be795e80c8ac8031f3adef7ae1361955d6cce706624eb26eb30d48fe60babd60

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_4b78f8b6cacc12dc23adcfb252f54c6e_amadey_darkgate_elex_stop_vidar.exe
Size 2.6MB
Sample260814-e5vxpacq21
SHA256 be795e80c8ac8031f3adef7ae1361955d6cce706624eb26eb30d48fe60babd60
MD5 4b78f8b6cacc12dc23adcfb252f54c6e
SHA1 5efcfcd21ca7bc031ffee81f3f92ffc2a53660a1
SHA512 dba4a04b6945af2af650b734e394d4aad16f65b598866b47c78bc692835a2e35d9029d42f66443c442a5005d4d2d88c3907e5124e04212e943eeb7df3cfb7d8d
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+EOkciw2J+ES+ES+ES+ES+ES+ES+ES+EOkciw2+DdY:zp78
TLSH
T1D2D54C09FAD64071E977517049EBC37A8A71BD2187318AEFE688C72E5D33BD0A834716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
788	svchost_BCAACABBCCAABCABACBABCACBCBABABABACAAABAACABCCCBACBCCBA.exe
4768	svchost_BCBBAACCCACBABCAACCCCBACBAABABABBCABACAACCAAABCBCCACCBC.exe
4976	svchost_BCAACABBCCAABCABACBABCACBCBABABABACAAABAACABCCCBACBCCBA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CACCABCABACABABCAACBBCACCAAAACACCBBCACCBBAAAAAABBBCACACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAACABBCCAABCABACBABCACBCBABABABACAAABAACABCCCBACBCCBA.exe"	2026-08-14_4b78f8b6cacc12dc23adcfb252f54c6e_amadey_darkgate_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABABAAACCCBBACCCBAACBBCAAACAACCAAACACBCAAABABBBCBACCABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBBAACCCACBABCAACCCCBACBAABABABBCABACAACCAAABCBCCACCBC.exe"	svchost_BCAACABBCCAABCABACBABCACBCBABABABACAAABAACABCCCBACBCCBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2144	sc.exe
3180	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4328	cmd.exe
1900	cmd.exe
5052	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCAACABBCCAABCABACBABCACBCBABABABACAAABAACABCCCBACBCCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBBAACCCACBABCAACCCCBACBAABABABBCABACAACCAAABCBCCACCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_4b78f8b6cacc12dc23adcfb252f54c6e_amadey_darkgate_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1412	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4920	2026-08-14_4b78f8b6cacc12dc23adcfb252f54c6e_amadey_darkgate_elex_stop_vidar.exe
4920	2026-08-14_4b78f8b6cacc12dc23adcfb252f54c6e_amadey_darkgate_elex_stop_vidar.exe
4920	2026-08-14_4b78f8b6cacc12dc23adcfb252f54c6e_amadey_darkgate_elex_stop_vidar.exe
4920	2026-08-14_4b78f8b6cacc12dc23adcfb252f54c6e_amadey_darkgate_elex_stop_vidar.exe
788	svchost_BCAACABBCCAABCABACBABCACBCBABABABACAAABAACABCCCBACBCCBA.exe
788	svchost_BCAACABBCCAABCABACBABCACBCBABABABACAAABAACABCCCBACBCCBA.exe
788	svchost_BCAACABBCCAABCABACBABCACBCBABABABACAAABAACABCCCBACBCCBA.exe
788	svchost_BCAACABBCCAABCABACBABCACBCBABABABACAAABAACABCCCBACBCCBA.exe
4768	svchost_BCBBAACCCACBABCAACCCCBACBAABABABBCABACAACCAAABCBCCACCBC.exe
4768	svchost_BCBBAACCCACBABCAACCCCBACBAABABABBCABACAACCAAABCBCCACCBC.exe
4976	svchost_BCAACABBCCAABCABACBABCACBCBABABABACAAABAACABCCCBACBCCBA.exe
4976	svchost_BCAACABBCCAABCABACBABCACBCBABABABACAAABAACABCCCBACBCCBA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4920	2026-08-14_4b78f8b6cacc12dc23adcfb252f54c6e_amadey_darkgate_elex_stop_vidar.exe
Token: SeDebugPrivilege	788	svchost_BCAACABBCCAABCABACBABCACBCBABABABACAAABAACABCCCBACBCCBA.exe
Token: SeDebugPrivilege	4768	svchost_BCBBAACCCACBABCAACCCCBACBAABABABBCABACAACCAAABCBCCACCBC.exe
Token: SeDebugPrivilege	4976	svchost_BCAACABBCCAABCABACBABCACBCBABABABACAAABAACABCCCBACBCCBA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4276	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 5052	4920	2026-08-14_4b78f8b6cacc12dc23adcfb252f54c6e_amadey_darkgate_elex_stop_vidar.exe	96
PID 5052 wrote to memory of 1412	5052	cmd.exe	98
PID 788 wrote to memory of 2820	788	svchost_BCAACABBCCAABCABACBABCACBCBABABABACAAABAACABCCCBACBCCBA.exe	99
PID 2820 wrote to memory of 1648	2820	notepad.exe	100
PID 4920 wrote to memory of 4328	4920	2026-08-14_4b78f8b6cacc12dc23adcfb252f54c6e_amadey_darkgate_elex_stop_vidar.exe	104
PID 4328 wrote to memory of 2144	4328	cmd.exe	106
PID 4920 wrote to memory of 1900	4920	2026-08-14_4b78f8b6cacc12dc23adcfb252f54c6e_amadey_darkgate_elex_stop_vidar.exe	107
PID 1900 wrote to memory of 3180	1900	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-14_4b78f8b6cacc12dc23adcfb252f54c6e_amadey_darkgate_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_4b78f8b6cacc12dc23adcfb252f54c6e_amadey_darkgate_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCABAAABAABBAACAACACCACCABCBBCCACAACAAACBBCCABBCBBCBABACCBBBAACCBACCABCCCABBACCCCBCABCCCCABAAAAACCBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACABBCCAABCABACBABCACBCBABABABACAAABAACABCCCBACBCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCABAAABAABBAACAACACCACCABCBBCCACAACAAACBBCCABBCBBCBABACCBBBAACCBACCABCCCABBACCCCBCABCCCCABAAAAACCBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACABBCCAABCABACBABCACBCBABABABACAAABAACABCCCBACBCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCCBBBABBBAABBBBABBAACCBCCBBCACBCACACAACBCACAABAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACABBCCAABCABACBABCACBCBABABABACAAABAACABCCCBACBCCBA.exe" start= auto displayName= "UserDataSvc_ABCCBBBABBBAABBBBABBAACCBCCBBCACBCACACAACBCACAABAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCCBBBABBBAABBBBABBAACCBCCBBCACBCACACAACBCACAABAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACABBCCAABCABACBABCACBCBABABABACAAABAACABCCCBACBCCBA.exe" start= auto displayName= "UserDataSvc_ABCCBBBABBBAABBBBABBAACCBCCBBCACBCACACAACBCACAABAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2144
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCCBBBABBBAABBBBABBAACCBCCBBCACBCACACAACBCACAABAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCCBBBABBBAABBBBABBAACCBCCBBCACBCACACAACBCACAABAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3180

