233a0ec276f3218f28371b80eb7ad30378504fc23aa30035b18c2d2519b5d26d

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 00:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_074f1b05a8f2bcba47df34ce31ec5aa8_amadey_darkgate_elex_rhadamanthys_smoke-loader_vidar.exe
Size 21.1MB
Sample260910-a498rsed98
SHA256 233a0ec276f3218f28371b80eb7ad30378504fc23aa30035b18c2d2519b5d26d
MD5 074f1b05a8f2bcba47df34ce31ec5aa8
SHA1 7548fb55a01a089a53aa93b26b10c7f4bb1eae4d
SHA512 e994deb9a40baa6557d37b22d061afd3c7d7f025c5a11c27c1aabe64fa9473c12ac49661489a68bc22aad5d98c56fc23c01ccbb155097e66a4ac6a0928b76c70
SSDEEP 196608:lqNqNqNqNqCgOvjleqNqNqNqNqCgOvjlA:QooooCgOLl/ooooCgOLlA
TLSH
T126278D06FA8340B1D97B31B009DFE3BF4979772185318DAAF74D8B2B6933B51582835A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCABCBCBCCACBAAACBBCBBCCABABCCBCACCCABBAACBCBABBACCBCCA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCABCBCBCCACBAAACBBCBBCCABABCCBCACCCABBAACBCBABBACCBCCA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5072	svchost_BCABCBCBCCACBAAACBBCBBCCABABCCBCACCCABBAACBCBABBACCBCCA.exe
6096	svchost_BBCBAACBBBBAACCCABBCCABABAABCBCBAACCCCCBCBACBACCAAABACB.exe
5680	svchost_BCABCBCBCCACBAAACBBCBBCCABABCCBCACCCABBAACBCBABBACCBCCA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCACBCBBCABCBACCBAACBCCACCABBBACCACCBAACCBBBCCABCABACBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABCBCBCCACBAAACBBCBBCCABABCCBCACCCABBAACBCBABBACCBCCA.exe"	2026-09-09_074f1b05a8f2bcba47df34ce31ec5aa8_amadey_darkgate_elex_rhadamanthys_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCCBCCCAAACBBBCACCACAABAABBBBABAACCCCACBCABBABBAABBBBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCBAACBBBBAACCCABBCCABABAABCBCBAACCCCCBCBACBACCAAABACB.exe"	svchost_BCABCBCBCCACBAAACBBCBBCCABABCCBCACCCABBAACBCBABBACCBCCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5196	sc.exe
6108	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3624	cmd.exe
3600	cmd.exe
5284	cmd.exe
4928	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCBAACBBBBAACCCABBCCABABAABCBCBAACCCCCBCBACBACCAAABACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-09_074f1b05a8f2bcba47df34ce31ec5aa8_amadey_darkgate_elex_rhadamanthys_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABCBCBCCACBAAACBBCBBCCABABCCBCACCCABBAACBCBABBACCBCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3372	schtasks.exe
696	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4144	2026-09-09_074f1b05a8f2bcba47df34ce31ec5aa8_amadey_darkgate_elex_rhadamanthys_smoke-loader_vidar.exe
4144	2026-09-09_074f1b05a8f2bcba47df34ce31ec5aa8_amadey_darkgate_elex_rhadamanthys_smoke-loader_vidar.exe
4144	2026-09-09_074f1b05a8f2bcba47df34ce31ec5aa8_amadey_darkgate_elex_rhadamanthys_smoke-loader_vidar.exe
4144	2026-09-09_074f1b05a8f2bcba47df34ce31ec5aa8_amadey_darkgate_elex_rhadamanthys_smoke-loader_vidar.exe
5072	svchost_BCABCBCBCCACBAAACBBCBBCCABABCCBCACCCABBAACBCBABBACCBCCA.exe
5072	svchost_BCABCBCBCCACBAAACBBCBBCCABABCCBCACCCABBAACBCBABBACCBCCA.exe
5072	svchost_BCABCBCBCCACBAAACBBCBBCCABABCCBCACCCABBAACBCBABBACCBCCA.exe
5072	svchost_BCABCBCBCCACBAAACBBCBBCCABABCCBCACCCABBAACBCBABBACCBCCA.exe
5680	svchost_BCABCBCBCCACBAAACBBCBBCCABABCCBCACCCABBAACBCBABBACCBCCA.exe
