291f143fa3710824fa008970a915c7cd74676962488030bd4e0d14e7352dfda7

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_d7d04a96ff29314798a67f20c5f9bf31_amadey_darkgate_elex_stop.exe
Size 991KB
Sample260828-jswexavemc
SHA256 291f143fa3710824fa008970a915c7cd74676962488030bd4e0d14e7352dfda7
MD5 d7d04a96ff29314798a67f20c5f9bf31
SHA1 844a4c15cfba2ccd983c816c7eba643c52c8a846
SHA512 3ae5b7b13271730790216d30f7e27dff1e687868a7c5da405199569c4d144198e145ae75c8cd2d26b15bdd3b6d0a33489416cb4e02d9a5edc8aafd92985873d8
SSDEEP 12288:mgUFgEsnojA4uagwBagwAgUFgEsnojA4uagwBagw8a0wIk0BX3RKuemGd70ioGu0:m9+EM0hLgLA9+EM0hLgL8afDd70iTWCT
TLSH
T1B4258D02F6818035F4B319704EAFD6799939BD718F518DCFE388666F29317E1A930B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBCCABCBBBAACACBABCABBBACBABBBCCACACCBAACBBBCCCBBAAACAB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBCCABCBBBAACACBABCABBBACBABBBCCACACCBAACBBBCCCBBAAACAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBCCABCBBBAACACBABCABBBACBABBBCCACACCBAACBBBCCCBBAAACAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBCCABCBBBAACACBABCABBBACBABBBCCACACCBAACBBBCCCBBAAACAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5544	svchost_CBCCABCBBBAACACBABCABBBACBABBBCCACACCBAACBBBCCCBBAAACAB.exe
4256	svchost_CACACACBABBBCACCBABBCBCCCCCCCCABBBABCBCAAABCCACCBACCCCA.exe
3492	svchost_CBCCABCBBBAACACBABCABBBACBABBBCCACACCBAACBBBCCCBBAAACAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBAAAABCBCCCCABCABCCCCCABBCBAABACBCBAABAABABBBAABCABCCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCCABCBBBAACACBABCABBBACBABBBCCACACCBAACBBBCCCBBAAACAB.exe"	2026-08-28_d7d04a96ff29314798a67f20c5f9bf31_amadey_darkgate_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBCCACAAAACBABABCCAAABCBAABBBAABBCBCAACBAABBCCCBABBCABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACACACBABBBCACCBABBCBCCCCCCCCABBBABCBCAAABCCACCBACCCCA.exe"	svchost_CBCCABCBBBAACACBABCABBBACBABBBCCACACCBAACBBBCCCBBAAACAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5904	sc.exe
2276	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2816	cmd.exe
1716	cmd.exe
4104	cmd.exe
4980	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-28_d7d04a96ff29314798a67f20c5f9bf31_amadey_darkgate_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCCABCBBBAACACBABCABBBACBABBBCCACACCBAACBBBCCCBBAAACAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACACACBABBBCACCBABBCBCCCCCCCCABBBABCBCAAABCCACCBACCCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3580	schtasks.exe
2756	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3340	2026-08-28_d7d04a96ff29314798a67f20c5f9bf31_amadey_darkgate_elex_stop.exe
3340	2026-08-28_d7d04a96ff29314798a67f20c5f9bf31_amadey_darkgate_elex_stop.exe
3340	2026-08-28_d7d04a96ff29314798a67f20c5f9bf31_amadey_darkgate_elex_stop.exe
3340	2026-08-28_d7d04a96ff29314798a67f20c5f9bf31_amadey_darkgate_elex_stop.exe
5544	svchost_CBCCABCBBBAACACBABCABBBACBABBBCCACACCBAACBBBCCCBBAAACAB.exe
5544	svchost_CBCCABCBBBAACACBABCABBBACBABBBCCACACCBAACBBBCCCBBAAACAB.exe
5544	svchost_CBCCABCBBBAACACBABCABBBACBABBBCCACACCBAACBBBCCCBBAAACAB.exe
