f767686a89b5ac37f7afcec9654086dbef7174f331d7537975e493f5bd69200b

Analysis

max time kernel
149s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_5286e919ad17b5e630afc942f0a79351_darkgate_elex_stop.exe
Size 1.5MB
Sample260905-msd3eazsds
SHA256 f767686a89b5ac37f7afcec9654086dbef7174f331d7537975e493f5bd69200b
MD5 5286e919ad17b5e630afc942f0a79351
SHA1 8ba6e76587efeb930b0e652defcb2b4d7717d672
SHA512 3a9d66464db91467f18a14ba78f5ab2d767b7728ab4b9bdb1919ecec56b08ce0660124e35fdc5991513beee0da556e8c0790f2096379f4961545a644c40942a3
SSDEEP 24576:m9+EM0v9+EM0JafDd70iTWCsLgV83LzXYJLKSMech6ispJzc5YYmsRr6ylMwpbdg:U+En+EYDd79WCsLgVLKRWTQ6Zs5DhgPB
TLSH
T1EC759E12B7C14031F5B335714AAFE379597D76214B3589CF93880A7E5E72AC0AA3836B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBBCCCCCBCBACACABCCAACCBBBCBAACCABABAAAABCCCBCBBCAABACB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBBCCCCCBCBACACABCCAACCBBBCBAACCABABAAAABCCCBCBBCAABACB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3268	svchost_CBBCCCCCBCBACACABCCAACCBBBCBAACCABABAAAABCCCBCBBCAABACB.exe
4268	svchost_ACBACACAACACACCCBCABABBCCBCAAABAABBBACCACCAABCCABABCABA.exe
4136	svchost_CBBCCCCCBCBACACABCCAACCBBBCBAACCABABAAAABCCCBCBBCAABACB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_AABBCACBCCCBCABCBCBACCBACBCABACACBBBACABCAACCACBBCBACACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBACACAACACACCCBCABABBCCBCAAABAABBBACCACCAABCCABABCABA.exe"	svchost_CBBCCCCCBCBACACABCCAACCBBBCBAACCABABAAAABCCCBCBBCAABACB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CCBABCCCACBCCABABACCBACBABAACCCAAACCACBACCCBBAACBBABCBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBCCCCCBCBACACABCCAACCBBBCBAACCABABAAAABCCCBCBBCAABACB.exe"	2026-09-04_5286e919ad17b5e630afc942f0a79351_darkgate_elex_stop.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3892	sc.exe
4684	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3740	cmd.exe
2460	cmd.exe
2216	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_5286e919ad17b5e630afc942f0a79351_darkgate_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBCCCCCBCBACACABCCAACCBBBCBAACCABABAAAABCCCBCBBCAABACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBACACAACACACCCBCABABBCCBCAAABAABBBACCACCAABCCABABCABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
308	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1944	2026-09-04_5286e919ad17b5e630afc942f0a79351_darkgate_elex_stop.exe
1944	2026-09-04_5286e919ad17b5e630afc942f0a79351_darkgate_elex_stop.exe
1944	2026-09-04_5286e919ad17b5e630afc942f0a79351_darkgate_elex_stop.exe
1944	2026-09-04_5286e919ad17b5e630afc942f0a79351_darkgate_elex_stop.exe
3268	svchost_CBBCCCCCBCBACACABCCAACCBBBCBAACCABABAAAABCCCBCBBCAABACB.exe
3268	svchost_CBBCCCCCBCBACACABCCAACCBBBCBAACCABABAAAABCCCBCBBCAABACB.exe
3268	svchost_CBBCCCCCBCBACACABCCAACCBBBCBAACCABABAAAABCCCBCBBCAABACB.exe
3268	svchost_CBBCCCCCBCBACACABCCAACCBBBCBAACCABABAAAABCCCBCBBCAABACB.exe
4268	svchost_ACBACACAACACACCCBCABABBCCBCAAABAABBBACCACCAABCCABABCABA.exe
