d4ffa65a040f6c610ef1020940d4304c36a97905b923e0118562ffc81226a5ab

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 02:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_52452063b82f6b0021565ed68a2a0f45_darkgate_elex_stop.exe
Size 7.7MB
Sample260810-c4mhtadf72
SHA256 d4ffa65a040f6c610ef1020940d4304c36a97905b923e0118562ffc81226a5ab
MD5 52452063b82f6b0021565ed68a2a0f45
SHA1 8a54ef60d6f2f67c828f7e13aea9ef03f9032b71
SHA512 0f1893d9bc069ce3bcfc8afe26097b4a566affb8cf3f7c19c926a80620054ebd9294b38ec98e5dcddf896ca12d0690bce9a6d97a7d034a839c109a1b55d642eb
SSDEEP 98304:Jp7Dp7Dp7Dp7Dp7Dp7/KRuy5a2p7Dp7Dp7Dp7Dp7Dp7/KRuy5a8:vBBBBB/q/BBBBB/qn
TLSH
T14A868D11B7C18035F5B329724ABFE339597DB9214F6885CFE3880A2E5E71AD0A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4488	svchost_CCCBAABACBBBBBCABAAAACBACCABACBCCACBAABCABCCBBCBABCBBAC.exe
1488	svchost_CCCBAABACBBBBBCABAAAACBACCABACBCCACBAABCABCCBBCBABCBBAC.exe
1416	svchost_BBAACABBAAABCAAABBAACBABCCACACCACCCAAACBBBBBABACBCCCBBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCBBABCACBCCBBBCACCBACAABCCCCBCACACCCBCBCBAACBCBCABABBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCBAABACBBBBBCABAAAACBACCABACBCCACBAABCABCCBBCBABCBBAC.exe"	2026-08-10_52452063b82f6b0021565ed68a2a0f45_darkgate_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBABCCACBAACCABBCABBACABBCBCCBAACACAABCAABBCBCABACACCBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBAACABBAAABCAAABBAACBABCCACACCACCCAAACBBBBBABACBCCCBBB.exe"	svchost_CCCBAABACBBBBBCABAAAACBACCABACBCCACBAABCABCCBBCBABCBBAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2120	sc.exe
1064	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4904	cmd.exe
4868	cmd.exe
3272	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_52452063b82f6b0021565ed68a2a0f45_darkgate_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCBAABACBBBBBCABAAAACBACCABACBCCACBAABCABCCBBCBABCBBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBAACABBAAABCAAABBAACBABCCACACCACCCAAACBBBBBABACBCCCBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1528	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4372	2026-08-10_52452063b82f6b0021565ed68a2a0f45_darkgate_elex_stop.exe
4372	2026-08-10_52452063b82f6b0021565ed68a2a0f45_darkgate_elex_stop.exe
4372	2026-08-10_52452063b82f6b0021565ed68a2a0f45_darkgate_elex_stop.exe
4372	2026-08-10_52452063b82f6b0021565ed68a2a0f45_darkgate_elex_stop.exe
4488	svchost_CCCBAABACBBBBBCABAAAACBACCABACBCCACBAABCABCCBBCBABCBBAC.exe
4488	svchost_CCCBAABACBBBBBCABAAAACBACCABACBCCACBAABCABCCBBCBABCBBAC.exe
4488	svchost_CCCBAABACBBBBBCABAAAACBACCABACBCCACBAABCABCCBBCBABCBBAC.exe
4488	svchost_CCCBAABACBBBBBCABAAAACBACCABACBCCACBAABCABCCBBCBABCBBAC.exe
1416	svchost_BBAACABBAAABCAAABBAACBABCCACACCACCCAAACBBBBBABACBCCCBBB.exe
