d8d5d5b3984beab34ac89d1de4716fc8cefd0785a8333092e54adabe5dc942bf

Analysis

max time kernel
151s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-05_53cc031b163567d1ccb3ae92ec35598c_amadey_darkgate_elex_stop_wannacry.exe
Size 26.3MB
Sample260907-2d8e2avwdx
SHA256 d8d5d5b3984beab34ac89d1de4716fc8cefd0785a8333092e54adabe5dc942bf
MD5 53cc031b163567d1ccb3ae92ec35598c
SHA1 129ca88b7467eb3e0ca9884b3c47f42f26650440
SHA512 bacba0a311ff6764c98cb6786baf3c8f72d515e86a27b8b46dedd735bb3c0f1f6d912f149515a58b62f3560e6b4134374ba1b52df4737b60b9472f4ee7d948ea
SSDEEP 49152:U+ESm+ES+ESm+ES+ESgq+ESm+ES+ESm+ES+ESm+ES+ESgX+Ex+ES+ESm+ES+ESmQ:5p7R
TLSH
T117572B09F98340B1D92B50F04DCBE3BF8A60BB25C6128DF7FB4DCB5BA932BA15428555
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCCCBCBACACAABBBCBAABAACCACBBCBBCCCCACCCCBCBBBCABBABBCC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCCCBCBACACAABBBCBAABAACCACBBCBBCCCCACCCCBCBBBCABBABBCC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCCCBCBACACAABBBCBAABAACCACBBCBBCCCCACCCCBCBBBCABBABBCC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCCCBCBACACAABBBCBAABAACCACBBCBBCCCCACCCCBCBBBCABBABBCC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4512	svchost_BCCCBCBACACAABBBCBAABAACCACBBCBBCCCCACCCCBCBBBCABBABBCC.exe
720	svchost_BBABBCBACCBAACABABAACCBBACBBBBBCBBCACACBBBBBBCCACCBCBBB.exe
1296	svchost_BCCCBCBACACAABBBCBAABAACCACBBCBBCCCCACCCCBCBBBCABBABBCC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBACABCACCBAAACACBAACBACBBCBCABBACCCBAACAAABAABABBBBBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCCBCBACACAABBBCBAABAACCACBBCBBCCCCACCCCBCBBBCABBABBCC.exe"	2026-09-05_53cc031b163567d1ccb3ae92ec35598c_amadey_darkgate_elex_stop_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCCCCCCACCBBCBBCACABCBCAABBAABACBBCBCACABBCBCCABACAACAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBABBCBACCBAACABABAACCBBACBBBBBCBBCACACBBBBBBCCACCBCBBB.exe"	svchost_BCCCBCBACACAABBBCBAABAACCACBBCBBCCCCACCCCBCBBBCABBABBCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5152	sc.exe
1560	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2148	cmd.exe
1064	cmd.exe
4628	cmd.exe
5412	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCCBCBACACAABBBCBAABAACCACBBCBBCCCCACCCCBCBBBCABBABBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBABBCBACCBAACABABAACCBBACBBBBBCBBCACACBBBBBBCCACCBCBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-05_53cc031b163567d1ccb3ae92ec35598c_amadey_darkgate_elex_stop_wannacry.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5308	schtasks.exe
1828	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4760	2026-09-05_53cc031b163567d1ccb3ae92ec35598c_amadey_darkgate_elex_stop_wannacry.exe
4760	2026-09-05_53cc031b163567d1ccb3ae92ec35598c_amadey_darkgate_elex_stop_wannacry.exe
4760	2026-09-05_53cc031b163567d1ccb3ae92ec35598c_amadey_darkgate_elex_stop_wannacry.exe
4760	2026-09-05_53cc031b163567d1ccb3ae92ec35598c_amadey_darkgate_elex_stop_wannacry.exe
4512	svchost_BCCCBCBACACAABBBCBAABAACCACBBCBBCCCCACCCCBCBBBCABBABBCC.exe
4512	svchost_BCCCBCBACACAABBBCBAABAACCACBBCBBCCCCACCCCBCBBBCABBABBCC.exe
4512	svchost_BCCCBCBACACAABBBCBAABAACCACBBCBBCCCCACCCCBCBBBCABBABBCC.exe
