14ae3757a508af8eca35909611a3e336450ba30a6f191dc480282da84873a6be

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_ce6f8ae29b965c013c95c67756e56c6d_amadey_darkgate_elex_glassworm_stop_vidar.exe
Size 5.0MB
Sample260815-qa2brsga49
SHA256 14ae3757a508af8eca35909611a3e336450ba30a6f191dc480282da84873a6be
MD5 ce6f8ae29b965c013c95c67756e56c6d
SHA1 020a3bafaa4ef176596efe210199447ea2cadee9
SHA512 6b8b7d50fea6417f1c387b6dfd4c566adefd399de0f6154f3ea16c90f148e7d8947182fb8d80100bc5311c2c194e72772a23291e0c4c7492c6a0b6e205b7e689
SSDEEP 49152:U+ES+E9B+ErpqatglX+ES+E9oqatglJ+E9B+ES+E9B+ES+E9B+ErDiw2z+ES+E9I:JemeWp7w
TLSH
T11B364C05FAC944B1E47712704DABC2BA9A71BD214B22CADFF248932E5D33BD09D35726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCABACBAACABCCCCABBCBCCBCBBCACCBBABAAABABAACCBBBCCCBABB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCABACBAACABCCCCABBCBCCBCBBCACCBBABAAABABAACCBBBCCCBABB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCABACBAACABCCCCABBCBCCBCBBCACCBBABAAABABAACCBBBCCCBABB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCABACBAACABCCCCABBCBCCBCBBCACCBBABAAABABAACCBBBCCCBABB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4204	svchost_CCABACBAACABCCCCABBCBCCBCBBCACCBBABAAABABAACCBBBCCCBABB.exe
1576	svchost_ACBACAABAACBBBBCBCBACCBABCCAACCABCCBCAAABABAAABBAACBBCB.exe
4376	svchost_CCABACBAACABCCCCABBCBCCBCBBCACCBBABAAABABAACCBBBCCCBABB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCCBCACACABCCBCCABBBBACACBCCABCCCACBAACCABBAABAACBBCACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCABACBAACABCCCCABBCBCCBCBBCACCBBABAAABABAACCBBBCCCBABB.exe"	2026-08-15_ce6f8ae29b965c013c95c67756e56c6d_amadey_darkgate_elex_glassworm_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBAAAACABBCCBBBCCCABAACBCCBAAABCCAACCCBBBCAACBCBACCAACBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBACAABAACBBBBCBCBACCBABCCAACCABCCBCAAABABAAABBAACBBCB.exe"	svchost_CCABACBAACABCCCCABBCBCCBCBBCACCBBABAAABABAACCBBBCCCBABB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2720	sc.exe
708	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2536	cmd.exe
5796	cmd.exe
1184	cmd.exe
5056	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCABACBAACABCCCCABBCBCCBCBBCACCBBABAAABABAACCBBBCCCBABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBACAABAACBBBBCBCBACCBABCCAACCABCCBCAAABABAAABBAACBBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_ce6f8ae29b965c013c95c67756e56c6d_amadey_darkgate_elex_glassworm_stop_vidar.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1740	schtasks.exe
5608	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2952	2026-08-15_ce6f8ae29b965c013c95c67756e56c6d_amadey_darkgate_elex_glassworm_stop_vidar.exe
2952	2026-08-15_ce6f8ae29b965c013c95c67756e56c6d_amadey_darkgate_elex_glassworm_stop_vidar.exe
2952	2026-08-15_ce6f8ae29b965c013c95c67756e56c6d_amadey_darkgate_elex_glassworm_stop_vidar.exe
2952	2026-08-15_ce6f8ae29b965c013c95c67756e56c6d_amadey_darkgate_elex_glassworm_stop_vidar.exe
4204	svchost_CCABACBAACABCCCCABBCBCCBCBBCACCBBABAAABABAACCBBBCCCBABB.exe
4204	svchost_CCABACBAACABCCCCABBCBCCBCBBCACCBBABAAABABAACCBBBCCCBABB.exe
4204	svchost_CCABACBAACABCCCCABBCBCCBCBBCACCBBABAAABABAACCBBBCCCBABB.exe
