	2026-09-08_cb99a2b365fa30dc8ee656745f897eaf_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	92
PID 1204 wrote to memory of 2144	1204	cmd.exe	94
PID 2548 wrote to memory of 3252	2548	svchost_BCBCCBABBCBAACABBBACBBBCBACAAAABAAACACCABACACABCCCCBCAC.exe	95
PID 4212 wrote to memory of 4912	4212	2026-09-08_cb99a2b365fa30dc8ee656745f897eaf_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	98
PID 4912 wrote to memory of 5208	4912	cmd.exe	100
PID 4212 wrote to memory of 4284	4212	2026-09-08_cb99a2b365fa30dc8ee656745f897eaf_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	101
PID 4284 wrote to memory of 4508	4284	cmd.exe	103
PID 2548 wrote to memory of 1288	2548	svchost_BCBCCBABBCBAACABBBACBBBCBACAAAABAAACACCABACACABCCCCBCAC.exe	105
PID 1288 wrote to memory of 5276	1288	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-08_cb99a2b365fa30dc8ee656745f897eaf_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_cb99a2b365fa30dc8ee656745f897eaf_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCBCCBCBBBAABAACBACABBBCABCBAAACBACBAABCCBAAABCABBBCCCABBBBAABCCABCABAACBBCAABCCACAACCAABAABCABABBBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCBABBCBAACABBBACBBBCBACAAAABAAACACCABACACABCCCCBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1204
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCBCCBCBBBAABAACBACABBBCABCBAAACBACBAABCCBAAABCABBBCCCABBBBAABCCABCABAACBBCAABCCACAACCAABAABCABABBBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCBABBCBAACABBBACBBBCBACAAAABAAACACCABACACABCCCCBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2144
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABAAACBBCBAABCBCBABCCBCCACBBACACCAACBCAABCACACACBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCBABBCBAACABBBACBBBCBACAAAABAAACACCABACACABCCCCBCAC.exe" start= auto displayName= "UserDataSvc_ABAAACBBCBAABCBCBABCCBCCACBBACACCAACBCAABCACACACBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABAAACBBCBAABCBCBABCCBCCACBBACACCAACBCAABCACACACBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCBABBCBAACABBBACBBBCBACAAAABAAACACCABACACABCCCCBCAC.exe" start= auto displayName= "UserDataSvc_ABAAACBBCBAABCBCBABCCBCCACBBACACCAACBCAABCACACACBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABAAACBBCBAABCBCBABCCBCCACBBACACCAACBCAABCACACACBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABAAACBBCBAABCBCBABCCBCCACBBACACCAACBCAABCACACACBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4508

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCBABBCBAACABBBACBBBCBACAAAABAAACACCABACACABCCCCBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCBABBCBAACABBBACBBBCBACAAAABAAACACCABACACABCCCCBCAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABACCCBAACACACBAACBBCACCABBBAABBCBBCABCCBBBCCAACAAAABAACACBBCBBBBAAACCCBBBABCCACCABCAAAABACCBBACCBACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACBAABBBCBBCBCCCACCBBBCBBBBAACCACABBACCCCBCBCCCAACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1288
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABACCCBAACACACBAACBBCACCABBBAABBCBBCABCCBBBCCAACAAAABAACACBBCBBBBAAACCCBBBABCCACCABCAAAABACCBBACCBACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACBAABBBCBBCBCCCACCBBBCBBBBAACCACABBACCCCBCBCCCAACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5276

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACBAABBBCBBCBCCCACCBBBCBBBBAACCACABBACCCCBCBCCCAACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACBAABBBCBBCBCCCACCBBBCBBBBAACCACABBACCCCBCBCCCAACCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3580

