a1666a537ce05ff34740c3ef28586dc00ad15127d6222a1d83f2a280fba8eac7

Analysis

max time kernel
149s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 05:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_42c4ef934f436ab3d2da9c3a01491750_amadey_darkgate_elex_hijackloader_luca-stealer_njrat_rhadamanthys_smoke-loader.exe
Size 4.4MB
Sample260813-ftg25asdkh
SHA256 a1666a537ce05ff34740c3ef28586dc00ad15127d6222a1d83f2a280fba8eac7
MD5 42c4ef934f436ab3d2da9c3a01491750
SHA1 ad4e6b1a1840eb7a173fe57f1834261b8764a1bf
SHA512 5c63745d18170eded61f135ff6057bba4fb62ce32955197c2e38f7e3e026579aaa8cbcbcbf5a0234a96b9fe8410d017cfaa236546eeb5781f7c6ca00cdc76169
SSDEEP 49152:W+Eg+Eg+E4+Eg+Eg+Eh+4gAjhU+Eg+Eg+E4+Eg+Eg+Eh+4gAjhU+Eg+Eg+E4+Eg2:/+4jz+4jz+4jz+4jH2cROGom6mGva
TLSH
T150267C05F9828EB1D92F107048DBD3BE4A677E20CE218FEBF7499F1A79326915438257
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACCBAACBCCBBCCBBABAACACCCBBCBAACACCAABBAABCCBACABCCACCA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACCBAACBCCBBCCBBABAACACCCBBCBAACACCAABBAABCCBACABCCACCA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACCBAACBCCBBCCBBABAACACCCBBCBAACACCAABBAABCCBACABCCACCA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACCBAACBCCBBCCBBABAACACCCBBCBAACACCAABBAABCCBACABCCACCA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4692	svchost_ACCBAACBCCBBCCBBABAACACCCBBCBAACACCAABBAABCCBACABCCACCA.exe
3496	svchost_CAAAABAAABBAABBBABCCABBACAACCCAACBBCABACACCBAABBBCCAAAA.exe
880	svchost_ACCBAACBCCBBCCBBABAACACCCBBCBAACACCAABBAABCCBACABCCACCA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACCBCABBABCACCCCAABCCACCBCCBBBBCCCBABAABBBAAAACCBBACCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCBAACBCCBBCCBBABAACACCCBBCBAACACCAABBAABCCBACABCCACCA.exe"	2026-08-13_42c4ef934f436ab3d2da9c3a01491750_amadey_darkgate_elex_hijackloader_luca-stealer_njrat_rhadamanthys_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABACABACCCCCACCBABBAACABBACABAACCCAABCCBBCBBBAAACBABBCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAAAABAAABBAABBBABCCABBACAACCCAACBBCABACACCBAABBBCCAAAA.exe"	svchost_ACCBAACBCCBBCCBBABAACACCCBBCBAACACCAABBAABCCBACABCCACCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1524	sc.exe
4608	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2844	cmd.exe
1376	cmd.exe
3844	cmd.exe
3440	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_42c4ef934f436ab3d2da9c3a01491750_amadey_darkgate_elex_hijackloader_luca-stealer_njrat_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAAAABAAABBAABBBABCCABBACAACCCAACBBCABACACCBAABBBCCAAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCBAACBCCBBCCBBABAACACCCBBCBAACACCAABBAABCCBACABCCACCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2560	schtasks.exe
2264	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1496	2026-08-13_42c4ef934f436ab3d2da9c3a01491750_amadey_darkgate_elex_hijackloader_luca-stealer_njrat_rhadamanthys_smoke-loader.exe
1496	2026-08-13_42c4ef934f436ab3d2da9c3a01491750_amadey_darkgate_elex_hijackloader_luca-stealer_njrat_rhadamanthys_smoke-loader.exe
1496	2026-08-13_42c4ef934f436ab3d2da9c3a01491750_amadey_darkgate_elex_hijackloader_luca-stealer_njrat_rhadamanthys_smoke-loader.exe
1496	2026-08-13_42c4ef934f436ab3d2da9c3a01491750_amadey_darkgate_elex_hijackloader_luca-stealer_njrat_rhadamanthys_smoke-loader.exe
4692	svchost_ACCBAACBCCBBCCBBABAACACCCBBCBAACACCAABBAABCCBACABCCACCA.exe
4692	svchost_ACCBAACBCCBBCCBBABAACACCCBBCBAACACCAABBAABCCBACABCCACCA.exe
