9f6a75fdccd01afe5aec8df045a554108f60d0e5f2d07995eff0509a41a0c750

Analysis

max time kernel
151s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 04:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_bbf8157e84b200c28e33e328019bdcaf_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe
Size 30.3MB
Sample260810-enakesap5z
SHA256 9f6a75fdccd01afe5aec8df045a554108f60d0e5f2d07995eff0509a41a0c750
MD5 bbf8157e84b200c28e33e328019bdcaf
SHA1 67d75d7cb2b16262b050f50c1bb4e7f07cda6ae1
SHA512 19c61e0ae14662c2d817b29b12bdc73476f10a39e402857c5eecb76d04e5c38c6892129c1f6fdaebb1f9b10b79ac8713c2474ef98d2dbe7dbadc85b3962131f8
SSDEEP 98304:GsNsgsNsgsNsgsNsgsNsgsNsgsNshKjKWQckVgtev5mnlNLf:VKWQc0gEYnvLf
TLSH
T12D676D06F98740B2E83B01B04CDBD2FF8A70BE258A128EABF64DD71F6933B905535655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBAABACBBACAABCBBCABAAABCABBBBAAACAABABCCABCBAAABBCABCB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBAABACBBACAABCBBCABAAABCABBBBAAACAABABCCABCBAAABBCABCB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
200	svchost_BBAABACBBACAABCBBCABAAABCABBBBAAACAABABCCABCBAAABBCABCB.exe
3232	svchost_CCBABCACCBABBCBBBCAABCBCAACCCBABBABCACAAABAAAACBACBABCC.exe
4860	svchost_BBAABACBBACAABCBBCABAAABCABBBBAAACAABABCCABCBAAABBCABCB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABCCBCACBACCCACBBABBCCBBCCCBABCABAABBBCBCAACCBCCABBABCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBAABACBBACAABCBBCABAAABCABBBBAAACAABABCCABCBAAABBCABCB.exe"	2026-08-10_bbf8157e84b200c28e33e328019bdcaf_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCCAABCBBBBCCCCACAAACACABABCCABBCACCACCABACACAACBAABAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBABCACCBABBCBBBCAABCBCAACCCBABBABCACAAABAAAACBACBABCC.exe"	svchost_BBAABACBBACAABCBBCABAAABCABBBBAAACAABABCCABCBAAABBCABCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2352	sc.exe
5236	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4308	cmd.exe
436	cmd.exe
4904	cmd.exe
5996	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_bbf8157e84b200c28e33e328019bdcaf_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBAABACBBACAABCBBCABAAABCABBBBAAACAABABCCABCBAAABBCABCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBABCACCBABBCBBBCAABCBCAACCCBABBABCACAAABAAAACBACBABCC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2380	schtasks.exe
3292	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
692	2026-08-10_bbf8157e84b200c28e33e328019bdcaf_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe
692	2026-08-10_bbf8157e84b200c28e33e328019bdcaf_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe
692	2026-08-10_bbf8157e84b200c28e33e328019bdcaf_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe
692	2026-08-10_bbf8157e84b200c28e33e328019bdcaf_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe
200	svchost_BBAABACBBACAABCBBCABAAABCABBBBAAACAABABCCABCBAAABBCABCB.exe
200	svchost_BBAABACBBACAABCBBCABAAABCABBBBAAACAABABCCABCBAAABBCABCB.exe
200	svchost_BBAABACBBACAABCBBCABAAABCABBBBAAACAABABCCABCBAAABBCABCB.exe
200	svchost_BBAABACBBACAABCBBCABAAABCABBBBAAACAABABCCABCBAAABBCABCB.exe
3232	svchost_CCBABCACCBABBCBBBCAABCBCAACCCBABBABCACAAABAAAACBACBABCC.exe