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCBABBCBAACABBBACBBBCBACAAAABAAACACCABACACABCCCCBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCBABBCBAACABBBACBBBCBACAAAABAAACACCABACACABCCCCBCAC.exe
1⤵
- Executes dropped EXE
PID:2816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e8d2ebd2b064394868012d609aad9c6019b0686d81c506e96aa51d0c3af2f1d7
MD5 87669f8a74556e8d15dd51dc39ebefad
SHA1 c310b4b8776df1813e506b8b8a2e98d2866afaf1
SHA512 68ddb5b66b489fecd19ad83a62c3ac0d7c755d6e06a0a2167f051c7a8c651dbcc817aee59ee631ed8ca9e7e663723836eb9cf75e74e188c81e15b5a65a446f3e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a25104e8642548cd10d480b5417cd6d586c681e196b44a7d7079c6a24219f226
MD5 c0f15e10517ec0259087bb39bcc55cb1
SHA1 5d5fc74daf54042dd16f0f2c3d9212713a528000
SHA512 c71a822c03660a4ae680a6a253e4a922e50042773d06ee3c290cc9e1353bcff13ea90f14589ac881a41e01d2f04ebd66a84d24ecf30b1933383653e1e0ac3e94
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 19a7176285606401888721c4c87439f752fd5a003385114b0af6c79bbd8661ca
MD5 c9456c4625cb80b78ecfd65aade351a1
SHA1 3a4e7e040fd3bf843a4d29a00e8b406d7c8d2706
SHA512 96607bf78417b4219e3c8bf8331af8d05a85995750fd67d682ccbcf3a3a8b16b963794dfbb21f9ecdcaeb2a20d32f4aa069fc73af51c53752ed60042c24581cb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8661ccff3b81c1ae7a2b144c5695251c2aa554fe34ecbbe9a2dbd04072e46732
MD5 dbfd6d8e890565f1d68de81dce597076
SHA1 47cf65ac2801a89b10f1e298a3419e90d3f2cd3a
SHA512 3bde32e645a67d0e37abff55c8cded46536c320e77cfe3719d9761d4d1733c71c67a9b5837cb10d8b9c13321bdcaa2567dcf4c629b821622f50e962fede35dfc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 78078de0810e037ab4096b3c6a162b0576d7d29aa89f07b3d24b23855402d1ee
MD5 5de4235cbfd167f0e42f5d29fe284921
SHA1 2f4219a22d2c1ff52acc4ff471b16acc67f2cf43
SHA512 9ee7b221bef431e1185124de149c5a31aee42821c474b65fd9aec071eca2fc031818168ba80d0285d8e64a5c2ff590c1a6f722a9e856d5b928d35169e58481a6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 78374f90fdd789d62501e6e86211a1e0c680b2035fd9069696b3da7d8634256f
MD5 a654197ee4df6bfd6b352d8a4557407a
SHA1 04b19ec0cf841e91f1c671432e7fecbfbc58f617
SHA512 b11f07e9003f8ca38643f48e2f20e9b0c690dd91c0aa53e039bafa239c05ea6b6a522fce888976412bbc2087c7b03a992a756878edf3592c783d6fe129e88c5f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d3fdaa1cf7eae67bf77f371016b9677aac540841918f1d1f355ec20fc9701aaa
MD5 7e59635e344f4cab71baedf3cedcd680
SHA1 a60684acf67396ec2cfdc2aacc87a835db8a040b
SHA512 46f14ab806c1b4cf576003f02b5ea2f620cfe488ed76314a045e64e64d461fde6a3c349d27d5b5223d8d54acb6c275c656c81758c18294aa2e40568b46ba9c36
MD5 SHA1 SHA512

Submit Download

svchost_BCBCCBABBCBAACABBBACBBBCBACAAAABAAACACCABACACABCCCCBCAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCBABBCBAACABBBACBBBCBACAAAABAAACACCABACACABCCCCBCAC.exe
Size 18.6MB
SHA256 6c68225d3a5d16de24f9059120141819498c5b973b260dbe249bd64bf210089b
MD5 cb99a2b365fa30dc8ee656745f897eaf
SHA1 7695dc6ac3e7630e45eee6e3474c4a713e880a3d
SHA512 285c2ee50b9e133335e8a91bb2379aa8a66391716e91d73fcbf0d9f522ae2a7e06c09736db19bc5eba489eb8c4ed4763bfa029a82e878dfddb8ab20d0ad6dffd
SSDEEP 98304:/KRuy5aaKRuy5aaKRuy5aaKRuy5aaKRuy5aaKRuy5aaKRuy5aaKRuy5aaKRuy5ae:/q7q7q7q7q7q7q7q7q4KWQc0gEYnvLg
TLSH
T1BE17BF02F68600B1E9B72570099BE37A997DBF2047318DDFD3885A3F5A32AD0593875B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 846b63086354dfe0343b338aa5f8dcfd5ebdd325c4fe1534ddbdbe9001d309ba
MD5 6656b05fda436f02c828eb199a7ce97a
SHA1 0f99efb001f4eb327d3f1cca9adce53d1c389756
SHA512 5aa74a8a39e28cd61279edcc6836344710e6858c2118491fd1e2ce06ddcbf87e1a186db5bd8f978ffa11e66c8e0a4f66b117cee870d4714563fbb46f4a8730ad
TLSH
T13511A340F0B5DC67F031A8DB4B299BE60CE8375FAC58AF5422088219FB29C35DD194E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 04f805437c864e270d4502d4bedd30afc2f6ff9b1f0ab2a908a0e3228b673d08
MD5 d8c0e2d85bec0268b8f9e94b25d35172
SHA1 88e26e8d578cb27ef6f88b1147f602150b975182
SHA512 d2bd1bc49b799f24a13bfdafb38540ef53602085dc82cac789d6ef1e3de1ba8bff9865d5e7b0a1141b80b8a128a926f580ed38a37b1071224c90f1ce43df0aaa
TLSH
T137119011F0B5DC67F032A8CB5F29ABE60CE8375FEC58AF4422088218EB69C35CD194E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2548-32-0x0000000000210000-0x0000000000231000-memory.dmp

Download

memory/2816-82-0x0000000000210000-0x0000000000231000-memory.dmp

Download

memory/3580-63-0x00000000003E0000-0x0000000000401000-memory.dmp

Download

memory/3580-87-0x00000000003E0000-0x0000000000401000-memory.dmp

Download

memory/4212-6-0x00000000005E0000-0x0000000000601000-memory.dmp

Download