dea35584b0f77a6ed69e38e3877635e561793c90d41be0264536628cb3824760

Analysis

max time kernel
149s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 04:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_d6958e6cd474a1741c2192c9e9956883_amadey_darkgate_elex_stop_vidar.exe
Size 3.5MB
Sample260908-fb76lada53
SHA256 dea35584b0f77a6ed69e38e3877635e561793c90d41be0264536628cb3824760
MD5 d6958e6cd474a1741c2192c9e9956883
SHA1 8297b6b26fd2453c3886beb6e5b98379b6aef00d
SHA512 62aca8469139694cdb78668d4dfbf496c67b84e420331cd2bc665b400afb5ce137c6eda7284b6ccef4f439fab6b4819c8c0a5ab826f70a492c576a56367cfea8
SSDEEP 49152:U+EnY5VbDd79WCHy6i1zuajsauZjam+EnY5VbDd79WCHy6i1zuajsauZjaHhOw:J5Vp71tC5Vp71teT
TLSH
T1FDF57C1D33E800A5E5739575CA6AC266ED71B8311B3196CF2280D63D6F37AE0E939F12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BABACBCCCBABBBBBAABACCBBAABABCABBCBAABAACBBBCCAABBABABC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BABACBCCCBABBBBBAABACCBBAABABCABBCBAABAACBBBCCAABBABABC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BABACBCCCBABBBBBAABACCBBAABABCABBCBAABAACBBBCCAABBABABC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BABACBCCCBABBBBBAABACCBBAABABCABBCBAABAACBBBCCAABBABABC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3716	svchost_BABACBCCCBABBBBBAABACCBBAABABCABBCBAABAACBBBCCAABBABABC.exe
900	svchost_ACAABAACBACABBCACBAABBBBABBABCABAACBCCBBCBAAAABACBABCBA.exe
6104	svchost_BABACBCCCBABBBBBAABACCBBAABABCABBCBAABAACBBBCCAABBABABC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACBBBBBCAABACAABABCBAAACCCABBAACBCACBCAACBBAABACBBACCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABACBCCCBABBBBBAABACCBBAABABCABBCBAABAACBBBCCAABBABABC.exe"	2026-09-07_d6958e6cd474a1741c2192c9e9956883_amadey_darkgate_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBACCBCBCBBAABABCCBAABBACCAABCABAAABBBACCBBCAAACAACBCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACAABAACBACABBCACBAABBBBABBABCABAACBCCBBCBAAAABACBABCBA.exe"	svchost_BABACBCCCBABBBBBAABACCBBAABABCABBCBAABAACBBBCCAABBABABC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4348	sc.exe
1440	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4464	cmd.exe
2640	cmd.exe
4684	cmd.exe
5364	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACAABAACBACABBCACBAABBBBABBABCABAACBCCBBCBAAAABACBABCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_d6958e6cd474a1741c2192c9e9956883_amadey_darkgate_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABACBCCCBABBBBBAABACCBBAABABCABBCBAABAACBBBCCAABBABABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
672	schtasks.exe
1532	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4664	2026-09-07_d6958e6cd474a1741c2192c9e9956883_amadey_darkgate_elex_stop_vidar.exe
4664	2026-09-07_d6958e6cd474a1741c2192c9e9956883_amadey_darkgate_elex_stop_vidar.exe
4664	2026-09-07_d6958e6cd474a1741c2192c9e9956883_amadey_darkgate_elex_stop_vidar.exe
4664	2026-09-07_d6958e6cd474a1741c2192c9e9956883_amadey_darkgate_elex_stop_vidar.exe
3716	svchost_BABACBCCCBABBBBBAABACCBBAABABCABBCBAABAACBBBCCAABBABABC.exe
3716	svchost_BABACBCCCBABBBBBAABACCBBAABABCABBCBAABAACBBBCCAABBABABC.exe
3716	svchost_BABACBCCCBABBBBBAABACCBBAABABCABBCBAABAACBBBCCAABBABABC.exe