4692	svchost_ACCBAACBCCBBCCBBABAACACCCBBCBAACACCAABBAABCCBACABCCACCA.exe
4692	svchost_ACCBAACBCCBBCCBBABAACACCCBBCBAACACCAABBAABCCBACABCCACCA.exe
3496	svchost_CAAAABAAABBAABBBABCCABBACAACCCAACBBCABACACCBAABBBCCAAAA.exe
3496	svchost_CAAAABAAABBAABBBABCCABBACAACCCAACBBCABACACCBAABBBCCAAAA.exe
880	svchost_ACCBAACBCCBBCCBBABAACACCCBBCBAACACCAABBAABCCBACABCCACCA.exe
880	svchost_ACCBAACBCCBBCCBBABAACACCCBBCBAACACCAABBAABCCBACABCCACCA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1496	2026-08-13_42c4ef934f436ab3d2da9c3a01491750_amadey_darkgate_elex_hijackloader_luca-stealer_njrat_rhadamanthys_smoke-loader.exe
Token: SeDebugPrivilege	4692	svchost_ACCBAACBCCBBCCBBABAACACCCBBCBAACACCAABBAABCCBACABCCACCA.exe
Token: SeDebugPrivilege	3496	svchost_CAAAABAAABBAABBBABCCABBACAACCCAACBBCABACACCBAABBBCCAAAA.exe
Token: SeDebugPrivilege	880	svchost_ACCBAACBCCBBCCBBABAACACCCBBCBAACACCAABBAABCCBACABCCACCA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 3440	1496	2026-08-13_42c4ef934f436ab3d2da9c3a01491750_amadey_darkgate_elex_hijackloader_luca-stealer_njrat_rhadamanthys_smoke-loader.exe	92
PID 3440 wrote to memory of 2560	3440	cmd.exe	94
PID 4692 wrote to memory of 5540	4692	svchost_ACCBAACBCCBBCCBBABAACACCCBBCBAACACCAABBAABCCBACABCCACCA.exe	95
PID 1496 wrote to memory of 2844	1496	2026-08-13_42c4ef934f436ab3d2da9c3a01491750_amadey_darkgate_elex_hijackloader_luca-stealer_njrat_rhadamanthys_smoke-loader.exe	98
PID 2844 wrote to memory of 4608	2844	cmd.exe	100
PID 1496 wrote to memory of 1376	1496	2026-08-13_42c4ef934f436ab3d2da9c3a01491750_amadey_darkgate_elex_hijackloader_luca-stealer_njrat_rhadamanthys_smoke-loader.exe	101
PID 1376 wrote to memory of 1524	1376	cmd.exe	103
PID 4692 wrote to memory of 3844	4692	svchost_ACCBAACBCCBBCCBBABAACACCCBBCBAACACCAABBAABCCBACABCCACCA.exe	106
PID 3844 wrote to memory of 2264	3844	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-13_42c4ef934f436ab3d2da9c3a01491750_amadey_darkgate_elex_hijackloader_luca-stealer_njrat_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_42c4ef934f436ab3d2da9c3a01491750_amadey_darkgate_elex_hijackloader_luca-stealer_njrat_rhadamanthys_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAAAABBABCAABABAACACBBCBABBABACCCAABCCBAACBBABCBBCCCAAACCCBACBBACBCABAAAAACCACBBCAABBACCBBABCBCCBBCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBAACBCCBBCCBBABAACACCCBBCBAACACCAABBAABCCBACABCCACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAAAABBABCAABABAACACBBCBABBABACCCAABCCBAACBBABCBBCCCAAACCCBACBBACBCABAAAAACCACBBCAABBACCBBABCBCCBBCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBAACBCCBBCCBBABAACACCCBBCBAACACCAABBAABCCBACABCCACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBABBBCBBBBCBAAACBBBABCAABBACAACACCBBCBCBAACBBACBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBAACBCCBBCCBBABAACACCCBBCBAACACCAABBAABCCBACABCCACCA.exe" start= auto displayName= "UserDataSvc_CBABBBCBBBBCBAAACBBBABCAABBACAACACCBBCBCBAACBBACBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBABBBCBBBBCBAAACBBBABCAABBACAACACCBBCBCBAACBBACBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBAACBCCBBCCBBABAACACCCBBCBAACACCAABBAABCCBACABCCACCA.exe" start= auto displayName= "UserDataSvc_CBABBBCBBBBCBAAACBBBABCAABBACAACACCBBCBCBAACBBACBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBABBBCBBBBCBAAACBBBABCAABBACAACACCBBCBCBAACBBACBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBABBBCBBBBCBAAACBBBABCAABBACAACACCBBCBCBAACBBACBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1524

