1569509913267cb93cb32c85f2e0b9e21ffc438b290c21760a4f0a234c608c8d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 01:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_e89ab932160277ef6cc97e7dc6596846_amadey_darkgate_elex_hijackloader_luca-stealer_njrat_stop.exe
Size 8.0MB
Sample260810-b7twmayeqa
SHA256 1569509913267cb93cb32c85f2e0b9e21ffc438b290c21760a4f0a234c608c8d
MD5 e89ab932160277ef6cc97e7dc6596846
SHA1 22d2a86c579f50ffed8d6298e2d4cd5af6ebee3a
SHA512 adc60aa1ef75bee4b672daa15a6cedf6ef2accb46e47f3ab1023f4732d259aa3c268f38963a95b1aae856aa8c1c7338f1fe0081e10891147103913299ccbcfcd
SSDEEP 98304:Jp7Dp7Dp7Dp7Dp7Dp7/KRuy5a2p7Dp7Dp7Dp7Dp7Dp7/KRuy5ak+4js:vBBBBB/q/BBBBB/qHjs
TLSH
T18A868D11B7C18035F5B329324ABFE339597D79214F6886CFE3881A2E5E71AD0A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCAABACCAAAACACCACAABCBBCBAACCACBCCCABBCCBBBBBBAAACBBCB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCAABACCAAAACACCACAABCBBCBAACCACBCCCABBCCBBBBBBAAACBBCB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3080	svchost_CCAABACCAAAACACCACAABCBBCBAACCACBCCCABBCCBBBBBBAAACBBCB.exe
964	svchost_BCABCCBABABACBAAAAABBAACCCCACABBBAABCCBABCCBAACCAACCBCB.exe
1260	svchost_CCAABACCAAAACACCACAABCBBCBAACCACBCCCABBCCBBBBBBAAACBBCB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_AACBABABCBBACACACBBAACABCBBBBABBBAABBABBBCCCBABABAACBCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCAABACCAAAACACCACAABCBBCBAACCACBCCCABBCCBBBBBBAAACBBCB.exe"	2026-08-10_e89ab932160277ef6cc97e7dc6596846_amadey_darkgate_elex_hijackloader_luca-stealer_njrat_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_ACBBACACBCCAAAABBACACAAACBCCBCCAACAAACCAACABACBCBCBCCAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABCCBABABACBAAAAABBAACCCCACABBBAABCCBABCCBAACCAACCBCB.exe"	svchost_CCAABACCAAAACACCACAABCBBCBAACCACBCCCABBCCBBBBBBAAACBBCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2036	sc.exe
3968	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2420	cmd.exe
4560	cmd.exe
1156	cmd.exe
3056	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_e89ab932160277ef6cc97e7dc6596846_amadey_darkgate_elex_hijackloader_luca-stealer_njrat_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABCCBABABACBAAAAABBAACCCCACABBBAABCCBABCCBAACCAACCBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCAABACCAAAACACCACAABCBBCBAACCACBCCCABBCCBBBBBBAAACBBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1700	schtasks.exe
4776	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2360	2026-08-10_e89ab932160277ef6cc97e7dc6596846_amadey_darkgate_elex_hijackloader_luca-stealer_njrat_stop.exe
2360	2026-08-10_e89ab932160277ef6cc97e7dc6596846_amadey_darkgate_elex_hijackloader_luca-stealer_njrat_stop.exe
2360	2026-08-10_e89ab932160277ef6cc97e7dc6596846_amadey_darkgate_elex_hijackloader_luca-stealer_njrat_stop.exe
2360	2026-08-10_e89ab932160277ef6cc97e7dc6596846_amadey_darkgate_elex_hijackloader_luca-stealer_njrat_stop.exe
3080	svchost_CCAABACCAAAACACCACAABCBBCBAACCACBCCCABBCCBBBBBBAAACBBCB.exe
3080	svchost_CCAABACCAAAACACCACAABCBBCBAACCACBCCCABBCCBBBBBBAAACBBCB.exe
3080	svchost_CCAABACCAAAACACCACAABCBBCBAACCACBCCCABBCCBBBBBBAAACBBCB.exe
3080	svchost_CCAABACCAAAACACCACAABCBBCBAACCACBCCCABBCCBBBBBBAAACBBCB.exe
964	svchost_BCABCCBABABACBAAAAABBAACCCCACABBBAABCCBABCCBAACCAACCBCB.exe