4512	svchost_BCCCBCBACACAABBBCBAABAACCACBBCBBCCCCACCCCBCBBBCABBABBCC.exe
720	svchost_BBABBCBACCBAACABABAACCBBACBBBBBCBBCACACBBBBBBCCACCBCBBB.exe
720	svchost_BBABBCBACCBAACABABAACCBBACBBBBBCBBCACACBBBBBBCCACCBCBBB.exe
1296	svchost_BCCCBCBACACAABBBCBAABAACCACBBCBBCCCCACCCCBCBBBCABBABBCC.exe
1296	svchost_BCCCBCBACACAABBBCBAABAACCACBBCBBCCCCACCCCBCBBBCABBABBCC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4760	2026-09-05_53cc031b163567d1ccb3ae92ec35598c_amadey_darkgate_elex_stop_wannacry.exe
Token: SeDebugPrivilege	4512	svchost_BCCCBCBACACAABBBCBAABAACCACBBCBBCCCCACCCCBCBBBCABBABBCC.exe
Token: SeDebugPrivilege	720	svchost_BBABBCBACCBAACABABAACCBBACBBBBBCBBCACACBBBBBBCCACCBCBBB.exe
Token: SeDebugPrivilege	1296	svchost_BCCCBCBACACAABBBCBAABAACCACBBCBBCCCCACCCCBCBBBCABBABBCC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 5412	4760	2026-09-05_53cc031b163567d1ccb3ae92ec35598c_amadey_darkgate_elex_stop_wannacry.exe	92
PID 5412 wrote to memory of 5308	5412	cmd.exe	94
PID 4512 wrote to memory of 1608	4512	svchost_BCCCBCBACACAABBBCBAABAACCACBBCBBCCCCACCCCBCBBBCABBABBCC.exe	95
PID 4760 wrote to memory of 2148	4760	2026-09-05_53cc031b163567d1ccb3ae92ec35598c_amadey_darkgate_elex_stop_wannacry.exe	98
PID 2148 wrote to memory of 5152	2148	cmd.exe	100
PID 4760 wrote to memory of 1064	4760	2026-09-05_53cc031b163567d1ccb3ae92ec35598c_amadey_darkgate_elex_stop_wannacry.exe	101
PID 1064 wrote to memory of 1560	1064	cmd.exe	103
PID 4512 wrote to memory of 4628	4512	svchost_BCCCBCBACACAABBBCBAABAACCACBBCBBCCCCACCCCBCBBBCABBABBCC.exe	106
PID 4628 wrote to memory of 1828	4628	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-05_53cc031b163567d1ccb3ae92ec35598c_amadey_darkgate_elex_stop_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_53cc031b163567d1ccb3ae92ec35598c_amadey_darkgate_elex_stop_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBBCCCABCCCACBBCCABBCABCBACCBBBBBAACABAACBBCAAACBCCCCBABAAABAAACBCAACBBCCBCBCACBBCCCCCBBBCBBBBBCCCCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBCBACACAABBBCBAABAACCACBBCBBCCCCACCCCBCBBBCABBABBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5412
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBBCCCABCCCACBBCCABBCABCBACCBBBBBAACABAACBBCAAACBCCCCBABAAABAAACBCAACBBCCBCBCACBBCCCCCBBBCBBBBBCCCCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBCBACACAABBBCBAABAACCACBBCBBCCCCACCCCBCBBBCABBABBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACBAABABCAABABCBACCACBBCCCBCCBBAABAAABBCABCAABBBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBCBACACAABBBCBAABAACCACBBCBBCCCCACCCCBCBBBCABBABBCC.exe" start= auto displayName= "UserDataSvc_BACBAABABCAABABCBACCACBBCCCBCCBBAABAAABBCABCAABBBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACBAABABCAABABCBACCACBBCCCBCCBBAABAAABBCABCAABBBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBCBACACAABBBCBAABAACCACBBCBBCCCCACCCCBCBBBCABBABBCC.exe" start= auto displayName= "UserDataSvc_BACBAABABCAABABCBACCACBBCCCBCCBBAABAAABBCABCAABBBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACBAABABCAABABCBACCACBBCCCBCCBBAABAAABBCABCAABBBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACBAABABCAABABCBACCACBBCCCBCCBBAABAAABBCABCAABBBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1560

