52660a92e0f7cb32829d2038dd230c04383881dfe52c4e628c08df0362e1a296

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_42e4558179ccae137188779b409a6ac0_amadey_darkgate_elex_stop_vidar.exe
Size 1.6MB
Sample260814-e9l6cafc52
SHA256 52660a92e0f7cb32829d2038dd230c04383881dfe52c4e628c08df0362e1a296
MD5 42e4558179ccae137188779b409a6ac0
SHA1 e89c290bcd471b72b921bbc57c49c6af1be2c853
SHA512 946fca391864ae8c28766f8add641dbafed4900e4dc646ff8a6fef3922e86f20ad7198bb81a2583d087aaacd61436558521d9ab00532af2e1687abccc3e13565
SSDEEP 49152:U+ES+ES+E2+EShhe+ES+ES+E2+EShhPDd79WCl:Fp7v
TLSH
T15D755C05F6D64071F5B715708DFBD37A4A35BE218B318AEFE348861E6932BE09834726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABCAACBACABCBABCCCABACBCCCABCBBABCCBAAACBACCABCBCCCBBAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABCAACBACABCBABCCCABACBCCCABCBBABCCBAAACBACCABCBCCCBBAA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
880	svchost_ABCAACBACABCBABCCCABACBCCCABCBBABCCBAAACBACCABCBCCCBBAA.exe
2332	svchost_AACAAABBBABAACBAAABCBBBCCBBAABCAAABAABCBCABABCABACACCBC.exe
4932	svchost_ABCAACBACABCBABCCCABACBCCCABCBBABCCBAAACBACCABCBCCCBBAA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCAAAAAACAABCAACCBCBBBCCABBBBAABAACACBBBCCACCCBBAABABCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCAACBACABCBABCCCABACBCCCABCBBABCCBAAACBACCABCBCCCBBAA.exe"	2026-08-14_42e4558179ccae137188779b409a6ac0_amadey_darkgate_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AAAACBBAAABACCBCBCCBCCABBCBBBAABABCACAABBAAABBCCBABCBCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACAAABBBABAACBAAABCBBBCCBBAABCAAABAABCBCABABCABACACCBC.exe"	svchost_ABCAACBACABCBABCCCABACBCCCABCBBABCCBAAACBACCABCBCCCBBAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
436	sc.exe
1272	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3044	cmd.exe
3920	cmd.exe
3992	cmd.exe
1604	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_42e4558179ccae137188779b409a6ac0_amadey_darkgate_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACAAABBBABAACBAAABCBBBCCBBAABCAAABAABCBCABABCABACACCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCAACBACABCBABCCCABACBCCCABCBBABCCBAAACBACCABCBCCCBBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2392	schtasks.exe
932	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3724	2026-08-14_42e4558179ccae137188779b409a6ac0_amadey_darkgate_elex_stop_vidar.exe
3724	2026-08-14_42e4558179ccae137188779b409a6ac0_amadey_darkgate_elex_stop_vidar.exe
3724	2026-08-14_42e4558179ccae137188779b409a6ac0_amadey_darkgate_elex_stop_vidar.exe
3724	2026-08-14_42e4558179ccae137188779b409a6ac0_amadey_darkgate_elex_stop_vidar.exe
880	svchost_ABCAACBACABCBABCCCABACBCCCABCBBABCCBAAACBACCABCBCCCBBAA.exe
880	svchost_ABCAACBACABCBABCCCABACBCCCABCBBABCCBAAACBACCABCBCCCBBAA.exe
880	svchost_ABCAACBACABCBABCCCABACBCCCABCBBABCCBAAACBACCABCBCCCBBAA.exe
880	svchost_ABCAACBACABCBABCCCABACBCCCABCBBABCCBAAACBACCABCBCCCBBAA.exe
4932	svchost_ABCAACBACABCBABCCCABACBCCCABCBBABCCBAAACBACCABCBCCCBBAA.exe
4932	svchost_ABCAACBACABCBABCCCABACBCCCABCBBABCCBAAACBACCABCBCCCBBAA.exe
2332	svchost_AACAAABBBABAACBAAABCBBBCCBBAABCAAABAABCBCABABCABACACCBC.exe
2332	svchost_AACAAABBBABAACBAAABCBBBCCBBAABCAAABAABCBCABABCABACACCBC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3724	2026-08-14_42e4558179ccae137188779b409a6ac0_amadey_darkgate_elex_stop_vidar.exe
Token: SeDebugPrivilege	880	svchost_ABCAACBACABCBABCCCABACBCCCABCBBABCCBAAACBACCABCBCCCBBAA.exe
Token: SeDebugPrivilege	4932	svchost_ABCAACBACABCBABCCCABACBCCCABCBBABCCBAAACBACCABCBCCCBBAA.exe
Token: SeDebugPrivilege	2332	svchost_AACAAABBBABAACBAAABCBBBCCBBAABCAAABAABCBCABABCABACACCBC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2180	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 3920	3724	2026-08-14_42e4558179ccae137188779b409a6ac0_amadey_darkgate_elex_stop_vidar.exe	96
PID 3920 wrote to memory of 2392	3920	cmd.exe	98
PID 880 wrote to memory of 2788	880	svchost_ABCAACBACABCBABCCCABACBCCCABCBBABCCBAAACBACCABCBCCCBBAA.exe	99
PID 2788 wrote to memory of 1896	2788	notepad.exe	100
PID 3724 wrote to memory of 3992	3724	2026-08-14_42e4558179ccae137188779b409a6ac0_amadey_darkgate_elex_stop_vidar.exe	105
PID 3992 wrote to memory of 436	3992	cmd.exe	107
PID 3724 wrote to memory of 1604	3724	2026-08-14_42e4558179ccae137188779b409a6ac0_amadey_darkgate_elex_stop_vidar.exe	108
PID 1604 wrote to memory of 1272	1604	cmd.exe	110
PID 880 wrote to memory of 3044	880	svchost_ABCAACBACABCBABCCCABACBCCCABCBBABCCBAAACBACCABCBCCCBBAA.exe	114
PID 3044 wrote to memory of 932	3044	cmd.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-08-14_42e4558179ccae137188779b409a6ac0_amadey_darkgate_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_42e4558179ccae137188779b409a6ac0_amadey_darkgate_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBBABCBABCCACACABCAAAABBABBABCBACCCBCCAAAACCBBBBBBBBCBABACABBABBCBABAABAACCAAABACABACBAABCCBAABABBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAACBACABCBABCCCABACBCCCABCBBABCCBAAACBACCABCBCCCBBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3920
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBBABCBABCCACACABCAAAABBABBABCBACCCBCCAAAACCBBBBBBBBCBABACABBABBCBABAABAACCAAABACABACBAABCCBAABABBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAACBACABCBABCCCABACBCCCABCBBABCCBAAACBACCABCBCCCBBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCABCCBCBAABCACABABBCCCCCCACCAABAACCABBACACBBCBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAACBACABCBABCCCABACBCCCABCBBABCCBAAACBACCABCBCCCBBAA.exe" start= auto displayName= "UserDataSvc_CCCABCCBCBAABCACABABBCCCCCCACCAABAACCABBACACBBCBCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3992
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCABCCBCBAABCACABABBCCCCCCACCAABAACCABBACACBBCBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAACBACABCBABCCCABACBCCCABCBBABCCBAAACBACCABCBCCCBBAA.exe" start= auto displayName= "UserDataSvc_CCCABCCBCBAABCACABABBCCCCCCACCAABAACCABBACACBBCBCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCABCCBCBAABCACABABBCCCCCCACCAABAACCABBACACBBCBCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCABCCBCBAABCACABABBCCCCCCACCAABAACCABBACACBBCBCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1272

