debc55e161babe5e6c5b8044c6254ee0d9b6c341720f5fbce5e99c4d0a9a47ec

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 04:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_3765f6b658a6da9c8318ef96fbc729a3_darkgate_elex_stop.exe
Size 2.8MB
Sample260815-es258syeja
SHA256 debc55e161babe5e6c5b8044c6254ee0d9b6c341720f5fbce5e99c4d0a9a47ec
MD5 3765f6b658a6da9c8318ef96fbc729a3
SHA1 37ed93f1f4a0ad6ba7536c090f50a3bb483221e4
SHA512 2923c103ff622fa45a9cbcd41fc85da31b250190d6a58bdcff429b037538d4c09a70a5786bd99642bf96da8c9476f7bd2888f851d5498e9529d347dcc50b5a66
SSDEEP 49152:U+ES+E2+EBLgVLKRWTQ6Zs5DhgPW+ES+E2+EBLgVLKRWTQ6Zs5DhgPXDd79WCu:hKRuy5afKRuy5aXp7g
TLSH
T106D59E12F7C24071E5B335714AAFE37A597D77214B35899FD3480A3E5A32AC0AA3835B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCAABCCABAACCCABBABBBCCABCAAABABCBCBCBACACBACCCACABCAAC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCAABCCABAACCCABBABBBCCABCAAABABCBCBCBACACBACCCACABCAAC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCAABCCABAACCCABBABBBCCABCAAABABCBCBCBACACBACCCACABCAAC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCAABCCABAACCCABBABBBCCABCAAABABCBCBCBACACBACCCACABCAAC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5108	svchost_CCAABCCABAACCCABBABBBCCABCAAABABCBCBCBACACBACCCACABCAAC.exe
3080	svchost_AAABACCCCACACBBAACBCACBBCBAACCCAACCCCCBCCBABBBAACBABACB.exe
5700	svchost_CCAABCCABAACCCABBABBBCCABCAAABABCBCBCBACACBACCCACABCAAC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACABCAAABABBCACBABAABCCBBABABCACACCABCBBBBBBACBCBACBCAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCAABCCABAACCCABBABBBCCABCAAABABCBCBCBACACBACCCACABCAAC.exe"	2026-08-15_3765f6b658a6da9c8318ef96fbc729a3_darkgate_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCAABCBACBAABABBBBAABCBCAABABBACACBABCCCCBACBBACCBBCBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABACCCCACACBBAACBCACBBCBAACCCAACCCCCBCCBABBBAACBABACB.exe"	svchost_CCAABCCABAACCCABBABBBCCABCAAABABCBCBCBACACBACCCACABCAAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5384	sc.exe
2748	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3212	cmd.exe
5112	cmd.exe
5616	cmd.exe
5100	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCAABCCABAACCCABBABBBCCABCAAABABCBCBCBACACBACCCACABCAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAABACCCCACACBBAACBCACBBCBAACCCAACCCCCBCCBABBBAACBABACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_3765f6b658a6da9c8318ef96fbc729a3_darkgate_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1184	schtasks.exe
4372	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5584	2026-08-15_3765f6b658a6da9c8318ef96fbc729a3_darkgate_elex_stop.exe
5584	2026-08-15_3765f6b658a6da9c8318ef96fbc729a3_darkgate_elex_stop.exe
5584	2026-08-15_3765f6b658a6da9c8318ef96fbc729a3_darkgate_elex_stop.exe
5584	2026-08-15_3765f6b658a6da9c8318ef96fbc729a3_darkgate_elex_stop.exe
5108	svchost_CCAABCCABAACCCABBABBBCCABCAAABABCBCBCBACACBACCCACABCAAC.exe
5108	svchost_CCAABCCABAACCCABBABBBCCABCAAABABCBCBCBACACBACCCACABCAAC.exe
5108	svchost_CCAABCCABAACCCABBABBBCCABCAAABABCBCBCBACACBACCCACABCAAC.exe
5108	svchost_CCAABCCABAACCCABBABBBCCABCAAABABCBCBCBACACBACCCACABCAAC.exe
