14ae3757a508af8eca35909611a3e336450ba30a6f191dc480282da84873a6be

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_ce6f8ae29b965c013c95c67756e56c6d_amadey_darkgate_elex_glassworm_stop_vidar.exe
Size 5.0MB
Sample260815-qa2brsga49
SHA256 14ae3757a508af8eca35909611a3e336450ba30a6f191dc480282da84873a6be
MD5 ce6f8ae29b965c013c95c67756e56c6d
SHA1 020a3bafaa4ef176596efe210199447ea2cadee9
SHA512 6b8b7d50fea6417f1c387b6dfd4c566adefd399de0f6154f3ea16c90f148e7d8947182fb8d80100bc5311c2c194e72772a23291e0c4c7492c6a0b6e205b7e689
SSDEEP 49152:U+ES+E9B+ErpqatglX+ES+E9oqatglJ+E9B+ES+E9B+ES+E9B+ErDiw2z+ES+E9I:JemeWp7w
TLSH
T11B364C05FAC944B1E47712704DABC2BA9A71BD214B22CADFF248932E5D33BD09D35726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCCBBABCAACCACABABAAACCCBACAABACCACBCABACBCCBBACABBCBCA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCCBBABCAACCACABABAAACCCBACAABACCACBCABACBCCBBACABBCBCA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4940	svchost_BCCBBABCAACCACABABAAACCCBACAABACCACBCABACBCCBBACABBCBCA.exe
1220	svchost_CCACBACBABAACCAABCCCBCBBCAABCACBBACACAAABCBCBAAAAACCACC.exe
5036	svchost_BCCBBABCAACCACABABAAACCCBACAABACCACBCABACBCCBBACABBCBCA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BACBCCBBACACBBAACBCABBBBBBCACBCABBACACCCBACCACBACAAACBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBBABCAACCACABABAAACCCBACAABACCACBCABACBCCBBACABBCBCA.exe"	2026-08-15_ce6f8ae29b965c013c95c67756e56c6d_amadey_darkgate_elex_glassworm_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCABCCABACCAACABCBACAACCABBBCBABCAAACBBCACABAAAABBCBBCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCACBACBABAACCAABCCCBCBBCAABCACBBACACAAABCBCBAAAAACCACC.exe"	svchost_BCCBBABCAACCACABABAAACCCBACAABACCACBCABACBCCBBACABBCBCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4216	sc.exe
4744	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
932	cmd.exe
60	cmd.exe
4292	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_ce6f8ae29b965c013c95c67756e56c6d_amadey_darkgate_elex_glassworm_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBBABCAACCACABABAAACCCBACAABACCACBCABACBCCBBACABBCBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCACBACBABAACCAABCCCBCBBCAABCACBBACACAAABCBCBAAAAACCACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4516	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3940	2026-08-15_ce6f8ae29b965c013c95c67756e56c6d_amadey_darkgate_elex_glassworm_stop_vidar.exe
3940	2026-08-15_ce6f8ae29b965c013c95c67756e56c6d_amadey_darkgate_elex_glassworm_stop_vidar.exe
3940	2026-08-15_ce6f8ae29b965c013c95c67756e56c6d_amadey_darkgate_elex_glassworm_stop_vidar.exe
3940	2026-08-15_ce6f8ae29b965c013c95c67756e56c6d_amadey_darkgate_elex_glassworm_stop_vidar.exe
4940	svchost_BCCBBABCAACCACABABAAACCCBACAABACCACBCABACBCCBBACABBCBCA.exe
4940	svchost_BCCBBABCAACCACABABAAACCCBACAABACCACBCABACBCCBBACABBCBCA.exe
4940	svchost_BCCBBABCAACCACABABAAACCCBACAABACCACBCABACBCCBBACABBCBCA.exe
4940	svchost_BCCBBABCAACCACABABAAACCCBACAABACCACBCABACBCCBBACABBCBCA.exe
1220	svchost_CCACBACBABAACCAABCCCBCBBCAABCACBBACACAAABCBCBAAAAACCACC.exe