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAACBACABCBABCCCABACBCCCABCBBABCCBAAACBACCABCBCCCBBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAACBACABCBABCCCABACBCCCABCBBABCCBAAACBACCABCBCCCBBAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBCCCBCBACACBAAABACACBAAAAAAABCACBABBBBABABBBCBBCABAACABBCBCBBCBCCACABBCCCAACCACCAAACCBCCABBABABCACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAABBBABAACBAAABCBBBCCBBAABCAAABAABCBCABABCABACACCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBCCCBCBACACBAAABACACBAAAAAAABCACBABBBBABABBBCBBCABAACABBCBCBBCBCCACABBCCCAACCACCAAACCBCCABBABABCACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAABBBABAACBAAABCBBBCCBBAABCAAABAABCBCABABCABACACCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:932

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2180

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAABBBABAACBAAABCBBBCCBBAABCAAABAABCBCABABCABACACCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAABBBABAACBAAABCBBBCCBBAABCAAABAABCBCABABCABACACCBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2332

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAACBACABCBABCCCABACBCCCABCBBABCCBAAACBACCABCBCCCBBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAACBACABCBABCCCABACBCCCABCBBABCCBAAACBACCABCBCCCBBAA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 e13760ea7dee514af1914268861c1a62db270b755513dd05ca5e34a2f0b8d3a0
MD5 a0a7d8c0b097c3c55baf6cdf44895b53
SHA1 baffae061730212a43e23215123dcf2837d09d90
SHA512 aec8e96543dcdd2f2fec0ed4e37065efa9293dd7da2c6e9ca3453a193713ee9edb7e3587442f50d4c491ddbb987225eebc2c2c7ac586c5de54bed186261443e9
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 2.0MB
SHA256 5222f082760f547ac19cbfb92238a8270a2aed5c2095ae8c8a80888e2c2bc17b
MD5 248360c1c24afda63d73d3333e2e65a0
SHA1 b07f3ff3a557b67cee399431a6a9bfe02847d426
SHA512 90b1a2041240c6f4e557b4367e00e4bbeba93d534091bb1421bde96ef836094d5e2c1dbbb6db9958f8a7b70776c104ad4976fb54348e0873c260cf89b8be54bf
SSDEEP 49152:U+ES+ES+E2+EShhe+ES+ES+E2+EShhPDd79WC2XpiMt:Fp70piY
TLSH
T1E8A53901F7D64071F5B31A708DBB927A4A79BD218F358ADFE388461E5931AD0E934B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.CapturePicker_10.0.19041.1023_neutral__cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 971904087c3e246612d2b2713f139b4dc137a3de3f05eac2b9ed0b4993f43f60
MD5 6af5fd922fb4b4e5a2330f4774a672e0
SHA1 9fce1506ca8a2fcb69dad007821a58eaf9a5d020
SHA512 f22cb0cbcfef03a565f4f4d3beafdfd0b819daa3037fc8a62e4e8c09f8a5847631171398d815f1a28c7324019cd1a01b2e06a3b443fa15e590359572fe698639
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\regid.1991-06.com.microsoft\qap`g`v~dtlq
Size 10B
SHA256 dbdd897ad4d4b8dc037b810eb4cf1bae1aa27aec221e3bc1bcd50ef6ee8f4228
MD5 eb152507de6886ea896bf24c5dfd744e
SHA1 adf74c8c24f24848c588d989941332cf7e4b7573
SHA512 e859a67aa3bb08f4d31f0674a594b4b8852780edd700dfd1facd49fe1f4e9ad86ec560fd9a26bda271b119b2ada1cb9a828eee0e019a76104be839915c6491ce
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 ea369864eb5d8ddf623c08cfe60f6abe62f651d84b6c6b9f6762bfd72ede67e4
