6c7033e6824f6c6726863cd8925147fbfc2d52dee62d3df4fb9279312c4f1256

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_8b9699c926c5f4358763d9a9d325ef04_darkgate_elex_glassworm_stop_vidar.exe
Size 27.9MB
Sample260814-eetxpscj9s
SHA256 6c7033e6824f6c6726863cd8925147fbfc2d52dee62d3df4fb9279312c4f1256
MD5 8b9699c926c5f4358763d9a9d325ef04
SHA1 294f3b56fc14bae33136afa68a3be51af3cf2962
SHA512 145d04eabff7bbf5d66c2f427f00c5b53b87c923ef6043eb8d114d0710e06e8e9cdd84dae98fa415fed6e75ad69540825d5ff7f5e85818afb83f65b68031a692
SSDEEP 98304:QVjV0PVjV0PVjV0PVkKRuy5aqVjV0PVjV0PVjV0PVkKRuy5aqVjV0PVjV0PVjV0k:+qfqfqG7
TLSH
T1CC577C45FA8690B2D4270171489B83BB5A70BD214F129AEFF788A33E5E337C0A736755
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCBBBCBBABBBBBBCCBBABBCCCBBCABBACACBCCACBABCCCCACABAABB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCBBBCBBABBBBBBCCBBABBCCCBBCABBACACBCCACBABCCCCACABAABB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4364	svchost_CCBBBCBBABBBBBBCCBBABBCCCBBCABBACACBCCACBABCCCCACABAABB.exe
3968	svchost_AABAAAABBCCCCCBAABCBCBABCCBCBCCAACCCACABBAABBCBBCACBACC.exe
4068	svchost_CCBBBCBBABBBBBBCCBBABBCCCBBCABBACACBCCACBABCCCCACABAABB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CAAABBBCCBCBCBCBACBAACCBCCAABCCBCBBABCAAABAAAAACBBACACCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABAAAABBCCCCCBAABCBCBABCCBCBCCAACCCACABBAABBCBBCACBACC.exe"	svchost_CCBBBCBBABBBBBBCCBBABBCCCBBCABBACACBCCACBABCCCCACABAABB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABBBCACBBCBACAAABBABACAAACCACCBABCAAABAABACBACBCCCACCBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBBBCBBABBBBBBCCBBABBCCCBBCABBACACBCCACBABCCCCACABAABB.exe"	2026-08-14_8b9699c926c5f4358763d9a9d325ef04_darkgate_elex_glassworm_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
712	sc.exe
5104	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4560	cmd.exe
3772	cmd.exe
2116	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_8b9699c926c5f4358763d9a9d325ef04_darkgate_elex_glassworm_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABAAAABBCCCCCBAABCBCBABCCBCBCCAACCCACABBAABBCBBCACBACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBBBCBBABBBBBBCCBBABBCCCBBCABBACACBCCACBABCCCCACABAABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3896	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3660	2026-08-14_8b9699c926c5f4358763d9a9d325ef04_darkgate_elex_glassworm_stop_vidar.exe
3660	2026-08-14_8b9699c926c5f4358763d9a9d325ef04_darkgate_elex_glassworm_stop_vidar.exe
3660	2026-08-14_8b9699c926c5f4358763d9a9d325ef04_darkgate_elex_glassworm_stop_vidar.exe
3660	2026-08-14_8b9699c926c5f4358763d9a9d325ef04_darkgate_elex_glassworm_stop_vidar.exe
4364	svchost_CCBBBCBBABBBBBBCCBBABBCCCBBCABBACACBCCACBABCCCCACABAABB.exe
4364	svchost_CCBBBCBBABBBBBBCCBBABBCCCBBCABBACACBCCACBABCCCCACABAABB.exe
4364	svchost_CCBBBCBBABBBBBBCCBBABBCCCBBCABBACACBCCACBABCCCCACABAABB.exe
4364	svchost_CCBBBCBBABBBBBBCCBBABBCCCBBCABBACACBCCACBABCCCCACABAABB.exe
3968	svchost_AABAAAABBCCCCCBAABCBCBABCCBCBCCAACCCACABBAABBCBBCACBACC.exe