964	svchost_BCABCCBABABACBAAAAABBAACCCCACABBBAABCCBABCCBAACCAACCBCB.exe
1260	svchost_CCAABACCAAAACACCACAABCBBCBAACCACBCCCABBCCBBBBBBAAACBBCB.exe
1260	svchost_CCAABACCAAAACACCACAABCBBCBAACCACBCCCABBCCBBBBBBAAACBBCB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2360	2026-08-10_e89ab932160277ef6cc97e7dc6596846_amadey_darkgate_elex_hijackloader_luca-stealer_njrat_stop.exe
Token: SeDebugPrivilege	3080	svchost_CCAABACCAAAACACCACAABCBBCBAACCACBCCCABBCCBBBBBBAAACBBCB.exe
Token: SeDebugPrivilege	964	svchost_BCABCCBABABACBAAAAABBAACCCCACABBBAABCCBABCCBAACCAACCBCB.exe
Token: SeDebugPrivilege	1260	svchost_CCAABACCAAAACACCACAABCBBCBAACCACBCCCABBCCBBBBBBAAACBBCB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
816	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2420	2360	2026-08-10_e89ab932160277ef6cc97e7dc6596846_amadey_darkgate_elex_hijackloader_luca-stealer_njrat_stop.exe	96
PID 2420 wrote to memory of 1700	2420	cmd.exe	98
PID 3080 wrote to memory of 4780	3080	svchost_CCAABACCAAAACACCACAABCBBCBAACCACBCCCABBCCBBBBBBAAACBBCB.exe	99
PID 4780 wrote to memory of 4348	4780	notepad.exe	100
PID 2360 wrote to memory of 4560	2360	2026-08-10_e89ab932160277ef6cc97e7dc6596846_amadey_darkgate_elex_hijackloader_luca-stealer_njrat_stop.exe	104
PID 4560 wrote to memory of 3968	4560	cmd.exe	106
PID 2360 wrote to memory of 1156	2360	2026-08-10_e89ab932160277ef6cc97e7dc6596846_amadey_darkgate_elex_hijackloader_luca-stealer_njrat_stop.exe	107
PID 1156 wrote to memory of 2036	1156	cmd.exe	109
PID 3080 wrote to memory of 3056	3080	svchost_CCAABACCAAAACACCACAABCBBCBAACCACBCCCABBCCBBBBBBAAACBBCB.exe	112
PID 3056 wrote to memory of 4776	3056	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-08-10_e89ab932160277ef6cc97e7dc6596846_amadey_darkgate_elex_hijackloader_luca-stealer_njrat_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_e89ab932160277ef6cc97e7dc6596846_amadey_darkgate_elex_hijackloader_luca-stealer_njrat_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACABBABACCCCBABACCACCCBCBCBBCBCCBCCCBBBABAABBCCBCBBACCACABABCABBBCABCCACACABBCABAAACCCCABBBBAABBBCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABACCAAAACACCACAABCBBCBAACCACBCCCABBCCBBBBBBAAACBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACABBABACCCCBABACCACCCBCBCBBCBCCBCCCBBBABAABBCCBCBBACCACABABCABBBCABCCACACABBCABAAACCCCABBBBAABBBCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABACCAAAACACCACAABCBBCBAACCACBCCCABBCCBBBBBBAAACBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBACACACACACCACBCACCACAABCABBBCBBBCBCBBAABABAABCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABACCAAAACACCACAABCBBCBAACCACBCCCABBCCBBBBBBAAACBBCB.exe" start= auto displayName= "UserDataSvc_ABBACACACACACCACBCACCACAABCABBBCBBBCBCBBAABABAABCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBACACACACACCACBCACCACAABCABBBCBBBCBCBBAABABAABCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABACCAAAACACCACAABCBBCBAACCACBCCCABBCCBBBBBBAAACBBCB.exe" start= auto displayName= "UserDataSvc_ABBACACACACACCACBCACCACAABCABBBCBBBCBCBBAABABAABCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBACACACACACCACBCACCACAABCABBBCBBBCBCBBAABABAABCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBACACACACACCACBCACCACAABCABBBCBBBCBCBBAABABAABCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2036

