7e5ae6e10d0c7ed366a7f55e41f3f62300cecdb7be04629d52d6c81bf09a53cd

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_367b1f36500e4f91bc99f0df2accaf8d_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe
Size 22.4MB
Sample260810-da59hatxc1
SHA256 7e5ae6e10d0c7ed366a7f55e41f3f62300cecdb7be04629d52d6c81bf09a53cd
MD5 367b1f36500e4f91bc99f0df2accaf8d
SHA1 275af7e459d6965066a5c670f513a34ad46cf87d
SHA512 5631d5876a1a4fe464e9f92e8b5039a54f98e66316d06857d5a2b162b95f2330048319e1781f47ac6621d754e682818f94581ede48e7501b79c77138d7c417bf
SSDEEP 98304:T7pW7pW7pGKRuy5a+7pW7pW7pGKRuy5a+7pW7pW7pGKRuy5a+7pW7pW7pGKRuy5p:gqMqMqMqMqMqMqMq1FIF0wu9
TLSH
T19B378E02B7E99031F5F32B305EBA92755A7ABD619D35C64F73841A1D0E70A80EA34B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCBBCBCCBBCCBCCBCCCAACCCBAACABAAACCABABCBCACABABBACCAAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCBBCBCCBBCCBCCBCCCAACCCBAACABAAACCABABCBCACABABBACCAAA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCBBCBCCBBCCBCCBCCCAACCCBAACABAAACCABABCBCACABABBACCAAA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCBBCBCCBBCCBCCBCCCAACCCBAACABAAACCABABCBCACABABBACCAAA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1080	svchost_BCBBCBCCBBCCBCCBCCCAACCCBAACABAAACCABABCBCACABABBACCAAA.exe
1520	svchost_ACBABAAACCCBABBCBCBBCABABCBCCCBBABACCBBBABBCAABCBCAAAAC.exe
992	svchost_BCBBCBCCBBCCBCCBCCCAACCCBAACABAAACCABABCBCACABABBACCAAA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAAAACBCCAABCCABACCCBCCBAABCABABCACABCAACCBACABACAACCCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBBCBCCBBCCBCCBCCCAACCCBAACABAAACCABABCBCACABABBACCAAA.exe"	2026-08-10_367b1f36500e4f91bc99f0df2accaf8d_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACBCABCAAACBAACAAACCCCCAABBBCCABBABABCBBACCABBBCBAAAAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBABAAACCCBABBCBCBBCABABCBCCCBBABACCBBBABBCAABCBCAAAAC.exe"	svchost_BCBBCBCCBBCCBCCBCCCAACCCBAACABAAACCABABCBCACABABBACCAAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
364	sc.exe
1960	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3664	cmd.exe
4372	cmd.exe
3632	cmd.exe
2748	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_367b1f36500e4f91bc99f0df2accaf8d_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBBCBCCBBCCBCCBCCCAACCCBAACABAAACCABABCBCACABABBACCAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBABAAACCCBABBCBCBBCABABCBCCCBBABACCBBBABBCAABCBCAAAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2920	schtasks.exe
2096	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5888	2026-08-10_367b1f36500e4f91bc99f0df2accaf8d_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe
5888	2026-08-10_367b1f36500e4f91bc99f0df2accaf8d_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe
5888	2026-08-10_367b1f36500e4f91bc99f0df2accaf8d_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe
5888	2026-08-10_367b1f36500e4f91bc99f0df2accaf8d_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe
1080	svchost_BCBBCBCCBBCCBCCBCCCAACCCBAACABAAACCABABCBCACABABBACCAAA.exe
1080	svchost_BCBBCBCCBBCCBCCBCCCAACCCBAACABAAACCABABCBCACABABBACCAAA.exe
1080	svchost_BCBBCBCCBBCCBCCBCCCAACCCBAACABAAACCABABCBCACABABBACCAAA.exe
1080	svchost_BCBBCBCCBBCCBCCBCCCAACCCBAACABAAACCABABCBCACABABBACCAAA.exe
