d546ecf4925eb5c70d245712b106e9d79f28a93b8c07d9f342f62bbe45a8819c

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_dc69253c59fefdeb1ff95ccb154aef4a_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Size 7.4MB
Sample260814-dkngfatcnc
SHA256 d546ecf4925eb5c70d245712b106e9d79f28a93b8c07d9f342f62bbe45a8819c
MD5 dc69253c59fefdeb1ff95ccb154aef4a
SHA1 9353c1d4d00a9263f01950124807a8bc6e510503
SHA512 c3f7e96afc710e386ded2fc143c6260e3758d14d627d18dd6b6fbc14cfc30edd3a95078bafb716bd6d05dfec260c9e60ced5cbfc12713f5a98f593dfe7ac27e6
SSDEEP 49152:U+ES+ES+ES+EWLhq+ES+ES+ES+EWLhq+ES+ES+ES+EWLhq+ES+ES+ES+EWLhq+ET:hOU/jIEeQfoR/IuOFVjUu52
TLSH
T15B767C02F98640B1E57711704DEBC27A8A31BA6187328DEFF68C961F5F32BD09935B52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCCACACCBAAACCCBACAAABBCCACABBCBBCAAABCBAAAAABCCCACBBAC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCCACACCBAAACCCBACAAABBCCACABBCBBCAAABCBAAAAABCCCACBBAC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCCACACCBAAACCCBACAAABBCCACABBCBBCAAABCBAAAAABCCCACBBAC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCCACACCBAAACCCBACAAABBCCACABBCBBCAAABCBAAAAABCCCACBBAC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3168	svchost_BCCACACCBAAACCCBACAAABBCCACABBCBBCAAABCBAAAAABCCCACBBAC.exe
3924	svchost_BCBCBBAABBAACABBCCCCACBCABCACBCBCABABACCABBAAABABACAACB.exe
3408	svchost_BCCACACCBAAACCCBACAAABBCCACABBCBBCAAABCBAAAAABCCCACBBAC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBBBAAABBCCCBCABABCCBCCABABBCABCBABBABCBBCCBBBABACCBBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCACACCBAAACCCBACAAABBCCACABBCBBCAAABCBAAAAABCCCACBBAC.exe"	2026-08-14_dc69253c59fefdeb1ff95ccb154aef4a_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCAACACABCCCBABCABCABCBBBCCBBABCABBBCBCACCAAABACBAAABCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBCBBAABBAACABBCCCCACBCABCACBCBCABABACCABBAAABABACAACB.exe"	svchost_BCCACACCBAAACCCBACAAABBCCACABBCBBCAAABCBAAAAABCCCACBBAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1552	sc.exe
3224	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5748	cmd.exe
2064	cmd.exe
2540	cmd.exe
6000	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBCBBAABBAACABBCCCCACBCABCACBCBCABABACCABBAAABABACAACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCACACCBAAACCCBACAAABBCCACABBCBBCAAABCBAAAAABCCCACBBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_dc69253c59fefdeb1ff95ccb154aef4a_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5732	schtasks.exe
5228	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5392	2026-08-14_dc69253c59fefdeb1ff95ccb154aef4a_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
5392	2026-08-14_dc69253c59fefdeb1ff95ccb154aef4a_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
5392	2026-08-14_dc69253c59fefdeb1ff95ccb154aef4a_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
5392	2026-08-14_dc69253c59fefdeb1ff95ccb154aef4a_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
3168	svchost_BCCACACCBAAACCCBACAAABBCCACABBCBBCAAABCBAAAAABCCCACBBAC.exe
3168	svchost_BCCACACCBAAACCCBACAAABBCCACABBCBBCAAABCBAAAAABCCCACBBAC.exe
3168	svchost_BCCACACCBAAACCCBACAAABBCCACABBCBBCAAABCBAAAAABCCCACBBAC.exe
3168	svchost_BCCACACCBAAACCCBACAAABBCCACABBCBBCAAABCBAAAAABCCCACBBAC.exe