5680	svchost_BCABCBCBCCACBAAACBBCBBCCABABCCBCACCCABBAACBCBABBACCBCCA.exe
6096	svchost_BBCBAACBBBBAACCCABBCCABABAABCBCBAACCCCCBCBACBACCAAABACB.exe
6096	svchost_BBCBAACBBBBAACCCABBCCABABAABCBCBAACCCCCBCBACBACCAAABACB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4144	2026-09-09_074f1b05a8f2bcba47df34ce31ec5aa8_amadey_darkgate_elex_rhadamanthys_smoke-loader_vidar.exe
Token: SeDebugPrivilege	5072	svchost_BCABCBCBCCACBAAACBBCBBCCABABCCBCACCCABBAACBCBABBACCBCCA.exe
Token: SeDebugPrivilege	5680	svchost_BCABCBCBCCACBAAACBBCBBCCABABCCBCACCCABBAACBCBABBACCBCCA.exe
Token: SeDebugPrivilege	6096	svchost_BBCBAACBBBBAACCCABBCCABABAABCBCBAACCCCCBCBACBACCAAABACB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 3624	4144	2026-09-09_074f1b05a8f2bcba47df34ce31ec5aa8_amadey_darkgate_elex_rhadamanthys_smoke-loader_vidar.exe	92
PID 3624 wrote to memory of 696	3624	cmd.exe	94
PID 5072 wrote to memory of 2784	5072	svchost_BCABCBCBCCACBAAACBBCBBCCABABCCBCACCCABBAACBCBABBACCBCCA.exe	95
PID 4144 wrote to memory of 3600	4144	2026-09-09_074f1b05a8f2bcba47df34ce31ec5aa8_amadey_darkgate_elex_rhadamanthys_smoke-loader_vidar.exe	98
PID 3600 wrote to memory of 5196	3600	cmd.exe	100
PID 4144 wrote to memory of 5284	4144	2026-09-09_074f1b05a8f2bcba47df34ce31ec5aa8_amadey_darkgate_elex_rhadamanthys_smoke-loader_vidar.exe	101
PID 5284 wrote to memory of 6108	5284	cmd.exe	103
PID 5072 wrote to memory of 4928	5072	svchost_BCABCBCBCCACBAAACBBCBBCCABABCCBCACCCABBAACBCBABBACCBCCA.exe	106
PID 4928 wrote to memory of 3372	4928	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-09_074f1b05a8f2bcba47df34ce31ec5aa8_amadey_darkgate_elex_rhadamanthys_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_074f1b05a8f2bcba47df34ce31ec5aa8_amadey_darkgate_elex_rhadamanthys_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAABACBABBCBCBBBACCBABACACACBAAABBAAABACCBBCABCACAAAABBCCBBBBCAACCBABCACAAABBCCBBACABACAABCCCACBCCCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBCBCCACBAAACBBCBBCCABABCCBCACCCABBAACBCBABBACCBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3624
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAABACBABBCBCBBBACCBABACACACBAAABBAAABACCBBCABCACAAAABBCCBBBBCAACCBABCACAAABBCCBBACABACAABCCCACBCCCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBCBCCACBAAACBBCBBCCABABCCBCACCCABBAACBCBABBACCBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBBBBBACCABAAACABAABABAACAABBBBABCCBACBACCBCCCBBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBCBCCACBAAACBBCBBCCABABCCBCACCCABBAACBCBABBACCBCCA.exe" start= auto displayName= "UserDataSvc_BCBBBBBACCABAAACABAABABAACAABBBBABCCBACBACCBCCCBBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBBBBBACCABAAACABAABABAACAABBBBABCCBACBACCBCCCBBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBCBCCACBAAACBBCBBCCABABCCBCACCCABBAACBCBABBACCBCCA.exe" start= auto displayName= "UserDataSvc_BCBBBBBACCABAAACABAABABAACAABBBBABCCBACBACCBCCCBBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBBBBBACCABAAACABAABABAACAABBBBABCCBACBACCBCCCBBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5284
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBBBBBACCABAAACABAABABAACAABBBBABCCBACBACCBCCCBBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6108