3716	svchost_BABACBCCCBABBBBBAABACCBBAABABCABBCBAABAACBBBCCAABBABABC.exe
6104	svchost_BABACBCCCBABBBBBAABACCBBAABABCABBCBAABAACBBBCCAABBABABC.exe
6104	svchost_BABACBCCCBABBBBBAABACCBBAABABCABBCBAABAACBBBCCAABBABABC.exe
900	svchost_ACAABAACBACABBCACBAABBBBABBABCABAACBCCBBCBAAAABACBABCBA.exe
900	svchost_ACAABAACBACABBCACBAABBBBABBABCABAACBCCBBCBAAAABACBABCBA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4664	2026-09-07_d6958e6cd474a1741c2192c9e9956883_amadey_darkgate_elex_stop_vidar.exe
Token: SeDebugPrivilege	3716	svchost_BABACBCCCBABBBBBAABACCBBAABABCABBCBAABAACBBBCCAABBABABC.exe
Token: SeDebugPrivilege	6104	svchost_BABACBCCCBABBBBBAABACCBBAABABCABBCBAABAACBBBCCAABBABABC.exe
Token: SeDebugPrivilege	900	svchost_ACAABAACBACABBCACBAABBBBABBABCABAACBCCBBCBAAAABACBABCBA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 4464	4664	2026-09-07_d6958e6cd474a1741c2192c9e9956883_amadey_darkgate_elex_stop_vidar.exe	92
PID 4464 wrote to memory of 672	4464	cmd.exe	94
PID 3716 wrote to memory of 5004	3716	svchost_BABACBCCCBABBBBBAABACCBBAABABCABBCBAABAACBBBCCAABBABABC.exe	95
PID 4664 wrote to memory of 2640	4664	2026-09-07_d6958e6cd474a1741c2192c9e9956883_amadey_darkgate_elex_stop_vidar.exe	98
PID 2640 wrote to memory of 4348	2640	cmd.exe	100
PID 4664 wrote to memory of 4684	4664	2026-09-07_d6958e6cd474a1741c2192c9e9956883_amadey_darkgate_elex_stop_vidar.exe	101
PID 4684 wrote to memory of 1440	4684	cmd.exe	103
PID 3716 wrote to memory of 5364	3716	svchost_BABACBCCCBABBBBBAABACCBBAABABCABBCBAABAACBBBCCAABBABABC.exe	106
PID 5364 wrote to memory of 1532	5364	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-07_d6958e6cd474a1741c2192c9e9956883_amadey_darkgate_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_d6958e6cd474a1741c2192c9e9956883_amadey_darkgate_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCBCBACABCABBAABACCBBBCBACCABAACABACAAAAACACABCBCCBCCBCCBBBAABCACACCBBBBBBCBCBCBAABABACABCCCABCBBBBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBCCCBABBBBBAABACCBBAABABCABBCBAABAACBBBCCAABBABABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCBCBACABCABBAABACCBBBCBACCABAACABACAAAAACACABCBCCBCCBCCBBBAABCACACCBBBBBBCBCBCBAABABACABCCCABCBBBBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBCCCBABBBBBAABACCBBAABABCABBCBAABAACBBBCCAABBABABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBBBCCCCAABCBBAACACABCBBCCABBCCABCBACCBAAABABBCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBCCCBABBBBBAABACCBBAABABCABBCBAABAACBBBCCAABBABABC.exe" start= auto displayName= "UserDataSvc_ABBBBCCCCAABCBBAACACABCBBCCABBCCABCBACCBAAABABBCCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBBBCCCCAABCBBAACACABCBBCCABBCCABCBACCBAAABABBCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBCCCBABBBBBAABACCBBAABABCABBCBAABAACBBBCCAABBABABC.exe" start= auto displayName= "UserDataSvc_ABBBBCCCCAABCBBAACACABCBBCCABBCCABCBACCBAAABABBCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBBBCCCCAABCBBAACACABCBBCCABBCCABCBACCBAAABABBCCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBBBCCCCAABCBBAACACABCBBCCABBCCABCBACCBAAABABBCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1440