992	svchost_BCBBCBCCBBCCBCCBCCCAACCCBAACABAAACCABABCBCACABABBACCAAA.exe
992	svchost_BCBBCBCCBBCCBCCBCCCAACCCBAACABAAACCABABCBCACABABBACCAAA.exe
1520	svchost_ACBABAAACCCBABBCBCBBCABABCBCCCBBABACCBBBABBCAABCBCAAAAC.exe
1520	svchost_ACBABAAACCCBABBCBCBBCABABCBCCCBBABACCBBBABBCAABCBCAAAAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5888	2026-08-10_367b1f36500e4f91bc99f0df2accaf8d_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe
Token: SeDebugPrivilege	1080	svchost_BCBBCBCCBBCCBCCBCCCAACCCBAACABAAACCABABCBCACABABBACCAAA.exe
Token: SeDebugPrivilege	992	svchost_BCBBCBCCBBCCBCCBCCCAACCCBAACABAAACCABABCBCACABABBACCAAA.exe
Token: SeDebugPrivilege	1520	svchost_ACBABAAACCCBABBCBCBBCABABCBCCCBBABACCBBBABBCAABCBCAAAAC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5888 wrote to memory of 4372	5888	2026-08-10_367b1f36500e4f91bc99f0df2accaf8d_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe	91
PID 4372 wrote to memory of 2920	4372	cmd.exe	93
PID 1080 wrote to memory of 2940	1080	svchost_BCBBCBCCBBCCBCCBCCCAACCCBAACABAAACCABABCBCACABABBACCAAA.exe	94
PID 5888 wrote to memory of 3632	5888	2026-08-10_367b1f36500e4f91bc99f0df2accaf8d_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe	97
PID 3632 wrote to memory of 364	3632	cmd.exe	99
PID 5888 wrote to memory of 2748	5888	2026-08-10_367b1f36500e4f91bc99f0df2accaf8d_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe	100
PID 2748 wrote to memory of 1960	2748	cmd.exe	102
PID 1080 wrote to memory of 3664	1080	svchost_BCBBCBCCBBCCBCCBCCCAACCCBAACABAAACCABABCBCACABABBACCAAA.exe	105
PID 3664 wrote to memory of 2096	3664	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-10_367b1f36500e4f91bc99f0df2accaf8d_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_367b1f36500e4f91bc99f0df2accaf8d_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCACACAACCBACBACCCACCCCABCACAAACACABCCCCCACCCBAABBCACABACCCCABACABBABBBBCACACBBACAABCBAACBAACCBBBCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCBCCBBCCBCCBCCCAACCCBAACABAAACCABABCBCACABABBACCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCACACAACCBACBACCCACCCCABCACAAACACABCCCCCACCCBAABBCACABACCCCABACABBABBBBCACACBBACAABCBAACBAACCBBBCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCBCCBBCCBCCBCCCAACCCBAACABAAACCABABCBCACABABBACCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCCCABBAABABCAAAAACCBBBBAABCBABAABCABCBBCABCACBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCBCCBBCCBCCBCCCAACCCBAACABAAACCABABCBCACABABBACCAAA.exe" start= auto displayName= "UserDataSvc_ABCCCABBAABABCAAAAACCBBBBAABCBABAABCABCBBCABCACBCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3632
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCCCABBAABABCAAAAACCBBBBAABCBABAABCABCBBCABCACBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCBCCBBCCBCCBCCCAACCCBAACABAAACCABABCBCACABABBACCAAA.exe" start= auto displayName= "UserDataSvc_ABCCCABBAABABCAAAAACCBBBBAABCBABAABCABCBBCABCACBCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCCCABBAABABCAAAAACCBBBBAABCBABAABCABCBBCABCACBCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCCCABBAABABCAAAAACCBBBBAABCBABAABCABCBBCABCACBCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1960