3924	svchost_BCBCBBAABBAACABBCCCCACBCABCACBCBCABABACCABBAAABABACAACB.exe
3924	svchost_BCBCBBAABBAACABBCCCCACBCABCACBCBCABABACCABBAAABABACAACB.exe
3408	svchost_BCCACACCBAAACCCBACAAABBCCACABBCBBCAAABCBAAAAABCCCACBBAC.exe
3408	svchost_BCCACACCBAAACCCBACAAABBCCACABBCBBCAAABCBAAAAABCCCACBBAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5392	2026-08-14_dc69253c59fefdeb1ff95ccb154aef4a_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Token: SeDebugPrivilege	3168	svchost_BCCACACCBAAACCCBACAAABBCCACABBCBBCAAABCBAAAAABCCCACBBAC.exe
Token: SeDebugPrivilege	3924	svchost_BCBCBBAABBAACABBCCCCACBCABCACBCBCABABACCABBAAABABACAACB.exe
Token: SeDebugPrivilege	3408	svchost_BCCACACCBAAACCCBACAAABBCCACABBCBBCAAABCBAAAAABCCCACBBAC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5392 wrote to memory of 5748	5392	2026-08-14_dc69253c59fefdeb1ff95ccb154aef4a_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	91
PID 5748 wrote to memory of 5732	5748	cmd.exe	93
PID 3168 wrote to memory of 1044	3168	svchost_BCCACACCBAAACCCBACAAABBCCACABBCBBCAAABCBAAAAABCCCACBBAC.exe	94
PID 5392 wrote to memory of 2064	5392	2026-08-14_dc69253c59fefdeb1ff95ccb154aef4a_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	97
PID 2064 wrote to memory of 1552	2064	cmd.exe	99
PID 5392 wrote to memory of 2540	5392	2026-08-14_dc69253c59fefdeb1ff95ccb154aef4a_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	100
PID 2540 wrote to memory of 3224	2540	cmd.exe	102
PID 3168 wrote to memory of 6000	3168	svchost_BCCACACCBAAACCCBACAAABBCCACABBCBBCAAABCBAAAAABCCCACBBAC.exe	105
PID 6000 wrote to memory of 5228	6000	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-14_dc69253c59fefdeb1ff95ccb154aef4a_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_dc69253c59fefdeb1ff95ccb154aef4a_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBCAACBACBBACACBBBCABCBACBCABCAACBBBBACBBCCACCBBBCABBAABCCCCBCAABBBAABBBABABCCCABAACACBCAABABBAABBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACACCBAAACCCBACAAABBCCACABBCBBCAAABCBAAAAABCCCACBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5748
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBCAACBACBBACACBBBCABCBACBCABCAACBBBBACBBCCACCBBBCABBAABCCCCBCAABBBAABBBABABCCCABAACACBCAABABBAABBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACACCBAAACCCBACAAABBCCACABBCBBCAAABCBAAAAABCCCACBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAABCCBBBACBBABBBCABBBAABCACACBCACABACCCBCCAABCBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACACCBAAACCCBACAAABBCCACABBCBBCAAABCBAAAAABCCCACBBAC.exe" start= auto displayName= "UserDataSvc_CAABCCBBBACBBABBBCABBBAABCACACBCACABACCCBCCAABCBAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAABCCBBBACBBABBBCABBBAABCACACBCACABACCCBCCAABCBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACACCBAAACCCBACAAABBCCACABBCBBCAAABCBAAAAABCCCACBBAC.exe" start= auto displayName= "UserDataSvc_CAABCCBBBACBBABBBCABBBAABCACACBCACABACCCBCCAABCBAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAABCCBBBACBBABBBCABBBAABCACACBCACABACCCBCCAABCBAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAABCCBBBACBBABBBCABBBAABCACACBCACABACCCBCCAABCBAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3224