1416	svchost_BBAACABBAAABCAAABBAACBABCCACACCACCCAAACBBBBBABACBCCCBBB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4372	2026-08-10_52452063b82f6b0021565ed68a2a0f45_darkgate_elex_stop.exe
Token: SeDebugPrivilege	4488	svchost_CCCBAABACBBBBBCABAAAACBACCABACBCCACBAABCABCCBBCBABCBBAC.exe
Token: SeDebugPrivilege	1416	svchost_BBAACABBAAABCAAABBAACBABCCACACCACCCAAACBBBBBABACBCCCBBB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4996	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 4904	4372	2026-08-10_52452063b82f6b0021565ed68a2a0f45_darkgate_elex_stop.exe	100
PID 4904 wrote to memory of 1528	4904	cmd.exe	102
PID 4488 wrote to memory of 1364	4488	svchost_CCCBAABACBBBBBCABAAAACBACCABACBCCACBAABCABCCBBCBABCBBAC.exe	106
PID 4372 wrote to memory of 4868	4372	2026-08-10_52452063b82f6b0021565ed68a2a0f45_darkgate_elex_stop.exe	107
PID 4868 wrote to memory of 2120	4868	cmd.exe	109
PID 4372 wrote to memory of 3272	4372	2026-08-10_52452063b82f6b0021565ed68a2a0f45_darkgate_elex_stop.exe	110
PID 3272 wrote to memory of 1064	3272	cmd.exe	113
PID 1364 wrote to memory of 1464	1364	notepad.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-08-10_52452063b82f6b0021565ed68a2a0f45_darkgate_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_52452063b82f6b0021565ed68a2a0f45_darkgate_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCABCBABCCBACAACCCBACBBAAAACCCBBACCBCACCCCAABBBCCAABCAACACCAABAACCAACBBAAABBAACABCCAAABCCAAABBABBABBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABACBBBBBCABAAAACBACCABACBCCACBAABCABCCBBCBABCBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCABCBABCCBACAACCCBACBBAAAACCCBBACCBCACCCCAABBBCCAABCAACACCAABAACCAACBBAAABBAACABCCAAABCCAAABBABBABBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABACBBBBBCABAAAACBACCABACBCCACBAABCABCCBBCBABCBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACAACBBCACAACABACCBBABABCABABAABBAABBAABBCBCCACACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABACBBBBBCABAAAACBACCABACBCCACBAABCABCCBBCBABCBBAC.exe" start= auto displayName= "UserDataSvc_ACAACBBCACAACABACCBBABABCABABAABBAABBAABBCBCCACACAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACAACBBCACAACABACCBBABABCABABAABBAABBAABBCBCCACACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABACBBBBBCABAAAACBACCABACBCCACBAABCABCCBBCBABCBBAC.exe" start= auto displayName= "UserDataSvc_ACAACBBCACAACABACCBBABABCABABAABBAABBAABBCBCCACACAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2120
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACAACBBCACAACABACCBBABABCABABAABBAABBAABBCBCCACACAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3272
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACAACBBCACAACABACCBBABABCABABAABBAABBAABBCBCCACACAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1064