3080	svchost_AAABACCCCACACBBAACBCACBBCBAACCCAACCCCCBCCBABBBAACBABACB.exe
3080	svchost_AAABACCCCACACBBAACBCACBBCBAACCCAACCCCCBCCBABBBAACBABACB.exe
5700	svchost_CCAABCCABAACCCABBABBBCCABCAAABABCBCBCBACACBACCCACABCAAC.exe
5700	svchost_CCAABCCABAACCCABBABBBCCABCAAABABCBCBCBACACBACCCACABCAAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5584	2026-08-15_3765f6b658a6da9c8318ef96fbc729a3_darkgate_elex_stop.exe
Token: SeDebugPrivilege	5108	svchost_CCAABCCABAACCCABBABBBCCABCAAABABCBCBCBACACBACCCACABCAAC.exe
Token: SeDebugPrivilege	3080	svchost_AAABACCCCACACBBAACBCACBBCBAACCCAACCCCCBCCBABBBAACBABACB.exe
Token: SeDebugPrivilege	5700	svchost_CCAABCCABAACCCABBABBBCCABCAAABABCBCBCBACACBACCCACABCAAC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5584 wrote to memory of 3212	5584	2026-08-15_3765f6b658a6da9c8318ef96fbc729a3_darkgate_elex_stop.exe	91
PID 3212 wrote to memory of 4372	3212	cmd.exe	93
PID 5108 wrote to memory of 5560	5108	svchost_CCAABCCABAACCCABBABBBCCABCAAABABCBCBCBACACBACCCACABCAAC.exe	94
PID 5584 wrote to memory of 5112	5584	2026-08-15_3765f6b658a6da9c8318ef96fbc729a3_darkgate_elex_stop.exe	97
PID 5112 wrote to memory of 5384	5112	cmd.exe	99
PID 5584 wrote to memory of 5616	5584	2026-08-15_3765f6b658a6da9c8318ef96fbc729a3_darkgate_elex_stop.exe	100
PID 5616 wrote to memory of 2748	5616	cmd.exe	102
PID 5108 wrote to memory of 5100	5108	svchost_CCAABCCABAACCCABBABBBCCABCAAABABCBCBCBACACBACCCACABCAAC.exe	105
PID 5100 wrote to memory of 1184	5100	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-15_3765f6b658a6da9c8318ef96fbc729a3_darkgate_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_3765f6b658a6da9c8318ef96fbc729a3_darkgate_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBABABCCBCACCBCAABBBACCAABCACACCABABBCCBCCCABCCABCCCCCCCCBCBAAABAACBCBBBCACACACABABCBACBCABBBBCABBAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABCCABAACCCABBABBBCCABCAAABABCBCBCBACACBACCCACABCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3212
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBABABCCBCACCBCAABBBACCAABCACACCABABBCCBCCCABCCABCCCCCCCCBCBAAABAACBCBBBCACACACABABCBACBCABBBBCABBAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABCCABAACCCABBABBBCCABCAAABABCBCBCBACACBACCCACABCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBBCBACBACAACABABBCCAAABCABBCCACCBAABCCAAACCAAABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABCCABAACCCABBABBBCCABCAAABABCBCBCBACACBACCCACABCAAC.exe" start= auto displayName= "UserDataSvc_CCBBCBACBACAACABABBCCAAABCABBCCACCBAABCCAAACCAAABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBBCBACBACAACABABBCCAAABCABBCCACCBAABCCAAACCAAABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABCCABAACCCABBABBBCCABCAAABABCBCBCBACACBACCCACABCAAC.exe" start= auto displayName= "UserDataSvc_CCBBCBACBACAACABABBCCAAABCABBCCACCBAABCCAAACCAAABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBBCBACBACAACABABBCCAAABCABBCCACCBAABCCAAACCAAABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5616
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBBCBACBACAACABABBCCAAABCABBCCACCBAABCCAAACCAAABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2748