4204	svchost_CCABACBAACABCCCCABBCBCCBCBBCACCBBABAAABABAACCBBBCCCBABB.exe
4376	svchost_CCABACBAACABCCCCABBCBCCBCBBCACCBBABAAABABAACCBBBCCCBABB.exe
4376	svchost_CCABACBAACABCCCCABBCBCCBCBBCACCBBABAAABABAACCBBBCCCBABB.exe
1576	svchost_ACBACAABAACBBBBCBCBACCBABCCAACCABCCBCAAABABAAABBAACBBCB.exe
1576	svchost_ACBACAABAACBBBBCBCBACCBABCCAACCABCCBCAAABABAAABBAACBBCB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2952	2026-08-15_ce6f8ae29b965c013c95c67756e56c6d_amadey_darkgate_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	4204	svchost_CCABACBAACABCCCCABBCBCCBCBBCACCBBABAAABABAACCBBBCCCBABB.exe
Token: SeDebugPrivilege	4376	svchost_CCABACBAACABCCCCABBCBCCBCBBCACCBBABAAABABAACCBBBCCCBABB.exe
Token: SeDebugPrivilege	1576	svchost_ACBACAABAACBBBBCBCBACCBABCCAACCABCCBCAAABABAAABBAACBBCB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2536	2952	2026-08-15_ce6f8ae29b965c013c95c67756e56c6d_amadey_darkgate_elex_glassworm_stop_vidar.exe	92
PID 2536 wrote to memory of 1740	2536	cmd.exe	94
PID 4204 wrote to memory of 1764	4204	svchost_CCABACBAACABCCCCABBCBCCBCBBCACCBBABAAABABAACCBBBCCCBABB.exe	95
PID 2952 wrote to memory of 5796	2952	2026-08-15_ce6f8ae29b965c013c95c67756e56c6d_amadey_darkgate_elex_glassworm_stop_vidar.exe	98
PID 5796 wrote to memory of 2720	5796	cmd.exe	100
PID 2952 wrote to memory of 1184	2952	2026-08-15_ce6f8ae29b965c013c95c67756e56c6d_amadey_darkgate_elex_glassworm_stop_vidar.exe	101
PID 1184 wrote to memory of 708	1184	cmd.exe	103
PID 4204 wrote to memory of 5056	4204	svchost_CCABACBAACABCCCCABBCBCCBCBBCACCBBABAAABABAACCBBBCCCBABB.exe	106
PID 5056 wrote to memory of 5608	5056	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-15_ce6f8ae29b965c013c95c67756e56c6d_amadey_darkgate_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_ce6f8ae29b965c013c95c67756e56c6d_amadey_darkgate_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBACAACCCBABCBABACCAABCBBCAACAACCACBBBABBACABCCBCAAAAACBCCCBBBAAAAACABBCCBBBCABBACBACACCABCABCAACBCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACBAACABCCCCABBCBCCBCBBCACCBBABAAABABAACCBBBCCCBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBACAACCCBABCBABACCAABCBBCAACAACCACBBBABBACABCCBCAAAAACBCCCBBBAAAAACABBCCBBBCABBACBACACCABCABCAACBCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACBAACABCCCCABBCBCCBCBBCACCBBABAAABABAACCBBBCCCBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABCAAACCABCBCCCCBCBBABCCACABBCCBBBAACCCCCCABCCBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACBAACABCCCCABBCBCCBCBBCACCBBABAAABABAACCBBBCCCBABB.exe" start= auto displayName= "UserDataSvc_BABCAAACCABCBCCCCBCBBABCCACABBCCBBBAACCCCCCABCCBABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5796
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABCAAACCABCBCCCCBCBBABCCACABBCCBBBAACCCCCCABCCBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACBAACABCCCCABBCBCCBCBBCACCBBABAAABABAACCBBBCCCBABB.exe" start= auto displayName= "UserDataSvc_BABCAAACCABCBCCCCBCBBABCCACABBCCBBBAACCCCCCABCCBABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABCAAACCABCBCCCCBCBBABCCACABBCCBBBAACCCCCCABCCBABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABCAAACCABCBCCCCBCBBABCCACABBCCBBBAACCCCCCABCCBABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:708