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBCBACACAABBBCBAABAACCACBBCBBCCCCACCCCBCBBBCABBABBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBCBACACAABBBCBAABAACCACBBCBBCCCCACCCCBCBBBCABBABBCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACCABABCCBBAABBBCCBCCACBBABBACCCCCABCCABACCAABCABBACBBBCCAABABCABCCBCCABBAAABACBBBACAABCCBCAAACABBACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCBACCBAACABABAACCBBACBBBBBCBBCACACBBBBBBCCACCBCBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACCABABCCBBAABBBCCBCCACBBABBACCCCCABCCABACCAABCABBACBBBCCAABABCABCCBCCABBAAABACBBBACAABCCBCAAACABBACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCBACCBAACABABAACCBBACBBBBBCBBCACACBBBBBBCCACCBCBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1828

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCBACCBAACABABAACCBBACBBBBBCBBCACACBBBBBBCCACCBCBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCBACCBAACABABAACCBBACBBBBBCBBCACACBBBBBBCCACCBCBBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:720

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBCBACACAABBBCBAABAACCACBBCBBCCCCACCCCBCBBBCABBABBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBCBACACAABBBCBAABAACCACBBCBBCCCCACCCCBCBBBCABBABBCC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 23bdb5deb519c675c01b4d67029de914c3dad10d8a8f64e4813d860a40668187
MD5 5e76778b13d82b19d38abffcf49b71f4
SHA1 7142fb765342be9c11eaee697cd40663421bf995
SHA512 5b9bf154be3dae631cb058522b914b508f123f9941bdf56088d187fd93f302548875eca766b406d634a02350180e266aff4fc3aab46c1e0f7dd97c4b6868ab93
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 b1d36f7c7a8cac00d8f1bcb9b3156f837aabe996003d62600fb576d88e940afd
MD5 71d676ac66eb45df82ca6f8e9e3a2b49
SHA1 25bc1da9b149c51d0f181716aec4e916eb867088
SHA512 72dc2f74081dc878ef21449d3533e42dd2625d117618a6fea35b404090ab94452e9b29ba8d564029a12aa46e9a7ce552cc84f374f1846e837ab9038dfce4e101
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 0c36b751587a4242da727325ef31fb9558f29029d6e86efdcb8be86f98e4f08e
MD5 02766b38dec3f6d8106ae9775215b743
SHA1 4016759dc610c64b662878aed05aa977bb4c46ab
SHA512 073894b0c0ffb0279de18aa92e1b3d8f6d7a0bbae817f87b294f17e8388808c4581a7a8d81aec3b3837e7eada532b302293d661a4c2feebba12d7bf12b3014bf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 74dc3900d3363a8bc2ddc0685f515b485f7959b28e6753252462a4962793ea71
MD5 f40c6f4bec4ce98d737fe72daef9154e
SHA1 9f07a41d26e9fd442c116a58d0139b5ec33137f3
SHA512 77acb47534d30e9af4a6d91bb2b16f82bd307fdc08526ac06b4b1fb1061e6266281ae419757ca6998693c0a28e8bbde59b3176ce3cb1d4aab755b23c38453d0b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\qap`g`v~dtlq
Size 10B
SHA256 738fdec9ffc96944b80b5ab1c36254468c3db52379302de4db4c2eba6e3c8fcc
MD5 92dfb1fdc16c3b4ebeaa487e88166656
SHA1 2243ca2bfa3706cc15f9ec09b0248fa90b4d1328
SHA512 a20ad410b56077933a035b398e9ed45b4acff0bdd59a060b4cb636c0d670f42ddfceb626476f105fbd923e049ddd20990aec1b8259772e02b1ae7f0aebe23a4e
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 26.9MB
SHA256 6b16e70dc78a951476beb82e7d78383c85c8f81c3e57f628d64d52681bd8aac4
MD5 753ab11abe02761ef71529ba4aa6b580