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABACBBBBBCABAAAACBACCABACBCCACBAABCABCCBBCBABCBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABACBBBBBCABAAAACBACCABACBCCACBAABCABCCBBCBABCBBAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1464

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABACBBBBBCABAAAACBACCABACBCCACBAABCABCCBBCBABCBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABACBBBBBCABAAAACBACCABACBCCACBAABCABCCBBCBABCBBAC.exe
1⤵
- Executes dropped EXE
PID:1488

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4996

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACABBAAABCAAABBAACBABCCACACCACCCAAACBBBBBABACBCCCBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACABBAAABCAAABBAACBABCCACACCACCCAAACBBBBBABACBCCCBBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BackupRequest.exe

Path C:\Users\Admin\Desktop\BackupRequest.exe
Size 46.5MB
SHA256 3db21336352b7ba27817599094f917107c0885318a14012ee71fa4eb4ed090f9
MD5 0a80f4c63ccf487cde27c0b401ccea93
SHA1 924bd419cf848017f31d3289f25f607e22046fee
SHA512 ed68905579c5cf5b54d8c7a277e5fdb01f25012d4265ea08aa4cae7d2dac0dd3b485a715af2276baa07a932de88a5df9fdd894941d680612655d787cc22ed4d6
SSDEEP 196608:vBBBBB/q/BBBBB/qvBBBBB/q/BBBBB/qvBBBBB/q/BBBBB/qvBBBBB/q/BBBBB/U:M8M8M8M8M8M8jB
TLSH
T193B78D11B7C18035F5B329724ABFE339597DB9214F6885CFE3880A2E5E71AD0A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackupRequest.exe

Path C:\Users\Admin\Desktop\BackupRequest.exe
Size 54.2MB
SHA256 bd1bcbc82ffa1822d5014345550e69d1ea0930af02c6533d320b60878b76b028
MD5 0f3115546461c99fc9773d0eb506cfa8
SHA1 6bc271400bd18cc2ec8176a9544b067b1f1b4f2e
SHA512 b27d7f5c2016f1135fb3706ea070b25cbfe3006092a9a667611da6c7a309a18f3aadea40a44b06d899eba6a89ec5ae6783760b21084f5c65fb1f989d978b4ac8
SSDEEP 196608:vBBBBB/q/BBBBB/qvBBBBB/q/BBBBB/qvBBBBB/q/BBBBB/qvBBBBB/q/BBBBB/z:M8M8M8M8M8M8M8j6
TLSH
T178C78D11B7C18035F5B329724ABFE339597DB9214F6885CFE3880A2E5E71AD0A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackupRequest.exe

Path C:\Users\Admin\Desktop\BackupRequest.exe
Size 15.6MB
SHA256 c004b6cd039363e0d3a21a7b555687a770871ba4bf21e50d5c51772876a98d95
MD5 beb9fee885aa8f71a1c7fe106b96b868
SHA1 7e6c001d50233f63196da67d37431f9519307f4f
SHA512 283765f464a82d2b3c3e8d9ae7bc23c4f4bfaf288add839d07b373ac6c56ea4cf21879c4270481a56cc41d143814f951cc73593ac06f41b77a9c71b296cf08e6
SSDEEP 196608:vBBBBB/q/BBBBB/qvBBBBB/q/BBBBB/qjZ:M8M8jZ
TLSH
T1EEF69D11B7C18035F5B329724ABFE339597DB9214F6885CFE3880A2E5E71AD0A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisconnectRedo.exe

Path C:\Users\Admin\Desktop\DisconnectRedo.exe
Size 38.7MB
SHA256 02968b25c8c964a71000e22b6a6b7bb27cd3f7ca530397935b464757ce299a1f
MD5 602ae7ef53e78e414b1c93114d4040be
SHA1 bd6a1aa9856cceb29e4eb25bcefb637977a15372
SHA512 876fe36f5687f76c20025a2b67a8e688f5a7add4603d93634bbc5af2bcb9f6a01615148d59a67711dbc5835d0b3f88e14f5964f0d5ab1a3def508cd2a19a1222
SSDEEP 196608:vBBBBB/q/BBBBB/qvBBBBB/q/BBBBB/qvBBBBB/q/BBBBB/qvBBBBB/q/BBBBB/4:M8M8M8M8M8lZ
TLSH
T1D6978D11B7C18035F5B329724ABFE339597DB9214F6885CFE3880A2E5E71AD0A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisconnectRedo.exe