1220	svchost_CCACBACBABAACCAABCCCBCBBCAABCACBBACACAAABCBCBAAAAACCACC.exe
5036	svchost_BCCBBABCAACCACABABAAACCCBACAABACCACBCABACBCCBBACABBCBCA.exe
5036	svchost_BCCBBABCAACCACABABAAACCCBACAABACCACBCABACBCCBBACABBCBCA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3940	2026-08-15_ce6f8ae29b965c013c95c67756e56c6d_amadey_darkgate_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	4940	svchost_BCCBBABCAACCACABABAAACCCBACAABACCACBCABACBCCBBACABBCBCA.exe
Token: SeDebugPrivilege	1220	svchost_CCACBACBABAACCAABCCCBCBBCAABCACBBACACAAABCBCBAAAAACCACC.exe
Token: SeDebugPrivilege	5036	svchost_BCCBBABCAACCACABABAAACCCBACAABACCACBCABACBCCBBACABBCBCA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1680	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 932	3940	2026-08-15_ce6f8ae29b965c013c95c67756e56c6d_amadey_darkgate_elex_glassworm_stop_vidar.exe	106
PID 932 wrote to memory of 4516	932	cmd.exe	108
PID 4940 wrote to memory of 1872	4940	svchost_BCCBBABCAACCACABABAAACCCBACAABACCACBCABACBCCBBACABBCBCA.exe	111
PID 1872 wrote to memory of 784	1872	notepad.exe	112
PID 3940 wrote to memory of 60	3940	2026-08-15_ce6f8ae29b965c013c95c67756e56c6d_amadey_darkgate_elex_glassworm_stop_vidar.exe	116
PID 60 wrote to memory of 4216	60	cmd.exe	118
PID 3940 wrote to memory of 4292	3940	2026-08-15_ce6f8ae29b965c013c95c67756e56c6d_amadey_darkgate_elex_glassworm_stop_vidar.exe	119
PID 4292 wrote to memory of 4744	4292	cmd.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-08-15_ce6f8ae29b965c013c95c67756e56c6d_amadey_darkgate_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_ce6f8ae29b965c013c95c67756e56c6d_amadey_darkgate_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABAABCBACAAAACCBBBBABABAAACCACCBBBBBABCCBCBBBCAACAABACCABCABCABAACCCBABCBCBCACCCBCAABACCBBCAAACABABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBABCAACCACABABAAACCCBACAABACCACBCABACBCCBBACABBCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABAABCBACAAAACCBBBBABABAAACCACCBBBBBABCCBCBBBCAACAABACCABCABCABAACCCBABCBCBCACCCBCAABACCBBCAAACABABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBABCAACCACABABAAACCCBACAABACCACBCABACBCCBBACABBCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACCABBBBCACCCBABBBABBBCCACCBACAABCABABCCCCCABABCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBABCAACCACABABAAACCCBACAABACCACBCABACBCCBBACABBCBCA.exe" start= auto displayName= "UserDataSvc_BACCABBBBCACCCBABBBABBBCCACCBACAABCABABCCCCCABABCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:60
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACCABBBBCACCCBABBBABBBCCACCBACAABCABABCCCCCABABCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBABCAACCACABABAAACCCBACAABACCACBCABACBCCBBACABBCBCA.exe" start= auto displayName= "UserDataSvc_BACCABBBBCACCCBABBBABBBCCACCBACAABCABABCCCCCABABCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACCABBBBCACCCBABBBABBBCCACCBACAABCABABCCCCCABABCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACCABBBBCACCCBABBBABBBCCACCBACAABCABABCCCCCABABCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4744

