655f1d2b425fc1137101ff7f2ce47e21d1956a9ba10180fb17fc4fb49613676f

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_8e7a904b9db327c09fc6f3d8e7291802_darkgate_elex_hawkeye_remcos_stop.exe
Size 22.2MB
Sample260810-e2ljvavyhx
SHA256 655f1d2b425fc1137101ff7f2ce47e21d1956a9ba10180fb17fc4fb49613676f
MD5 8e7a904b9db327c09fc6f3d8e7291802
SHA1 f42126540c22cc8a0d32a25d77ceee5a1ba62de0
SHA512 2fa63c1a7866ea767a8dc397b47229e835bb2c2f10686db81e5362ec80c3caa500c386b2f7da005166918df7454d199571f92e410912e5e7acad0d4e3cd5df92
SSDEEP 196608:kFlfFlVFlfFliFlfFlVFlfFliFlfFlVFlfFlaqsT:i3Z3+3Z3+3Z3JM
TLSH
T18137F106FDC640B0ED7725700CEBE27A49357E36C4318A5EF6C97B0A6A33E50942A767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c572-18.dat	UPX
behavioral2/files/0x0008000000018297-385.dat	UPX

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABCABCAABABCCBACABABBBCCAACABBABABAAACCABCCCACABABBAABA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABCABCAABABCCBACABABBBCCAACABBABABAAACCABCCCACABABBAABA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABCABCAABABCCBACABABBBCCAACABBABABAAACCABCCCACABABBAABA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABCABCAABABCCBACABABBBCCAACABBABABAAACCABCCCACABABBAABA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1512	svchost_ABCABCAABABCCBACABABBBCCAACABBABABAAACCABCCCACABABBAABA.exe
1528	svchost_BACBCACBAAACCACACCABACAABCACCBBAAACABCCBBCBAAACCBCCBBCB.exe
5124	svchost_ABCABCAABABCCBACABABBBCCAACABBABABAAACCABCCCACABABBAABA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCCCBCABCBBACCACAACACABBBCAAAAAAAACACABCAAACAABBBCACACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCABCAABABCCBACABABBBCCAACABBABABAAACCABCCCACABABBAABA.exe"	2026-08-10_8e7a904b9db327c09fc6f3d8e7291802_darkgate_elex_hawkeye_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCAAABCCCCBBABCBBABABBCBCAAACCAABBACBBACCBBAACACACCCCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACBCACBAAACCACACCABACAABCACCBBAAACABCCBBCBAAACCBCCBBCB.exe"	svchost_ABCABCAABABCCBACABABBBCCAACABBABABAAACCABCCCACABABBAABA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1244	sc.exe
1492	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2252	cmd.exe
3036	cmd.exe
4460	cmd.exe
1216	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACBCACBAAACCACACCABACAABCACCBBAAACABCCBBCBAAACCBCCBBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_8e7a904b9db327c09fc6f3d8e7291802_darkgate_elex_hawkeye_remcos_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCABCAABABCCBACABABBBCCAACABBABABAAACCABCCCACABABBAABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3364	schtasks.exe
5996	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4192	2026-08-10_8e7a904b9db327c09fc6f3d8e7291802_darkgate_elex_hawkeye_remcos_stop.exe
4192	2026-08-10_8e7a904b9db327c09fc6f3d8e7291802_darkgate_elex_hawkeye_remcos_stop.exe
4192	2026-08-10_8e7a904b9db327c09fc6f3d8e7291802_darkgate_elex_hawkeye_remcos_stop.exe
4192	2026-08-10_8e7a904b9db327c09fc6f3d8e7291802_darkgate_elex_hawkeye_remcos_stop.exe
1512	svchost_ABCABCAABABCCBACABABBBCCAACABBABABAAACCABCCCACABABBAABA.exe
1512	svchost_ABCABCAABABCCBACABABBBCCAACABBABABAAACCABCCCACABABBAABA.exe
1512	svchost_ABCABCAABABCCBACABABBBCCAACABBABABAAACCABCCCACABABBAABA.exe