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACBAACABCCCCABBCBCCBCBBCACCBBABAAABABAACCBBBCCCBABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACBAACABCCCCABBCBCCBCBBCACCBBABAAABABAACCBBBCCCBABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACAABCCAAACAAACBBABBCCBBCBCBBBCCCABCBCABBBBABCCCBCABCCCCCAACCCBCAAACBBABCAAAABABAABABCCABBACCBBBBBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACAABAACBBBBCBCBACCBABCCAACCABCCBCAAABABAAABBAACBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACAABCCAAACAAACBBABBCCBBCBCBBBCCCABCBCABBBBABCCCBCABCCCCCAACCCBCAAACBBABCAAAABABAABABCCABBACCBBBBBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACAABAACBBBBCBCBACCBABCCAACCABCCBCAAABABAAABBAACBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5608

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACAABAACBBBBCBCBACCBABCCAACCABCCBCAAABABAAABBAACBBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACAABAACBBBBCBCBACCBABCCAACCABCCBCAAABABAAABBAACBBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1576

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACBAACABCCCCABBCBCCBCBBCACCBBABAAABABAACCBBBCCCBABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACBAACABCCCCABBCBCCBCBBCACCBBABAAABABAACCBBBCCCBABB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 b20c10f3257350290723f9694f9b8753aca8eaf8f734e824e16f498e44d1263c
MD5 50eabeb57765f35e2a953f2deb054cc2
SHA1 7234b10fe7d1ecbd6f19aee7023148ef1823d053
SHA512 c904a20bc68acf9bacb2c0f144746ce9dc74763711b286e7f9d5765d6dd3d268fb5802195e1e803b1ad4506add8cb3ec9a5d6c9f8f5a3f02556c56e2a5a62e2c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 c7556fc01782b31b3cdbf5792fb25253bbc8c8fde779bd946f3bd37006c59cbe
MD5 8dd923360e939bf68ffb7d8059529d97
SHA1 09ee1f770a2e98b6cb3ce499f619fb924b1ffa14
SHA512 8d88354ba1aeddb5f076dc56ec55e982cee89e5e9b10e4535e7bfebcd5c60faf8961d1465ec72759aff6b49c9e51e9d15a32553b40e58e6b8e33d62d2504561a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\OneSettings\qap`g`v~dtlq
Size 10B
SHA256 4777e8e92c26c5ff6201f03a3333566613c639165444fc311e246d4f612f0b66
MD5 b6df6523b753a1a17ed49292f9df7df3
SHA1 b4db275d4ad35f85c126c730d6f28bae9c8ccb12
SHA512 ed544798a1fc357cfbad0837bf83940e9e99029be039737abab93e69618de4d1fe17d56af342dd3d913dc412b009a564cb204551b65b179c191f7cb130ba0d55
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 5.6MB
SHA256 ae5bfe03f97495f311a123d5fd0f77e205fab3f44a286536151fa6e71b90b850
MD5 9e847deb92364f5f98499142c9a8dff5
SHA1 92107f753af5b60ca6ef25e0f7a4095535e9bd34
SHA512 01f6e3a60f80319c39f5065cfee07dc194f60b3a4e04631a14d41e763a946082c5774fd8dab53b73de0d92116560f149447618d261e28b5d926b9512d585fc90
SSDEEP 49152:U+ES+E9B+ErpqatglX+ES+E9oqatglJ+E9B+ES+E9B+ES+E9B+ErDiw2z+ES+E9/:JemeWp7vgZ2Hb9t+2xr
TLSH
T148565D05FAC94071F47712714DABC2BA5A71B9214B12CAEFF388972E5D33BD09A35722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 67ebfff0abe3c65ab7df8395e3b77bb893d912c1edfbdfc7b6a48ce21c404fd2
MD5 0dde3d32fe53d15e707719b6d62021f3
SHA1 b75cda8e601093d25f3dcd5ce22480e135324dac
SHA512 5cba9ac3c58cc94d9397939f3e00bfc5e183ec9322cc0ee141050046cbf5e6a47ed34516839f540e0f07b5bbebf639448f227631608ee9f63080018ab67de87e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 8f6d4e37849125d6d1c893ccfa62c258255d3d50bce59f8a25a823ca2a744987