5544	svchost_CBCCABCBBBAACACBABCABBBACBABBBCCACACCBAACBBBCCCBBAAACAB.exe
4256	svchost_CACACACBABBBCACCBABBCBCCCCCCCCABBBABCBCAAABCCACCBACCCCA.exe
4256	svchost_CACACACBABBBCACCBABBCBCCCCCCCCABBBABCBCAAABCCACCBACCCCA.exe
3492	svchost_CBCCABCBBBAACACBABCABBBACBABBBCCACACCBAACBBBCCCBBAAACAB.exe
3492	svchost_CBCCABCBBBAACACBABCABBBACBABBBCCACACCBAACBBBCCCBBAAACAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3340	2026-08-28_d7d04a96ff29314798a67f20c5f9bf31_amadey_darkgate_elex_stop.exe
Token: SeDebugPrivilege	5544	svchost_CBCCABCBBBAACACBABCABBBACBABBBCCACACCBAACBBBCCCBBAAACAB.exe
Token: SeDebugPrivilege	4256	svchost_CACACACBABBBCACCBABBCBCCCCCCCCABBBABCBCAAABCCACCBACCCCA.exe
Token: SeDebugPrivilege	3492	svchost_CBCCABCBBBAACACBABCABBBACBABBBCCACACCBAACBBBCCCBBAAACAB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 2816	3340	2026-08-28_d7d04a96ff29314798a67f20c5f9bf31_amadey_darkgate_elex_stop.exe	92
PID 2816 wrote to memory of 2756	2816	cmd.exe	94
PID 5544 wrote to memory of 5796	5544	svchost_CBCCABCBBBAACACBABCABBBACBABBBCCACACCBAACBBBCCCBBAAACAB.exe	95
PID 3340 wrote to memory of 1716	3340	2026-08-28_d7d04a96ff29314798a67f20c5f9bf31_amadey_darkgate_elex_stop.exe	98
PID 1716 wrote to memory of 5904	1716	cmd.exe	100
PID 3340 wrote to memory of 4104	3340	2026-08-28_d7d04a96ff29314798a67f20c5f9bf31_amadey_darkgate_elex_stop.exe	101
PID 4104 wrote to memory of 2276	4104	cmd.exe	103
PID 5544 wrote to memory of 4980	5544	svchost_CBCCABCBBBAACACBABCABBBACBABBBCCACACCBAACBBBCCCBBAAACAB.exe	106
PID 4980 wrote to memory of 3580	4980	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-28_d7d04a96ff29314798a67f20c5f9bf31_amadey_darkgate_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_d7d04a96ff29314798a67f20c5f9bf31_amadey_darkgate_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBBAAAAABBAABAACACACCAAAAABBCBCCACBBACABCCCBCBCCBAABBBBCCBCCBCCACABACAABAACABACCABCBACACACCBCACBAACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCABCBBBAACACBABCABBBACBABBBCCACACCBAACBBBCCCBBAAACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBBAAAAABBAABAACACACCAAAAABBCBCCACBBACABCCCBCBCCBAABBBBCCBCCBCCACABACAABAACABACCABCBACACACCBCACBAACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCABCBBBAACACBABCABBBACBABBBCCACACCBAACBBBCCCBBAAACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCBBBCBCBCAAAACAACBACCBAACCCBBACABBBBCBAAAABAABCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCABCBBBAACACBABCABBBACBABBBCCACACCBAACBBBCCCBBAAACAB.exe" start= auto displayName= "UserDataSvc_BCCBBBCBCBCAAAACAACBACCBAACCCBBACABBBBCBAAAABAABCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCBBBCBCBCAAAACAACBACCBAACCCBBACABBBBCBAAAABAABCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCABCBBBAACACBABCABBBACBABBBCCACACCBAACBBBCCCBBAAACAB.exe" start= auto displayName= "UserDataSvc_BCCBBBCBCBCAAAACAACBACCBAACCCBBACABBBBCBAAAABAABCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCBBBCBCBCAAAACAACBACCBAACCCBBACABBBBCBAAAABAABCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCBBBCBCBCAAAACAACBACCBAACCCBBACABBBBCBAAAABAABCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2276