Path C:\Users\Admin\Desktop\DisconnectRedo.exe
Size 54.1MB
SHA256 5cc00f0c69f83d67eae4ce89416a0df1b931ca47af42a331a5b8d26aa77d1fcd
MD5 3853ef70c64a9f75775326f530e976fa
SHA1 fa6367e89a368a1ce1683c5d017b8df83e8c7848
SHA512 ed012d58674952e440b80808dece5c4ebb152e15840cac2c8f61a6150958ed79ddbd29860842faf03f9c1c1e2d374fda72a584fe8a1948a917f948886100fc15
SSDEEP 196608:vBBBBB/q/BBBBB/qvBBBBB/q/BBBBB/qvBBBBB/q/BBBBB/qvBBBBB/q/BBBBB/4:M8M8M8M8M8M8M8lH
TLSH
T120C78D11B7C18035F5B329724ABFE339597DB9214F6885CFE3880A2E5E71AD0A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 641b622827aabdc74ef0ea73ef42aeec197e8bebb5730f67a3a92fc6912565cd
MD5 9d195de5cdd9c01593fa6fd7dcfaf097
SHA1 b70fcd02d21392b8862feb369273d34f5a497444
SHA512 5f4ecbab7c3df3fef4a1177ad26a52cedeb628b09cfade07889875a19269afa7cf40e69c88b16d9f58ea548586e40e471c5a6000078a0405fdd88dfa1f8dfe61
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e9015861fa631e5bd0362b135eac5980c990e50d14f8126d4da8014c6d0872c4
MD5 6ca0854c7b55e3bcbe7e87d865e43826
SHA1 40404b619d606798752c4dc093f5c8649a0ae99e
SHA512 6d639983ba0e962bbbfc282f5340d6c18c0886d1801d154edce855cdc427210fb9c36695565e4a3ad09fa9cb103b5f45c1f14ff420b929aaec1fb3dbeddc2316
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 458ee751e669bcce9c0ecc33ae726f5c627f7602f5e16b0fe8927c16db6d8ed5
MD5 51b64415ffe225e76ec9053f5f74aa3a
SHA1 4dd99c56d34bde5e624d02695517b179ea3b4704
SHA512 e6f6a07881cbbf5ebcfface4244088599d9b6b98d6958f224165b51901b90d072877a17500e5f6306d9c8a76acf97434f532faa88696dc213d6053a8effcdfe0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6152e3656209d881f913d7cd32339a3f8a05c3af6578b1f557318e84d0ab00ef
MD5 a1b8c63a1cc42fce9382e480686adef2
SHA1 b48749d1bafac9af01fc24e38a892ecebd7ce28a
SHA512 276e8926ef4a0474232c0b5686d5ca7d76157fa2b8057ec1fc8c08c42f8271a6e84ace66860f0aa717b87f941282179d48f647329e390a38c0377d21388b60ff
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 43daa9edbe01bc665c36a70107dee2d4b90a65b9b33fc9bb59491c7631338295
MD5 a8038b1358d1c0c6ac9e52c48a89a3be
SHA1 a480c1022c7dfb5b6058413136cdf8d74a1df2d8
SHA512 292d1e95432b62abcfcc7e1e6500833ab4dc468d54ff8d872eee838c3c9dd6a09a89c278c21b18e8730cfb7f6d3d243bfa70f9252ac1dc633da9ac8f119eceb5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 874ce9af03dd69f0701a128e0ce8e7e7880745b6aac3254621e57cf4f20d4da0
MD5 4185c8b9e362ec2581c1f5855698f643
SHA1 91749eb60f515bbc76e79eb98a8fec56a05c07c2
SHA512 e710a90ada299fc532a405bd9cd1be2a3b09813b3f0d028dbe5ed4565c6d56c5ac3d8817f92bb60442fcb20ce0ebed4873f165bde1ed8fa7def6e01b2e360f00
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 019c6c91051d07901ed48c4fa8edfa6cd28c962cf5b8c6862a59fe40c5f5fb3b
MD5 977a8e289bf7293c2be1872264f41b98
SHA1 05b53e91640dc07f48d4f85206fcef85ae72220f
SHA512 5807d8820b67b1d8dee5d9988c23f79a34c4b2c4b626dc226c7d945f9db1f1e6c1643d965c511c9578741523314d25204e12924060adfdddf27b4ad5337df224
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d8cffccff61289ff0662675aeebf56f0bd02898a9549135dd12561baa52b3d45
MD5 1a2cf9d1b196b53113109a17a308f09d
SHA1 b9e4819d03f56456801c120407cd8d45109274c3
SHA512 8e6a883170f7876cfb8ef1c8f43e8b56182e18e20cb90b06eb84b59e34b9c39d35a70833da81f4ea57748ab1ecd5475b19b178e5ad0853d4ac2172d7b7f55355
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0c7a8a95fe1729898187bd9554d53f9cf869360be44b6c6f78a92a2fdd9db1a6
MD5 eaa8481c96b4ae768598764ff84afdcf
SHA1 1f7207895956be30e1aa892d0ecc14eab05ad6b3
SHA512 c478933541b8460df09355bb5879f877bf1e3f8090a146293652bac91ffe17c7410006b20edb8de1034b5d9cc66bfc12d27dd3b6336d7c03318c5fc7d05982be
MD5 SHA1 SHA512