3232	svchost_CCBABCACCBABBCBBBCAABCBCAACCCBABBABCACAAABAAAACBACBABCC.exe
4860	svchost_BBAABACBBACAABCBBCABAAABCABBBBAAACAABABCCABCBAAABBCABCB.exe
4860	svchost_BBAABACBBACAABCBBCABAAABCABBBBAAACAABABCCABCBAAABBCABCB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	692	2026-08-10_bbf8157e84b200c28e33e328019bdcaf_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe
Token: SeDebugPrivilege	200	svchost_BBAABACBBACAABCBBCABAAABCABBBBAAACAABABCCABCBAAABBCABCB.exe
Token: SeDebugPrivilege	3232	svchost_CCBABCACCBABBCBBBCAABCBCAACCCBABBABCACAAABAAAACBACBABCC.exe
Token: SeDebugPrivilege	4860	svchost_BBAABACBBACAABCBBCABAAABCABBBBAAACAABABCCABCBAAABBCABCB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 692 wrote to memory of 5996	692	2026-08-10_bbf8157e84b200c28e33e328019bdcaf_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe	92
PID 5996 wrote to memory of 2380	5996	cmd.exe	94
PID 200 wrote to memory of 5944	200	svchost_BBAABACBBACAABCBBCABAAABCABBBBAAACAABABCCABCBAAABBCABCB.exe	95
PID 692 wrote to memory of 4308	692	2026-08-10_bbf8157e84b200c28e33e328019bdcaf_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe	98
PID 4308 wrote to memory of 2352	4308	cmd.exe	100
PID 692 wrote to memory of 436	692	2026-08-10_bbf8157e84b200c28e33e328019bdcaf_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe	101
PID 436 wrote to memory of 5236	436	cmd.exe	103
PID 200 wrote to memory of 4904	200	svchost_BBAABACBBACAABCBBCABAAABCABBBBAAACAABABCCABCBAAABBCABCB.exe	106
PID 4904 wrote to memory of 3292	4904	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-10_bbf8157e84b200c28e33e328019bdcaf_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_bbf8157e84b200c28e33e328019bdcaf_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBBBCCACABCBBABBCABCCBCABCAACBAAAABABBCACAABABBAABCCAAAABBBCBBAACBBBCBAABCABABCABCBABAAAACACBCACACBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABACBBACAABCBBCABAAABCABBBBAAACAABABCCABCBAAABBCABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5996
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBBBCCACABCBBABBCABCCBCABCAACBAAAABABBCACAABABBAABCCAAAABBBCBBAACBBBCBAABCABABCABCBABAAAACACBCACACBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABACBBACAABCBBCABAAABCABBBBAAACAABABCCABCBAAABBCABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2380
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCBBBBCABBAACBCACAABBABACABABABACABCCABCBAABBAACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABACBBACAABCBBCABAAABCABBBBAAACAABABCCABCBAAABBCABCB.exe" start= auto displayName= "UserDataSvc_ACCBBBBCABBAACBCACAABBABACABABABACABCCABCBAABBAACBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCBBBBCABBAACBCACAABBABACABABABACABCCABCBAABBAACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABACBBACAABCBBCABAAABCABBBBAAACAABABCCABCBAAABBCABCB.exe" start= auto displayName= "UserDataSvc_ACCBBBBCABBAACBCACAABBABACABABABACABCCABCBAABBAACBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCBBBBCABBAACBCACAABBABACABABABACABCCABCBAABBAACBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:436
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCBBBBCABBAACBCACAABBABACABABABACABCCABCBAABBAACBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5236