3968	svchost_AABAAAABBCCCCCBAABCBCBABCCBCBCCAACCCACABBAABBCBBCACBACC.exe
4068	svchost_CCBBBCBBABBBBBBCCBBABBCCCBBCABBACACBCCACBABCCCCACABAABB.exe
4068	svchost_CCBBBCBBABBBBBBCCBBABBCCCBBCABBACACBCCACBABCCCCACABAABB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3660	2026-08-14_8b9699c926c5f4358763d9a9d325ef04_darkgate_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	4364	svchost_CCBBBCBBABBBBBBCCBBABBCCCBBCABBACACBCCACBABCCCCACABAABB.exe
Token: SeDebugPrivilege	3968	svchost_AABAAAABBCCCCCBAABCBCBABCCBCBCCAACCCACABBAABBCBBCACBACC.exe
Token: SeDebugPrivilege	4068	svchost_CCBBBCBBABBBBBBCCBBABBCCCBBCABBACACBCCACBABCCCCACABAABB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2568	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 4560	3660	2026-08-14_8b9699c926c5f4358763d9a9d325ef04_darkgate_elex_glassworm_stop_vidar.exe	100
PID 4560 wrote to memory of 3896	4560	cmd.exe	102
PID 4364 wrote to memory of 4772	4364	svchost_CCBBBCBBABBBBBBCCBBABBCCCBBCABBACACBCCACBABCCCCACABAABB.exe	104
PID 4772 wrote to memory of 4516	4772	notepad.exe	105
PID 3660 wrote to memory of 3772	3660	2026-08-14_8b9699c926c5f4358763d9a9d325ef04_darkgate_elex_glassworm_stop_vidar.exe	109
PID 3772 wrote to memory of 5104	3772	cmd.exe	111
PID 3660 wrote to memory of 2116	3660	2026-08-14_8b9699c926c5f4358763d9a9d325ef04_darkgate_elex_glassworm_stop_vidar.exe	112
PID 2116 wrote to memory of 712	2116	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-08-14_8b9699c926c5f4358763d9a9d325ef04_darkgate_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_8b9699c926c5f4358763d9a9d325ef04_darkgate_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACACACABBABACACCACCCACACAACBCCAAABCABAACBCCABBBACBBCCBBCCACCABBCCACBACBACABAABBBBABACCBCCBBABCBCCACACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBCBBABBBBBBCCBBABBCCCBBCABBACACBCCACBABCCCCACABAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACACACABBABACACCACCCACACAACBCCAAABCABAACBCCABBBACBBCCBBCCACCABBCCACBACBACABAABBBBABACCBCCBBABCBCCACACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBCBBABBBBBBCCBBABBCCCBBCABBACACBCCACBABCCCCACABAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBACBBAACACBBBCCBCBACCBACCBCBBBBABCCACBBCCBCCABCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBCBBABBBBBBCCBBABBCCCBBCABBACACBCCACBABCCCCACABAABB.exe" start= auto displayName= "UserDataSvc_ABBACBBAACACBBBCCBCBACCBACCBCBBBBABCCACBBCCBCCABCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3772
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBACBBAACACBBBCCBCBACCBACCBCBBBBABCCACBBCCBCCABCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBCBBABBBBBBCCBBABBCCCBBCABBACACBCCACBABCCCCACABAABB.exe" start= auto displayName= "UserDataSvc_ABBACBBAACACBBBCCBCBACCBACCBCBBBBABCCACBBCCBCCABCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBACBBAACACBBBCCBCBACCBACCBCBBBBABCCACBBCCBCCABCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBACBBAACACBBBCCBCBACCBACCBCBBBBABCCACBBCCBCCABCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:712