Submit Download

svchost_CCCBAABACBBBBBCABAAAACBACCABACBCCACBAABCABCCBBCBABCBBAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABACBBBBBCABAAAACBACCABACBCCACBAABCABCCBBCBABCBBAC.exe
Size 7.7MB
SHA256 d4ffa65a040f6c610ef1020940d4304c36a97905b923e0118562ffc81226a5ab
MD5 52452063b82f6b0021565ed68a2a0f45
SHA1 8a54ef60d6f2f67c828f7e13aea9ef03f9032b71
SHA512 0f1893d9bc069ce3bcfc8afe26097b4a566affb8cf3f7c19c926a80620054ebd9294b38ec98e5dcddf896ca12d0690bce9a6d97a7d034a839c109a1b55d642eb
SSDEEP 98304:Jp7Dp7Dp7Dp7Dp7Dp7/KRuy5a2p7Dp7Dp7Dp7Dp7Dp7/KRuy5a8:vBBBBB/q/BBBBB/qn
TLSH
T14A868D11B7C18035F5B329724ABFE339597DB9214F6885CFE3880A2E5E71AD0A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 1dd814f0ada1ec5faf070349ff6ba950060046394eaa83e6328de18354d4432f
MD5 56b525ead3219a278796cec692ad6d7c
SHA1 1d7dc61cdd5857c04d6761a4bd4a267edff46ceb
SHA512 cae715a9c5af8d97da27a498543173ad44728446af0d50647801c53e52ff6b8e3ea6af9893a4e4429768233e3ff063a516fa5c0fd304f0c7feaaaecff7bd3b1c
TLSH
T14E110811C4F9D863F93368CB4219EBA70CE472AFB858AE1413050609BBE5C30CD594F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1364-108-0x00000000027D0000-0x00000000027D1000-memory.dmp

Download

memory/1416-134-0x00000000003E0000-0x0000000000401000-memory.dmp

Download

memory/1488-116-0x0000000000460000-0x0000000000481000-memory.dmp

Download

memory/4372-111-0x0000000000410000-0x0000000000431000-memory.dmp

Download

memory/4372-79-0x0000000000410000-0x0000000000431000-memory.dmp

Download

memory/4372-30-0x0000000000410000-0x0000000000431000-memory.dmp

Download

memory/4372-46-0x0000000000410000-0x0000000000431000-memory.dmp

Download

memory/4372-14-0x0000000000410000-0x0000000000431000-memory.dmp

Download

memory/4488-95-0x0000000000460000-0x0000000000481000-memory.dmp

Download

memory/4488-45-0x0000000000460000-0x0000000000481000-memory.dmp

Download

memory/4488-68-0x0000000000460000-0x0000000000481000-memory.dmp

Download

memory/4488-146-0x0000000000460000-0x0000000000481000-memory.dmp

Download