4268	svchost_ACBACACAACACACCCBCABABBCCBCAAABAABBBACCACCAABCCABABCABA.exe
4136	svchost_CBBCCCCCBCBACACABCCAACCBBBCBAACCABABAAAABCCCBCBBCAABACB.exe
4136	svchost_CBBCCCCCBCBACACABCCAACCBBBCBAACCABABAAAABCCCBCBBCAABACB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1944	2026-09-04_5286e919ad17b5e630afc942f0a79351_darkgate_elex_stop.exe
Token: SeDebugPrivilege	3268	svchost_CBBCCCCCBCBACACABCCAACCBBBCBAACCABABAAAABCCCBCBBCAABACB.exe
Token: SeDebugPrivilege	4268	svchost_ACBACACAACACACCCBCABABBCCBCAAABAABBBACCACCAABCCABABCABA.exe
Token: SeDebugPrivilege	4136	svchost_CBBCCCCCBCBACACABCCAACCBBBCBAACCABABAAAABCCCBCBBCAABACB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2412	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 3740	1944	2026-09-04_5286e919ad17b5e630afc942f0a79351_darkgate_elex_stop.exe	95
PID 3740 wrote to memory of 308	3740	cmd.exe	97
PID 3268 wrote to memory of 2208	3268	svchost_CBBCCCCCBCBACACABCCAACCBBBCBAACCABABAAAABCCCBCBBCAABACB.exe	98
PID 2208 wrote to memory of 1592	2208	notepad.exe	99
PID 1944 wrote to memory of 2460	1944	2026-09-04_5286e919ad17b5e630afc942f0a79351_darkgate_elex_stop.exe	103
PID 2460 wrote to memory of 4684	2460	cmd.exe	105
PID 1944 wrote to memory of 2216	1944	2026-09-04_5286e919ad17b5e630afc942f0a79351_darkgate_elex_stop.exe	106
PID 2216 wrote to memory of 3892	2216	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-04_5286e919ad17b5e630afc942f0a79351_darkgate_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_5286e919ad17b5e630afc942f0a79351_darkgate_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCBACCAACBAACAACBCACABABAAACBCCCACACACCAAACAACABAAACACAACABCBCBCCCBCCCBBBACCBBCBBABBABCACACACBCACCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCCCCBCBACACABCCAACCBBBCBAACCABABAAAABCCCBCBBCAABACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3740
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCBACCAACBAACAACBCACABABAAACBCCCACACACCAAACAACABAAACACAACABCBCBCCCBCCCBBBACCBBCBBABBABCACACACBCACCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCCCCBCBACACABCCAACCBBBCBAACCABABAAAABCCCBCBBCAABACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBABCCBCCBACAABACACBABAACAABBCBABACCAAABAACACCACCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCCCCBCBACACABCCAACCBBBCBAACCABABAAAABCCCBCBBCAABACB.exe" start= auto displayName= "UserDataSvc_BBABCCBCCBACAABACACBABAACAABBCBABACCAAABAACACCACCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBABCCBCCBACAABACACBABAACAABBCBABACCAAABAACACCACCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCCCCBCBACACABCCAACCBBBCBAACCABABAAAABCCCBCBBCAABACB.exe" start= auto displayName= "UserDataSvc_BBABCCBCCBACAABACACBABAACAABBCBABACCAAABAACACCACCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBABCCBCCBACAABACACBABAACAABBCBABACCAAABAACACCACCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBABCCBCCBACAABACACBABAACAABBCBABACCAAABAACACCACCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3892