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACABBCCAABCABACBABCACBCBABABABACAAABAACABCCCBACBCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACABBCCAABCABACBABCACBCBABABABACAAABAACABCCCBACBCCBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:788
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1648

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4276

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBAACCCACBABCAACCCCBACBAABABABBCABACAACCAAABCBCCACCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBAACCCACBABCAACCCCBACBAABABABBCABACAACCAAABCBCCACCBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4768

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACABBCCAABCABACBABCACBCBABABABACAAABAACABCCCBACBCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACABBCCAABCABACBABCACBCBABABABACAAABAACABCCCBACBCCBA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 3dfbbd96a5f087f62b677e783ac46d6d91eb41b71e4b53c08ce4dc250ca2a34f
MD5 f9af3131ef84a0dfa214747585934315
SHA1 30601b35cfa7061c7a5d78caf7b1b8c28d5f8de7
SHA512 23310d8f974737524c19394080410be4704a35f15011a800097719fe85337a509b0e361e73ff844517a0c5c12faa1e9da25e548792225bfb2b57ddb5f8e34020
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 3.1MB
SHA256 542ff5f67aca85a01a87af76b60629554f25dedcb4c0d4f66c11c5b49ec2c4b9
MD5 c2ef8c755a1188b2eb8fd5d9a65b983e
SHA1 b37ade84b8adbf06cd6f9b39d0127c3c399e5203
SHA512 78f2937e0fa0f0ececd51be157f04644f5896c64a96aa02dea9b7441c4e0712d1026b9dd0627a9507c7cdf27d6ad86b34ec08fc99005acfb01155f95212335e0
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+EOkciw2J+ES+ES+ES+ES+ES+ES+ES+EOkciw2+Dd+:zp7fpid
TLSH
T191E55C05F6DA4071F5B755704DEBC27A8A75BD218B31CADFE388862E5D33AD0A834B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\qap`g`v~dtlq
Size 10B
SHA256 5a33b2b3c252219742077f572a5ccc15d67b9e3b61438ee459ce3a1d860ab917
MD5 9433168d7dab0ff0e6e84fd8d2a5336b
SHA1 bfb5ac9f7fceb3dca87c3f20ceed1dbcd9155e41
SHA512 b4cd48ec8a5ceb9e01fc53261645936b06cc644ceb47422915f365faa59f5943b231f0648aa3886d737ce3bc82de86a3cf64b8e06972680450f89a69d99a359b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\_locales\my\qap`g`v~dtlq
Size 10B
SHA256 c9780d6e052013f6c030288914acea38d856ae47fa40fe78c6c021dbc4ead0d6
MD5 112a9eb935758b683cffb891cffdc786
SHA1 e05caf7a486d6bda0470432a3265d154e33fd20c
SHA512 d89482941aedb6d180f3e0d9a42cc3bf37b8aec776e2ccbbb035d0a4edb1d00a68866d88dce436a93060a2170b608a085c23122bc11e3b4ea80888b1487ab5b4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 7d3599cce71f77946c8239ce009d916e0afb4a4198096c4b04d8350ca0ca707c
MD5 4081749365a326096ee50f7ba51bb67d
SHA1 f2be1f2ae8c55b990fbbcd5c3986e1c7b1cf481a
SHA512 8862a847e69e73851096458c39f563cd7ed7cebbe2ef2fa112fac7c519fc7120a703444f77f8ad35feebfd130dedaa5636e7adab26e359a61ff1bd6856fafe96
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\Settings\qap`g`v~dtlq
Size 10B
SHA256 da6012867bdf045c57851ee8f05758c0c3e1512db83a045fe94774c017a792e1
MD5 914762f4853695cf4ec9b50bb248d667