MD5 517a986d7f6d8df5f6dd46f8ac4f996f
SHA1 cddf0502c88c185592219dc383cdedc80303e29e
SHA512 da11d1addce9625d5ef3a5adf4eb332ba7c7915a3ec650e9a0c28ac81d7c7ff5a6a76fe2a95536824a97c86a9c9df4c61eb1169544d5fe1d59b7304361287ccc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\Settings\qap`g`v~dtlq
Size 10B
SHA256 a6e7fd8a7f9b50a2dbb598ffbcc405face26d3a497b691ce5bdfe4469a6b6d6d
MD5 18ce0e345bff8e2c791cbdb84a7fe50c
SHA1 90dd1fc741cc7dc517323434f2787017ca9888a1
SHA512 3daa977434c3dd786f79442a6b2663de8aec60be6d191ffaf7f817aebb4c032af93e51f95978c2791768b5d09384c2dec116b4e5d5f39a437c4abc0ee4402d6a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9c7866b878751c9eb1595225eff59124184991c84ed1b9f0411064cb2ea09b59
MD5 ee9859d2416f40692275ded395ac23eb
SHA1 63d252ef029f9aa60d48965b52ea2d14a0dcfdec
SHA512 6b67b3acb7fdd5f3db3d7e4ea591f6500ed9568acbeb866ee49f01a07868d0031d194093c46eee2590858c0dff71d86fdf6873957e31fb537871d5ac6c543ca5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ff33070fe2883b942aa423a5d9d47dc5ef2d5c4f3bd2d6116822a3107649ce9b
MD5 b6014071080997e5be18b7f90f8eed14
SHA1 66b0cef7b400c2a7d94878137ba5c413d5e12ebd
SHA512 16b8ef78ee0737714c8d975febb22ee73d83a91254743653674771af8cdafef19193189dfe168b863e526a5144562697805d5160665a856c7006da8078425741
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cb082d6883127ffa0d4255cdbea548f3c622f2bce995efd4e168eab1b96da490
MD5 e6c6d0dd295d60676afed432a4bcd1ba
SHA1 0fe32e999a8c526bb6807e2fe88b5b4f09cefb4e
SHA512 b6b805f513d8a1fe79901a971085d279ea257ce483a5de50d1ec76d4661150a4b8aeb50c73acb814ad4a6cc1c17e0ca89e0aea8cbaeb8263fd021863f1bdc45a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a00a2b1ab4938c515748e38aaffaa567e729e65e29d4a8e79b1470b54a040f0e
MD5 0631d5f816a43a160017033d94e2d377
SHA1 bbc28437df877d0c6e99bd6b50465a0f375ac370
SHA512 d3bdca58b4b4e8152cafd610a58d96eb68192bd5f90c50b112a17f079f83bf1817ff96dec487ee5ee891c22dce1463d1cb97a3c303f9c8960c6bc97a96bdc127
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 24633dc9cd5f3a28179c6784f14b5af331fca338c3acd908490ba0d4feffbc6a
MD5 f781a1b63d13ae4c633ed8baafdcbde3
SHA1 3c0d337e9503a77a779fca03db7677e42ebe0806
SHA512 bf4ebeb07ae187a21fc06458f3fddfe7d301c9b60580d948ff92fae7a8596c7d21bda3e1635511c5b3824c3d2dd5a93bf5c5ffbe75d27148e3bd5e85420d40df
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5d9435705f8ccca598144021725e3d69faf23545e9e9abf133fae93e85485f0c
MD5 57afce783701e7f56502fc7fdf9b49af
SHA1 b549384290dac74af73956a9707e30099f9acaca
SHA512 a16b907b83d3e74bead7cf149d3875130a0ea20f918524145a76ed6b0b49dc85eafaf3c57dc7b02cd56e52858b25a32c12cdea7e2dcccc7233228c0c1f1b63e8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 27755644b49b51238872f6f847b831c11b4715f4188742c69770dd9ed0c82134
MD5 bfad3a6734415ee375e3ef55fc3de750
SHA1 6cc68eb34a6d1130603fc9cd065ee5ce36ef9c6c
SHA512 b767df63ff4ba6ed95ff4979a9bf8f15673619d7fe6e0ead884562f08733fe28ff201995b9105f19afe26e327e150f23e0333cabaaf67e3d305415d397fbff1f
MD5 SHA1 SHA512