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCCCCBCBACACABCCAACCBBBCBAACCABABAAAABCCCBCBBCAABACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCCCCBCBACACABCCAACCBBBCBAACCABABAAAABCCCBCBBCAABACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1592

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2412

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACACAACACACCCBCABABBCCBCAAABAABBBACCACCAABCCABABCABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACACAACACACCCBCABABBCCBCAAABAABBBACCACCAABCCABABCABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4268

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCCCCBCBACACABCCAACCBBBCBAACCABABAAAABCCCBCBBCAABACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCCCCBCBACACABCCAACCBBBCBAACCABABAAAABCCCBCBBCAABACB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 a2931f67d440c0ff411d016c345d71874a0ff29a9373b0218d6ef3f0ab492731
MD5 1a32fc9853d1637c2ad6cf349ade4ec0
SHA1 ed02e346edd8642667c7baff3d6934136284cbce
SHA512 859853a713e4c5b92a2f41cce825ee13b717c87aa657b6f7bb2188610b36a2a0b871177a3dd7e08d1381c77d4e62c2f8fa919800f85033e91852133e3be611e8
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 2.0MB
SHA256 9add37b74d09461c6ce83bded514806081395a6324d504d73bafabf6b4c1e8ff
MD5 bb61d6064808a6acc92b7e6f7583c04e
SHA1 e0deba6702c719a9b7a7206631d3935d210d1272
SHA512 97fc0a45fbe9a9c930d019aa40091273de31bc4d2e5e240aa1f8e20e2529cac1c42697adbb8aebc4301bf581a29793335f0e93e9eeb0584191013e2984069f59
SSDEEP 49152:U+En+EYDd79WCsLgVLKRWTQ6Zs5DhgPKXpiMS:1p73KRuy5a+pix
TLSH
T18A957D12B7D54031F6B33A314ABBA375597EBE214E34C58F63841A2E5E71AC0EA34727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\fr-FR\qap`g`v~dtlq
Size 10B
SHA256 8c9cde795711c8f626efcdc3aca0b0b716f649e26d78fc57c3b3c26b1f482a89
MD5 c4af4b0250b5ca9e1f04baccfae78396
SHA1 87789295dad8c3287cc3d534e74b86146b1f1ac5
SHA512 e77814c8be51e989fa43e140babfc1bca513c972fd20a261fdf4ae3c3d1000f78d94fa75eca7842a45f5aec90d890dbdcc232a54d00cc3c728e09dcd70eb8e5e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\fr\qap`g`v~dtlq
Size 10B
SHA256 b81c39e1aecec7d562019f0208f304cd24d2a6c33158d8065e8bd6ed2ca9bcc6
MD5 13671c03aaa6136e9338295cf7438fbc
SHA1 9983ed8ca3ceef757d8fdd18d7f64957fede3102
SHA512 4f74c7a9bb2a44a357ce2424934649d68fc37e83b41bc7c1af2088a9ccc73470bbf7d24bbc74eec4015a4d92647b588c710ab9a1c8cdf5c011114e9740f57775
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\AC\INetCookies\qap`g`v~dtlq
Size 10B
SHA256 20bae58c4e0a20979b3ad49e1200da6219af752b484cfba420899ffd852ad124
MD5 fad5fe89e3fb3cabe7907a4ea9742cae
SHA1 f8b23e1424ac9fc5425d1c0ef08a082c61e0dc19
SHA512 8d2c9ed761cf4bea1b150f049509ddad2f479ac496c6ef87e875a543d8a5efa685e478d311edb076b6f580f45ca10976349ab7f29e9207e351e83337b2bb6eed
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Temp\TCDF7E4.tmp\qap`g`v~dtlq
Size 10B
SHA256 54709c2a7febfc77a804755d29b8f5083ebbcfe9c2ec02dfc789c4dbe170cb4e
MD5 52cbcc9cf9074859e6d4e03543ca707c
SHA1 0c3692f537e19e3e5f5cfcd8ef25f20c093d7a84
SHA512 0414d42fa8c9b148c4160b09ec077e010ea959f3a24f9b9aa6cdd7bc6c63288fb43008419e4fa0d3ef8101aa24d1e2917f84e9e089950a3779e81f4a56cae3bf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2c41703caa8b8c24ba7c5805f680d3fb78c850d0216675780c45a4953a934730
MD5 0cbb2bc4539a3528f2deca4a6c893c1f
SHA1 9efa96b05314feef621641b20d2815f6265d34db
SHA512 20f1dd4d9c9d7de230543612288c33554baaae68f72737bfc94d6a2c27a1117fae9458810746b3b43e9fc888943ed93bb65da79c706e7c86eec0b6ec629fc45d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7a4fbb7089591595a4d6efa841dbc4cd2315158e7a6843eecb7d9fc8136fcadb
MD5 c834af3bf26166e385fb8d44c9ceea2e
SHA1 b9ded8c6ac2d71da1dec7aa685f4d8e9107ccc90
SHA512 13342981842fa21b4d805f3c32de48f1f9cd101b49a2173d61e848c5a3ffa5af6a2cada67876c92ff85b5bd63aa768c27e45ec7b6d6d2c316797a609a60c89e2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0d412bd6d813ccfbf3bea2036908d216c9807a227d8a8070c537ba4b901bd0c8
MD5 bf0a9039b00f2fdfeb58e6ec5557e40b
SHA1 0761055ace72f6a766d820c5553faef9acf0caf7
SHA512 9269709f266a51b1b074add85ca513333631e380d84d67958a4533cbf11a999d96d8d8ef62565d9dc48b39a85f667589748c580fbd416974f5f050d1d4139e9e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1396ea63c9b04649e56139981675c1e0810af2438df6912230ccfa334a6d8643
MD5 53f5bc5d2af7aae69ec4faa094d7e56c
SHA1 5478bc0b3b6bc868157d071f838d156724d0b9d2
SHA512 2447415154b78d00352ba310f3eeaeb081c8dcbc1d1eb900e3acd44e76a249bc213dd87266fd81ee9d2b652831347fc9719e2ff71db9f4aed4c0365482d983a7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2753e54452eafd228193cfc4fce1e530cfc52d0c24441a30c166fda88ba287f8
MD5 85928385b66deff4b9efced851ea676c
SHA1 abf8d270f6c118b93b16272d9658577f0a53b01a
SHA512 21d29efa431bd9e3f84456ff798ff33bcb04f4332e775eb563f91f68ed91f27ae451c0680dd16ddb8f4d1559e665f3860aab01e1d565da537ccbf25b13c96361
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0293e69bd53db21b13ea6c845abb0bde058242f11475ee312723af113e73662a
MD5 35d4c92d7be133b6160b9e26c7295e44
SHA1 faf2ec805384a075ab5d195728335da93d01b285
SHA512 0b356e71c7ae8c9dd2690806c92465524f21c2c56d4e6d2c8855505ba2ac71ce1b4c31c33cfe4cd74c71c5838a0ded1a8409404ce09d15d488797b4e93e5e534
MD5 SHA1 SHA512