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABACBBACAABCBBCABAAABCABBBBAAACAABABCCABCBAAABBCABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABACBBACAABCBBCABAAABCABBBBAAACAABABCCABCBAAABBCABCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:200
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBACCCCACBCABABCCACBAABBAACCAACBABCBCACBAABBBCCBAAACACBBABCBCBBBCACACCBACBBBBACCCCBCBBCBAABCACCBCCBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCACCBABBCBBBCAABCBCAACCCBABBABCACAAABAAAACBACBABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBACCCCACBCABABCCACBAABBAACCAACBABCBCACBAABBBCCBAAACACBBABCBCBBBCACACCBACBBBBACCCCBCBBCBAABCACCBCCBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCACCBABBCBBBCAABCBCAACCCBABBABCACAAABAAAACBACBABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3292

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCACCBABBCBBBCAABCBCAACCCBABBABCACAAABAAAACBACBABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCACCBABBCBBBCAABCBCAACCCBABBABCACAAABAAAACBACBABCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3232

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABACBBACAABCBBCABAAABCABBBBAAACAABABCCABCBAAABBCABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABACBBACAABCBBCABAAABCABBBBAAACAABABCCABCBAAABBCABCB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 41f715fe0e893e40c26b5cedeb6e310d411cca82a3c809cf10cf79487baddf14
MD5 855cad4c02fd6adc7b2b9c15fe2f78da
SHA1 7838f28615a15a99b0afcdc67559fcdd3a1dc191
SHA512 495737b9c15034bba7b6217e2bb4eb875d3a532afa9629d3003265679fea65d28f88fafd34150f2b133c1f2f4160789c5d0aeaeee6e2ac5ed9386aeac66c889b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 0b1b07bcffee533a27b708b07ca011c0968294aca9b40267339f398e0bb67943
MD5 410a15270e3e7c1126cf7fc972219084
SHA1 b571e5b301b7741d98ce0118c9005ef6ffcddb64
SHA512 998e528abe974d57e90d08bd07bc8665af543d3d0924fe6d59c804ac3f4f87afe079c129cc68d51121dbcc65e24422fd35b30d70f7ac37413fd7ad1eaa731351
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 d538aed3cc7ca02b1ba6b2e66fed0da81b8d8116b930f2ce764f06b5b7f453ed
MD5 7c5dd6f80a8eb0c5c917319ef05e4da8
SHA1 542fb5324343383a72aa0a7a70150d85a8f49e9e
SHA512 c399b53f45c5e89b5a67838ad8b00c5bd6233360815d4a9e1fde5357722fd46599b5aecbfc00452ad7b0b87b8e1e9a625a73f7b55889541c83b40c4a94fd6894
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 5b5c3de5f02e115c820220478020f6f4a1c1a4f80fb21a8f0302430855287928
MD5 924c31b9f28fb1cf5fee259601b094c7
SHA1 6d46cba37668908f40978970e2b3ea4d6a6d41dd
SHA512 6cd007b371430ab4cc0d015a271b8e6503ad30d42a1f16c44c9527c438ef68a934e11bfec38d3560c91651d1489f694b5c048e7286c652e0d0563b49c483e5d0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 7fd507b39695bf391627ff5a6ff14213b077147ecf9af67560422205bf1ef1fb
MD5 0f3f4ab928ede38458333bfc1b2b5005
SHA1 701427248f07f40e0f580496fddf5039f8998dea
SHA512 a8db9d02a21e95e9d4c21af3c1b64fa9c401444b6e17ebd806bbcf9f73cbcd5d27f294c8649ceb8e322b4667cab3b36324727838fa1708d85b9a3216a08aad34
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 6c9aef8737a1fd1c91f8d0aa07582545cbbc76e6ab713f9f41a3822a30980c33
MD5 9053c6e7f79374888d8b806829204c0a
SHA1 d621f50cf471ecc199ad6690d76cc1aab42a127c
SHA512 5c1251026e415909cfe2fa78b860e8462f2ff940a96bcac413d07171a825780c9033efcb0badac4b1070257eb03a6b73a443bdf38cf115e70065a3d6817464a7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 a91b782b6bf5c7bab5688850170ea53dc7a02a780585fa1968e0390abaebeabc
MD5 6a20cbcc4c47fef60e3d02c5fa05c261
SHA1 53a6cfd6ab59daaaca6174e0b67d3908667fa3da
SHA512 1f4fd5f85a8c7a8be4323a0edaceeda690ba8ca4fc91a17642eb083a9a011741ec090b86b05a0cd79d49c9451234c1de48209679e56b92c7c98287db6bffc98b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 e15dc2f1f248c863d3d6ab47bfeb593b29f4c2aeaa1a38588c5fde9d4df788d4
MD5 d305c792b3bae5a6f2a1b368f6cf3501
SHA1 75f66d134c2ab7d943e12076231888d4591bd09f
SHA512 d0c35c60f76cd1d1e4156d566030272693f5aac2ac5dc8e4d1fecfcc577ff6acfe598e5660c263b5b9f855760a3184df4176aac2b52223aace8d34dafc47aa84
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Controls.2\qap`g`v~dtlq
Size 10B