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABACCAAAACACCACAABCBBCBAACCACBCCCABBCCBBBBBBAAACBBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABACCAAAACACCACAABCBBCBAACCACBCCCABBCCBBBBBBAAACBBCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAAACABBCBBBCBCBCAABCCABABBCCCCABBCCAAAACCABCBCCAACCCBABACCCCBBAACCCBCCCBCAAACAABCCAABCCAACCCABBCABBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCCBABABACBAAAAABBAACCCCACABBBAABCCBABCCBAACCAACCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAAACABBCBBBCBCBCAABCCABABBCCCCABBCCAAAACCABCBCCAACCCBABACCCCBBAACCCBCCCBCAAACAABCCAABCCAACCCABBCABBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCCBABABACBAAAAABBAACCCCACABBBAABCCBABCCBAACCAACCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4776

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:816

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCCBABABACBAAAAABBAACCCCACABBBAABCCBABCCBAACCAACCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCCBABABACBAAAAABBAACCCCACABBBAABCCBABCCBAACCAACCBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:964

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABACCAAAACACCACAABCBBCBAACCACBCCCABBCCBBBBBBAAACBBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABACCAAAACACCACAABCBBCBAACCACBCCCABBCCBBBBBBAAACBBCB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 9b027eb17e7daa8de50d6b2e7c21c52a485c4b52e08d51082648aaa47e902564
MD5 7038cf2906550ddc1ce233865ee923d7
SHA1 82ade67dfc71db0bab19d8ddf476de9a13a6daea
SHA512 9a6e916decd1472b7c56d3ba0776b409d793f1717435266897a99add1d2295bd02c6e05355d34346b28a3911ba5dbc2d9d0ff266a394b9215d251f88b161cc5e
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 8.5MB
SHA256 ce52f9812e3993c1a38d30f95b06dee07c010f43c1f54391cb8b8a94c7cfacf5
MD5 a5e3cbf36c52b4eba6a140b6fb1c64a7
SHA1 3292ec25df902fd5ff2ab2dc73fb9f9cbf0505b2
SHA512 5af3497c1de829c4e974124a5ab29f449fd184aa8415b215dce1dc673e619a9516071d7710fcf8621848f7a69654b092a67acab0c46e987685e326153b282893
SSDEEP 98304:Jp7Dp7Dp7Dp7Dp7Dp7/KRuy5a2p7Dp7Dp7Dp7Dp7Dp7/KRuy5ak+4jPpiF:vBBBBB/q/BBBBB/qHjq
TLSH
T1D1967C11B7D18031F5B329314ABFE339597D79214F7886CFA3881A2E5E71AD0A93472B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\qap`g`v~dtlq
Size 10B
SHA256 acfb0d565cceea5f036964425346c9c5fa3a36ed1d1f20fead8816206bf7825c
MD5 93cf2ec79283b763adbf56458c743a12
SHA1 b2d4f43b40d91dc3c801f5efd41839e9297fead1
SHA512 3b112d842d7c9f8bc878a8407ac626699ed398d65565fb8bee5adc730edcde9ac3dea0ab773c379ee1b50eab1bf867675090dd212a12c3629ae920e930e89625
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 26585340585d067fbea0598a5b783cd9f58c1f44ab1c7145cd295668ffe8c418
MD5 c2b6406d28e5ac4ab4484d7ec32362a0
SHA1 5bf6ab7f5db894ddf500eb25d1c6b7380b724b7a
SHA512 c2e2705bb61f9365989be3b8a7899f9e43b901719b8d08d85daa4aaf23766a999c1bde140ae7933b4203fd554de3c8ab8d6c04c1979921c174eda8ee08338d0c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2d5mkwou.default-release\safebrowsing\qap`g`v~dtlq
Size 10B