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBCBBABBBBBBCCBBABBCCCBBCABBACACBCCACBABCCCCACABAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBCBBABBBBBBCCBBABBCCCBBCABBACACBCCACBABCCCCACABAABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4516

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2568

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAAABBCCCCCBAABCBCBABCCBCBCCAACCCACABBAABBCBBCACBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAAABBCCCCCBAABCBCBABCCBCBCCAACCCACABBAABBCBBCACBACC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3968

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBCBBABBBBBBCCBBABBCCCBBCABBACACBCCACBABCCCCACABAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBCBBABBBBBBCCBBABBCCCBBCABBACACBCCACBABCCCCACABAABB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 f8f7dddd929b7b063256222c8b7afc0502fbba31162c8d6615f0616a8bfe4481
MD5 66c73b86fcb35f9b95389cd1ab201287
SHA1 9be44701197dfc760c3ee2cd17cf7442267ef9d1
SHA512 0bee204e1f1e4cd857782b62fb12674bf62b0e03218f848b1c068d4a1d268ace3c47bd1a4709e6cafc888586d3c59761c348292d160d9e079d2c15eca2dbe07f
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 28.4MB
SHA256 99e7bce5c0ced57da9e304204506a36545455efbe69460d9f23436d4827e3981
MD5 4082545e8f9c19018ca4abcec675b8b6
SHA1 952389bc7c76a4ab4fc391c45074095ef69a4cc9
SHA512 4c3ce120bde20b4f781f5e6f9539d665f90950528b034de3c619f1c5587ba1c8d9a70663d25420efa8fd2d72a99dcf82914b7e8efc6ceb15889ed8f23b31aee3
SSDEEP 98304:QVjV0PVjV0PVjV0PVkKRuy5aqVjV0PVjV0PVjV0PVkKRuy5aqVjV0PVjV0PVjV0v:+qfqfqGA
TLSH
T116677C45FA8690B2D42701714C9B82BB5A70BD214F129AEFF788A33E5E337C0A736755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\MapData\qap`g`v~dtlq
Size 10B
SHA256 0239c5c4323e72036dbf2a3e4e1ff89629b293f262348f028d2a97646b750153
MD5 40a59ccfab677bfbbc0d01d98ffc2af3
SHA1 8269ca17f15ec2ed1a5b6a0bfc6e21090cd71709
SHA512 b7ef29f20466310dde88cfdefa7b41dbaf8b5ccd8a8abcc358ec0691ac444ccd289bb704144d3da33e7b0b8a636145bde3fc9eaf5902f5249e4f557b75e91f4f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.Apprep.ChxApp_1000.19041.1023.0_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 e1438fb5fcfab88e90489116e567afbec4246c9875cd725e1c0a3e2dc91cdcbd
MD5 a50a515826e42f8b70a6b7a59b18d112
SHA1 4888542730913dd059939c6a4fb710ed8ac20d7c
SHA512 6679a99764490eb242a462bfaf05af8ea69c890f4f2d6da61835c1812d7a0ce09d3779e8ff10538949cb6475aabce7a8b2294c12e42886e069d35e3418c569b4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 d524379eedcaaac4d5b54e6452a6257d478e735b52c623182a5c21703e95546f
MD5 f41b0f30d162e91690becce79678112b
SHA1 45e027e21b8357ffa79a4bc8da0003144d27bf3e
SHA512 4bcc76111fcb5aad757de3c62908783c4391b49041d81d0905e1c7ac244c2e574d897e256d5740a252c3256a199806d001e3545b0421441664dde700ad6fb9a7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 13b406b049c4a7f4542c11507ea4ad49e9456b93ce15b009cf65a2d18875c34f
MD5 28221e71070be843afb64fbc0c823e4f
SHA1 907201afedc86771528f4fcce4b1749dd2036f8a
SHA512 2167bab813c7a4e404217f231023d62666ed1763c5c70f83d7a7cf2fb974e49a9eb85a8e47773154128c273237149abd99e9461dac96efc156b380a6698f34b6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 38917a26386b3b3624ad92fd413a2b7a3969a1869c74ed03840aecaad5fbd7f5
MD5 fc6e63f0559795a393c66f297f9b2409
SHA1 761e7dc7d0da7656192d07d6d31de0d16e65265f
SHA512 9f0a388ee1cd5a2114e40ac8f52518a99a3fddc4006aeffdb75b9e1d4773962fc4f85df8f8932b7644cc4601972b8e2a05c65da90009e92831711a839c3b3845
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\cache2\entries\qap`g`v~dtlq
Size 10B
SHA256 782f472dbf25f7cc2a482ac666780cb03836b3670883dc0ec8031448f0fd20a1
MD5 810ffa2c31b372be1bd7d1bc6520408f
SHA1 8f8811c82d1b943db0a3352164c25c11422387b0
SHA512 7df7e261fe4886a3e60eb407b9b0f14eba5edab0c9ea20bf987f465f9b7cbe2b9e76907fe3a11dd4e31980bf695985e40246ed227963ef102496ca3f6309c071
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\qap`g`v~dtlq
Size 10B
SHA256 cedeca8bdf6e28e414b510af0e28a5354de6af71d7f7be2cb6efdbdc3128174f
MD5 623edc6bfbd1f94de2cf2f6a283c4e42
SHA1 9dcfa3848429302cbd76dc2e008cab135e51c614
SHA512 dcbb4fcfaad3b773056ae27b3cb4d489302155298f4d17b4ddc188264d30d3b171d3401884b50c29164eef298e2c06082218b40117a1c8659e83f340706ae00a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c71bc9d375930aa89d05ee8cdd40e581b597e460fe1d7a7fa9dd8197c09d7727
MD5 ce60da912c09aefc3d67fc62a4b30e0c
SHA1 dd759b138851528d5926a79ace35b2452bbfa890
SHA512 803c670229382b5eb14f9db33f3b1e7b5ec40fe3298adec03b469ff96cc1623ee28f6aa28668432dd40ff37838781f315b99e686a39e05e2c0fd46a98d6a5add
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a3d1719d6ed3423396f8c8dc362a8d1dbf2c15efa09d68cf910ad379d8b8bbe9
MD5 a22a9ba45d9f40e30653db5c1c16a7d5
SHA1 035fef757aa4a9ff923910a9f0bec972fca7a226
SHA512 5c7dfc36f0ba6545617650fa8e5a687398bedc00c798e5f9f6eb851bff3213e5b3fc76259cd6585d8a7855707e098b7fddb7e19c83ad8d442d497defd5af5da3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2ddee20dba7d0ada84447dbec23b2006055f10ec30ac4dc95170185c3fcec867
MD5 2239a28b9b316c6b9c166511c07b7e3e
SHA1 4b92d4e1e2c4a625a1523a3f6a6afaefef8a5dc0
SHA512 d7e299a00a8c7c2a0ea97ca1e86d154617099f746d7e30f5b311551f02f1d5cbcdeb21a692f40d070d116584d558fe043d20997eb464fac05aba1c04d42ebbf1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2a70c3d394319660963971bfecb57e951c836cbdc6a7430d93292e735862555a
MD5 de6333876dc8a6074553e417ce7726e6
SHA1 fae5155eea3dc3061f08b8f0b24adb6655490b29
SHA512 668200496804426906ff03b7857da2079fb6ad0e29c0ccd1e2ddf7355812db3144feff1e80ed16327ff4aa42f804c830a709d8de93fd1acbbcdfb7ea402aa7d5
MD5 SHA1 SHA512