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCABCBBBAACACBABCABBBACBABBBCCACACCBAACBBBCCCBBAAACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCABCBBBAACACBABCABBBACBABBBCCACACCBAACBBBCCCBBAAACAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5544
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCABBCAABCCBBCACACCBABCBAAACABAACCABAACBBAACACBBACCCBBBBBABACCBBABBACAABCBBBBAABACBBCABABACBACACBABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACACBABBBCACCBABBCBCCCCCCCCABBBABCBCAAABCCACCBACCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCABBCAABCCBBCACACCBABCBAAACABAACCABAACBBAACACBBACCCBBBBBABACCBBABBACAABCBBBBAABACBBCABABACBACACBABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACACBABBBCACCBABBCBCCCCCCCCABBBABCBCAAABCCACCBACCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3580

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACACBABBBCACCBABBCBCCCCCCCCABBBABCBCAAABCCACCBACCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACACBABBBCACCBABBCBCCCCCCCCABBBABCBCAAABCCACCBACCCCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4256

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCABCBBBAACACBABCABBBACBABBBCCACACCBAACBBBCCCBBAAACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCABCBBBAACACBABCABBBACBABBBCCACACCBAACBBBCCCBBAAACAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 008521f5927e0b24b880708c41df46e6aafc51c6bd105872f23ec0d6b6953f2e
MD5 7c9ef6a56a59ad4e15ec3fa2c4cae5ea
SHA1 30f20a899c54c6fb6315d3cb6d74f4635dfa6668
SHA512 7ea4b1f7417934034cde211a5b94edb9940c10904d0242d03f0b924ef9696a7be7a3e99056b2fa2e157db4557dcbe67bf0ecb904b0fe58e23a8fc9ecc2b7750e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 7798cac9c421113e1dc0eb9b1412fa4c49bc7f57d33e2ff2494ad149c279fc41
MD5 9eb43fdc69d3b79c90d19b35ef4bbd94
SHA1 3d2895c749e0f3e9b16677060120f1eb7c9e6f3f
SHA512 219c77708906418cff15d5e951e3ec13b1ec0b535c72c69531e109bf26d9e1a4c732ed322c51191191d4a3fa682ddd1002200fcf3fe4f2e469a2a83a77f21a0d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}v56.64.8781\qap`g`v~dtlq
Size 10B
SHA256 d0d15e739b3a7cb9feffc7434b0b1ca722c1ecb83dcb97fa288bf9cbe6f9406f
MD5 13c07ec1bfb1869fe2b43bc415588e23
SHA1 f006f38397d9d6e24d6499c16ec49052bf332ce2
SHA512 9eeac6c375024bdbe0824f545c9fc06d28a5aaaa4a738f50589b7b914350b86b00d09cf399a303fae530cf3ed2c4256d4df3527dfc508063ada69d034aef5f97
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 1.6MB
SHA256 2c154beab76ea2e7ef6325ea90ab5d2282c8e2e2b81f08fa4e6d7c37f1b412ae
MD5 55396668934dd9e39b74d1da7bf0b45e
SHA1 8a17a5d15bde399c8e8f53cd9b791a167fa1cab4
SHA512 c3af6f722101f3e7e2684a3396d4d13fadc9f39df38aed7a264eb3559cd23b1fe1c877103a3458106a317fef10b8df2392ad82c37e9c120c7431ef40fd9f4c23
SSDEEP 49152:U+ErU2+ErU3Dd79WCWgZ2HbbZt+jqpQ0CMs:xp7UgZ2Hb9t+2xs
TLSH
T1D675AE22F2918036F5F205728D6ED2356D3DBA205B508DDFE3C86A2E2E705D1AA37717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\LocalState\qap`g`v~dtlq