SHA256 7dbddd833f557f94c2f9c200db76fc660df88c63006b16d9bfd0b3cee75767ae
MD5 a7e91315078731d66b82c97b9752eb51
SHA1 2ea526d16f926653830bdd47d6830140e84ae9e6
SHA512 a18ebe0780bdcd2f1beb1ef6e64c8a955b94368ecaa9063220cf68b76e96de07c9042fc5ca95201d8ea2f4cedf890048da94cbbbcccb6943d4d7ec564bdd135c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Window.2\qap`g`v~dtlq
Size 10B
SHA256 c871d7f8d60abc80ab48789c7feb8f9afa4bcea4aa68150699aedcff5827afe9
MD5 72b68e0d97c08849d7ee0b4e4ccc2079
SHA1 ba565b752090d4f4ffc1881ddabdc213d9c73a3d
SHA512 195012a3db33f4ca9481673e219bcfd2df8c65957a9023e12e5da65d16d7c0e76ab01bfa8afd3031bb09d10864a95f4c7a4c03cde3d076fa61d73716dd9920e3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\qap`g`v~dtlq
Size 10B
SHA256 d56aef54a7672c4783bb78a51a0e926a881052efdcab377d0425f6b71e9fbd23
MD5 b5bb636e6a53bf47e3e8597133a824c1
SHA1 89383a8a71629fcef8a467d2c1982f463b2e1262
SHA512 943b03c463259941e3be69a835a3f9004cbf4c80300b718e4e2984de54e5b189d326b094d9ca94586fbdbe09b318a38f9e9edbe482f725722c0976eb734ae0b3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8dc072e2bc0c7c5f4e77153ec1fed7f967e4c8488bcc4199b92ba8ce06e2cb90
MD5 eb7405bd33030b12afdc51a27e076897
SHA1 c6373ba8dea7e99206dcae773ec5b8e42fb6bc0a
SHA512 a5e79f639db41571b0a091bc7c1388c032ae863648ff20d311b3e7ff2e2e9521cf1ce03af54d058c2d310140995c84753b5f29cb3798113576dd30b53de14fa0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 488c7d40356d22072ad1a8ad2226fdcc07a2aa776e7894b84efb8a826c655a3e
MD5 a99137b8cede27b7f818cdf95c9ec4b0
SHA1 3a0a7065894b70dbd46815932314eec5abba645e
SHA512 be9b5233f57e707f92b09264d26396133a94b66ba216f2f2254517bebbcc45c7d1b0549903be24be3f60e807bb050e2c4c4b64daf3a315b1fb877acab599b1c9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7500159e37d970417ea6d1812a32dfc0f108964d63c41eba81efb0a51485ec3f
MD5 d3766bee360688452daad8e520aca9d8
SHA1 97d12739659a7e08cc0278d9997f71b6161604d5
SHA512 6bf687c0a6668d62476b6255a91c9e5319ba4fc8a5ffefd15af57c0e93f6a8b9922a4df4e0fd05eb729665c6731dfe29e4c96dce2d2c481dc0d2cc3609cf50de
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 11a27aed04b4c7fc113d81c964d890c08635efacfedc36ca43ee9480e9538dc0
MD5 a4e6f73fd0fa57e80aa691b33f721c25
SHA1 0f6309566810165eb52c88cdc7490a1f2ea57309
SHA512 405f6f192b477fe5a87a78838dfa5ec59e106fb49434aee9204761642b8450b5899b50fe4768230b9cdc462a0f5ea915467be5a660ead5c6ebaba18fc45e1a4a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 98f7371a9b2e100b117d12c2dad753ba74bc45fb3c81e47f005e272548bce090
MD5 a1ebdf902460b4a90bb1f9eaf0adf230
SHA1 708954ff71287608c053e571ef5c22ce4748f0cf
SHA512 76ad1c89edc8914cfcb952768f687a02769e3e12eb8042e45b80d2de5d8c99c2b81fd88139a72fd1b27a99dfd9be43dfb5a9f017d58d9c731ae3516fc64ea960
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8a9c8d20e1f2e3b82a3a6cab4560781361ecdcb09788b1fbfee5589d1d52eccc
MD5 771951f8499f0bda71b612802c9201c4
SHA1 08b2d0521ac8ef29ba4aacabbaba7100199c57ab
SHA512 70d47388c03d7aefc030a0920897cc8bfd73d5d817d5021a715000d2c6cc243ccc896fcd3b68f53af67ee4c4a4d5a9450b80913e47f5363dd6f5cbe005002a11
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 42576089f90684ccf84206cdfa6aa5781211ead12451f9e8bc4ad2b97f74e9b3
MD5 acf4db32539d6e6fed2abb23865ca44b
SHA1 ca76c7bbd27ec18e50bec9841bf51484f63164a4
SHA512 7ceae85c059a34e24276051da89d62237df0675e63752ec898889b2a79f9a1c54e034ff187f34e8ec1be71020044e715ceaa0726ae9a3204daa934acf83c55de
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Music\qap`g`v~dtlq
Size 10B
SHA256 f5dd4866deda581182603e76c88b767d784d5467ccced9d6fdc305d24642b3b7
MD5 153ba1c3b6347732ee9e97291078ad3b
SHA1 a571c1dccbd8db076f5bc397b1e07bd9fb1bd92d
SHA512 98319267b977878c1da45a164ba7a875747cff00a55f0f3bc9a6bf92420d2c9cb487042dd3a9128602fc5d1e5e89a1265e93a56ffcf4f4dea1b060958b25a274
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Music\qap`g`v~dtlq
Size 10B
SHA256 dac1a063464873d3f7f0bfa5358e4312bb29b9abf3617389b2c8cbec031eefc6
MD5 067c30c017069ae4410dc1033d6e4fa8
SHA1 5813b9c24b680f561f4d14fa08451889dd4b1f46
SHA512 2163064b4903b1c23ae359815ee9af30394e262864ed13ecc5454f905edd3eb7702588d7d6b3b778fe4961fc308c9d1b7a0777ed45e961b022dfdb533ecd3226
MD5 SHA1 SHA512