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBCBCCACBAAACBBCBBCCABABCCBCACCCABBAACBCBABBACCBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBCBCCACBAAACBBCBBCCABABCCBCACCCABBAACBCBABBACCBCCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCBACBCCAAABBCBCCACACACCBBACBBACBABACBACABBBCBBCCACABBBCABCACABBCACCABCBBABBCAABAABBCCAACCCABABABBCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBAACBBBBAACCCABBCCABABAABCBCBAACCCCCBCBACBACCAAABACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCBACBCCAAABBCBCCACACACCBBACBBACBABACBACABBBCBBCCACABBBCABCACABBCACCABCBBABBCAABAABBCCAACCCABABABBCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBAACBBBBAACCCABBCCABABAABCBCBAACCCCCBCBACBACCAAABACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3372

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBAACBBBBAACCCABBCCABABAABCBCBAACCCCCBCBACBACCAAABACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBAACBBBBAACCCABBCCABABAABCBCBAACCCCCBCBACBACCAAABACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6096

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBCBCCACBAAACBBCBBCCABABCCBCACCCABBAACBCBABBACCBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBCBCCACBAAACBBCBBCCABABCCBCACCCABBAACBCBABBACCBCCA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 1ef786ba771fd48d1b7b9b479c72359b0b5d64fafc09e5a79a46b68ae3d4ecf2
MD5 b5f9a639363e882acba87204ec9ab242
SHA1 bdde34d391a7a411ee6aa6f45fffc57527835872
SHA512 4fcdb3553dbe897cb804adc481789b78d6c94bc37ba56108b1210521035dfff7016af092ac7b1faa0cecc47ad5df0411980f99681a3f9a15c0238d74484a62c6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 01521edc2b5cd723235ecb0a067fded7bc1ccaf6fca3b3c9764527b966bfdb9a
MD5 ff01d420673ffc544b145c7114c54698
SHA1 0172ad37a8c64ba1ba5f8d17c9fe061fa77e6e43
SHA512 ff0a3d4e7208bb56ca2c4767785d4ebfc88f76289994c2e8484405efcc35bd247e65d7cb3c66554375be4f2e91d9640f537c550b842907d44beea086b5e1b400
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Provisioning\AssetCache\CellularUx\qap`g`v~dtlq
Size 10B
SHA256 c8e44444cb289237f17f88c38c348f9be6ffe0fd8b4a9b37288994ee21ec3396
MD5 5ff7345ddc137c8e2a80e136e8d27d2b
SHA1 721a787f85e0ebd08a065df9f93ccbd5c515428f
SHA512 d8b00bb69b916c38d4dadcb3e51d74d9e9dced9a273fcf8ec62e532e76ac24164a36dc7b469c043f18ccd9c67678dd9efddc69dfd9a2b2d62a7977d2bd9e8670
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 596fd77e3d2a82946ccd88cdcf95cd3bba9df7d91b8c3d0f936e2b7a75d5c1f9
MD5 32352eeb70781019695fbb765c4b54cb
SHA1 efc52b505ee36fae7b415ddb6ae7abf41a15b760
SHA512 f8c6f337d90cd2f4957e9fe9c5a4356d674b88146035543889f83aafb7162b6e02b35c1ce458ad20b9704a2b28090227870a64ed7ee262933e1b5f6d08b1a491
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 21.6MB
SHA256 fef0ff40eaa0253047b6e103523027cc2fa4f7917c34d9e576fdd37e738c9cd1