Size 10B
SHA256 761cf8c900326e19bb55bc18e7f341145d369fe22cef121518076f2a53b07daf
MD5 762d07677d8f9a11b39a731d28423363
SHA1 e9bd6732450238378816d5a16cfcdb2aa6fcb243
SHA512 0ef453b643761609714dc3fef6f87c3b5fbec95e53e05648ab7e665c7f9031b8e56821eab8a8871b71b7ec0880adad7a8a1d5842c2f15e0763f63eae0b3591b3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.NarratorQuickStart_8wekyb3d8bbwe\AC\INetHistory\qap`g`v~dtlq
Size 10B
SHA256 108b1365073004241deb0726dc6856c8eee8c0cf078d65eae97258837ffc5d20
MD5 20b7b47babf8605b3bdca888998212c4
SHA1 25ad2fe88f1e620bbd73b965d58a076cd7e73c7d
SHA512 d2cc86a2eb48b33039e785c65f6227d80104864b2fa01c0ece7b23165427a1bc596a92ed0121cd5584c9fcd1e35a52fcd754e1bf4b0be861dadc9738d335a67f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\zgn7oo5w.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\crashes\events\qap`g`v~dtlq
Size 10B
SHA256 eb217c7351df522c38333693376490c25ec4f859fb9af92ca25d05a7055499f4
MD5 b8bba9c86cb12fa72c9be2d2a8db74be
SHA1 796052a08a5c1728be09d2d2437556f246f20f98
SHA512 70f16a928eda92a34fc493ef3784b7f4dda55b8287bfd284d0a182faf86e7b3142733dbb0ec7db5c8aed904686c1cd00787fe33708ebbfc629bfdf763653dd98
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 040bedcca4b2cf1d1b6f34af6574717a62cadb7f7f29453166335388698e4235
MD5 85ff6f3d55ef0c4a920e46c2cc23b472
SHA1 cc5dbac62d94fe37dd598c5673c60c09efb0a0a1
SHA512 97b3a2f258bf37aa0b7878ca899d553ca5c20583fd556524a6a72061e0972e9dffbc64f6bf7e819c9fe2798092e1da185e9687ae773c94d58063473824064ae0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 41921416749d1bad5c7ebae0ceb9ef7562c2f581fcdf10a4286813e653cd7018
MD5 5cd25e77d11333ad72cfbe5baadac13d
SHA1 a63718094a0fea98efc8a837b7d3ccc9c979ce86
SHA512 eb5c2c038308b2fc7d5174a5b39dc9484fd0eb85c621d71aab4840ff1eb39914268a2a2feacef3ed9d92c4b234f55045f1f6c9dafdeaaa70507a3149199cf423
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b87bcf29503948fdad07b249b02206c7c4598243156e7f01c804f7b75dcbf122
MD5 e226e449ef5c78fe8eb2af2d98ad6f81
SHA1 ab7cd5cfb5a8957df48122ed9c058b67abbd7387
SHA512 a95bad9687a3b7fd01517b60408c11e056e37ca7c02be4fd6dd94106440cd11af186ba8a8689c36f1f591dcbbca03f1f744682607086c0465bbcb838f15cc929
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4269298d535c422da8a30885232b30af59981737fa811a337aedb185e511f923
MD5 bc075766d5cef1bd04c8ed36ec0a2c4b
SHA1 12d19221bca0c20144a5f9752a98c840d9e806bc
SHA512 1e2d0df4c26dcb39406100ca94738cef6115df80123b106ba8d208cc818013f7a8f41afdbd462d883028d0feaee654a27cb5fa3a5f05adf538a44efb6ee88cb1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1fb5752e32b614fd3603b3e58683451885c1fd392c0e40e033793fbabe489fc9
MD5 8934aa9c5f42102e53c921185e9e196e
SHA1 f308cd4aea37585fc0a84f3906382cda7e3e0c0f
SHA512 fd1cca9645d6ed8312faa774d0d0a8d599fdb248cd6d11f8ada663e83128fbb2e314cce9806d3ee70ccc3f23b8086fec56e4b9e2558d8b3a082109444d6895aa
MD5 SHA1 SHA512