SHA1 e666b0643ffb7d33214950c349ebe48b8fad1751
SHA512 f0b96ff56002e7cdd0606d805baeeefb82a7875f546efe542fba76394f2e53760603b9897235e91cfe9f85e3fd850248eafdf43cfd714e058b8f01a0e619efef
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\5ujxowiy.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\datareporting\glean\events\qap`g`v~dtlq
Size 10B
SHA256 8c665146cddb3e101521c3286c8caa246de53892706e7fb7e24937074c253a4c
MD5 7850a541a383dac45e031dbf0f869dec
SHA1 26987c1be9194a8aa5c86e5d8ffe0fb5663eba50
SHA512 a9866f0e3764b8ec91731948f3f110a4df535088087536d04f11985c84cf1a5fc46841f98b02b10c54733db574e9cc52128e0f23aa8e6e93eda9a478b4aa84ab
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4bb928781dd27d4038f0b6850f9bf5423b4e761f6f066dc1b65744bb2d9f831b
MD5 5ce3938e0634fffe2f8321eb4a9b65ca
SHA1 e20418657c3b796c5679cc50ef87612d40713154
SHA512 cac43ebb252352dd0159b80b73425fb84d8b87086fbf6c498640ca293134628df66a0f082ff668878f63c938beeab1d3e2dfd6aa822e906a884c4486c5f8c88a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f0a4d667bc222baf2811a7c29cbb1ee5f0a94dc77964cf6878a61bcf1c9471ac
MD5 45fbe84c4a6ec87f9caa50bd9aeb2c68
SHA1 92e031628b30124c0cc7c2daddb4679ff332a92a
SHA512 5f24f4307ab8668cf267824eca61e3b8e0e83b791a4b8c33b0c081f8f68794f1d898ab15c848018184816d3f1d38ce5c58ba712059cfb02782530606ff38993f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 18924b015613cf464274a860fc0979fddfc047435ceb506fb3ec29dc97851e2c
MD5 2c0bd89f1eb2273d39f28404b7c0ce56
SHA1 291d5e16a4d22fefb9b7dacdb47c80f09b867e98
SHA512 ac29c907176d4158228476eaf339b266d624af32133e48b1d5133896d82f274793810b569f60100831d0aa69ac58117cd445242effc2816d3e0d20511dc8a2e5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 347b6ec0623c17279e5bd839c87146d2410815e0712e120d4f282148d852af84
MD5 0b2c4b78b99ce7d91ca14c5a242cde01
SHA1 465f67eb6762874fb0a60cfadc25df6abc7597c7
SHA512 3b57be2ed0d53fe0787a3e5f7030a43df32ce1e57c819d4c1dbfd5dbc1ef23ea46c59528d199461fedb13dee0def15a3bc26c5cb725bf63e289c21d8f7aff760
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3e039b149fa3972fe06964065c5ed7c488b0efbd901d3223e010fd28561fc8ef
MD5 a994a025c259d283a8e2c78e046fd2f6
SHA1 e1bb5e995f62d46025b8071073cf174e818182f1
SHA512 c35018c78c89d59b2837b826ee363409dd06342417137a7c46069dc84bd682116c3cff01b4bc0a3454dc633af7eb27c18c8dc351533d4d2580a01f7f781d3cc9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 df2246dbd293951c98e4b93b2c4af6b8f6ab116128be3870504026d33f2064db
MD5 a659f02a0995797a77020a0afb78d32c
SHA1 8fcff8b55877bac789b5645072db669436f4b27e
SHA512 4f02b1aa378a73314d335ac2c30887ff39dbfeeede22fc1b10454c75dd5915262645b916a24da476ecf7dc3fc50e8175e89304f908906208c810e8fea1149b6b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7924faeb8b47abed8aa659dac4689958cb13ca02c2400867b5ef172c99f3a0b0
MD5 04f8cae84fcc9986ea63a6fcd863f07b
SHA1 7265bd87b2738f7b295637f4521f2c809b983625
SHA512 9283b48ddf7a7574554d327b6c7e3dcdc50571578a0f10268227a704e51b71a4b5da6daff62593d44990dd8f6085ab9df62084e9d7c129eec65aa9218db4fd8a
MD5 SHA1 SHA512