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCBCCBBCCBCCBCCCAACCCBAACABAAACCABABCBCACABABBACCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCBCCBBCCBCCBCCCAACCCBAACABAAACCABABCBCACABABBACCAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAAAAACCCAACCBBBACACCABBBBACABAABACCBCBCAACCCAAACABBBBBBACACBCCBAABBCBBCBBCABACCAABBBCACCCCCCAACBBAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABAAACCCBABBCBCBBCABABCBCCCBBABACCBBBABBCAABCBCAAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3664
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAAAAACCCAACCBBBACACCABBBBACABAABACCBCBCAACCCAAACABBBBBBACACBCCBAABBCBBCBBCABACCAABBBCACCCCCCAACBBAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABAAACCCBABBCBCBBCABABCBCCCBBABACCBBBABBCAABCBCAAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2096

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABAAACCCBABBCBCBBCABABCBCCCBBABACCBBBABBCAABCBCAAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABAAACCCBABBCBCBBCABABCBCCCBBABACCBBBABBCAABCBCAAAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1520

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCBCCBBCCBCCBCCCAACCCBAACABAAACCABABCBCACABABBACCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCBCCBBCCBCCBCCCAACCCBAACABAAACCABABCBCACABABBACCAAA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 8d10fa7b70f79ed70ca40f47399d0f3b95fbabb115e0352401b8bb06a1a13a1a
MD5 0b39acf96f3cf06477d23227987b6b9c
SHA1 fa14dc78f220cba36954761e004d0f44322aaada
SHA512 4689b4c0895ba14a970b146c6d1e49a98e1ee19fe9cfac6e235f29b487dd754fc2430f335a6539ebf0fda8c8a154d9bd357c41b628291427e182d776a5559f39
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 96e9d9633d8aae295895e58419574aef0e8b4265d35b3456fc5d005bcf155b00
MD5 1d0dd2fef3b92704845097ce695ff0a0
SHA1 e99841bb7e001d4b0e986e55c5d26a3f790e45b5
SHA512 19d13f4f5ba324c839198a2073535183933909976b1f6b625d2df55d9718d7f96d91d867e672be1e8431bd04a21487a60b3c799883dc88d70ed82a7f2a8879e2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 55239d22bf1f662e5a2af4182bf93783708c8d8f10c3abeb279c0d451a224374
MD5 5d9fa1ec81c2d62061a4d3c767a8938f
SHA1 3b05e36c8689df126a7c43543ca6dec68a7bd5c8
SHA512 af8d86a43e72abe230b2d784e4d158b9fff55b79bd000c53c3c8c2c8c0424731acd10784876fe42952661aa636849939c59616895b84046581de55b6c2406b05
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 22f17ba7cf993ae69cf8a394652d9747e1dc51c3030910d1ec719546d43769fd
MD5 45aa5b8c1bfaf3568000d29b9f25c866
SHA1 1ed0b1089121b6a98a89664ca1470e303b58ec9a
SHA512 8f291f68ccb19ca0d3a058d85060d82a6639251b3eb46601b64813b3f1b93cfe459c20b381771a93f97c65a43d1e5899850b97cb4919ab1f0a7375f2aae5ce85
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.CloudExperienceHost_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 9742564dcd4d1fb99c61b7589bfca71b9b8d8b53335c5ea36ae18928e365ecda
MD5 320ddefaa0b28ba6b05be5fc0a77d9b0
SHA1 4eccdf3e29eb71bec0d975e06e05bd130e73fa4a
SHA512 fa7bd6779cac03f22e3b8a4a14cfd141d67c2afef171d6b481a3fe06e5dd0205cb2fc3a2e35449262dea926b26d4d3c913d8ace44af708bfd4409ac018ebb080