MD5 185d0c930a24015eae8078ba9709f06f
SHA1 d1119a93f5e9499110f074187f5350e085c14f68
SHA512 907824f68a85fc1cdb8bfafc7686d8e6a4f752a1a82aa34eff7808527b45ea074819828a6529049686c7c56aae4dae8847064149e4fe6dd8bf10567fdb489215
SSDEEP 196608:lqNqNqNqNqCgOvjleqNqNqNqNqCgOvjl/gZ2j9:QooooCgOLl/ooooCgOLlO25
TLSH
T119379E06FA8340B1D97B31B009DFE3BF4D79772185318DAAF7488B2B6933B51592835A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 0441a2c9537cbda2e175559776fadc03af3d405129e4acdd9241442e5d8f28c3
MD5 71f229f9b3d10ed7d5e2c65a8be9fb74
SHA1 fe0fc676b7889617112100ef8b4bc8122f62f848
SHA512 41778f6e8d1af4aa8034b0b28226bf8f715cfc87bd0d2752bcce9d821d38e054afccab2b98d24a3fddc97dea37b51c4663f509137ea2ef2f00286e89f40c6414
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 3c8c72d4f22c83104b3dac55d1de034f833ecf43486ad211f7d30cc50e0b3ba9
MD5 a71fd82508d461ae8c304677ec7104c1
SHA1 3bb895927caa7b0c2a021254bb14279bb66adb6c
SHA512 dff6ee0e7a85ed85e29c967a73c1b2af3fd1b342ef137c5bbb2d7ece232581b644ff608d7175fb0470d85733042e702e2723d3765c156372ffe73ed47d1ba3ab
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 c35e96d53701a7cc5556f5d8688fb05477c85748e8081c2d85d0d2d7aa0c2fee
MD5 722b1a9f450f22a8b805e469481f5e69
SHA1 291c28f9cc698729bd1c3979334d002933c6016f
SHA512 c2da862229483ea9bcc4d38464460722bab5721930f26c556ad8f043204ce75bd0ed22a43dc155bac5728950f5652684618ac4b74346bc1fc3d9976eef7734ca
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 bdf5e57cf18c6500bdb77ae9cb2a6b3978a68438eec9c15ceb5f9a65d64513b3
MD5 4ec2526774ea3d5cdc9a7610123f1e19
SHA1 0850117d957a34f37efb241f912d42d2d06b742d
SHA512 4f091661a81a21056aaa3ea31f4574c32a6e92db106254ab6ad7e608f2f01f02bc31ac0335e9f3c0f1c2d7babddefd5447029109173864235f8c2b321cef217d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 6c9a95babab78e6a27c173fbf3bcb9a7458314bbd81a28711d7a651acb3db6b9
MD5 acc58e424ed8568c4641bfd21c5213b8
SHA1 93c12d0e706cfc569e136015b2758b4afd4b7683
SHA512 367549a21e415ad3c370ef13a82c976739b2dcb9765d95ebb565e6de09c9a3980271ee51eb89c8d30f0dd81f6121444603ae0f166ee9319d28e65ad879743e27
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 49151bb4e3e94368b8e6d990db8f9b4912978dceb62cdfea165682ca1f22492f
MD5 a373d563f6ea23f3740f490e541b7c94
SHA1 30471c68c6fb6d5bbeac49c35b87e6e3d28e5d7c
SHA512 b1ff42387d4d76f2d8850cff679d46e07bcc7cd373eb2730cda2aa0b5107991174ef86f1c80b8999c79016bd8d4f249ac133f952b7413a251c19817177bb0f7c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 8458e2fdf12c2ee815d9cc564a242a7b880e0d1aefb44fea016bc9d2b0105a6b
MD5 cddda6d3ccd366998239e38bfa7344c8
SHA1 6c2b8da3f8f46ca34c1e18ec9dd8460e33093ee4
SHA512 301aba456751a73658dcde0dd8deaa5234a4334bfa4c495cb0bab0ff46f6aa58a76a98b6e10e1e57ca66c991168e25d2670c5d866fe5df9e10f84ffbe8e8e690