1512	svchost_ABCABCAABABCCBACABABBBCCAACABBABABAAACCABCCCACABABBAABA.exe
5124	svchost_ABCABCAABABCCBACABABBBCCAACABBABABAAACCABCCCACABABBAABA.exe
5124	svchost_ABCABCAABABCCBACABABBBCCAACABBABABAAACCABCCCACABABBAABA.exe
1528	svchost_BACBCACBAAACCACACCABACAABCACCBBAAACABCCBBCBAAACCBCCBBCB.exe
1528	svchost_BACBCACBAAACCACACCABACAABCACCBBAAACABCCBBCBAAACCBCCBBCB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4192	2026-08-10_8e7a904b9db327c09fc6f3d8e7291802_darkgate_elex_hawkeye_remcos_stop.exe
Token: SeDebugPrivilege	1512	svchost_ABCABCAABABCCBACABABBBCCAACABBABABAAACCABCCCACABABBAABA.exe
Token: SeDebugPrivilege	5124	svchost_ABCABCAABABCCBACABABBBCCAACABBABABAAACCABCCCACABABBAABA.exe
Token: SeDebugPrivilege	1528	svchost_BACBCACBAAACCACACCABACAABCACCBBAAACABCCBBCBAAACCBCCBBCB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 1216	4192	2026-08-10_8e7a904b9db327c09fc6f3d8e7291802_darkgate_elex_hawkeye_remcos_stop.exe	91
PID 1216 wrote to memory of 5996	1216	cmd.exe	93
PID 1512 wrote to memory of 5756	1512	svchost_ABCABCAABABCCBACABABBBCCAACABBABABAAACCABCCCACABABBAABA.exe	94
PID 4192 wrote to memory of 2252	4192	2026-08-10_8e7a904b9db327c09fc6f3d8e7291802_darkgate_elex_hawkeye_remcos_stop.exe	97
PID 2252 wrote to memory of 1492	2252	cmd.exe	99
PID 4192 wrote to memory of 3036	4192	2026-08-10_8e7a904b9db327c09fc6f3d8e7291802_darkgate_elex_hawkeye_remcos_stop.exe	100
PID 3036 wrote to memory of 1244	3036	cmd.exe	102
PID 1512 wrote to memory of 4460	1512	svchost_ABCABCAABABCCBACABABBBCCAACABBABABAAACCABCCCACABABBAABA.exe	105
PID 4460 wrote to memory of 3364	4460	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-10_8e7a904b9db327c09fc6f3d8e7291802_darkgate_elex_hawkeye_remcos_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_8e7a904b9db327c09fc6f3d8e7291802_darkgate_elex_hawkeye_remcos_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCAACABBBAABACCBCCCBCCCAAAAAACAABBACACACACABBAACCCBCCBABCCBCACABCAAAABBBBACAABBCACABBBCBCBBCBABCBCBACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCAABABCCBACABABBBCCAACABBABABAAACCABCCCACABABBAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCAACABBBAABACCBCCCBCCCAAAAAACAABBACACACACABBAACCCBCCBABCCBCACABCAAAABBBBACAABBCACABBBCBCBBCBABCBCBACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCAABABCCBACABABBBCCAACABBABABAAACCABCCCACABABBAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCACABCACCBCCBACACBCBBCBBABBAABBABCACAACACCBABCABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCAABABCCBACABABBBCCAACABBABABAAACCABCCCACABABBAABA.exe" start= auto displayName= "UserDataSvc_BCACABCACCBCCBACACBCBBCBBABBAABBABCACAACACCBABCABAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCACABCACCBCCBACACBCBBCBBABBAABBABCACAACACCBABCABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCAABABCCBACABABBBCCAACABBABABAAACCABCCCACABABBAABA.exe" start= auto displayName= "UserDataSvc_BCACABCACCBCCBACACBCBBCBBABBAABBABCACAACACCBABCABAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCACABCACCBCCBACACBCBBCBBABBAABBABCACAACACCBABCABAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCACABCACCBCCBACACBCBBCBBABBAABBABCACAACACCBABCABAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1244