Submit Download

svchost_ABCAACBACABCBABCCCABACBCCCABCBBABCCBAAACBACCABCBCCCBBAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAACBACABCBABCCCABACBCCCABCBBABCCBAAACBACCABCBCCCBBAA.exe
Size 1.6MB
SHA256 52660a92e0f7cb32829d2038dd230c04383881dfe52c4e628c08df0362e1a296
MD5 42e4558179ccae137188779b409a6ac0
SHA1 e89c290bcd471b72b921bbc57c49c6af1be2c853
SHA512 946fca391864ae8c28766f8add641dbafed4900e4dc646ff8a6fef3922e86f20ad7198bb81a2583d087aaacd61436558521d9ab00532af2e1687abccc3e13565
SSDEEP 49152:U+ES+ES+E2+EShhe+ES+ES+E2+EShhPDd79WCl:Fp7v
TLSH
T15D755C05F6D64071F5B715708DFBD37A4A35BE218B318AEFE348861E6932BE09834726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 974B
SHA256 87f16020cebc4c72ce98679f47646bfb63eb722adb686639076fc73a11bc2f44
MD5 ad9798986b53d12047a6f29ed1af9b79
SHA1 e3412a99ebb5749b560d0ea88485f742c90804ab
SHA512 3f48ac4a6f6bf8d0aad908d26160d8ac44cdc3bc3295dd1645e0bc849eb95f18a20d48751efc5c5b85fffae79bd7293df0c6f37c94b8c8a6767fc9fb99d84c9e
TLSH
T12A110B60B8E5D433ED3268DF822DCBD20CF5B78F6C586A94230981287BD9D35CE518E6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 493db1c7d5d19cac59d64d6c5d290a46f9f56f609e70d37bf6c23ac7c8b73981
MD5 387cedda1853f8b2604797315efc6f51
SHA1 ed0aad86c660049e3b6b3c0a9e3acdfffab80ad8
SHA512 c2c397844e3a614664642006cd44ed63209fba930ca379050431ce045f1aa23381d72ab5d7bf16010192187fa2cf21c519a6618b523653d617492837ef5ae2fb
TLSH
T1D921FB21F8D5C833EE3268DF822DDBD20CB5B79F9C585654530981187BD9D31CD158E6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 cd02c25852581d906b5f5956db260c16bdb604df8d85110c24910498f3afc1c1
MD5 c2fa767bced2ad4f2f9b4a522b095fb2
SHA1 263beea793596771575ab25846c3ee31d7d4e977
SHA512 b4aae7885cfc94b900ba06b3df3489168b998e07f82c8a985310c5e32d3291f2eedf014dbe7f551ee4ed81e37bdcef90071899b0d80ef36823f7aa4124a89b75
TLSH
T18A110B20B8E5D433ED3168DF822DCB920CF1A78F6C586A54230981287BD9D35CD518E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/880-35-0x00000000002B0000-0x00000000002D1000-memory.dmp

Download

memory/2332-71-0x0000000000060000-0x0000000000081000-memory.dmp

Download

memory/2332-3043-0x0000000000060000-0x0000000000081000-memory.dmp

Download

memory/2788-59-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Download

memory/3724-6-0x00000000009A0000-0x00000000009C1000-memory.dmp

Download

memory/4932-3029-0x00000000002B0000-0x00000000002D1000-memory.dmp

Download