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBABCAACCACABABAAACCCBACAABACCACBCABACBCCBBACABBCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBABCAACCACABABAAACCCBACAABACCACBCABACBCCBBACABBCBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:784

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1680

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACBACBABAACCAABCCCBCBBCAABCACBBACACAAABCBCBAAAAACCACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACBACBABAACCAABCCCBCBBCAABCACBBACACAAABCBCBAAAAACCACC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1220

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBABCAACCACABABAAACCCBACAABACCACBCABACBCCBBACABBCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBABCAACCACABABAAACCCBACAABACCACBCABACBCCBBACABBCBCA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 aac53af0137daa629283617650bb13a47ae8e597bee8bf661a2831685859001a
MD5 9e126f07fe81e47a88d076e8a790720f
SHA1 be90459e4be2f60b3f43f8e9eae6815ee69e821e
SHA512 a0f270ac204fbea48d5de33480f2c01ae5105ecb31aa37e68afa32dfc14fff357bc2f6ab57aa8a296a155fa99f11ee198cb58e914a8290ef92edf4137f2a8bb4
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 5.5MB
SHA256 b02da2fe8e55a7e56303d5eff27129036c9c3b84b52cfb9e6d2bcb1e8d5087cd
MD5 871df2606cdf14c7a65391f38bcb4de9
SHA1 37ba7c37c12b998f4247d401026505642ad47404
SHA512 f625c715dfd5f11886a9d211333b444731b1d984d533a7a2ce938b6893409851a98c30c8597e18f95fd92b376d92778c7da152c2dd159f3abd684920c27cc7a7
SSDEEP 49152:U+ES+E9B+ErpqatglX+ES+E9oqatglJ+E9B+ES+E9B+ES+E9B+ErDiw2z+ES+E9J:JemeWp7zpim
TLSH
T1BD463B05FAD94471F47712704DABC2BA9A71BD218F22CADFB248931E5D33BD0A935722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\SmsRouter\MessageStore\qap`g`v~dtlq
Size 10B
SHA256 b20c10f3257350290723f9694f9b8753aca8eaf8f734e824e16f498e44d1263c
MD5 50eabeb57765f35e2a953f2deb054cc2
SHA1 7234b10fe7d1ecbd6f19aee7023148ef1823d053
SHA512 c904a20bc68acf9bacb2c0f144746ce9dc74763711b286e7f9d5765d6dd3d268fb5802195e1e803b1ad4506add8cb3ec9a5d6c9f8f5a3f02556c56e2a5a62e2c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 8f6d4e37849125d6d1c893ccfa62c258255d3d50bce59f8a25a823ca2a744987
MD5 52a9498f40b0ccb9c4ec6f9b11500dd6
SHA1 b8cb0b320466092bcf44bfc6a6858155f1a56556
SHA512 e63382b3d957cd7da84b7d1e1089e85cce685f096e336f4d22f721c6981e76ba131e4c6b7c3b9f0e8f304ee71230a5915fd8f34032280865cea19a047b989e4c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\TempState\qap`g`v~dtlq
Size 10B
SHA256 fe1a54c4faaa9d2bff44962589ac21726a40c99dbaa2ba4909f98110da8b988e
MD5 98f21f8332ca13404cf40cdfbeeead3c
SHA1 8047c656f8a0fb350d52effde8457b899b6d9138
SHA512 e64896f3822ceb2c595bb9c24c4e405b3980ae88bb4d97a0401af109871b63813f8f9ac7a3824f8890c36fb9ada750b97b7287eabb6499766f25bbd76b5a6cd1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Settings\qap`g`v~dtlq
Size 10B
SHA256 a0d934a7250f09256b98e345eef65130088e481cabba9ec8aa0920f3940d3b83
MD5 878070691aa387ef6ac3b581f3443614
SHA1 06e71de7e25578cf9d9624bcc179082ae1360a4b
SHA512 6a3bc4ab4d7c04468982adfc5271d0a9bea7e26408641f3a436373c4b1c3a1fdb6d7c8621cfecf8e3f901a3ea931e348aa43c56fa1f684f5e347def44d9e252d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2028ff2ac1541b056b94a66ab03b442e2a1edc0f77bb5e8c9c863cd8921f77ed
MD5 dcab1944f4c1a02fde7fc91ecc4a6bc0
SHA1 b0979a54c917a2e62257a5a2c92522c409be43bb
SHA512 c01d3b7664296b7ac78ec6dbedc9ec9aaecac1ffa4d8fde099ca80354f8a44a22daab97f6e802328dd222ce5fd9e8a3ed34a92ed191c05be36bfddafdafe13a6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8a32d16a164f035466d70a9e76f7ce6919a7de48990f0f6659727fbecefce6c1
MD5 f36dacb7294756246f268c2f5157cb00
SHA1 4fe23ccc6d514a46e68a3d78b5973590dcff53d3
SHA512 6f7f31d437187a3866a46784696ec8ef52645b7a4802e7e9e0d131b6c4943452fd909937647fddd16a8e6bf4a1c66876a302b541486fa9f29ab94d2afbace894
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 80a60eae4a63e1149a96f121c57623deb848c478ce6c015641c62f866220a40c
MD5 0e0360f29bad3717f70d6c8030688639
SHA1 76d39e5b5b14fd1cfe21a9e537f3198385c10e6a
SHA512 afd205619850ffc3d5b9ef25229dc250f6a5d9b7b7d96d489a3c52f8825f9b7bcaf56e0b50186cf361610a1aa6cd7bfb7d5a6745ff1f51a069951490894dd844
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 337d84b9b30df8bdb42a2d259d5c01ef59c00e9920e2a907ade047a2b014ddd3
MD5 041f80e962be5f029d3c073b46b47b4f
SHA1 47dc53172fd8995fe9640249ff64e9b3dfa143f4
SHA512 50f63328b3f67d46c6f4ef1207d142c52cc9e5ec380790723569731d1df5e7da19ef8d996b8af54a755eff2509a9b2f8678c051675f97e862f296b68be0ad963
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6847093090f65db694acd4114b1955217b8cb9c05457ede49f4dbcb145abe13e
MD5 9ae64a4634aae0e5c457e97193edc6da
SHA1 304689d6e932c27801812002bca7f39e5898e428
SHA512 74abc354795312db0907b801fa4a174cf894b22b048d6639041bb002535b075493f28d6394b9831a6b0cbc5ba49ae7ed6a1b1df1e4d82fdfd4b17ed0f7bc8366
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3703e96b498201135a8566c21cc74a91b48047ac34b3f2ac1e6fbe03123ef04f
MD5 642b441cf4ae5fb0aa884bf830adb993
SHA1 405f6229e5f7686c06035dfe1b0b6d9551e99480
SHA512 7dc039b32decc46543033b0db35a4be3b023a69b34c137dff21a819797fa7fe94c242a34fbb3c1a6e9b061b7e553a0e4a5f55e2f12964d5f9a38cc9b040137b1
MD5 SHA1 SHA512