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 56ae101c534309174084a24d65b6d34f870046017ef7b2ecd3b35f754f551570
MD5 cc26b6c5cf6aa368b30b610373bda908
SHA1 3c836a2f6d7783fd0ebb275e39f95ec2e6dbd32b
SHA512 8c29e2070f5460b8e6637475aa604f9d6b85b220d29fe24b8768634a0230f6930bfaea2029bdd39729d128a523732bdd1addc21349f203f649ab107049ed2255
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8de832c7cd08bf2c55496f5c3e3cd91ca9a347a745a90a2b88778013a4a12b03
MD5 144f3d05fa35a9e10f025bfb2be33f8d
SHA1 4240d1f8886ac25d7d07c56a1629305e2ea26901
SHA512 bed8989e5fe72e4aa5e24f4467c02109714dc70e8b00576faafd83e43822ac471cc4279c5e10d84543ed2fbb244f8cfac1b2c3785bcd7344290c00fce5c4e5ea
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a2081750263d0b355e3d4f5191e01c09e8a0427db8f47118ed47eca8e0cf60af
MD5 f9e338a389c523050b98d985936c0bf9
SHA1 3227caff5162fbad6073675102702302e24cb89b
SHA512 2d4cc6584ad30def280ca1a1095c2357b7fc42402ff786c94456b3a9c74b48cad350bce0e644f45539e3e0d9aa9fdef8d7e07bbaba751c558fe837355df7f5bf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 787a4cb7dadc5aeee59e24fc608bfb27aeeffc717230e5f0829c6725bbbbe17b
MD5 3cb35a601640f7df02025a26190dcc0a
SHA1 6e83f51aa80d487797c70898aee69a408e7b9b1c
SHA512 7b561df36dd195f1d79730115ebf9b1cea03cb49a756860ac5db7b088ef68373886ef4f18abace4c67651a6c2e806934d273679c538cc69f0a1807b6fc7c4ecf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a51585cfbda4e3e619802af85e06b8187d972e586700e15322bf92ac503a272d
MD5 068bda1ecbf8c72fe3cc7619431c1bc5
SHA1 8968f600a5a7bf74f1d4c8eba77f2dfefc320de8
SHA512 290b589bb89bc33b8a4c4d07423ace0dc74eeffd7eadb4a2a96e9abd8c9149cfe22725a41a132dfc6843996f0c135f412423d8f732dfc29a09724be712223960
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f677af9e81454ace8be144e82f383eb326477cd6803564caae1e56ac6f0a7d02
MD5 bc686799fe74f137f98da0f95754de6e
SHA1 7da76b72abef05357008b55a551aedff1a36d10b
SHA512 d60ef5ed5243f930d99dcb36aaaa432be6adf27e5ab5003794f37131c7cb10ec6c750df0ab0ac54cb25791637303aad5994424d7c90b4d03aee78ec2d2f5e965
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d81457c39946bf214df0e031118ab6acc8b390628dbf7d233f528cf88eec2814
MD5 463a6ae93540f371190a1ad61b7f06dc
SHA1 5916a43808abf5fcd29fbd376022ef749fdd3e1e
SHA512 3aaee46e9ca15f584ad5a3a59392e0baf678736e32febe34f10973179c5552b99a7a8539500e954e2eed5ab30294ee2cf2c70982203242f208cbf872738ffff3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\qap`g`v~dtlq
Size 10B
SHA256 a4fb329d12a4af7a33e6566765bee4fa2911537a81e5f18759afa1e2e2f076d0
MD5 07fa674e1e823b175316f11cb0836c4e
SHA1 cdc8c8960b79961385666a06cf1ff5fd425145ee
SHA512 0648c3581876f8961f20dfe24f87f70d4ce51ad33bd7f068ea1ce8b4dbdb3dc56ff0ba82031040194116a7e7edb6684f1a6cf0fba649297f7dec92e56eedef10
MD5 SHA1 SHA512