Submit Download

svchost_BCAACABBCCAABCABACBABCACBCBABABABACAAABAACABCCCBACBCCBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACABBCCAABCABACBABCACBCBABABABACAAABAACABCCCBACBCCBA.exe
Size 2.6MB
SHA256 be795e80c8ac8031f3adef7ae1361955d6cce706624eb26eb30d48fe60babd60
MD5 4b78f8b6cacc12dc23adcfb252f54c6e
SHA1 5efcfcd21ca7bc031ffee81f3f92ffc2a53660a1
SHA512 dba4a04b6945af2af650b734e394d4aad16f65b598866b47c78bc692835a2e35d9029d42f66443c442a5005d4d2d88c3907e5124e04212e943eeb7df3cfb7d8d
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+EOkciw2J+ES+ES+ES+ES+ES+ES+ES+EOkciw2+DdY:zp78
TLSH
T1D2D54C09FAD64071E977517049EBC37A8A71BD2187318AEFE688C72E5D33BD0A834716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 9a79de207f6bb339d8b22abb5ab0010760324f2d3130b591df6dcc735fb72087
MD5 49a34198d8bfb86c174d2a939befd0d5
SHA1 5b1c124dcd607bc0fa75ac6dc7a43a9588c7a86f
SHA512 29da13665c6e20d89beef3489753a7db4a8a0c2854da85749769b8836c714d8a4e0107aaf2490473223182d967056dfea8dd1010a4c5f9ba980b3d4c0f34d7f6
TLSH
T175110810B8D5D873EE226C8F951F9B830CB4B7DF6D9C9A04530D82287E94D31DD454D6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 38db235837a049e2793b06a3016e65a2f6b7ddd83ef4e05cedd9cdadbbaa598e
MD5 4d7949115f51699a8f04d0c5119f8597
SHA1 b67a8f8878cc3481e3c205fdeb1e818b188d3d87
SHA512 2bd6dce6e0a4254253869bc41d568dfc91f6613c8088cb26136ba8023a688e0453a98ee0ae98a0a206ff80dcd7e0942ffb83e84785ff1c5f6ae7c557f33e4c3b
TLSH
T115210A50B8E4C873EE226CCB951F9B820CB477DF6DAC9A04630D82287ED5D31DD554D5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/788-36-0x00000000006C0000-0x00000000006E1000-memory.dmp

Download

memory/2820-59-0x0000000004F10000-0x0000000004F11000-memory.dmp

Download

memory/4768-81-0x00000000007D0000-0x00000000007F1000-memory.dmp

Download

memory/4920-0-0x0000000000970000-0x0000000000991000-memory.dmp

Download

memory/4920-7-0x0000000000970000-0x0000000000991000-memory.dmp

Download

memory/4976-1476-0x00000000006C0000-0x00000000006E1000-memory.dmp

Download