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBCCCBABBBBBAABACCBBAABABCABBCBAABAACBBBCCAABBABABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBCCCBABBBBBAABACCBBAABABCABBCBAABAACBBBCCAABBABABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBACABBCBCACCBCABABCCABBBACCCACCCCAAAABCBACBBBACCCCCCCACABBBABCCCAACBCCAAACCACACCBAAACBCCACBBCABBBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABAACBACABBCACBAABBBBABBABCABAACBCCBBCBAAAABACBABCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5364
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBACABBCBCACCBCABABCCABBBACCCACCCCAAAABCBACBBBACCCCCCCACABBBABCCCAACBCCAAACCACACCBAAACBCCACBBCABBBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABAACBACABBCACBAABBBBABBABCABAACBCCBBCBAAAABACBABCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1532

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABAACBACABBCACBAABBBBABBABCABAACBCCBBCBAAAABACBABCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABAACBACABBCACBAABBBBABBABCABAACBCCBBCBAAAABACBABCBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:900

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBCCCBABBBBBAABACCBBAABABCABBCBAABAACBBBCCAABBABABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBCCCBABBBBBAABACCBBAABABCABBCBAABAACBBBCCAABBABABC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 0635c69974d85ab4ead79e23e0cae6af3864c83760b22a05e84fe665d0b75f6f
MD5 3979d1f92ddcdc65b18087514b1d3768
SHA1 d5a0ac6b48930ae4a0203bd7052936d04ecfcc93
SHA512 0244dcd3671229f650a2b3f1bfbc8b432a0d1230146d4b425d3bb04c7a725f42c6252f74efb0bb2c2b21f531f130b57ea6b3375dd63dc786c1fd1703af3d8070
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 ebf116419d445f1fb40c8bffc21014ae347bdff6179c85564769969f63a3d52d
MD5 4de6fef19a2efd0fd37476654d0f0964
SHA1 f91672d697ad023a00825125a9a80a9ad8295125
SHA512 aa1974de4fcbe7257edd55a7996c6c6e4c7c6a5eb111671d9e9a8eae41341df32bc65ffb8912d6d409fa0c6ce10920a0972f7f18600344025c96ac1dc00200c8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{11CCC9F6-77AA-4421-9EAC-BAEC36D96817}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 df6591e55bc83478bfa3a9fc1d4aa17248ecc91e3b4eec40b015de3a52045cae
MD5 7ea5a15a59dd17fbda5587a29e4b7c77
SHA1 65feaf0b222fb232c6bf205ea95707620f335659
SHA512 01aff037a88a0631719f2e4ef72ca56d8bc47656e22ce7293e3351056da70c9b4400de4a51248cb7e2ec90cf890fe5394f0c2c71388e803ad7c2caf34f1f9624
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 4.0MB
SHA256 07cfb8e7d7c9f58a4b634bfeae9b9afc36eab9fe7392bf61ae8b696df6ddface
MD5 52d01fb07f7699056a95e8efbcab83a3
SHA1 512bf3aaec6d8615ecc7beff0c854dcefa480685
SHA512 dc5bb50d0e9107fa0ab8cf3ba8021f775b6120da6abc2b9ef829d1a429f6d76a4da5d70f7f2056e4d95c22ff53aadb890e19b158fd4aaec1e7e7aa944cb8e6c5
SSDEEP 49152:U+EnY5VbDd79WCHy6i1zuajsauZjam+EnY5VbDd79WCHy6i1zuajsauZjaHhOvg0:J5Vp71tC5Vp71teWgZ2Hb9t+2xt
TLSH
T1D0168D2973E800A5E5B39575CA7AC261ED75B831173086DF6380D63D2F379D0AA3AF12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\qap`g`v~dtlq
Size 10B
SHA256 4ae1a2292ea7b769304fb1a4edab2c07dc91389207fada366f68ae8bb5b39760
MD5 1b50b9e6a4cc4e1b67b7c54a674b5c5e
SHA1 cd78a94b9b74e83e8f238184a7f7813c611eaa7c