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 23.0MB
SHA256 da7c41bbe13e583c73c0a877c3d66016e0f568bb56b77d5509503f69ff74e673
MD5 9ad288609f9320b4e42e605bc3adc620
SHA1 e7fd26cf0d74ae2741872f42d74ada3974f4ba1c
SHA512 e7547d3df320224df07f7801a29d93870d9e41fd854ab71eef36b25d9ba5a06bff11ee5c0381d6da6201eb0962a06b9e2ebf358fe586648f487e85922beeb16b
SSDEEP 98304:T7pW7pW7pGKRuy5a+7pW7pW7pGKRuy5a+7pW7pW7pGKRuy5a+7pW7pW7pGKRuy5g:gqMqMqMqMqMqMqMq1FIF0wusgZ2jr
TLSH
T119378E02B7E99031F6F32B305EB992755A7EBD219D35C64F63841A1D0E70A80EA35B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 1f5177c65ad05a821a56ff8c0eedeb309183fa5233928b7392f578fb9993bdd4
MD5 af210264fd13ba37d9c33e8fef923ef0
SHA1 f9ca1faf76072c750555ab8ad111758c2aeaff85
SHA512 f327cf2a9469f00f77779b5dd1a31d99459d4f32f230c0954a14f78b29814fb681e634d44eb8bbcde3e9293272de07ad2608d7f5ea91d71ce93a27a6ced32918
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 9e8819bb42d52ee4e9b2444226a2d4e1dca12f995858dbc11bf62432dbd50698
MD5 42a7c52cbd7370ac02a4f0bc41ed2aca
SHA1 05400baf6731fe6e7ddb63165c6df876b1445a4e
SHA512 f935e2c615074573fa2392b9d24e2172525689456b665034ba61bd9d3562cf1bbca251df7b637fd97671f929b7ec47c7b1cbced3b59788cc6d4affafecd0b6b4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 1ad68cf23e43e17a52b72c9269b4bde173ab55d1a05ec49642aaf08bd0cc9558
MD5 1eccf19c49f146e299e5e6f4554a7c4f
SHA1 eac74574f30c3e04bb63781bb6829beb2116fdf1
SHA512 5d06c37550ea17fc15b53e80692d81c0a45f93b81d086be736d71ff066d5d39ba5d3ddd0a3b96f845e40350ebcdc69c489b93b25179c67c3108a9dd4c78e245f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 4bfe2ed6321f981b97885a1ec45fb98744d004b67dd6417c4611f7c40c985dde
MD5 ba8b4f1e438de4abfc602548e8226c79
SHA1 e3adef0b31b2d9f883da9d1cb147f36661bfd241
SHA512 e3534807c289ea53489be35ad7c07d5513a9bc04c04b62f0e14cccea7d97c0a652923bd2f7cf33f2507733903a7072a14813bab9b43fde71b84eb12fc6ff36b9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 bbf045e751507f24dc98518c8a14958ab00b676189e20f38589a5ba21cd779ab
MD5 41b9043bd25c6c32d7059672476bec25
SHA1 ecb9ae43e6874238f75b634d512dcdca20f43742
SHA512 b3682f583929af37cf6da16657e46fcbb6be60595dd303dce492621742a412838800ab3ddb59b8cbe3cbc6bdccad32451aba3143d8f0d385cf3bf02b37037f7e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 c8245729b1d7cce06b9db12a3611e6e3bb6dd80c65035795c8a04ebb254744e9
MD5 fb51a2883c761be46b57f579b3ddea8b
SHA1 88c62a3b3d9e77e72ce4568f16b7864f77dca374
SHA512 5671c5145b94bbfb7a2fe5531f95e613683a9af42e2bbd44881cbb1a61d9348efe11bf0757243b39dae7118d426a4f7ce6e4d239c8a4f995f6c732385f786b07
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 24dfb4c150376d70cf583bdb74f0a2d9aadb606bcdeef2576e0f102bf3a18bcd
MD5 472ece4c321c2377548e494a3ae931e5
SHA1 3426b56036cedc460b81002074fb1ce87a46d96f
SHA512 08e7d8c29da7c80aa0be022a0b3905c1432cf9945f5191d619f36cf66adbc0f9a81fb06afc15bac1110ebfacde14ee26413f2287d19886e2cffc018b44a4496a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IECompatCache\Low\qap`g`v~dtlq
Size 10B
SHA256 784c9a9d806363fd68bcee937761c27bb3b289ef142fcde4aa4a48f75f787dfa