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBAACBCCBBCCBBABAACACCCBBCBAACACCAABBAABCCBACABCCACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBAACBCCBBCCBBABAACACCCBBCBAACACCAABBAABCCBACABCCACCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAABBBCAAABCBAABBAAACABCCBBABACCACACAAACACCBABCABCAABACBCBCABBBAACCBBABBABCACCCBCBBBBAABBCBCBBCBCACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAABAAABBAABBBABCCABBACAACCCAACBBCABACACCBAABBBCCAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAABBBCAAABCBAABBAAACABCCBBABACCACACAAACACCBABCABCAABACBCBCABBBAACCBBABBABCACCCBCBBBBAABBCBCBBCBCACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAABAAABBAABBBABCCABBACAACCCAACBBCABACACCBAABBBCCAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2264

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAABAAABBAABBBABCCABBACAACCCAACBBCABACACCBAABBBCCAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAABAAABBAABBBABCCABBACAACCCAACBBCABACACCBAABBBCCAAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3496

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBAACBCCBBCCBBABAACACCCBBCBAACACCAABBAABCCBACABCCACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBAACBCCBBCCBBABAACACCCBBCBAACACCAABBAABCCBACABCCACCA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 f1d95aaa0ae21de69b47e067bbdde627fe85482906c4b55da81a5cc4d8dad193
MD5 6c2568efb1ab3a0f509602a4a9a744f4
SHA1 594cbb049c5b80f5d8fb14275da0739840492098
SHA512 d0718032dbbc718bfd29e24763d8ff53ae482266f6152d214c6107440a3b58fc4de8177cc6fc24c6f99561d567b9fb6ef8c21edb031eb90409a4ce8c1c62d2ec
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 240496c9bbe035285b8311a3eda3f18a5629dd4ef49e1a85ae76c58c8598675f
MD5 c5e38099fb141f5476a209f03a673a98
SHA1 035e9793161e3f21f2a3c54abfc90a24ca249980
SHA512 e258c702a4cf70dd2c3d445b3c1a6d99a6860cd03a618cfee7049dc4a20a163a8f23345161b1e435ab6d0cc16384790872df1497d1e8f8aaf010cddfdaf9964e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\ClickToRun\MachineData\qap`g`v~dtlq
Size 10B
SHA256 8cc58f1fe4f869b04aae3ccbe80902056abc041a42365774901839cb2abf61e0
MD5 105583c4efee89989d8ac550a1ff81f6
SHA1 49279a97c914e4c12f0161c16219107395885654
SHA512 77349a0e2d95294c231d831eb23cc5a47a37e6116d296c65ff0670b895f7ab209d1002aae2bcc01d88bfe4780344d50f8c84651a0fefef9f68eb5fb49d458416
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 5.0MB
SHA256 deef49961d9004041304c03da63aaea8a01202ad6fdcb5cf9761dfd339a63a20
MD5 669d039a2233b69a36f4604f076713d7
SHA1 fa23bfd63099535a23e9967ee360f7f9faa75484
SHA512 d557df52e8261e10aaad2f862d19d9db43122595eea0acc258704cc1725b6d77ca805542fd9930fd6bcddecc2ade9e042029d674a003cd9340f585f0cdea63db
SSDEEP 98304:/+4jz+4jz+4jz+4jH2cROGom6mGvdgZ2Hb9t+2xm:Xj7j7j7jWgOvjllgZ2jm
TLSH
T14336AE05F9428EB1D92F017148DBD3BA4A6B7E208F218FEBF7899F1B79316915439213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 0facf9ca1891fd24e9dae5d9a57343fa1c1c3b36a8c5cb10af5d88dd16b779d7
MD5 2207bc521e49e5ef7c76473d1e9fafda
SHA1 9715cfdccae3184c1b09522dc5908ca8bd737233