Submit Download

svchost_BCABCBCBCCACBAAACBBCBBCCABABCCBCACCCABBAACBCBABBACCBCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBCBCCACBAAACBBCBBCCABABCCBCACCCABBAACBCBABBACCBCCA.exe
Size 21.1MB
SHA256 233a0ec276f3218f28371b80eb7ad30378504fc23aa30035b18c2d2519b5d26d
MD5 074f1b05a8f2bcba47df34ce31ec5aa8
SHA1 7548fb55a01a089a53aa93b26b10c7f4bb1eae4d
SHA512 e994deb9a40baa6557d37b22d061afd3c7d7f025c5a11c27c1aabe64fa9473c12ac49661489a68bc22aad5d98c56fc23c01ccbb155097e66a4ac6a0928b76c70
SSDEEP 196608:lqNqNqNqNqCgOvjleqNqNqNqNqCgOvjlA:QooooCgOLl/ooooCgOLlA
TLSH
T126278D06FA8340B1D97B31B009DFE3BF4979772185318DAAF74D8B2B6933B51582835A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 b5db3c5b7ee5675e4c823a0b2cec8930657c1981c83e44ad2dde33a86a2f99f0
MD5 be2d7b4b9814fe8d0b4c30308f4ee89b
SHA1 d37c0d4221986940c4f527c707f0e0567858f4e7
SHA512 0849eafa663f994898f90f8bb83da11133db7b754d60b6ad82b91c3cf260833d807d48bd2a70ca7df8a2442ebe7aecb4f4ce8967c38e849d621ee1d95d8ef0d1
TLSH
T1C9118411B0A69C57F03168C7692D9BD60E9877DBBC5CAA44230D8218BF59C35CD194F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 abae64af13624e608ffcc78c47e20e789f6c6a7f52bfc339ae9414d087a9fe5e
MD5 5ab37fa16a2bfce995e25ef4c5a36530
SHA1 beb59484b2e0c48dff44e371c53b6486a70e9ab1
SHA512 4813ec3c248320ecd358f5cb26f0b118e7e6d838240f3cd8380f3a5a11f4c45904be02bc6768d44738b663e46c6c5e45b0ae2bf16720867ccf31e1a1bef1859f
TLSH
T1C321A651B0A68C67F03268C7692DDBD60D9877DBBC5CAB40230D8218BE59C35CD194F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 2dbe028619a9807f649a5f0c7dade030d3ad183185e065c2edf7e54d179dfc79
MD5 50efea8b68414227b518da3f40116319
SHA1 6378ce98ed7f8deb33a1aad7714419d4399707ed
SHA512 5f007de39770982434d45b93adb3ee4265f5e902f3a68ab6af4204c927e7322065f2986f858042789d44fa7f03d91b2acae4d42f9e962efeea1e839c7c5e8cd1
TLSH
T1F411E350B0A69897F03268C7792DDBD60E9877CB7C58AB54230D821CBA59C35CD194F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4144-6-0x00000000004E0000-0x0000000000501000-memory.dmp

Download

memory/5072-33-0x0000000000AE0000-0x0000000000B01000-memory.dmp

Download

memory/5680-1460-0x0000000000AE0000-0x0000000000B01000-memory.dmp

Download

memory/6096-68-0x0000000000110000-0x0000000000131000-memory.dmp

Download

memory/6096-3922-0x0000000000110000-0x0000000000131000-memory.dmp

Download