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCAABABCCBACABABBBCCAACABBABABAAACCABCCCACABABBAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCAABABCCBACABABBBCCAACABBABABAAACCABCCCACABABBAABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAAAAAAAAACABBABBABCCCBCCBBABABAAABACAABCBBCABBABAABBBBBBCABBCAABBCBBCBBCAACBBBBBACBCACABACBAACBBCBCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCACBAAACCACACCABACAABCACCBBAAACABCCBBCBAAACCBCCBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAAAAAAAAACABBABBABCCCBCCBBABABAAABACAABCBBCABBABAABBBBBBCABBCAABBCBBCBBCAACBBBBBACBCACABACBAACBBCBCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCACBAAACCACACCABACAABCACCBBAAACABCCBBCBAAACCBCCBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3364

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCACBAAACCACACCABACAABCACCBBAAACABCCBBCBAAACCBCCBBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCACBAAACCACACCABACAABCACCBBAAACABCCBBCBAAACCBCCBBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1528

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCAABABCCBACABABBBCCAACABBABABAAACCABCCCACABABBAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCAABABCCBACABABBBCCAACABBABABAAACCABCCCACABABBAABA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 f33520bca9c8ae0060ce445b3d669629753a014dd0209fcf3f6c1871ab53ab1a
MD5 3fc5594fb947c9f92dd2738cbe7fdd3e
SHA1 e2e3f613347d663a9cb12325e8bb558cea256761
SHA512 1b784c474fab7acd723909861246f2ecd680d014db66ad306d9cbdcc7b1e59aa5019483eafda56ec10b68bfe807524324f1b0d72cc37b22907f76987f65017e8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\qap`g`v~dtlq
Size 10B
SHA256 974a75341bfff2e1238405fd1f26da54d2b8ace065af7e61fc7e5a73750e5474
MD5 cd24b40f195e93760b9f3d1ba30802a2
SHA1 a866bf6863e7aa2c3944449191a8413d122abeea
SHA512 ff645264207fc1965518392313cb3d976317599ebbdec1b7f3f153863e961375f526318a7fd34e0e1baf9a3f002ef21032b37cda7c5b675f2c40155ccb38c0b1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Diagnosis\Temp\DiagTrackTraceSlot_miniTrace\qap`g`v~dtlq
Size 10B
SHA256 cc487398aaae1d10f5a00f5adaf23d402b877a9f88ed4712bcef75047754ae70
MD5 357e7a5d3080a388bec0150228d52c28
SHA1 63504fb47b9e28d780b21c82f86880a88b8c6512
SHA512 1054b8d203df6056c67307f094cfbacc7a36a8cb59b71ec83b28bd40ed5d485275c7cae87b9126232e9d6886776347a5b0fb6b67010727cd7f9d02291ad5269f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Default\qap`g`v~dtlq
Size 10B
SHA256 f942016dc90a5b3077fdec5852764c429622304806565beefd95815f679839a4
MD5 68e83928ec27d88ab5acfd05ec579228
SHA1 ca5eb0aec9c90460617e3f479ccb423b480f7c23
SHA512 1a7d4dce468ab50e10476a034b80e6588eb258e006d7e7d952affacc5afdd36ebd221f7da151ba9b2441c6facb9b9e3264c16fd1fdb028658643c390d8fdd51a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 96e79884bc0a779a648f8be1a3490fcf4b30599cd736563230da3ff9f77d6b75
MD5 87b5816ac986a048fcaf67d8be27cacc
SHA1 45a8c6d860f1ccceabf6da875c14286dba13663b
SHA512 ac8faf319b99a46407d7b2fabff8ead7fb044878a49d24b71deb7466b537f20c8895d9fbbb495cc26f8ae54ebf19b0ae552df89ac29d0077fe13766aec3c99d5