SHA256 62171ba2bb126f2735964bb43d50f63550bad716fae59ff80298ed3b38e71c3a
MD5 495b2d9b5ed062039771af3a9d06f42f
SHA1 6c20f68d04f8f67af5051aeebb7e19541993db4d
SHA512 31b530d218090b9a26b7c5d96e1e868762a782b538b9f3527b1c2d24fe5a771b62568e43764f516d3d66341c11a32118a55e915b6218d97f98016d1d29912655
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\qap`g`v~dtlq
Size 10B
SHA256 aaffb3cef150530adc72edef54c0ab52d05c9c74b3c5615a25663943fd9f2dc0
MD5 3c5c7aabf38758cae034c44d54e3c914
SHA1 e6b8a91382e3166321da748ee727283ae5c0319f
SHA512 1f3892bfea07234b21b53058abff4673e3545de4edd6eccbb0f5de3714d8228a5322298752fd950f1f92dd78802f57d60327bf06ebfaad395cbf977a11e74211
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e4ad658adb159869d56a957f28e8293946c0334f6fa2b52ba9dc8137598147ac
MD5 6bca38b9e556ba4504830054a20b718d
SHA1 3c510254de6360f2784582812ea5b587777e5e67
SHA512 6d6fb1e54f96aa84faca8b33b77c2f25ae47ec10c768f589d51bc587f78ad00799509931fc6816912ddad57d7a501f306d419b6127f05e4eb0676afb3eed7894
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cc0743129f5a0603ef78b3a74801e636500ae6fdab9839521ce092686d9d299b
MD5 808efe93ed984f01010fc510b6279f26
SHA1 7bd8814db9e75c7108d219cdcb7955ea74b5ac75
SHA512 459cbc20e9643a6a8092d134825299241aab9ed9a737d02d8c49e2a3f4e18477a5f401ec86e23d7f97940a4bb348e2f44c909588e9b10e5048a55e9a57a986df
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 38a4150c276749c8f82ecf5325dbe68a276810867bf40ba027a78cac7b7c1b2b
MD5 bca05030342b83320dbba6d6e65ad572
SHA1 68a8f4db358badbb0605c175f358864d50ade671
SHA512 2b4800a47339489a4bec0b50db01bac6289aa66ba3a8ccc54a70d9f8073d59fa51b4e5b911ec50c7c5ed4d86d6441709de28ad3317502db11eba3849de3616d1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 306f4377e5045c6ae8825962a11831f9da60d4d97b3b10639e239eda10cb2122
MD5 bdf5a251ef720e005a4190200c441207
SHA1 11bd0dbee769e3a8caebfa0c6755a1f6b0ded7e1
SHA512 341d7bc34570c61aaf43c06104b5640c888abdcc9ae2f8761901348a880b3f102a74650537b13cca66159a49d1534aa160c747e64ceace326614ccc61405f529
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f8f253c51d6f28a4cbfff7ee1293ee9eba8a7da63fccc69545b2f9ba7e2fb50c
MD5 960fd4c0878d3e9219387f7e7ed12b26
SHA1 fab77ecc4c74595acb1823e907ef03c68370f73a
SHA512 c77750ce0ecdd2b7bd17ce5ec818a3d93e855393aee1a06eaec1017537b48936a78bb44a5f7ba5eb39ad17e52b3b89c2bd76dde3412a5db3ff4067fcc7884822
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2b0715513c5f0841679f372d172ece066f01029d6aab0b885a66b3d8669185b2
MD5 513274a0c37bdaf40b009301bbad7963
SHA1 dd3d6d4a7a05d56c32c1f5447e1a726496466ac9
SHA512 8137e2ef3393f8b70504b83a9a5f1c7037e23fcaa46fff24d4514f4fd6773590d5d25353ef58b579d203f9cee1029cc081ddf14e9f5a6f1aef353a224d93e78b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 61597421305d00f45dfa5be9db2378fffe98b97b37a638e77bbdb9ec7300dfcd
MD5 c66b2fede4a27780f3407e5f4492f173
SHA1 c15ab77f579eca4e7cc6f2d1b2e62f8efbf73a93
SHA512 3c4b681e0abbb8c80aef40565c7ce7ba4e100e66ddd46915e3c9be54132cd45f6f19eaa5f287445544093ebbfdd4081f85dfd39f11a923ca1c1bf8e80a38bb2e
MD5 SHA1 SHA512