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACACCBAAACCCBACAAABBCCACABBCBBCAAABCBAAAAABCCCACBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACACCBAAACCCBACAAABBCCACABBCBBCAAABCBAAAAABCCCACBBAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCCCACCBABCBBCACCBACBBAACABCCCAAAAABCBBBBCBABBABCAACCBBBCBCACAACBAABABCCABACBAABBCAAAABBACCCACBAACABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBBAABBAACABBCCCCACBCABCACBCBCABABACCABBAAABABACAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6000
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCCCACCBABCBBCACCBACBBAACABCCCAAAAABCBBBBCBABBABCAACCBBBCBCACAACBAABABCCABACBAABBCAAAABBACCCACBAACABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBBAABBAACABBCCCCACBCABCACBCBCABABACCABBAAABABACAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5228

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBBAABBAACABBCCCCACBCABCACBCBCABABACCABBAAABABACAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBBAABBAACABBCCCCACBCABCACBCBCABABACCABBAAABABACAACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3924

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACACCBAAACCCBACAAABBCCACABBCBBCAAABCBAAAAABCCCACBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACACCBAAACCCBACAAABBCCACABBCBBCAAABCBAAAAABCCCACBBAC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 a0b47b32a90d04853f1ee401089814e82907d70379d045a8f0bb55daf814bd3b
MD5 83dc1354723a92b9cddab903e855739c
SHA1 5918c56e6b5fef1a5af0fc7e0591f1709cf4cd40
SHA512 c3df238f8a87948df8be19bc8942b4bf6118af3f9147a3914e1aa5926c505872258229e7536bc651c8cd23999c457d9a31eb7d78681846ff3040f463d22eff1d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 b67b046acd8f6905aea9deac8791cf9202ddb3b3b542fe705241525776a3b5c0
MD5 a2e9e15f1524d856bfe94234d4265e61
SHA1 f06086cd274eb5139824cdf30112516e70ab24c3
SHA512 e0f492b9f3b879449c2b372720b5ed2a455648854bb27c4f5881e3e287c9afeee2677add94d6f7f432e82380fd7cad4d70458bd27d92846fb68a30be39bc711a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\Setup\qap`g`v~dtlq
Size 10B
SHA256 69360d648df5dedb0867baafb9df7a5eef986a54e87f0e4e797f14f6f0b289f9
MD5 01868b8a5a792b7f3fd5dde67ea1856b
SHA1 43a407c1d27497a9f64ede480b573e2acbecb00f
SHA512 11ecd3cd82578175aab48228a0f8e1adb0767e90363c226f09a60de1879a660fd32bd4c20aaab15c928f2bcfb9207ba756567d0ce9ebdd8b793c13c096135aa8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 86340e6425eb35dac07e7c9b74db66055dcc6990a721912fe6c29a416ebef022
MD5 c833a720579e872bc839eb24e671d7f5
SHA1 a5103a65e7b652f3afdccbfe7c3c904de67928a5
SHA512 171bfb8099edcfbfce76dd883c9a89d7c74c5ecda199e5b54bdf7d0c48c8d57985b3b9a10cb6724c9f87c004f4ac0e868630cc4dcca4d4c2ef4e4e704af67f9a
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 8.0MB
SHA256 f66d67dd1a51f1dcb9d3945a3618394d1fc6dcd442fb8c3fe4d531c05729afe1
MD5 7a6c526b8e5379979020c5d239e96cb3
SHA1 105c1c8796bbdbae214e8b5b1e2d66e8ddb5bedb
SHA512 1a8a5dfcffe941b4ae2e6eae4d3d11c674f5eac4006ef7504df4b288e70e223b0f191525981daa35ab0457bc469f5653cd57114f57ce476564541901f2568ba6
SSDEEP 98304:hOU/jIEeQfoR/IuOFVjUu55gZ2Hb9t+2xb:hFIF0wuXgZ2jb
TLSH
T15C868D02F98640B1E57711704DABC27A8A35BA6187318DEFF6CC961F6F32BD09935B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 39f2600357779c2794cc78fc3f1752e7cb7b4cee79a942fcde7ed069065ec6e3
MD5 5c882f646ed09599e899d4a4af714e90
SHA1 bafa248769e91cdb4dbbed23145f68a93ccc4c30
SHA512 7b3e7799564ace00d4cb553bc0e318d4ac58ee57ae973fe5ef8faf528020572cb54fd17473c26de377c6026618903e60f5d5a6686d6acfab8dab05ad96936369