SHA512 c97a41fbf66d4b5b28acd023b89ce3421a0da91cfd32988f0d403df0cafa38b3b1be2ee068567e167372a22ea3d60cfaba0cf2886c915c51596178143e728769
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6\qap`g`v~dtlq
Size 10B
SHA256 d5dbf77089b56536aa31cafc5bf75fb6392637af63df8f3116ba2d193278406b
MD5 f2f538bc2e32e9ae7e99c02aa3772c9e
SHA1 7e4160c7d881409edf43abc9e58678176e9ec7c6
SHA512 210e316d6b5c17a61b47ac04e89b84462f423493f9bcc8db903ed07ff3156fa34f15cb254908760a757e08387c4bf3268bd3d9df9423f970ea2771ea06192ac9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\qap`g`v~dtlq
Size 10B
SHA256 5dca324b58d5ca93288909068e0e3ffe1c8dc4a667e64344ea94fff1ce18ba27
MD5 741defe966b208b29cd02c1c909c186e
SHA1 5c304c3268fe10ef1449a666bf908fbe5539d6e7
SHA512 3b755c1f630fcd057a7fcd5f5f28204eeb4b006097a9c028b8bb5b59038084392d908288850c82546ac43fc111cc65ae33607d5926e53d2169146bd0e4c92953
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\qap`g`v~dtlq
Size 10B
SHA256 5084d0ece5f3c72bd0cecb11bb734136b19e31abcab3683d6655a505ceb2fc50
MD5 d8c62adfeaede81051e49d2409a46ae7
SHA1 48be2dcf10aa4632dfc5ee0495fc44a8720a75dd
SHA512 d5b402bdd1a2bf3e06251168ecdcec1964e7e7d3188d597790175323e8ad4187a96e739cd0bc994146c475fec50f009334fbb58c5c5fe0b08dcd8a0268202580
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\qap`g`v~dtlq
Size 10B
SHA256 66d97448bba2584f9130367e7591eb311efbd152b66d3e1e5a4ae4bab47a07c0
MD5 d9b6f39cead38c3dd988152f6f945338
SHA1 8cd2760e5002448a12e2bc6e26668479877a24ac
SHA512 339f3b9012e978470ba70beac2a861550ba3a70e6bf60c5780cd1eb1a6a48d2583fca1f1e6800c939fc82c25a08e6bf36091106cc563e8271e41fb00af198f08
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\qap`g`v~dtlq
Size 10B
SHA256 3c4792b01d502d0c60b12a47d66889c40151c338391473f989612103d100ca3d
MD5 c535299665a9cb27a10811735e0e43eb
SHA1 c0ff131390a99b7dec260042f5a03317981b208a
SHA512 07e023d553b6a81f7e4ea42c0e4abff096eb45b79b63b127f35e13dfcebe9245e77e4b83c7f98f7f9dbc26796ec2d14d38ea48b85ca8857a9bc0547668693c09
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ea3a4823ff843c0120c2219e4e85f31bd8df2838633215233231362c07528776
MD5 4f034453e5468ff9b039e5813878b500
SHA1 6d38ba015202a68a95b42d1e7beb95648a527771
SHA512 52ae69be7dc91fd0e6a2dc60d70605f2148b2736a098983efaace583f2ac91b754d5dbe8e12a14d4a6deadff3abd40e904080db143d1229cad11c4aa97d2cab5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 76411f6f480acbb9dd6abcb6226b1d80b503f0c8dd0e1a508a0f13ba9756fffe
MD5 e544afcacc874b14a799071adc3c5161
SHA1 626fdacdf7988c77356f1d10690d422b65e9a065
SHA512 bcc440562eff1b3b9e002762763a41c054a9c97e45f5bec3ccc615288e9fd43160b3e1d09e6e63b1f0411481d36b2a1bfc67a38dc1ac9b131aadfb8b80d5e5b5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0125a2343aec8f7619936222960c8f243677d84d08b4a2fd0aa06f6547deddab
MD5 d2be58632e38b89a413eb27bcab6ed11
SHA1 7c4c5b05a870b0295c9f350b07418f5b6cbd7a2f
SHA512 8179ef503881d45aeb825019b3163d600d171fc9e346662cd6f4cb5b116932e6c1248371922e716003e05460ea8982a674fb9fbe8fa8d9be3221bc252123429a
MD5 SHA1 SHA512