MD5 52a9498f40b0ccb9c4ec6f9b11500dd6
SHA1 b8cb0b320466092bcf44bfc6a6858155f1a56556
SHA512 e63382b3d957cd7da84b7d1e1089e85cce685f096e336f4d22f721c6981e76ba131e4c6b7c3b9f0e8f304ee71230a5915fd8f34032280865cea19a047b989e4c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 6c0bd02957a3d2a0e6cc796ef8a0dcb0048dd01478c543cab0b962be6d5af223
MD5 f1b2f5ba2aa0d717ec041e2c9f87026d
SHA1 3d50725adb96f47e0ca8e820ded31b9d12d8ac10
SHA512 4f016cb9752451b9e142d81c65e605f9d67018ea6ff07ea302a7ed7103b2acf71f941a6fa606818e374370891a95ef8a6263d32b8ad219f55a450048902c32d0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\kk\qap`g`v~dtlq
Size 10B
SHA256 fe1a54c4faaa9d2bff44962589ac21726a40c99dbaa2ba4909f98110da8b988e
MD5 98f21f8332ca13404cf40cdfbeeead3c
SHA1 8047c656f8a0fb350d52effde8457b899b6d9138
SHA512 e64896f3822ceb2c595bb9c24c4e405b3980ae88bb4d97a0401af109871b63813f8f9ac7a3824f8890c36fb9ada750b97b7287eabb6499766f25bbd76b5a6cd1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ca45a9e4132c0a9599395b41690018824fa36c5f4ff6d890f1b1954298761d0f
MD5 0606a5f5778dbf7f5d2685ae28e80686
SHA1 b9d6945a795ee67f280dfe807142c63a8471b2e4
SHA512 d6e5f7cb337a6d7d221f965280342e02df3fe5f3a1c4889d6db9dae56cf9c1b8fd3c5bc6705a5e9f8e4cd5086cffc9328bfda10e96302122213ae022af7808e9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c53238062933bdde92f4b9f7d3984320c8249c1cabe00fc7cebaea62a8cf2c55
MD5 3fa211548169a60769539c0d506f2ee1
SHA1 0d8af1d31832f573be50cb4865a82d528795435e
SHA512 8668f19e2f6b7db903899d2f1c9c1b78194424336af2560b173186694d645a4eb6098fe8b960fa3fa389ae3aabd0c3d56c9dad5ee95024f5d014efab169454ae
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a10bc020d6e6a0d269670bb90b30672bfac0a5a349d69fc12d0d0bef10a4e1b1
MD5 95e239ae241eec9cebe1db14e2af205d
SHA1 0e62dac7a96d865b0717506bc750f649aefb4274
SHA512 a6b004477c76a027b04209b0272f39d0fb9d97a7b5cf36a3dc2029edc1ff85c80b2dc9dd964e13e63a10b1a8ec0a1a6192d3787849e5c0f49409f5bb04bf7f58
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 517af751362551ed26650798021b261771fabda3652d2889e20e8cac7b45768a
MD5 8d5948739e97a59f381b65fdddaf7073
SHA1 6dae4c3cc1823ed3456a482ce460dd01bfdc896a
SHA512 24b532697784571688de916ce10c127f902d09980a59acba746212cb22945ea518c2957178bce43d4e9d4fe50db6d9de35f85d2f1859883a06ed4ae256edd0e0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 337d84b9b30df8bdb42a2d259d5c01ef59c00e9920e2a907ade047a2b014ddd3
MD5 041f80e962be5f029d3c073b46b47b4f
SHA1 47dc53172fd8995fe9640249ff64e9b3dfa143f4
SHA512 50f63328b3f67d46c6f4ef1207d142c52cc9e5ec380790723569731d1df5e7da19ef8d996b8af54a755eff2509a9b2f8678c051675f97e862f296b68be0ad963
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a0d934a7250f09256b98e345eef65130088e481cabba9ec8aa0920f3940d3b83
MD5 878070691aa387ef6ac3b581f3443614
SHA1 06e71de7e25578cf9d9624bcc179082ae1360a4b
SHA512 6a3bc4ab4d7c04468982adfc5271d0a9bea7e26408641f3a436373c4b1c3a1fdb6d7c8621cfecf8e3f901a3ea931e348aa43c56fa1f684f5e347def44d9e252d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 23c5ec1db3ac99b00d45db43361ecedef6d7ad1f705b9982d26faccc31ffcb05
MD5 ffb87d536f9e8281eb2c3fe9b4cd04ea
SHA1 c1854c939c56169abd893906ecf2cf2cec8aa5e4
SHA512 72e6385212e3a33aa22fef953ddeaa546fe621f990f2125ce89e5e80b060d69e19df042c095a76a2d0eeb465dc96590de5ca0db54c95edd12a30bc71a3aa519e
MD5 SHA1 SHA512