Submit Download

svchost_CBCCABCBBBAACACBABCABBBACBABBBCCACACCBAACBBBCCCBBAAACAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCABCBBBAACACBABCABBBACBABBBCCACACCBAACBBBCCCBBAAACAB.exe
Size 991KB
SHA256 291f143fa3710824fa008970a915c7cd74676962488030bd4e0d14e7352dfda7
MD5 d7d04a96ff29314798a67f20c5f9bf31
SHA1 844a4c15cfba2ccd983c816c7eba643c52c8a846
SHA512 3ae5b7b13271730790216d30f7e27dff1e687868a7c5da405199569c4d144198e145ae75c8cd2d26b15bdd3b6d0a33489416cb4e02d9a5edc8aafd92985873d8
SSDEEP 12288:mgUFgEsnojA4uagwBagwAgUFgEsnojA4uagwBagw8a0wIk0BX3RKuemGd70ioGu0:m9+EM0hLgLA9+EM0hLgL8afDd70iTWCT
TLSH
T1B4258D02F6818035F4B319704EAFD6799939BD718F518DCFE388666F29317E1A930B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 20f294bf67245116fa25ca7046f9c673b0cf7b0ceb60f4a9120c9f00966c9515
MD5 7ebfb8ddadc39173dee8b9b2ec630a7b
SHA1 50ebe91af7357dc894f346959e9ae38e0207ce64
SHA512 5d4be52243fdf5695f6d5d15b882a80109f0a50d54bd1ec06bb6e4a74c5ae9bb429f0031506b7365282ed59e7ab37d0038612a666bf8525bf17467f597d6c850
TLSH
T15B212C22F0F1C867E53368CF6B25CAE25CA4375F9C9C6936534D5218BBD5C328D590E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 0a65af12a3820d0d0270074cdd9947e94e4bd17679fd1c7bd2046eae04a96cdc
MD5 c0c8c344d9c39fbf6a98f48d1ae56063
SHA1 dd86dd2c9552a6bdeeec77a0a792fdde29fe9e6d
SHA512 28bf964d5df786f2bb9a5e2559fdfdd498effa93c8633fbb3a74470ab7de4bf252de04127c97e05f32f8906cd6dcff13f8a1281d7c87ce12bb2769e5ab2e1812
TLSH
T146112711F0F5C867E43368CF2619CAE29CA4378F5CAC7A36534D521C7B95C329D551D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 1a44e6543e92254266b1038e82932a85ad9e1c6d602de03b744d1f94a9fab67f
MD5 91984413087f0fe08ca003d8b3bce909
SHA1 d3eaf37f8123546247b09f6cd7ee20db2cd62de2
SHA512 46d4e5b4f8da54d0534e7ed15b260d5b0a53806f45f1c229a5244ee66874bb423d1918a8d15beb95463c367a4316df998d7e669ac724269f4c0fc2a6abcf41d3
TLSH
T11C213861F0F5C867F43368CF6625CAE29CA4374E9CAC7A36534D521C7B95C328D590E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3340-6-0x0000000000210000-0x0000000000231000-memory.dmp

Download

memory/3492-1466-0x0000000000940000-0x0000000000961000-memory.dmp

Download

memory/3492-4032-0x0000000000940000-0x0000000000961000-memory.dmp

Download

memory/4256-72-0x0000000000170000-0x0000000000191000-memory.dmp

Download

memory/5544-32-0x0000000000940000-0x0000000000961000-memory.dmp

Download