MD5 cf10be6a38cbde3dc999af742ce5fa9d
SHA1 9ae8172ed759c102a1e0415c178511a1d5fc76f8
SHA512 f24b3093ecd3ce91fb173e44f2a21224087a170b1d9995f45752e3e5206f23fddc69cf170e838b9f72126492b01ed8ccd5902d7347282a438e884671ee6d90d4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Temp\{349151BF-01A1-4D04-BF53-8B640BF6FF6A}\qap`g`v~dtlq
Size 10B
SHA256 2c47359e2436d52e586ea9763199c20474a5e2def3b5e37977f7dbdf141a6f5b
MD5 02a8bcd58bca0248068daf3819d1d322
SHA1 36804db01132139e1642b67daab1bddb1556df8e
SHA512 33aab3fcbc53f4ece71407377acfa7f43dfe4340661b9936220c2f23245c8752ab006b0ca5e121f59684629f320a7ff32725fe418e1bb4f599db09b541b272ce
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9d9942b7edaaa7645e18868669ab5493fc09e98eb105bfa5d867bcbeca668759
MD5 ef3aad3ba1ca648b39ff4c3c558a0857
SHA1 0d87dfb0031315ad9ed8158e31447248debde9e4
SHA512 f47979747f025c5e33a6df53140601f147fb4e496d01756475b5d6a1eed8a3b9ec8857a42d3088df19adbb579ea30d440a1694ba7937502028d761c8200f731e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 03b84590f3e73bdb64d3de25ac8765303c9e8020d727bdd3c8a1440646bd1341
MD5 09da17babf9d6f46ca09db11e905ec07
SHA1 3cc65e5ac1baacf2c7f7faed5e53e2655ae41103
SHA512 0d9e1bbf6fc9229744b956384dbe3ee1b2793975d5c38b502b21e25d963772e8c8d2133feb409588d0035f6e80073aa5581203dbec150f5dc2b99a4c2e9a3325
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 72baceea0061e54a5f90058f0083db3963d1a8b3f2d75cd066db2fd298ad873d
MD5 1ab72351a672ffa0f5467b95f24fceea
SHA1 60c21eef6d3b1f3e326dc86bd3961d575c62c29c
SHA512 b63ca35097163801142deb1fc58b1bb972d22422585040d3c16309bbabc1b1d0e30ca7ec19a21146b232cfd6b5b8e19b275411512fe5c35e06dd7ea1aa8c559c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 950ddf626c4a2a926ee7060e2495f6a37ce9f9d8626964e903a0c0ce358e39bf
MD5 cec89ea46aaa6a182c2bdb86b6561d95
SHA1 947952d4215ecf9f1de4d7d45cd3fd5b531269ea
SHA512 65a75a3da12d4591587ca0857ba1c8a0aba9486405b1e69374f5bd2a77bdebca9fb71c77f728952709f32a7bdda8953fe2c2bc8fa46ba13feffe250f851100f2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 02f46dc2eb4e2314350d91a85435890dc97856100f7d54e8ba45c91790d798b4
MD5 b4de5f8118019e64b7a8096303299e11
SHA1 fe2564f9288e1a84f7e9fab98220610b90e939a4
SHA512 1d010207c16afefba3ced9c9f6c539db293680571c990bee194d659ba4030c5a6ecf7624f3593809367d37628a783ce5de0d79e8d940544cd353fa30abaaa964
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9b999cd32deda499c42a7380421de0153a0fb0068528135807940d182d8d62f3
MD5 bd5220f4191341f5a86018563c8e2493
SHA1 46c690d833e71b3bb953ebd1eca5c20fa5784a06
SHA512 c6e661ca397f510448280d915b03dc1308e3d2c8e641c9609d836d9a82ae16a505ae26c9c4454bfb3af5268e0c06bf57b1fdea28cacdf11d6843972138d94a8e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Local\Microsoft\Windows\Shell\qap`g`v~dtlq
Size 10B
SHA256 107255d8eecc472cbb20a4bde5dd32df5f9e81cd2f89bf493978b5849356e08d
MD5 7232df837adf9af19f149b629470c41d
SHA1 fbb73fed3ee02b47f77dda191308206f7c4a3459
SHA512 00e606e390a2c0bd398a13807c71df22ef5484939003b777cfe581c50af01c222bcecc4e15c2401f3b33c2418fbf7dd501de10a19e63088bec47a2c27bfc0236
MD5 SHA1 SHA512