SHA512 8eb4f772a911e9ed24bd2c442baaba513d894a497a4eac40dbb2f2efbcc134c05bd231c824ea45fe04a4a9f34f2475f516404155dc87ae0bf25eb534cee80253
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\bn-BD\qap`g`v~dtlq
Size 10B
SHA256 194dae499d1c64ed4fe74b741d2270a11c25d4b2d1610a23b3c73504dbd85f0d
MD5 413f4c36d3f54d18d7e9a0c1cdd5f914
SHA1 e82c129cbebda40c52fd16e7826f0e3a6b6d61f1
SHA512 28e2ccc034961cd5521ddb3263f6bb0c1f699be2f741669eb3d9b2aa743bbbecef9c8df0bcdd7e753e3bf0dc04aa30b7939f931857ff637c3818081278ee1b16
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalCache\qap`g`v~dtlq
Size 10B
SHA256 dee02991e5ce421b4f0e7b7c748e0fbdaa8474c7aa5c84f9e046e59f17e119cb
MD5 60d7db47bf46cbe17cc31c4f4a8ad7de
SHA1 6496d999dc1e9e706b2b2b9f6417d6942930d7c7
SHA512 2706222b0e88a1118fece5f72a78603151b196b735ea44243d1a6838d2f7fcfa0cad94a12a72351fb0cc9389addf3312ebdd261794671b093c6a94f79744fc19
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5664ba13f5b732c953e226d6dfe6745be51527f0b4bc86af1c8804eab55c2ee5
MD5 5c464cb2e2bf88f3b584eb6dfcf245b2
SHA1 d0c3126229a30d4742eac1cb46f1e94f57ae2912
SHA512 b9ef6e9d3d2f08c318871c9b5708066db3553aa38abedd4c1cc06c73da38cc4f29285b1a925d380af69d6846387a4bd0562557ef2818a4d973b585a5d6af9108
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6071ffbad8345478ad65d185c82b0227003a3ea7ab29250fcc36286f303b6646
MD5 7497c0b3ba9478e634c224c55add46e8
SHA1 234afd1e0d3649002fa223db1979cbc8b927ead7
SHA512 5aa5af41457783d2719585d2d974e861f08fbd3952b0a16c97e71d78211610c5e74f57f4e039c995c63909e9f6cd391f3aa0476d939e6eaa4fb5708bdc1adf28
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bb896eafaafa1e7ba8180832b5509e5af6eeecb0decf3c46f62c066400a43c95
MD5 9cfb0673fe1bc40b7d958b88bc1e4ed0
SHA1 a6d511cf77e358ebacae74e9e2c13a09bf32f137
SHA512 744c1df6b5e666fe92b6023caaf9f3f44d18add0619161eac4113176f59cdd293bb7aeab0fe689ab8da5d9cd0636c058baba6944dc8834b1b21e8ef97f52ae6e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 74e6034340b49786241a3c7f6ac877623a41aa62cca952dde3a79915a1e13f1a
MD5 750aa573d07ba3ca29830560ac8f67b7
SHA1 229e1e483be562f1797b74e9664b4483743f773c
SHA512 bec697b463c79909de57b556ff823583306b7156cb2a4a183140b81b7243feeaa2ff9a1faa182e9309356cbea5f93582d830980690a8ef443ee205cbc7ef85ca
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b9f5325032aed7bc2acf0425cc19c0df7e6b52dd969830f236441d7e63464f8e
MD5 5bccf09cf8124c92ac39c9bc261891eb
SHA1 698ced2361cb971274f63a6ed4233629c3eca6b8
SHA512 6df018c33ef437e01b7cc473e6a2aea19acca990f597f704c3037a4af8f99b1d95ed1fe21abf43008a4f646fcbe934239298191c5c0a98661220b53987a21620
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 daa43032f44e6de030368ecc5e9bac56c06cad3749302747eeb0957f0d1baf9b
MD5 9533a07749e1e0a2fd40555077bf811f
SHA1 85f14d9812859f1fa27a6c5fa99a231c3104c20d
SHA512 4c5242bb0f28b692097eacb37918e6c15ae61b4fc89ed2c09104c8aa2aef32795dc967265281aae42c784b31151892a7dce223c5e6185cd288d804b85613176e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2def5f858677371a5412b00ff25d9f858928c728befed877ef5a402091582daf
MD5 272ca7f13accfedd5e479b85bd0c6425
SHA1 89596a4c8af4c6736469c20d722a3e236813f06d
SHA512 829b36537931566ddbf34bfd82ce0c40ce7cb2a24b34df7d621933cab927bd572228c01f39e78ce4cc834e7abe9dab0786550c93d79c63dc7124d579cf3821d0
MD5 SHA1 SHA512