Submit Download

svchost_BCCBBABCAACCACABABAAACCCBACAABACCACBCABACBCCBBACABBCBCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBABCAACCACABABAAACCCBACAABACCACBCABACBCCBBACABBCBCA.exe
Size 5.0MB
SHA256 14ae3757a508af8eca35909611a3e336450ba30a6f191dc480282da84873a6be
MD5 ce6f8ae29b965c013c95c67756e56c6d
SHA1 020a3bafaa4ef176596efe210199447ea2cadee9
SHA512 6b8b7d50fea6417f1c387b6dfd4c566adefd399de0f6154f3ea16c90f148e7d8947182fb8d80100bc5311c2c194e72772a23291e0c4c7492c6a0b6e205b7e689
SSDEEP 49152:U+ES+E9B+ErpqatglX+ES+E9oqatglJ+E9B+ES+E9B+ES+E9B+ErDiw2z+ES+E9I:JemeWp7w
TLSH
T11B364C05FAC944B1E47712704DABC2BA9A71BD214B22CADFF248932E5D33BD09D35726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 80736afee069dab1ea455af6b00b645522b5d7e697a07f158740633dfa0e337d
MD5 5dcef5cb0faa07e8c093ab69f559fe66
SHA1 a35106a76eb690c5abd845a68ea7603b3c674ec5
SHA512 56bed63ccf630ee32af870d4976c8e839eabfb4ca5980486d804eabc8939af289918e62a86c03bd7f224bad5205814c54a1ec9fc4ef3e9371ad6201d93bbf430
TLSH
T144112B21A4A69813FA637CDBAE5EDFC30DF0BB9B68546E4023088728AB45C328D054D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 960cf5a7a20f93e9e83576221b1dc25770d6a9c8ef3833a0682cb033473adadf
MD5 7de7e1f197bd8b5838adb674a5dfb74a
SHA1 df1d4e96139ec1d81f94738496d18edc5aad88f2
SHA512 cf9632322404d6f1b58e78ced4e9b6dc524d33b6a363a212aacdc31708d6a1f2c61faee6431ee6ee7ac69eb0308ba27a284d7d1c2524cb8b356aeb6a2a17ef75
TLSH
T11E21FC51A4E69857FA736CDBEE5ADBC30DB07BAF68546E40230986286745C32CD054D1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1220-86-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download

memory/1872-57-0x00000000014A0000-0x00000000014A1000-memory.dmp

Download

memory/3940-6-0x0000000000290000-0x00000000002B1000-memory.dmp

Download

memory/4940-36-0x0000000000F00000-0x0000000000F21000-memory.dmp

Download

memory/4940-26-0x0000000000F00000-0x0000000000F21000-memory.dmp

Download

memory/5036-1474-0x0000000000F00000-0x0000000000F21000-memory.dmp

Download