SHA1 b83f39041553e6130149e29fd95052ca98850caf
SHA512 fdedbecb53c3b488cf77655067014310879bdf0ad4e1e8ab01e2d1ad8dc9d4f7e3e6a51522377443728914503b1d830ee49654d17ec4f018cc8825cf52d11e05
SSDEEP 49152:U+ESm+ES+ESm+ES+ESgq+ESm+ES+ESm+ES+ESm+ES+ESgX+Ex+ES+ESm+ES+ESmY:5p7wgZ2Hb9t+2xU
TLSH
T110573B09F98340B1D92B50F04DCBE3BF8A60BB25C6128DF7FB4DCB5BA932BA15428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 0d99e342abf68f82c11ee517bbee7ded472c3d817cd003bd18484dc0b44f4010
MD5 53d8578b5809f2a87ad6f53dfc4fa717
SHA1 ed29713d5874c0c297f20222bf7229f8e56846df
SHA512 1a7c72fe1eb7b6b153c89b7bb42ee571b1b1a7af77d6962a4bebc5c3a5a6764eea89f6362d12b2817e942228b7d3025c5feb34a78a331b9beabf4f2e4d3e4dda
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 b150873aa7d015373696c50adec12ddf17e13300e4919db7fc5a1020978f2bc4
MD5 685d2b8be49f84b48f3dc6c00b303f74
SHA1 0b0d2527a091d6994cf1678d499a71e0d945fb67
SHA512 98f9ee6ac621f494e9fd7e3f855b7ece6357823f6a9ed86fd14cf429e4996413c5f7af952beb6265e95a56aedf883b3319df4186c8632f05e56b042e6e8117c7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 97edcf59f66bdd6f834a9ff77f4d45f0791a52e3ca9e7ee1fbf66ceb47842230
MD5 79a34df1346c575269f3a1697c193808
SHA1 a8fd5160f89c665df89937b2e60514112079ccac
SHA512 dacca8e936887b18b9965f57833387578a19a423f54d056ae48949706a0231eca3701119dcb3140352c40daf8ff4395525265edd49422877ae80396fa7e89e9d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 0fc8a9081fa40b3cd35a928b93c93e758112ee0d21663bb95da3b411a51f9248
MD5 bdba42b135eca6d92de740d1794ca6f4
SHA1 6392b2aa2079533a68feea8db649a1d06ce9ed0f
SHA512 61934ef85d0efcc63900e30f9fd0c9d0cd8872802f4af5048886b687a6c88a043a11c5ac55836c755c6595676973c6c1efd052ccbf71e7e9c843d05b4ec485ca
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 dbbbe38151bea7f2dacebfac935cf8a327486472070884e6a48589ff263b7154
MD5 03591c56bf46a7df09ee617535663f94
SHA1 d49170f9d09c159794b46666fa32d8306ffc9a44
SHA512 7fc54b58392839fb64cba982e318d692053f1c7dd415307ddd08bf106f369270d902a1c27527b419cbe03faaba8a034da1e16d3199432dd9a0a8f2484201e931
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\pl\qap`g`v~dtlq
Size 10B
SHA256 fe72c808d9e6d0705b724168166b3359766fcb3023ed6ea511d2d172024c4d5e
MD5 67a1e29676a129a2c927e068e5d2a568
SHA1 7358a7e2e3ea19aace2450f3fbf0d0580f23487a
SHA512 3894a4bc1cb82bbaad6c689f22a9b8b8dcb30d34dd0cbdde3e96daa444930a4727ba3c877c05bdc09b3b84ed399db8cac8f0c258458a33681b95f45e9e70711a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 f35d1f78e6b4fd2bb0916dfb77e992acad340b76510eb5b73c95cc5697c57f28
MD5 8f908764d24cd5c09b07b62e563f0cfa
SHA1 0dd6cc9a7b4dde86de23964d858ab1315d0d2190
SHA512 7473187649d2c0f807c3ff2e43e29ae33c13f18adb0508b288cf330a463a50bb332c9f6edfd80ae3bac5298314a312533acae27bdfed094d357e8bcb4b65a9c7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 b32996f5023b66ac22d5e2477064b7eaf6cf1da07a70acfb9de77625bf69104c
MD5 9ec905c505cbbb61aa82afcdee51d488
SHA1 e9a5a2d476a369c09eab5d9f3d0dfa92ef850621
SHA512 6ebffcda536af70718d9d9c8ef65a860bc34264b741be13cdbf756c6151f622c2f000d66d46428dc1986800a159161e5bb5a9140f24fe44086648f5994c38dbf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\ResumeCheckpoint\qap`g`v~dtlq