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 22.8MB
SHA256 71f27755c29fb706fc5ab740eef980356cebc5932e664aedd200b91202472105
MD5 8e698ccb17bd3b525069b9f5174ff2bb
SHA1 1e7cfdeab9552bfc3e83627868eb34759b0fa896
SHA512 a0b49ffb8d811b6cc20945ee5f75e78b01faf835e92c432bf41838d10de158aabc846e53c3e0d4af8c7a5d36777de9d1e3cfb375e4589ebf9225fcc1352fbde3
SSDEEP 196608:kFlfFlVFlfFliFlfFlVFlfFliFlfFlVFlfFlaqsWgZ2j7:i3Z3+3Z3+3Z3JC2X
TLSH
T16637F106FDC640B0ED7725700CEBE27A4935BE36C431C95EF6C97A0A6A33E50942A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 febc564c6835a50f0b16d4229f69181ee4a2979ab142370395578e2cac009b4e
MD5 c81c12a9d914479e315faa260d345265
SHA1 b292f327468aded9433df9d47bc19de8bb83e054
SHA512 7cca632d4ca740563f653795543a132d98b46aec8d3d6f7699eeb5d3f654ea6ad7bdd0f4ae461f0019702b0483546a8d6772b2d8d052d0c5a1e6dbc516923bc8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 ac2e14351d5d2a663750d7d6158bcd53054c8f5c9ca0c85c5d9851330a7685d3
MD5 0070ecc0b98c827abb49a20dd873c34c
SHA1 53c7782b5aab3aa7d638324b84b792a69b5021dc
SHA512 7e3359ed89ea5d45b3a52bcd1f649bcf7c3b330028c53cea5c0bdfe32a830a0d08a52f95866d3bb5dc66572708e86a8e4ffa64bd799d8b45fe5dd4f3e8889584
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 6a320bf329f700f946ce86f70a671c18a599cfaecb369c3d053077edd6ab5ef6
MD5 a1f56e3d1c0eed170c176c655cc11a39
SHA1 7f3346e123b7342e84c3edd29568aba55e71e74a
SHA512 9a842af2eb26df89251613a282b9e0840531f913d4710667d78c0775db22c8415dc6ea1d769a761915452e130f81aa9e6d787e2527808971c5b9babcf3018493
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 372b6256e1a0745eb95668815853d0f043d2e72ec576f57d401670e8deeef5d3
MD5 8a6ea702ce2f564a837c7b839cc6e876
SHA1 3f379b7d88e3da9afd59df2156062310d1d73161
SHA512 bd9cd18da1c979b161b3f474fa73034dd15b57f02630b92aa23e1fef67570c70cb1a2ef9426c43d88565cd13fe0a1ae791e64568a877298a4749cbf971e8decf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB\qap`g`v~dtlq
Size 10B
SHA256 c2015b8e221d2c2bb7014b1ec02d26e94a8e6c96a0112fcca695d24ffb31f1a1
MD5 b3de1d4f3e88b721251d4f2817744134
SHA1 1c9c404ea94a74c692e75b8dba88e5e67db5b5b5
SHA512 74744fe5b11f4f4e83e5b2ca41a8547a1e8008d5065290dbd394b72964db95e0b855ad1786633d310db6cfdab0ab4a24cce9aaeca17a44a06f3cdd62a39a12b2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 fa2e83a6df73de8ec57441e980f9bff1c73d3f08f0ff251bff0cc2a4664adbe5
MD5 3ae9268da0cbdbab4bcf543703c721c1
SHA1 c5324ba018a4bdcb682eb8884aa7172e08cc85fa
SHA512 61190923bcd3f1e9cd53641b31e7236ae66af1eb1705bd612db80d89b4a4c2e17ca44b50389a88066d7409806f96fe7df0d7b44d8ee9a5eaaf14da3e4fac6218
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 bf7a250c8c777046c5cfe0ff3cd5810b8df17d9b405ea90c5f83e5ab3a6015bb
MD5 77237960afdae1c82deaee14013225e3
SHA1 d354ed33389f900181aaeb1566c766903a7749e4
SHA512 28eb25230be269f4311085b40e54277933d7349a02f480d5612330c824debe486b94d2320633541d81c7ddb04b5906ddfbbc32fff5fe4b78e628af53894cbbc9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AppData\qap`g`v~dtlq
Size 10B