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\qap`g`v~dtlq
Size 10B
SHA256 aba73439ade9f023f5f925736481f69ffe9c9ea9ed17df9c809c761152a006d6
MD5 ac8b5b3db952d2f0de043637b69833fc
SHA1 efed484d5f19538598e8ecf08453990652ced42c
SHA512 67a70ca58f9d2c65f4ebe137299948b15c617b9a2cdc9eb832a97a9cda138df7c6e2d00c0015b35d4f5712c2a2300110fa9c4473f2a2964d1e4f87c9bf54be37
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 a5a6dcb2a4021ac59bb6aa09e37e77f17c2dc98eb09e6f4784f3bd9d988bbae2
MD5 cd93f3f2f05184f70f00a212a99380ca
SHA1 74f4316281ef7a7696b89ed22c735f013b1cd04b
SHA512 8764985135be529daf032183c905ff0052095743885e2731f6da57d35510caaa89b1cb8743b1c5311cdfdbc5e0d9a940d69e4c5a5be6104556adc70a7b27121d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\qap`g`v~dtlq
Size 10B
SHA256 0a4f2a6ff920f69be23c643b0962c2c950b6928383beadf1765cdeb37ba8ab6b
MD5 1ec448c462e2250a711a3f31061eae7f
SHA1 3a6da671d2a3b146b834bdcb32668ae30729df07
SHA512 42a8f357fef26068f9bcafad0ffd06ceeaf4a011324b01e9cfe74bdd368fc3fa37805f9b57b6339ed68f58bfc492b7f9fe04ac37009613b7c017c4f3add2ed4c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fcbf5689fbb350a108182634821f3b7229e98f1f528bdfc37c364e91928d6831
MD5 a33c495e3e496f64cc86248d6c698e53
SHA1 6e594655433769f0c31f401c9f710b24d1b8be05
SHA512 a10692337acc2cb4aa30dcc332f39eeb3fbd48c38abf839d3da525686b4072e68fa00b5967e8041cb03b24a0e8e9056d6a87624c47f43aa76526bd9c33ffa9da
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 26a23b045ca39ba3ae873d29d04a64d6e2c1e004a4150dc5452f90fa2ad64fd4
MD5 a6fbe5b7e05fe48f9af7116a17990b69
SHA1 cbabcce253439d76b6a0b99e66473442cac7119a
SHA512 116b34ff017f156b1e82f861c73750bb3e74f7b5a79ddd067ad6fa891240c6e84f6f632c1feeab91ebb8d00986fcef54205268a4c4dc4eb2b94062ae4c23f0a7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9981ba1b0b366ed9644695c9ffabb28693749f398e763587d6dfd839bc5f41e1
MD5 187a79f4fe32aeecca76fb2bf36fa405
SHA1 7af6a6ffaf64463fe242301534f73aaa792669bc
SHA512 7b3e2f3437ba134ba7e2dcc4b89bda8e632aa1af85a3376510d0fba1186780142c2e8e8e11658af4e7a4aabc7d4aeb7f7660c3476da6f35307d297b21e9e149d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b37784454e8bb4dd6c25fbf4cfe5db2945003d019d8fae54e3e1f22832e63def
MD5 14053971fe07af0119c73e5a4626a09e
SHA1 145eb559afe6db1320a55a6c5f02fea2632c800a
SHA512 423f4b98af5146563214b3eb832250d4ac1343fd717334ae651f227261f6c358cf17238362b9de5e60683114ec5b9e87cb6aaad86ad5111a924d24f30ce89771
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 71991f2590fe8b7fbfa3e12407db0f96161fb7da5c12a235f9f7d02437b9d913
MD5 c9c8d5b33b9bc9f428aa99fd937603b4
SHA1 34d9119b5b8075aa5ff27bf5e189f011837ca5dc
SHA512 183656c7eeb7468af470336905050d09b2e35d3cdce087560e91fd468377ae151ea212455665773526183a09f29d7eeab1778936847ff33d9a9b4e6b06e6eb0d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e2e8917d3d10c18b3194356e2960fb4a206ba4979b7d881b6b70e8baf9aa52c5
MD5 d19f43c61ef4f0d336eaf75ffa3860cc
SHA1 ef1ab9712d3badff1a8c3564a92dd2a6c83325c0
SHA512 85ab7b531895d90525ba3b8baadba51eb02dce6e84b60dbf8d831ef83122611f17f2c191c0ee64bd6cdaadc589b3771e03e041bdcc93b4feb2d2ad026f369478
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dd68ebb17e852ec2f5caf5a30ec7ce4e6e19b84cae68ed45e03e821f47a1b550
MD5 f2cac83ad25321f70b8c5620d44a45c7
SHA1 f561d7061bafa27e46c16e7ca2df7ff560121fb1
SHA512 e1dc1e8475706d30af45d79dd429b9b79f2b9e546cea0ce6fc4f84dca5847f500b32f52a1bc8b949b147c731afb5a3e1c2dbf29882740e03b3cfd1dbb9426d6c
MD5 SHA1 SHA512