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABCCABAACCCABBABBBCCABCAAABABCBCBCBACACBACCCACABCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABCCABAACCCABBABBBCCABCAAABABCBCBCBACACBACCCACABCAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABBBCACBCBABABCACBCCCCCBAACCBCBACBBACAABBAACABBABBBABCCAACABACBAACCCBBABACACBCCCBCABABCBBACCBBBACBCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACCCCACACBBAACBCACBBCBAACCCAACCCCCBCCBABBBAACBABACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABBBCACBCBABABCACBCCCCCBAACCBCBACBBACAABBAACABBABBBABCCAACABACBAACCCBBABACACBCCCBCABABCBBACCBBBACBCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACCCCACACBBAACBCACBBCBAACCCAACCCCCBCCBABBBAACBABACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1184

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACCCCACACBBAACBCACBBCBAACCCAACCCCCBCCBABBBAACBABACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACCCCACACBBAACBCACBBCBAACCCAACCCCCBCCBABBBAACBABACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3080

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABCCABAACCCABBABBBCCABCAAABABCBCBCBACACBACCCACABCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABCCABAACCCABBABBBCCABCAAABABCBCBCBACACBACCCACABCAAC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\qap`g`v~dtlq
Size 10B
SHA256 3c45a22064ec7ece35006fa0652533e90f297c0be66e396b062b794e10964207
MD5 aa626bebed6407e5f98d894428652021
SHA1 f4502042925d828dabf7b4a5d50fc92cbbd5ecf6
SHA512 61f510b3ff6fc6fa73e2004f944f6a4bbb9759ef8a09f088aea61338ca7629affed769234c959c8b9eadc7d878c2dde2c1445d37f1c9520f415d5b664a5dacc9
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 3.4MB
SHA256 ff829cb020bea47d4c36823cfe7b45798b19dde057f6189c0c1238400731557e
MD5 4b288e1f9f8f1d9fcf103fffcabe7f4d
SHA1 3b6ef4fd6c9cd2147b473bbe24db8584ee97ed3b
SHA512 48905aa90177ea75723f39b4a7e4cbc568408ee01ea27b19e50edf920038ad68bfcf0d736c6632ae3d6ce82065874d52abb546bb098c11c773b6368c953881ae
SSDEEP 49152:U+ES+E2+EBLgVLKRWTQ6Zs5DhgPW+ES+E2+EBLgVLKRWTQ6Zs5DhgPXDd79WCxgn:hKRuy5afKRuy5aXp7fgZ2Hb9t+2xM
TLSH
T1F0F5AF12F6824031F6B2357149AFE3755D7DB7204B34899FD3884A3E5E32AC1AA3935B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 1253b81cd4391e9640acf998bcde30ab02a70391d4bb4608084ddfcebaee0b0e
MD5 fcd942c5abc865747070e6d36d4c81da
SHA1 9c7423f5336c204cd8eca1a0d962cfbcb4d1f91b
SHA512 4d2a27879c1796b55ffbf92bc46ec772ab306b5861c3fc8e58438c5e4968de1dcbcc1d0ea2c2354477cc4089f708779d6a9a1339867570c7bed86b9a9b6f586d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42\qap`g`v~dtlq
Size 10B
SHA256 91d55e6a779cf51931299911d563ae6757b7ca025232e0096a88be066f7e8169
MD5 eeb669592ce9c4b65a014a6e2026a397
SHA1 f5705dc040fc1b5bec34f973f4e85582f351ee12
SHA512 236d40ccb764fdab792c47c2618d077ab67af6ed5d5334f86ed4453a9b385708883752d9807bfd4489dbfda8e545a185e345d9b33481417de29de4ff946404c4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Safe Browsing Network\qap`g`v~dtlq
Size 10B
SHA256 7bfaa9290132afb6c37f0a0b42c3a7d8d3d1f4aeaeec73b79b2e6519540e7011
MD5 81218d332e34ea9d045aeb436f3416ce
SHA1 f9c505aebd7f38901aa54d0cda76ea2e38e6f057
SHA512 819459230e685e897e1e1ba4c10be680e7ad32771ad3b2d5358ca1d56d0c6a42d8cecd1f62c2fd2f7682d418de01175579b9de68701a2177382813a2fe4cd734