Size 10B
SHA256 985a582ea6e6dcc23e318a892aebbbc27bdee13fff717036b0b4aebce0be7fc2
MD5 334bd0938a9bbb98d304a8469960ee9f
SHA1 e16378d57ec7acfbf70e9de8d149180524705eb4
SHA512 29db478442edde62aa37c39162561a4649cf92c329cd7b693b81e0a4188f50f4453d4ec0f296915cb6997fb746612bbfc674d0f6386c0fe57d8cc5081b057ef0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 522ac18ee831ff5a993550a28d411f20ce82dbc37b9b62509fa29c90a3ecfd1a
MD5 e361d11ab41b6f2c1699ceae0f9e61a2
SHA1 4982e2db8826304d877333ddce649a568c1d7b78
SHA512 5d6c83227e95f43eb0b1407d097d25ea7b8ca8cf4d6fdefe78692b60799ed8ca66228bc53854edae87533d86188dea4d76cac3d71bd2bba16676af5779d6287a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 202afee3c5b2ec293fa8bf73eaf92a46fdcc4f7eaf4db629f3d57c83a12b2ed3
MD5 00aa2b8b2644d3c1d1029f468e868e96
SHA1 00562283a16bbeaef3102e262c71e259e8366075
SHA512 22e15702bb51b26e29628a7452238ee1948d1d9edece5c2acace6d39ea3e07a355b1b817896faa2d6a6e1ea3fe39fb49538d5dc8c7d6bcc462249f4e3dfe44ba
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 80cfce4f6d9645bfd0b16a21b4cfc53ba66b90a0deff50848199313897680e26
MD5 7d368208f5e3d9387cf3a4eae847469b
SHA1 5904607026023767187c90ddcb1032a24dcb8dd3
SHA512 189d7fe69020c6fba03e622e6d9b5ad890fb2456c9148185c50dceceeb7fd55394cc9acd103d03f8d709e42d24a8a00e1b9d2f6aa38ede3e7b7ebd0b9a27b59c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 49147bc34cd33e84286fc209204256f3b438ccc67bff23c56974785bc6355c07
MD5 60a6f32fd54c0a26c1301159bdc3dc78
SHA1 34c694b5a09b938a199434a79020b8e7f43f75f2
SHA512 c2badc26e7f3c4871fe0bb22a9060723c5ffbe9362e791613897b6531ecaba9cdbc792a4bbaca944d3aa3e67faff92682427ada34043f0ee932c753e4c9bfd6f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b7a531f5d806275a7395c65e282567edd4a95a3e6e89ec01c52e7ea7543fda54
MD5 bb478d0330a569b3d578431d647de264
SHA1 b1eac2d1c3b6a0ed2aa0e4e6b125d7149bf3c156
SHA512 2ef602a2f6557a905e6d55526a3b49b322fdee3100bf1530958205cbcf5d531b762f2ef06413c8138ca135fcf2091e4edc4bb1c1c9ceba119d6544784001d8a4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 62ef2fb614328737546e6e857f44f30fc0a42df6823a4249a272322ec5ec08d9
MD5 a515ddbd4d41cb9d10076872cd90c920
SHA1 8d98bd5035ce5258503d6762de62f56fc3beddcd
SHA512 b13bbc39939a3e7ac07a89c610a40c6141e6c87df8103642bd91d2edbf55c21a1e5591968e90b20771dc530d8691b2c3bdde9cda96bb16e81a2eb08f4261b1bc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 eba0699206982e22d23722ea61200e8e3284b2a8fe845625245bebe405829eb3
MD5 2d93e700248e5bda120b8ad1af590c84
SHA1 88099500ec2bf79b13d27f872b3c063913261f82
SHA512 609bf630b805c77f579597557977318878237041475ab164bfd3f36dbbcf29bc69caeeee4bc1bbaaec063e49e914c06eb89355e419f4d63482a3cd32397d1be5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\Links\qap`g`v~dtlq
Size 10B
SHA256 76e83586460283f130a4dc2f2077711307f55e5334e8610ecbe721e24751a86b
MD5 d19427d08f0d5291a5d1ebb36eb3690a
SHA1 0d18fa8d002ada304f6ecb1f05227018883f7348
SHA512 98ff7c61af37158b973a0870499e629fb318df989dc20789e8285b4cef42b945d325d4678f49837703c600e99dfdcb08d92de541b255afc44b54392f972d794b
MD5 SHA1 SHA512