Submit Download

svchost_CCBBBCBBABBBBBBCCBBABBCCCBBCABBACACBCCACBABCCCCACABAABB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBCBBABBBBBBCCBBABBCCCBBCABBACACBCCACBABCCCCACABAABB.exe
Size 27.9MB
SHA256 6c7033e6824f6c6726863cd8925147fbfc2d52dee62d3df4fb9279312c4f1256
MD5 8b9699c926c5f4358763d9a9d325ef04
SHA1 294f3b56fc14bae33136afa68a3be51af3cf2962
SHA512 145d04eabff7bbf5d66c2f427f00c5b53b87c923ef6043eb8d114d0710e06e8e9cdd84dae98fa415fed6e75ad69540825d5ff7f5e85818afb83f65b68031a692
SSDEEP 98304:QVjV0PVjV0PVjV0PVkKRuy5aqVjV0PVjV0PVjV0PVkKRuy5aqVjV0PVjV0PVjV0k:+qfqfqG7
TLSH
T1CC577C45FA8690B2D4270171489B83BB5A70BD214F129AEFF788A33E5E337C0A736755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 0d0553296531115a7b5363487883adf5f896abf0eb79aabea32033630fea4368
MD5 00fbd725075583eb40f0019535d3366c
SHA1 6dde69cfa923423a225ff481ffa00af134590d4c
SHA512 604db1f9aa1f63d3eb404a6ca2dcad31176506c53b68d72a4f900917027bde9c1d0c4d09b72c3bbab493daf11e150e719453b34936a4978c0b02a3b2fba20ed9
TLSH
T12B11EB51E4E5DC23EC33688F935A9BE20CE877D7E8189A2513CD412DBF85C318D114E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 b3801b81c55f11cc3f73ae85721cc76b0e38c10ff9355a336a8b889556f1c181
MD5 29d1d1f0da193bd15426200e69edb3f6
SHA1 49b3281b501cc0607a2ba6650c94962b06ba3c87
SHA512 f6d736172bb3f35a2cd0de4726a5326e60b171ae60c3128c8a1d53568438daa49f1ecdb4748be0c18e88826e5761aa812f0ec5a4c0c2c7c8dae1dccb89304d59
TLSH
T12421F951D4E5CC23EC33688F932AABD30CA877D7E81C9A25238D4128BF85C328D110E2
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Public\Libraries\qap`g`v~dtlq
Size 10B
SHA256 5d5fbcb1df92974ec4d0ff550a687f3ff8d4bb904bdeb4b5865d78d7c8d62e80
MD5 2d620f6e8cc2e82fa40805e3621cc9e0
SHA1 69934bff1086f4730d21590e9a6f9b7e7fb92518
SHA512 13fbec9ba7442299e440bd95670a74a4d76fd5ad1a47b18c3d09bc384b249e9d3427f080265477adf321f9cb55c3973e21594830d12a83e0d559cd79346993f1
MD5 SHA1 SHA512

Submit Download

memory/3660-0-0x0000000000D80000-0x0000000000DA1000-memory.dmp

Download

memory/3660-7-0x0000000000D80000-0x0000000000DA1000-memory.dmp

Download

memory/3968-88-0x0000000000240000-0x0000000000261000-memory.dmp

Download

memory/4068-1132-0x0000000000080000-0x00000000000A1000-memory.dmp

Download

memory/4364-36-0x0000000000080000-0x00000000000A1000-memory.dmp

Download

memory/4772-60-0x0000000005680000-0x0000000005681000-memory.dmp

Download