Submit Download

svchost_CCAABACCAAAACACCACAABCBBCBAACCACBCCCABBCCBBBBBBAAACBBCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABACCAAAACACCACAABCBBCBAACCACBCCCABBCCBBBBBBAAACBBCB.exe
Size 8.0MB
SHA256 1569509913267cb93cb32c85f2e0b9e21ffc438b290c21760a4f0a234c608c8d
MD5 e89ab932160277ef6cc97e7dc6596846
SHA1 22d2a86c579f50ffed8d6298e2d4cd5af6ebee3a
SHA512 adc60aa1ef75bee4b672daa15a6cedf6ef2accb46e47f3ab1023f4732d259aa3c268f38963a95b1aae856aa8c1c7338f1fe0081e10891147103913299ccbcfcd
SSDEEP 98304:Jp7Dp7Dp7Dp7Dp7Dp7/KRuy5a2p7Dp7Dp7Dp7Dp7Dp7/KRuy5ak+4js:vBBBBB/q/BBBBB/qHjs
TLSH
T18A868D11B7C18035F5B329324ABFE339597D79214F6886CFE3881A2E5E71AD0A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 4d3b6fcd618d3dc3a557e813c80354283df579c20cb65908d9ef447a4ff230bf
MD5 d840267373def9760d594e02bc4fa2ac
SHA1 2f0bb5d417e2720b3f86e76e9f47dc1dfaef7e60
SHA512 cbf5adac2133a0450b5825c79913cdeed5768283e39d49255b2f3149b319abda6154aab05d242e3e0c086116b1c7fe40a15baab1866c4ffe10f53bb3c4268ece
TLSH
T15821D631A4A9DC23F9336CDBA62DEAE24CA477EFA8586900230DC5086B99C31CD558F1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 2ac1f6f8236f75885e6d58c1c20b5090b90e158683385b01fb55bbcf918e8578
MD5 c75d7870933bb42647c633e7b3e98463
SHA1 2e8aae0978d0ee38e8551ab8c721619d7fba0606
SHA512 1706a82f10f7c47a5d8a4cdda0c7c2d4bd383a417b1c749b5a2bcb9d0dddd91739b172251c19d95f55ae6ed96dec2f4226fab79d6f2b9fdf83459f66a0e0a954
TLSH
T10111CD61A4A9DC23F8332CCB951DDE924CE4779FBC186A54230DC618679DC31CE554F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 e99aa056f69a2191f996562c82474ec0d6afedb530e60d0902996fcfb9c16a5c
MD5 2d3960acadf6e285a3fd7e7d957aac31
SHA1 f00775053f5f12f3ec2822cb128e47c036dd0be2
SHA512 d1d2a8ff7d0e52e1afd8abe70a6ca1a01f1357d024ada7c57dbdf33db064a7016a147c653ec559c286135f106b7a9526ae27708d2e32279b13ab4aeed0dbd422
TLSH
T1F0210B61A8E9DC23F8332CDBA61DDE924CE4769FB8586A10330DC518679DC30CE558F2
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Public\Libraries\qap`g`v~dtlq
Size 10B
SHA256 8bef6fda34a7a499a22bbd3560b68bdc2b604ed02074d40f3a61d27c4400ad7c
MD5 4cd158e084887d51c378579db18325cb
SHA1 5ef581b1db9c42efc66e9a2b1d2357fd80ceba14
SHA512 a4d0c2d0690d0757f227613b28968b231918c09c74b8fb601ab93ed7fa34e0f3afab0d29aa498d2c0e47541b3da557a0cded5a72a6d13ea857bb011a09964d1b
MD5 SHA1 SHA512

Submit Download

memory/964-88-0x0000000000F90000-0x0000000000FB1000-memory.dmp

Download

memory/1260-845-0x0000000000280000-0x00000000002A1000-memory.dmp

Download

memory/2360-6-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/3080-36-0x0000000000280000-0x00000000002A1000-memory.dmp

Download

memory/4780-59-0x0000000005190000-0x0000000005191000-memory.dmp

Download