SHA256 c9a1560daf9550a2e9c8ab4e5f13a7caedb813c085b9a6546750fa07576722b0
MD5 332c14c954a49d710f4b1e1f67d2e4b0
SHA1 c17469704e830ee301747ca3dcc71a51bd887409
SHA512 f3ed059e314123e50c77e5418afafea5132ed4e48c86c26f0ee3fa8c6df6f6d3c49b3fea5461eccc96d059be657f3c20acd55caab5ab22556e2741d7bec5c736
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\qap`g`v~dtlq
Size 10B
SHA256 7973e30786c203b59df8a456c8af9c3591266cf4193a6f3eca2e72da5c7614e5
MD5 90579df81e2152e2fcd2ed4d63c5e8bb
SHA1 2ac3e4c47bc8b8d41ce5ae06f4d43dfca812263f
SHA512 eddd812e286d161ad1617fdc79901479463ceedba9e630693d5fa096631cd19eee2b1cf4a57891bd1d064e6649737c72f4107fd7d1887d3a02f54fa2e8ae80b6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1e4656a87c93d6c10a57e07eb0360d9280d41527de24d1e6bc5162111ee9598c
MD5 1923b3f1fc6bbc57330fb07795363363
SHA1 a2c937d7ff03fde22ef4e0b831315cbd30610111
SHA512 a7bf29a2294f06c345e14da8bfd5ab32a17c724eb9d9fb0031427d7d8b54cf60722f6b29bad019b1cc80fe1b36d75f8e55e85c563b3fd7d3c80278ad5bdbb946
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 62994faa59eeeb4b8ce9b2b08fbfe445759651773a6d3419273432fee80ba57c
MD5 6d65bb308339fb6ee7684c89c3015b26
SHA1 ae31432f30bc0f39455f41ba4ecb51fddbcb15f0
SHA512 09dc7dc8791a54bcedb40bb167aaddfd5f9cb1273e18cff28878d2a2b9957f20dee45018e0da80cbd00ea2a190158c125715e29f0b357b4659b1b9a78d2b51a5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 673df693a307f0c417b7e328e607282e30ca3146a8ab9ea06531a138221620e7
MD5 6e5414674a41d7fec60583ef67c26654
SHA1 29d86ed8cd6a687801bea5de4b0c8d16c705546f
SHA512 cdd242b6ec0cde7de1984461eac40f6038395596edeefa40094ca4067a4c0b7b35192a7e173fd838b338f8a9becf6d2c0e30b2422df6e09ffca1e294b3a954cf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a067b57d9bf3a82e3689b455db928bd5a725c6d0cfe31e466caef9671cfd55a4
MD5 c3b8f9b72004d260d5add1dabfb85afa
SHA1 19428271bd9b39cbff1c3b2659c4fca980b8cdf1
SHA512 3eea8896265998946b734b706a7b183cb1b95b49354d482231c0c9060de0b15d66ad1759371e3cb63a9eff8bb189dbb749882d000a11e8b4cc6421aeba3a0c0b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9182cfbc7ecb4db40b72eeefb3907d22646f332c009689a92be59aa63ae35a42
MD5 1ce2be7adfea13f6f205ed7a0a3ff27c
SHA1 0232fbe26eaeca305035263660191803c37518a7
SHA512 273ad4f673f109f15985c2b749fb54c4cfba776a6859f87e2ce5e3eb91c405b1ac1b759c846f6872a373ea430e36cba12ee880740ac6ad3ec72df917f1fe5e16
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 35342f9dbbc1efa8075e913a515b95f2834adc1cac3f5c4fae8819d7ba2beacb
MD5 874bafd80808da8d685496a15f092f0b
SHA1 4a56e0d194ae668d025357aa535d8f3e2821157f
SHA512 69414eba5d03d9301ff25438edb2c7747726901f719f8ca3abfbb7a7a978352ba73d56460cc4f10a073b48cd9e02f7645d601ebd345596104d58c4bc49f5f577
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f32b0c31eda8e277f25fba377ffc66c51afebc99a57c59200286ab0b5c14a4ec
MD5 aa479111bf0e464d13edae682ee5388c
SHA1 faf4a9ff20bbdf9109b7f91eb0312f61890bd64e
SHA512 d4866848bb09a9ee522243e8b978d7ecc9b2eacd599442f587e9ea387f1ce4aa020e4c49e19471d684ed7c88c003c20c3fd624f5d907147bd27339c00ed99e16
MD5 SHA1 SHA512

