415eed4fa369ce588a76c5e5cf1a7af15f7a17be43990f77709f11acaff2fbcd

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_4e76c20098be27138783f428f6dd147c_amadey_darkgate_elex_stop_vidar.exe
Size 1.8MB
Sample260816-e9199sbc55
SHA256 415eed4fa369ce588a76c5e5cf1a7af15f7a17be43990f77709f11acaff2fbcd
MD5 4e76c20098be27138783f428f6dd147c
SHA1 7df4f883d8d532a190a71b4b8f46410cb6c3f281
SHA512 6a8e9ef606bd030294edfe4c7964cba2324544250f8498526a70e940c620a138854f44d3e3df2541fa7a0fad95bbf11667199e049650ac9fa9460554017c9b90
SSDEEP 49152:U+EW5+ES+ES+ES+EWLy+EW5+ES+ES+ES+EWLzDd79WCZ:5p7r
TLSH
T1C2957D05FA828075E96710B04DDFD2BE8A34BE218B118DEBF78D9B1F6932BE16434715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCCABCBABCACACBACBCBAAAABCCCCCBBCABCCABBAACACACBBCBABCB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCCABCBABCACACBACBCBAAAABCCCCCBBCABCCABBAACACACBBCBABCB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2428	svchost_CCCABCBABCACACBACBCBAAAABCCCCCBBCABCCABBAACACACBBCBABCB.exe
5052	svchost_CAACBACAABCCCBBCCCAABCAACAAACABCABBBABCCCACBBBBCCABCBAC.exe
4064	svchost_CCCABCBABCACACBACBCBAAAABCCCCCBBCABCCABBAACACACBBCBABCB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CACBBACBBAACACCABBBAACBABCBCAAABBBAAABBBCBBACBCACACCCACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACBACAABCCCBBCCCAABCAACAAACABCABBBABCCCACBBBBCCABCBAC.exe"	svchost_CCCABCBABCACACBACBCBAAAABCCCCCBBCABCCABBAACACACBBCBABCB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACBABACBCBABABCBBCBAACAAACCCCBABCBBBBAACACCBCBCBABCBAABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCABCBABCACACBACBCBAAAABCCCCCBBCABCCABBAACACACBBCBABCB.exe"	2026-08-16_4e76c20098be27138783f428f6dd147c_amadey_darkgate_elex_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3380	sc.exe
4336	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4556	cmd.exe
3896	cmd.exe
4688	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_4e76c20098be27138783f428f6dd147c_amadey_darkgate_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCABCBABCACACBACBCBAAAABCCCCCBBCABCCABBAACACACBBCBABCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACBACAABCCCBBCCCAABCAACAAACABCABBBABCCCACBBBBCCABCBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2156	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2220	2026-08-16_4e76c20098be27138783f428f6dd147c_amadey_darkgate_elex_stop_vidar.exe
2220	2026-08-16_4e76c20098be27138783f428f6dd147c_amadey_darkgate_elex_stop_vidar.exe
2220	2026-08-16_4e76c20098be27138783f428f6dd147c_amadey_darkgate_elex_stop_vidar.exe
2220	2026-08-16_4e76c20098be27138783f428f6dd147c_amadey_darkgate_elex_stop_vidar.exe
2428	svchost_CCCABCBABCACACBACBCBAAAABCCCCCBBCABCCABBAACACACBBCBABCB.exe
2428	svchost_CCCABCBABCACACBACBCBAAAABCCCCCBBCABCCABBAACACACBBCBABCB.exe
2428	svchost_CCCABCBABCACACBACBCBAAAABCCCCCBBCABCCABBAACACACBBCBABCB.exe
2428	svchost_CCCABCBABCACACBACBCBAAAABCCCCCBBCABCCABBAACACACBBCBABCB.exe
5052	svchost_CAACBACAABCCCBBCCCAABCAACAAACABCABBBABCCCACBBBBCCABCBAC.exe