Submit Download

svchost_ACCBAACBCCBBCCBBABAACACCCBBCBAACACCAABBAABCCBACABCCACCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBAACBCCBBCCBBABAACACCCBBCBAACACCAABBAABCCBACABCCACCA.exe
Size 4.4MB
SHA256 a1666a537ce05ff34740c3ef28586dc00ad15127d6222a1d83f2a280fba8eac7
MD5 42c4ef934f436ab3d2da9c3a01491750
SHA1 ad4e6b1a1840eb7a173fe57f1834261b8764a1bf
SHA512 5c63745d18170eded61f135ff6057bba4fb62ce32955197c2e38f7e3e026579aaa8cbcbcbf5a0234a96b9fe8410d017cfaa236546eeb5781f7c6ca00cdc76169
SSDEEP 49152:W+Eg+Eg+E4+Eg+Eg+Eh+4gAjhU+Eg+Eg+E4+Eg+Eg+Eh+4gAjhU+Eg+Eg+E4+Eg2:/+4jz+4jz+4jz+4jH2cROGom6mGva
TLSH
T150267C05F9828EB1D92F107048DBD3BE4A677E20CE218FEBF7499F1A79326915438257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 2b31dd0b874b316ec097004fb13f5b05c37c18177a8b33dd5f50cca18d977804
MD5 de06270120961455e0c8e8865c5130a9
SHA1 e3d8614dbf4e0955ae2bf8b991158f8de12131fe
SHA512 fe28ee72e34a6d03de682da65db90ee6abd690f428edfd6cc65df72eabb64695299dc201eddfab119da6a260a60024dddeb21fa74faefa9d049eda0ea26464d1
TLSH
T10521EF60E4D5CC63F97358CBA23EDBC20CA4375F6C69551853048119EBDDD728E1A8A1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 2f572be328d83694f1b6e3ec7bfd1e22aa37fe110161605b9daa44b9dc3c29f8
MD5 e32c9dbd4a3e8723043ef688d41c7cd0
SHA1 c9b0ed09d23fc498dd065d968f2fcd3f30aba419
SHA512 22e8319a438a7368e9dc9acd26cfbab0726c33b43b55fa686bd562be16b7574b4f74fbcfab304e748b75c4fdaae5686d3b86e426f3820fa6b2f161fc439c6260
TLSH
T1DA11A251E4EAD813FDB2648BA23F9BC20C94365F6C7959181304811DEECDD668E16CA1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 449a3c022b7b95041820545ec9ca518f6f4c2aeb201375d216936c4a0ff06243
MD5 2ea9cc81a0922540d706392baa3264a6
SHA1 acc71cb1697c983d13f10f693ee851ddf9413c61
SHA512 eeb1c3b289a5e6d850104c50a4cf59cd67bddf939c41c088adbfd95d1b38070034096e391fce64b0ebee5d0ca2f8fbfeb505cd73f96442d58dd660d53e08c88b
TLSH
T17D21CF60E4EAD823FD7364CBA23F9BC20C94375F6C7959181304811DAACDD638F168A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/880-2042-0x0000000000600000-0x0000000000621000-memory.dmp

Download

memory/1496-6-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/3496-78-0x00000000004F0000-0x0000000000511000-memory.dmp

Download

memory/4692-31-0x0000000000600000-0x0000000000621000-memory.dmp

Download