Submit Download

svchost_ABCABCAABABCCBACABABBBCCAACABBABABAAACCABCCCACABABBAABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCAABABCCBACABABBBCCAACABBABABAAACCABCCCACABABBAABA.exe
Size 22.2MB
SHA256 655f1d2b425fc1137101ff7f2ce47e21d1956a9ba10180fb17fc4fb49613676f
MD5 8e7a904b9db327c09fc6f3d8e7291802
SHA1 f42126540c22cc8a0d32a25d77ceee5a1ba62de0
SHA512 2fa63c1a7866ea767a8dc397b47229e835bb2c2f10686db81e5362ec80c3caa500c386b2f7da005166918df7454d199571f92e410912e5e7acad0d4e3cd5df92
SSDEEP 196608:kFlfFlVFlfFliFlfFlVFlfFliFlfFlVFlfFlaqsT:i3Z3+3Z3+3Z3JM
TLSH
T18137F106FDC640B0ED7725700CEBE27A49357E36C4318A5EF6C97B0A6A33E50942A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 8c22660cb143801e84901fc1b886fd3db101aaaf738d3850ba2a4f4756d8c90e
MD5 9544174964fe24d0f463092a28037361
SHA1 fde55ed47031124b602b163ff609b882c32f60f6
SHA512 a93e0b2a714b54a83a2fbfc1c40bbffc75a504259afd1ce0576e47c58000b08e5ed84f2931433ad63f0f89a59cb74331fea8bcdd92553c3867ac520bf800f161
TLSH
T15F219561ECAAEC17E9326CCA922DAB731CF4365BB81C7A94124582187B45D32CE954E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 1ce9f094ddf39652bb610757f48d7f0abff7fd3356e766395ab2d152ea8dc0a7
MD5 2c6fee1a20b381a956e844f084ffa663
SHA1 c36b66077718647786e04beeb1c60e152132395a
SHA512 e3c6d5e815d6ded36c8c03f0793ceedee48aa223ae9959684e3a59df8f1cc6a9b3da155ff5322b4d60da768d0291fae415f69e6704316c8b3cf3174eaf282945
TLSH
T1BA21DB21E8AADC57E9336CCBD329ABB31CB4379BFC5C798052058218BB85D32CD954E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 bbc0250ed7b7030236dcea48523f9fb14e363a087887ba5595a5194287f03f6c
MD5 a6a5329ac30114a242441ea64ab33f10
SHA1 8e3ea2b991494095165f76f67c6a6f8eb64e2f22
SHA512 7a27734dac6e29a63449770644101642e57f6a013578524e736b7cad02abdc1acf2d445233accdd84dcd51bbcaeaf9c7625a90876c03b780270700c4ee91a7e5
TLSH
T1B911B661E8AAEC17E9323CCA922DAB631CF4365BB85C7A94124582187B85D32CD954E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1512-33-0x0000000000250000-0x0000000000271000-memory.dmp

Download

memory/1528-63-0x00000000006C0000-0x00000000006E1000-memory.dmp

Download

memory/1528-3964-0x00000000006C0000-0x00000000006E1000-memory.dmp

Download

memory/4192-6-0x0000000000210000-0x0000000000231000-memory.dmp

Download

memory/5124-1576-0x0000000000250000-0x0000000000271000-memory.dmp

Download

memory/5124-3966-0x0000000000250000-0x0000000000271000-memory.dmp

Download