Submit Download

svchost_CBBCCCCCBCBACACABCCAACCBBBCBAACCABABAAAABCCCBCBBCAABACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCCCCBCBACACABCCAACCBBBCBAACCABABAAAABCCCBCBBCAABACB.exe
Size 1.5MB
SHA256 f767686a89b5ac37f7afcec9654086dbef7174f331d7537975e493f5bd69200b
MD5 5286e919ad17b5e630afc942f0a79351
SHA1 8ba6e76587efeb930b0e652defcb2b4d7717d672
SHA512 3a9d66464db91467f18a14ba78f5ab2d767b7728ab4b9bdb1919ecec56b08ce0660124e35fdc5991513beee0da556e8c0790f2096379f4961545a644c40942a3
SSDEEP 24576:m9+EM0v9+EM0JafDd70iTWCsLgV83LzXYJLKSMech6ispJzc5YYmsRr6ylMwpbdg:U+En+EYDd79WCsLgVLKRWTQ6Zs5DhgPB
TLSH
T1EC759E12B7C14031F5B335714AAFE379597D76214B3589CF93880A7E5E72AC0AA3836B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 928214dbcc166ef9c605e74971102500f75d147b7173dd51ecd646c89628836c
MD5 93086ae1c5f05801d06234f0d05d3754
SHA1 0dcdf7726e7276796f5b5654f0c277ea6ab7238f
SHA512 892fb8393c11ef4459d64ed77408aa47a0cbc209381e51a23281aeba9f097b0bc7138fda77700617545978936acbc443e2823a16bb97ff391e565c32cebb7ed4
TLSH
T165110A62B0A5D857E13168CB65259B4B0DF83BABEC5CAB253329421C7719C38DD198F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 3aa15c325734837fda95136566950d3459a2ac23cfeddc51056f2c452fedf807
MD5 c7ddf5ef61c46b79d263be66741e8cc9
SHA1 9d52c78d28b9af4b4c8304c7a75cafccaac54eb2
SHA512 1187d7fed87b3ad9ce4bef577a0547bae048e8ff7f4805f62f9097528da03a13cc59b428928bdd1431af52814fd890adb429d87689b337dd18ef713b0ebdb160
TLSH
T135210B62B0A5D857E13168CB6525DB470DF83BAFDC5CAB603329421C7719C39DE198F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1944-7-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1944-0-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2208-58-0x0000000005B20000-0x0000000005B21000-memory.dmp

Download

memory/3268-34-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4136-2915-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4268-77-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4268-3159-0x0000000000400000-0x0000000000421000-memory.dmp

Download