5052	svchost_CAACBACAABCCCBBCCCAABCAACAAACABCABBBABCCCACBBBBCCABCBAC.exe
4064	svchost_CCCABCBABCACACBACBCBAAAABCCCCCBBCABCCABBAACACACBBCBABCB.exe
4064	svchost_CCCABCBABCACACBACBCBAAAABCCCCCBBCABCCABBAACACACBBCBABCB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2220	2026-08-16_4e76c20098be27138783f428f6dd147c_amadey_darkgate_elex_stop_vidar.exe
Token: SeDebugPrivilege	2428	svchost_CCCABCBABCACACBACBCBAAAABCCCCCBBCABCCABBAACACACBBCBABCB.exe
Token: SeDebugPrivilege	5052	svchost_CAACBACAABCCCBBCCCAABCAACAAACABCABBBABCCCACBBBBCCABCBAC.exe
Token: SeDebugPrivilege	4064	svchost_CCCABCBABCACACBACBCBAAAABCCCCCBBCABCCABBAACACACBBCBABCB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4368	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 4556	2220	2026-08-16_4e76c20098be27138783f428f6dd147c_amadey_darkgate_elex_stop_vidar.exe	96
PID 4556 wrote to memory of 2156	4556	cmd.exe	98
PID 2428 wrote to memory of 2556	2428	svchost_CCCABCBABCACACBACBCBAAAABCCCCCBBCABCCABBAACACACBBCBABCB.exe	99
PID 2556 wrote to memory of 4024	2556	notepad.exe	100
PID 2220 wrote to memory of 3896	2220	2026-08-16_4e76c20098be27138783f428f6dd147c_amadey_darkgate_elex_stop_vidar.exe	104
PID 3896 wrote to memory of 4336	3896	cmd.exe	106
PID 2220 wrote to memory of 4688	2220	2026-08-16_4e76c20098be27138783f428f6dd147c_amadey_darkgate_elex_stop_vidar.exe	107
PID 4688 wrote to memory of 3380	4688	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-16_4e76c20098be27138783f428f6dd147c_amadey_darkgate_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_4e76c20098be27138783f428f6dd147c_amadey_darkgate_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABCCACAABBCBACABBCBBACCBACCABABCABABAAAACACACABCACBBCBBCBBABABCABBAACCCBACCBCCBAACCAACACABBAAABAABACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBABCACACBACBCBAAAABCCCCCBBCABCCABBAACACACBBCBABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABCCACAABBCBACABBCBBACCBACCABABCABABAAAACACACABCACBBCBBCBBABABCABBAACCCBACCBCCBAACCAACACABBAAABAABACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBABCACACBACBCBAAAABCCCCCBBCABCCABBAACACACBBCBABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCAACCBBCBABABCCBBCCABBCCCAACCACACACCBBACBCACAABACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBABCACACBACBCBAAAABCCCCCBBCABCCABBAACACACBBCBABCB.exe" start= auto displayName= "UserDataSvc_CCAACCBBCBABABCCBBCCABBCCCAACCACACACCBBACBCACAABACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCAACCBBCBABABCCBBCCABBCCCAACCACACACCBBACBCACAABACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBABCACACBACBCBAAAABCCCCCBBCABCCABBAACACACBBCBABCB.exe" start= auto displayName= "UserDataSvc_CCAACCBBCBABABCCBBCCABBCCCAACCACACACCBBACBCACAABACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCAACCBBCBABABCCBBCCABBCCCAACCACACACCBBACBCACAABACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCAACCBBCBABABCCBBCCABBCCCAACCACACACCBBACBCACAABACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3380