Submit Download

svchost_BABACBCCCBABBBBBAABACCBBAABABCABBCBAABAACBBBCCAABBABABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBCCCBABBBBBAABACCBBAABABCABBCBAABAACBBBCCAABBABABC.exe
Size 3.5MB
SHA256 dea35584b0f77a6ed69e38e3877635e561793c90d41be0264536628cb3824760
MD5 d6958e6cd474a1741c2192c9e9956883
SHA1 8297b6b26fd2453c3886beb6e5b98379b6aef00d
SHA512 62aca8469139694cdb78668d4dfbf496c67b84e420331cd2bc665b400afb5ce137c6eda7284b6ccef4f439fab6b4819c8c0a5ab826f70a492c576a56367cfea8
SSDEEP 49152:U+EnY5VbDd79WCHy6i1zuajsauZjam+EnY5VbDd79WCHy6i1zuajsauZjaHhOw:J5Vp71tC5Vp71teT
TLSH
T1FDF57C1D33E800A5E5739575CA6AC266ED71B8311B3196CF2280D63D6F37AE0E939F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 bae3c424dbda96478fb816beb58321076e4ea1041a09c2e4e90831f29bf53fc7
MD5 79fd463a87862303790aa27e5b03dd3a
SHA1 ae6e6ef4fb2f27204b95adbcf0c77905ccb37053
SHA512 3257fffd127208bb0840cc3601e797d2a5c9a91f464c7a689f2ae9e4c75f7b5e440b91e4995cf7e9df18720f1ea4a57936e86eeac5f0262810ae5cc75667ee79
TLSH
T1ED110B31F464D893E23164CB6A25DFC748D4379A985C9B48A30A4218E7EDC398D59CF1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 3d90aa6b6e3f759f8231f3c850ccb2bd6a3a34fb5c4e6febf515a22a59c6655b
MD5 c892a2fee0ccc35df7b4aa9310f12dd1
SHA1 d681015f62cc9be9b07cf4621a9cae6fa61c320d
SHA512 e92cec77403f857a3dec7e83c46f76fefaeb981cdc211c38c524509df2d15213acf0e336e936b0ab495ba4e4af0c803e076fb923c2c3853dd4214b89e457f5b5
TLSH
T14221EA31F465DC93E13164CB6B25DFC748943B9A985C9B48A30A4218E7EDC398D59CF1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 e845c7fba7cedb57e31ca1b27bbce838466d5d684c489b2db5d7f00e7c98541f
MD5 9462df056bdaad337e1f803e0bdb9160
SHA1 fdb3fdb62da9c92325ec6dc625bfd73440f19556
SHA512 f2df922f54d1abbf428bbf4a24ca08c4dd3df43c23c4295ea6e1add94db7068cbdd87b7d69077a9b10f5e4734933eeb0952190126d62b9e6c31d2de8e6a4dce3
TLSH
T17D112731B475D883A53264CBA731DF8B4CD42B96285CAB48A30A4218E7ACC398D59CF2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/900-71-0x0000000000210000-0x0000000000231000-memory.dmp

Download

memory/900-3923-0x0000000000210000-0x0000000000231000-memory.dmp

Download

memory/3716-33-0x00000000007A0000-0x00000000007C1000-memory.dmp

Download

memory/4664-6-0x0000000000EE0000-0x0000000000F01000-memory.dmp

Download

memory/6104-3624-0x00000000007A0000-0x00000000007C1000-memory.dmp

Download