Submit Download

svchost_BCBBCBCCBBCCBCCBCCCAACCCBAACABAAACCABABCBCACABABBACCAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCBCCBBCCBCCBCCCAACCCBAACABAAACCABABCBCACABABBACCAAA.exe
Size 22.4MB
SHA256 7e5ae6e10d0c7ed366a7f55e41f3f62300cecdb7be04629d52d6c81bf09a53cd
MD5 367b1f36500e4f91bc99f0df2accaf8d
SHA1 275af7e459d6965066a5c670f513a34ad46cf87d
SHA512 5631d5876a1a4fe464e9f92e8b5039a54f98e66316d06857d5a2b162b95f2330048319e1781f47ac6621d754e682818f94581ede48e7501b79c77138d7c417bf
SSDEEP 98304:T7pW7pW7pGKRuy5a+7pW7pW7pGKRuy5a+7pW7pW7pGKRuy5a+7pW7pW7pGKRuy5p:gqMqMqMqMqMqMqMq1FIF0wu9
TLSH
T19B378E02B7E99031F5F32B305EBA92755A7ABD619D35C64F73841A1D0E70A80EA34B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 468563eb4824ada406ff73ca05b39b438b4921a2aedced08b8969744cae5c0a4
MD5 2be2bffa09df219ad8665c1248f52bc1
SHA1 8a3a5516f96cb39cd8d26d3e2e6928fdaa618ad6
SHA512 fd46b32fcdaf27b3157bc5dd74cfe29ea4a4bbb94d48cefc6f1d6eaded1d885823b2a0c275b814d895d4d159a4ccc77599ff7df4e1b09c3898466cdc74c46989
TLSH
T148219260A4B9C853ED33ADCF8229EAF21CE8379B78A86E14134A411C6B59C25DD594D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 11b78ab3fcf951b28e7b763537b9d0b84ec7010fae6f2d174ae8f074ece939cd
MD5 3bfd8a604f2f3ded2812d2b5b6ca660a
SHA1 ff764c79bab609fc5ddb0cbe167712b2f0889459
SHA512 5f9c99d0dd328a424e013a541d21002b10203effd33cc4fe5699759f74ac9b9aeae9a193878ed5926ed2071286b2ac438ed8911fd9784d9b78e88ac9f21de122
TLSH
T17721A860A4F9C863EE33ADCF922DDAF20CD8379B68A86E10134E411C7B99C21DD5D4D1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 638d8a7e64302f8964dd75bb15786e86db63c790dc405ea862627b7666dbc692
MD5 b12d588f92b26311de5d8bf46e1536be
SHA1 6d0f9fe902c62b57fe77b46d59d6366d48f3ae7d
SHA512 2ec041673b3237db650a2e20872bdac5bb1be75c6cbd8b22360c427e499fd356f89fd0b28ecfd7ca1f43465779c6dd1f4782d5b6a78655dd75ec9e1deabdc3ab
TLSH
T16C11B250A4B9D823ED32ADCF822D9AF20CE8378B64A86E14134E411C6B55C25DD594E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/992-1576-0x0000000000BC0000-0x0000000000BE1000-memory.dmp

Download

memory/992-4079-0x0000000000BC0000-0x0000000000BE1000-memory.dmp

Download

memory/1080-32-0x0000000000BC0000-0x0000000000BE1000-memory.dmp

Download

memory/1520-63-0x0000000000D30000-0x0000000000D51000-memory.dmp

Download

memory/1520-3903-0x0000000000D30000-0x0000000000D51000-memory.dmp

Download

memory/5888-6-0x0000000000200000-0x0000000000221000-memory.dmp

Download