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBABCACACBACBCBAAAABCCCCCBBCABCCABBAACACACBBCBABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBABCACACBACBCBAAAABCCCCCBBCABCCABBAACACACBBCBABCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4024

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4368

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACAABCCCBBCCCAABCAACAAACABCABBBABCCCACBBBBCCABCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACAABCCCBBCCCAABCAACAAACABCABBBABCCCACBBBBCCABCBAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5052

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBABCACACBACBCBAAAABCCCCCBBCABCCABBAACACACBBCBABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBABCACACBACBCBAAAABCCCCCBBCABCCABBAACACACBBCBABCB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 3be42f7a2a44cbb1808c6409563b6463b2ad214d9752626556200702c9b2e135
MD5 06a51d2c6c658a707f9387d7272305e8
SHA1 0e24d2063730bd1b3e21e870b79e79feecbfc606
SHA512 0585e594c4e348d3db2b3c6e0cce6a50a4f1c03827310df25e9fca5c5bffc036db2d31865ea847ba2f81562b0e2828ba37d0fde8dc2a2872c2c958451f656ff1
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 2.3MB
SHA256 d48254ff9930e9117864588154899ace64a1aec4d77295d70c57b2945fc3533e
MD5 2196aaea7817047f89d84db45b347b28
SHA1 9d2ecdf963679298a1978707e6fba03aa2688da2
SHA512 877a7dfa3d30a23e923535bcaaafe4dae376804adb9d802edf0913a4de47f8565bbd84f4f2f2250234d43db8f0a5336813a70d0129957a09a9d36d179559916b
SSDEEP 49152:U+EW5+ES+ES+ES+EWLy+EW5+ES+ES+ES+EWLzDd79WCCXpiMm:5p7gpid
TLSH
T11DB57C01F6C68035F5B716704EFBD27A8A75BD218B318ADFF7889A1E1931BD0A534722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 47d2b9997657a73bcfe5b4e4bf0c5a2d996c3b24d2f32db6bc964da19c6efb44
MD5 0c3b0108c5bad506ee1ebc1428602078
SHA1 8a35da99250a72f4d2be0f6f9f46ea80a3c4c733
SHA512 04cdfd9822c41407b59a75450f5397d1a6afdfc83417eebc013731e5753893c3afa9158197927dd301a514ae0a38d58bf2610ceb051bad1d6707fc9e0bff7705
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\vi\qap`g`v~dtlq
Size 10B
SHA256 1de3d86705874049d01f392a2283473c46cf1356881cf21af9cc1d14615e080c
MD5 fe690790910c51901fef14ca191fe385
SHA1 3e30997645a029ba1b87229dc341c6427c3f7042
SHA512 79a91a2377502c43df0e354852bc01a0cfbdfc7dd9d1f86c1400e094e4ce2b5d5d3f35950873f6c75c7a19959cb9dde1fa9294efd0ff13c3d8842ce3c8de8a89
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\AC\INetHistory\qap`g`v~dtlq
Size 10B
SHA256 20cce2b4a0273677f92b21aff0791e2bdb9ab895d35c3e4a31d70d98bc292f91
MD5 38e393ad2ac18f679ced92aaa8ed2080
SHA1 69cb919ec16191ed003e500b74400c42afdcaf90
SHA512 665a5796956d4e3b628a18b64d7c48a0e36847f62d6cacd529dbc678e1c3beee4048e07272cc1203490fa6dceda0f292cb61a76177d9d954a854832221f519cc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\qap`g`v~dtlq
Size 10B
SHA256 eac8eb613c1f5fa6be85117093d8eb55ad8a62f8c41f66fa122424948afc8c07
MD5 8ac2c7a878f48f262675e1a85a011ce4
SHA1 5067490b086e4a118be039505551f3abab2df771
SHA512 d02e7b85fcccf4070064383694586399c949697e1e52c75fb661fbe5706b92dee5d7be45c87280ea2e0c4577768ce1b32ee49acfade79083879ed4e16863de7f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a7f043fcfe62477e2054e61bd91658460a153f0398ad253425b1485cd0a74327
MD5 af8c9adf847532669e2ec95bc96dfca4
SHA1 09176e551ba663bf4ad96a603f4f2cedc3649735
SHA512 b4613a9a2332f73b259a9c63e8fd7990eb164a82a1fa767b53928b6b7a9515019fb9844181293a6cb783c464c7bc52da488c5b404094b9aca55b7d6f0d1c654d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 21e8455a9dfe7e03791adb0b0b65a297025c5973b88606ff521e96ae78043b2a
MD5 94b68ee9ec5d48cab64fa4ad31f1e3e3
SHA1 73e637f606ed50c9ae357d264a0b3244be6da8e4
SHA512 3fb551acf56e323c4120235d40c971728a0f6f40f628e984b1656e87bfd436099865268aa3a7ef65a09aa7f778c32c6ef34bc6f1f1f7d3417db631e4015b0279
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 85b012611fbd0a019b451e6c2ced98a8ea2ec2e81487d0fba112a6e5df9267ee
MD5 11ca9b42b58c55842c22fcbb88586735
SHA1 f3ddc425e8b5442295d8c27fbeb930303ec14aa5
SHA512 340c52e4a37e7d99cde44e0fce4f218e239dd2a70a015b0d5f5a4e4a75bac7c8df0a76460f4fbca6b06177f884a5c5b7c9a7258eb2904968c9a894fad48d4d95
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6f130b717f1adc1ab570fa5fac4cadbf811117cd161f6003dc361796d8569791
MD5 e1e30cf8b505f62b157196e2c06bf6d4
SHA1 242d0342f421cbdbd9694e874c5cbe6e56b5b3d6
SHA512 ac8e112d072d887148ec8374b74739410e9baa5e2a86374ea952198b3460ea4149739d4a1ef2cbeec54487ebdd991bea68f0bd8fa5022bc6c5942159dc8e58c3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0c1adca94c8a462b92e185572819edf852eb6652e97935b9f0e45041e91f8757
MD5 41f5c8e12ac61b1a746cea34c39baac6
SHA1 80f1ccfba832dce6a3619f7a7830d130e39475b5
SHA512 b1f53ed2c5b3b93f44be6bba0d98981994d987aaca314fa25536dff4d1f1f12cdb6855c8635765dcd45a0b3eed3024038e8ff2aa3c478b6835c60f063434ce16
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 63ad59cbd59e47ff2e3a8a99a8b7e3d1e016f356e3edb80be9fec0758f379264
MD5 d3d28c65231e66adffda422105ebfc06
SHA1 5c06c793bd3d405608a61b7d8b903d75e8ee2558
SHA512 0efc2e4e04a647dd4fb64ce5df1058da3d7a49e9cccbbebdb052adac000a28967b23dff233fa17f9ea64ba3c46c5066200a26967bdd96068be54c228908df85d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9b8a94732085de88927dcaf690f20019314d011beb536d544743f4e396cf123a
MD5 a2bd7891ad43a0fa88aa67c2afd373c6
SHA1 aeaaad413c32fa3b0e0e31320b7b6eb257c74016
SHA512 1f335511491ceb1f9f7ae7010d2cbddd901c5ca4f46c2603243cf11d929e2b1faa11727b1c0a24ed45e142d35ee1355a7ad1a1f8a95982faaf8131906e20800f
MD5 SHA1 SHA512