Submit Download

svchost_BBAABACBBACAABCBBCABAAABCABBBBAAACAABABCCABCBAAABBCABCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABACBBACAABCBBCABAAABCABBBBAAACAABABCCABCBAAABBCABCB.exe
Size 30.3MB
SHA256 9f6a75fdccd01afe5aec8df045a554108f60d0e5f2d07995eff0509a41a0c750
MD5 bbf8157e84b200c28e33e328019bdcaf
SHA1 67d75d7cb2b16262b050f50c1bb4e7f07cda6ae1
SHA512 19c61e0ae14662c2d817b29b12bdc73476f10a39e402857c5eecb76d04e5c38c6892129c1f6fdaebb1f9b10b79ac8713c2474ef98d2dbe7dbadc85b3962131f8
SSDEEP 98304:GsNsgsNsgsNsgsNsgsNsgsNsgsNshKjKWQckVgtev5mnlNLf:VKWQc0gEYnvLf
TLSH
T12D676D06F98740B2E83B01B04CDBD2FF8A70BE258A128EABF64DD71F6933B905535655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 fdbbc42eb9e7670a9a6693b1a613ce57c6944e37610d5a55328baf5f328fd534
MD5 2aa0978fd0e8ac3d38d162e5a0a09854
SHA1 e84f1448a6a532f915da288dbb91805041f4f1be
SHA512 610d850aed27a7ca71e2ec8f0297600c0036490537b0612052083dfe40fa8bdbc82015e779bb679784d804102c5cc25147c6866a3f87ee5f504912c38555dfbf
TLSH
T10021DA7268A9DC63E93338C79215CBF30CA8359B6C9C5B54530A461CEED5D32DE990F1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 da858cd17c42fe269b8f44afefb9287e73f7dc3e66b6d6cf06f82cd7d76f8581
MD5 0325b5f870ddb9cebca35526ed43382c
SHA1 814e8ec80c970b5810a9e6bedb8cc478d90a105c
SHA512 db7ab720ffe90478ce29b6e65ecfcd4647aca1538e678c662e034c1de2f5a78f32b30f34f42c7fb226406bdbfd97a3fadc20244ca6ef2d62a03499e742707d93
TLSH
T18021B972B898DC63E93368C75615CBF30CA8369B6C9C5B44520E461CEAD5D32CE994E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 1d8adc758f10b0cac0566f2b98aa320fbd1547ecf0a7df1a49e44629fd6ade6f
MD5 c034651e65eeef78b7e8bd741b9ad835
SHA1 20e6700197049b6fdac1cd17e9e2ecc2f52081cd
SHA512 9e5a7eade214e0affdf3de39de0344a4969baf9ef7a953918fea209f3a4fa97346d5ea295db01a0c7a626c4fcbba850515814c3e67790e1fe591cc7593c13bd7
TLSH
T18F11E93268A9D863E93338CB4215CBF30CA832976C9C5B04520A421CEAD1D32CE990E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/200-101-0x0000000000240000-0x0000000000261000-memory.dmp

Download

memory/200-68-0x0000000000240000-0x0000000000261000-memory.dmp

Download

memory/200-46-0x0000000000240000-0x0000000000261000-memory.dmp

Download

memory/692-1747-0x0000000000A60000-0x0000000000A81000-memory.dmp

Download

memory/692-10-0x0000000000A60000-0x0000000000A81000-memory.dmp

Download

memory/692-70-0x0000000000A60000-0x0000000000A81000-memory.dmp

Download

memory/692-48-0x0000000000A60000-0x0000000000A81000-memory.dmp

Download

memory/692-45-0x0000000000A60000-0x0000000000A81000-memory.dmp

Download

memory/692-21-0x0000000000A60000-0x0000000000A81000-memory.dmp

Download

memory/3232-96-0x0000000000E50000-0x0000000000E71000-memory.dmp

Download

memory/4860-1750-0x0000000000240000-0x0000000000261000-memory.dmp

Download