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\PlayReady\Internet Explorer\qap`g`v~dtlq
Size 10B
SHA256 ab10f73a5cd713a8ea0c0b41135dd250360b9935cb11e4cfb352899708b4b308
MD5 d509f9063f1b23e00d6068eed3f9ea5c
SHA1 383b10b42936e1b04cdc5016dbec63e25f8595b9
SHA512 95fefc8f2334b00666a29f96a39fdb063a4a60e36a085cab12c767e515d977cd5f627606f473f583943e938535e13e52d15130facfdf42244d5ac68c38b2c8cb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 45345ebccdb368c8dbb820d1ef6ee5d891b83c3cbd874db5a2eeb832c950328e
MD5 8584619ef3e0449a69bb6b7973f18d9a
SHA1 c31e7ea396779634dcfa177156b271557642e373
SHA512 43a3d15164ab06c381e55241bdcdc31037549cd352492ad515279471489624ccde18240652d1c869613d3c424ebb2e566c7fd6a7d26cfb59d2c013224306fa7f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 612818666092cb0c350969410833981b1a92549fdf52a0d5a666c889f7a176d5
MD5 6072640c202ad85c99ab60715fe761d0
SHA1 a1bbe7d5c789fbcd8947950707c08855356706a3
SHA512 23639641db567a8dbf754a0317f1de9dbe0870a208ba6a4dd3877d29624de7582b5206f4ebe3af8db0ce503c8c853098f71da26996e6c5792f9508d0bb7d35d6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 260df36c5befe593f6f2ffc45ff09fa6973f912b2361e56268ce690e448aec40
MD5 d508f872ad50cb7cc41dfb4fbf80aab9
SHA1 81f88dec9d6205c4b757152be7e1cf7a807ea797
SHA512 9f42e0f4ed687ec47a79f2596217cb8b26af90bf63c438a85dfd27e328964594ecb9648c11c2c6af97a09824c5a0ebdd7f390f825a94ddefb2155a5aacc29bdb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 88c66cd52ce53b8b22bb6fee0b95acdaa7e4912e5791277d89084bb763c0d0f2
MD5 c45b3cce3a5d9379e1fcdc9e75b90919
SHA1 9e91353972a643222a68cee597db72e453acb2e4
SHA512 8be76d6307eb8448c53a625fc746379c05cbb0141b4cc436f9688865e0a420e57844cf80e5176c98e74aee3d7e1b36925f7d9c9a1e517d34435f6bf248df47ec
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 60cd8d1f65624e125db0fb3d26f36dbbcd6d257f0d1ed078b78469d933d472f7
MD5 9d1e9afeda5d28c6a82226851e30fb90
SHA1 c991e83170b424a51245718203ba88e937d6a1cd
SHA512 7914fdb01e59b59026b467c259d2e4d5f02b4913aa317ce0c38bad407b4e84d9982b277168ce1879d88c7e9b952a1c438173ac2422a87baeb06655c10422950c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ae20e669805c798c502eeb58a37f32114f75b7d2bf7934a5edb9945cb4358efd
MD5 8678b62f2e9891b6fa639c94317bb7c9
SHA1 2b98c04d55d5ba51f81d87f3ff160ce473cd85e3
SHA512 783cb6d4da8443ddfa67b32afcc354b8969a2e70613eaf18d6203e5b608accdf43abfc0d91784e59bd676eb9fe6b1da2fcc5e8ca5e0e6dcd77085a3228899265
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 db8492460d5cec76be906f5b7652a2696dd184a612481ebd68ce2a6c60294255
MD5 a7489eaa511de51ca5a8b7a970e3b79d
SHA1 8c8619f553c0c6b639ac9c48bbe20e7b40d79f73
SHA512 b5dce3e14c9704a4583973e57e53951ddbe43a175fc85a1134fe9f489e764d23c36d1ca78d3771edd4235968df7b428d0924b02c5155135d1e8864cd69382f0e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\qap`g`v~dtlq
Size 10B
SHA256 118999188039f6b3b351b0330e4c202a57f1cf8d67790eff62a71597883d86e7
MD5 3f9d87e631ce81c99b9ca42f80306889
SHA1 9e84b276b8f5d72b7ea134def0ccf8808a180b2e
SHA512 35ea22a4b271fc8b433ca9b52f53211c4e7815d7f2ee56ce44845ee51538d8af506a51cca3f688e41177f863d1d95419b2c6da43f08827f830090a990ebcebb6
MD5 SHA1 SHA512