Submit Download

svchost_BCCACACCBAAACCCBACAAABBCCACABBCBBCAAABCBAAAAABCCCACBBAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACACCBAAACCCBACAAABBCCACABBCBBCAAABCBAAAAABCCCACBBAC.exe
Size 7.4MB
SHA256 d546ecf4925eb5c70d245712b106e9d79f28a93b8c07d9f342f62bbe45a8819c
MD5 dc69253c59fefdeb1ff95ccb154aef4a
SHA1 9353c1d4d00a9263f01950124807a8bc6e510503
SHA512 c3f7e96afc710e386ded2fc143c6260e3758d14d627d18dd6b6fbc14cfc30edd3a95078bafb716bd6d05dfec260c9e60ced5cbfc12713f5a98f593dfe7ac27e6
SSDEEP 49152:U+ES+ES+ES+EWLhq+ES+ES+ES+EWLhq+ES+ES+ES+EWLhq+ES+ES+ES+EWLhq+ET:hOU/jIEeQfoR/IuOFVjUu52
TLSH
T15B767C02F98640B1E57711704DEBC27A8A31BA6187328DEFF68C961F5F32BD09935B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 f58b3c9300501010b927f6ebd91833907886bb0e873707ebef55d906652d6e5c
MD5 452271f6d31719d2d46993f06d251f48
SHA1 1df78a49a2e87645d0927120f6b382f41a0dcdf5
SHA512 6e93ed62dc00a05349c56f21b24ad0cd73b12fb343739aeabe57b5de150c8acd5893c9ac4ee8c2eff052da518dd32cc32189d10ff8ab217f97b429c5271a74b6
TLSH
T11A21B951B8E5C493E92364C79A1ADBD31CB4B7AF989C5E1523088229FBD5C33CE158E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 1f803e67c2ddaf21f06bd88b0191a3408bc2e63290b98eb2d9daaff220d9b6ff
MD5 85f3bcb069f365399b0b996eee91b76e
SHA1 a45ba12866fbc855c19885108c80acfefffbe960
SHA512 1a1cf11546063b17b53338555be1b72597ea08cd5d9a15c0e457eb8ae20433d9118429bbf0d2aeeba7428c2e03412db55d6fd7985870bd8fa0dd6ec4f558d782
TLSH
T10811EB50A8E5D453E9236487EA1A8BD31CB4B7EBA8986E2523044129FBC5C33CE154F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 a4bd4258bad83f59426697b7c0562a5776464d516d2bccba560108d6beb06099
MD5 40614e6183b8dcf8be4feb6f0d5569b9
SHA1 7cf789c2faa18f89c1bfbc8fbe258ba7b8d68345
SHA512 1c2a4936ed51fbfc9386b8cd5c5db7026a398cfc14c135f974eadaf054702cb6f252e6f28f0e64e9928c1e24c213aeeb5f18156a38fee6105cf0d4289187364d
TLSH
T13B210E50A8E5D493E9236887E61EDBD31CB4B7DBA8986E2523088129FFC5C33CE154E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3168-33-0x0000000000040000-0x0000000000061000-memory.dmp

Download

memory/3408-912-0x0000000000040000-0x0000000000061000-memory.dmp

Download

memory/3924-77-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/5392-6-0x0000000000750000-0x0000000000771000-memory.dmp

Download