Submit Download

svchost_CCCABCBABCACACBACBCBAAAABCCCCCBBCABCCABBAACACACBBCBABCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBABCACACBACBCBAAAABCCCCCBBCABCCABBAACACACBBCBABCB.exe
Size 1.8MB
SHA256 415eed4fa369ce588a76c5e5cf1a7af15f7a17be43990f77709f11acaff2fbcd
MD5 4e76c20098be27138783f428f6dd147c
SHA1 7df4f883d8d532a190a71b4b8f46410cb6c3f281
SHA512 6a8e9ef606bd030294edfe4c7964cba2324544250f8498526a70e940c620a138854f44d3e3df2541fa7a0fad95bbf11667199e049650ac9fa9460554017c9b90
SSDEEP 49152:U+EW5+ES+ES+ES+EWLy+EW5+ES+ES+ES+EWLzDd79WCZ:5p7r
TLSH
T1C2957D05FA828075E96710B04DDFD2BE8A34BE218B118DEBF78D9B1F6932BE16434715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 9021169a5d12429bd937cbbba822b893c7707079deba45f3a011c8c68744da2e
MD5 752c19ec754f89a8e7df641ab8bf7351
SHA1 a4a4b7d2f84f2b49d1df1205e8977dc568e18b1f
SHA512 bd7bd0c9ff6da80be0b0b72c77028bce413def29227dfbbc4916a146b187022aa0d7e85a89ef8c200c3a875226f08c312ff80c7f66eaf5129b63b95c03f9032d
TLSH
T189113A60F9B5D423F932689B632DDF930CF2739FAC986A5423088109E7C8D318D598D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 d936c821f2e89c89c912262ad6f57ce63b127564bf10d5c9b06b3b9a73772e29
MD5 8c766025368d3197e0a28358760c4266
SHA1 0536dddf0775a81e53a9e568281558090a0dc548
SHA512 e24d950de34894cedd423fa11742c3da558036763efb5940183e3061ab7f5d157659d6678e197098f60a1c7543078a442c93799654d7c58241c1fadb1c4dafdf
TLSH
T13321F660FDF5C823F933689B632DDF930CB2779FAC986A5423098119A7C9D318D598D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2220-0-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/2220-7-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/2428-36-0x0000000000D00000-0x0000000000D21000-memory.dmp

Download

memory/2556-60-0x0000000005280000-0x0000000005281000-memory.dmp

Download

memory/4064-2178-0x0000000000D00000-0x0000000000D21000-memory.dmp

Download

memory/5052-81-0x0000000000F20000-0x0000000000F41000-memory.dmp

Download