Submit Download

svchost_BCCCBCBACACAABBBCBAABAACCACBBCBBCCCCACCCCBCBBBCABBABBCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBCBACACAABBBCBAABAACCACBBCBBCCCCACCCCBCBBBCABBABBCC.exe
Size 26.3MB
SHA256 d8d5d5b3984beab34ac89d1de4716fc8cefd0785a8333092e54adabe5dc942bf
MD5 53cc031b163567d1ccb3ae92ec35598c
SHA1 129ca88b7467eb3e0ca9884b3c47f42f26650440
SHA512 bacba0a311ff6764c98cb6786baf3c8f72d515e86a27b8b46dedd735bb3c0f1f6d912f149515a58b62f3560e6b4134374ba1b52df4737b60b9472f4ee7d948ea
SSDEEP 49152:U+ESm+ES+ESm+ES+ESgq+ESm+ES+ESm+ES+ESm+ES+ESgX+Ex+ES+ESm+ES+ESmQ:5p7R
TLSH
T117572B09F98340B1D92B50F04DCBE3BF8A60BB25C6128DF7FB4DCB5BA932BA15428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 409d7e284b76c81f24fe9cf8dd8b19687c60a7bfcc7b2641d26f594cbcedb23c
MD5 0e5dab4c18e5e22cfccd3738da6059dc
SHA1 f36bd364eb256a49b3d55b42a783b3b7cf896a2a
SHA512 157918ef1fe7edf06cd667a8f659c1006c0077418d0a420063553557d6157d90f234a1412029e9411caccfa31225fba1cc869277749c7c15e9a99f37202ba145
TLSH
T15F216260F0B69C77E031A4CB5B29CAC708AC3BBF995CEB5C13095518A715C7E8D394E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 9855e038bedf5509c7ceb98c0cf8d68afbb8b3c2dd17262602348bb75b415550
MD5 bfae337188582aba67e26e9df56882f8
SHA1 233856d710c405fc98244c9a91b7859662b9854a
SHA512 6634929e8abe863d4058cfec3abda4d0202575ba52affa3a0355e21d34f58f3ba8ff8f3171e54f57a0554de2aeff09171e5bb4362b156edab8f19c14b2d57f51
TLSH
T1A111B250F0B6D873F031A4C75B1A8AC7089C3BBFA858EB1C13095618B709C7E8D390E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 2f57714fa2205a215cee6abf59c5c27d107b71150a2c0b531992a888c4875ca7
MD5 4093abc63b956ecb938bf53ec2965b5e
SHA1 79bdbd9fbd12b432d21f806502486f4d8f985bb3
SHA512 4b076f06f7caba3fe57f0a38e8e413fe771b1f4df21fe0b6eb1c239c214d7ed8a2cadd9a8a8781e8694fdb87a43117559ea80d0f8e17fc5bec0424d91242f59f
TLSH
T16B219250F0B69877F031A4C79B1ACAC708AC3BBFA958EB5C13095518B709C7E8D394E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/720-1707-0x00000000000D0000-0x00000000000F1000-memory.dmp

Download

memory/720-70-0x00000000000D0000-0x00000000000F1000-memory.dmp

Download

memory/1296-1710-0x0000000000C20000-0x0000000000C41000-memory.dmp

Download

memory/4512-33-0x0000000000C20000-0x0000000000C41000-memory.dmp

Download

memory/4760-6-0x00000000001B0000-0x00000000001D1000-memory.dmp

Download