Submit Download

svchost_CCAABCCABAACCCABBABBBCCABCAAABABCBCBCBACACBACCCACABCAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABCCABAACCCABBABBBCCABCAAABABCBCBCBACACBACCCACABCAAC.exe
Size 2.8MB
SHA256 debc55e161babe5e6c5b8044c6254ee0d9b6c341720f5fbce5e99c4d0a9a47ec
MD5 3765f6b658a6da9c8318ef96fbc729a3
SHA1 37ed93f1f4a0ad6ba7536c090f50a3bb483221e4
SHA512 2923c103ff622fa45a9cbcd41fc85da31b250190d6a58bdcff429b037538d4c09a70a5786bd99642bf96da8c9476f7bd2888f851d5498e9529d347dcc50b5a66
SSDEEP 49152:U+ES+E2+EBLgVLKRWTQ6Zs5DhgPW+ES+E2+EBLgVLKRWTQ6Zs5DhgPXDd79WCu:hKRuy5afKRuy5aXp7g
TLSH
T106D59E12F7C24071E5B335714AAFE37A597D77214B35899FD3480A3E5A32AC0AA3835B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 aa4f756a7e6aab22dc6f33a25eba53464866a0ecb68a0f3a172cafe6e7a035c6
MD5 5df970afa7a0f4d94881c294926f492c
SHA1 bc31f14b283509e1e8b0f48cdffb796b0b22496a
SHA512 39ce91e0ae21d5e7b0cb411d1a965ff58b86541c8a3449e98a63749cc8b8623e29b59c3f90749c6a5cf0f7a6bc8d1ba45da165f0bddc3cae18c4ff2e91ccd014
TLSH
T14F21D631E8E5C827F92368CA6E2DDA9209B43B9FD8685D4023495318B7A9D318E558E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 1d8f0d67f895bf33b56f0c3c222e0d2e7b9ea679f9167595c7a6b70915bf24e7
MD5 98c9730487e30a2e9dd4360f1d0137ed
SHA1 5c5fb992e52703b9a7bf5cfbd871ce83e64eb4b1
SHA512 d811a606aa1d4711a2d406ed7d1c0c9a0ac6c8a92dbd1b793dcfc12d22f08cb82e5a32fcd5d9ed1fdf9a228969ba10a2d1fa66df21cd96f9dd19dfdb3e2772f1
TLSH
T15311C461E8E5D823FC3328CA5D2DDA4209E43B9F9828AE542349431CB3A9D718E554E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 53cd76084ed091a0f663a919e43631497bac61f889c4068dd42b39e52fcf7aa5
MD5 836c11f5327472b81dc53decb4d77e64
SHA1 3800dc7e7905d7d06e4c82a27b5b4888c15a5a7e
SHA512 750211e842451f1724045c4e8d6b9e64c5cc40a4b8b364e053aab84d60fe959315c6cf416cf287623bf5204b81505d02f01d90ca8dd01beda2087593757bae2b
TLSH
T1B321F961DCE5C827FC3328CA5E2DDA4209F43F4FD8286E5423495318B7A9D318F554E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3080-63-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/3080-3353-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/5108-33-0x0000000000B90000-0x0000000000BB1000-memory.dmp

Download

memory/5584-6-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/5700-74-0x0000000000B90000-0x0000000000BB1000-memory.dmp

Download