Submit Download

svchost_CCABACBAACABCCCCABBCBCCBCBBCACCBBABAAABABAACCBBBCCCBABB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACBAACABCCCCABBCBCCBCBBCACCBBABAAABABAACCBBBCCCBABB.exe
Size 5.0MB
SHA256 14ae3757a508af8eca35909611a3e336450ba30a6f191dc480282da84873a6be
MD5 ce6f8ae29b965c013c95c67756e56c6d
SHA1 020a3bafaa4ef176596efe210199447ea2cadee9
SHA512 6b8b7d50fea6417f1c387b6dfd4c566adefd399de0f6154f3ea16c90f148e7d8947182fb8d80100bc5311c2c194e72772a23291e0c4c7492c6a0b6e205b7e689
SSDEEP 49152:U+ES+E9B+ErpqatglX+ES+E9oqatglJ+E9B+ES+E9B+ES+E9B+ErDiw2z+ES+E9I:JemeWp7w
TLSH
T11B364C05FAC944B1E47712704DABC2BA9A71BD214B22CADFF248932E5D33BD09D35726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 ba4d0265e971ed865128aedfc9282d3e4f8f813640c2e1d05c0fe28deefc2523
MD5 cf8caa3bfb78043ec4c91dedd0cfb3f6
SHA1 89c0c00cf41926a4d90be0282457646ac45f73ef
SHA512 d5295f7c2c06e1876d6a23a8a32994ecda66f0e79f7ca003adb2afeeddd96377f175263fafdf13054c0fe85241c10a59fbd293800f5e14a0c7a070c77262b3c9
TLSH
T177213B7158A6C863F872A4CF9D6ACAC31DB47B7B9C586E04230D812DA7E4C32CE114F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 1682d6e50b4c389df81c8d0dac5556510a9b06b286c55b1344a6e76009f3597d
MD5 310379fdbea729d31300da2149d1a242
SHA1 a11596f2c1014b6dfd47d7e51b878d5d6e9c6a73
SHA512 e30c338f1bf2617154e22c2e9d6c9457727979a1d0e4a817c329b9fb1ac66d687d42f991c95934d3dbdd92fa20d8637550ae2afc3def190a4523511e54dc4566
TLSH
T1EE210C3298A2C873F871A4CF9D2ADAD31DA46B7F9C5C5E04230D8128A7E4C32CD154E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 d536b29e54adbc8036cbe7199e768a098a99ccc0a5216d25b8f6f354efe5d313
MD5 2f21e5691b8d26c8185dff9685343533
SHA1 6b80977658e7334394940d92534fed8c57034b2b
SHA512 58c6fd8a4fe90daa80874c6548a23e7f97e5e7983a204e5d0bfb9c5a6fa9d912143b3867b97f3ad1309c4a4f0f9ebd872a471b3ef031097771c8b54fa65867ac
TLSH
T11911276258A6C863F872A4CF9D6ACAD31DA86B7B9C586E04220D4129A794C328D114F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1576-67-0x0000000000890000-0x00000000008B1000-memory.dmp

Download

memory/1576-3929-0x0000000000890000-0x00000000008B1000-memory.dmp

Download

memory/2952-6-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/4204-32-0x0000000000450000-0x0000000000471000-memory.dmp

Download

memory/4376-1435-0x0000000000450000-0x0000000000471000-memory.dmp

Download

memory/4376-3931-0x0000000000450000-0x0000000000471000-memory.dmp

Download