4518a6bd5246602b45e0ba53c9676a603aeb9abccc9de90ef023c97fcbc98cb0

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_98264db0185ff98e3bfe4123b08ea6af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Size 20.5MB
Sample260814-eam9cstxhs
SHA256 4518a6bd5246602b45e0ba53c9676a603aeb9abccc9de90ef023c97fcbc98cb0
MD5 98264db0185ff98e3bfe4123b08ea6af
SHA1 c75cf61e8c2f70403006035bdaed549e368d493e
SHA512 c4e1225667c5cbf5419e695daa7117dfb07eff670d6d3f0afabfd61a0607c5f7fec2866470508eb6a35c4d16f03812e335aa5dd50ecfef5c259d45ea0db52f5c
SSDEEP 98304:KKRuy5a1KRuy5a1KRuy5a1KRuy5a1KRuy5a1KRuy5a1KRuy5a1KRuy5aoOU/jIEB:KqKqKqKqKqKqKqKqpFIF0wux
TLSH
T1A0278F02F9834071E97721B00DDFE3BF49757B2186318DEBF74C8A2B6A32B91552875A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCCACCCABCCBCCACCACBAACCABBBBAABCBACAABBACACAAABCBACCBB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCCACCCABCCBCCACCACBAACCABBBBAABCBACAABBACACAAABCBACCBB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCCACCCABCCBCCACCACBAACCABBBBAABCBACAABBACACAAABCBACCBB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCCACCCABCCBCCACCACBAACCABBBBAABCBACAABBACACAAABCBACCBB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1364	svchost_BCCACCCABCCBCCACCACBAACCABBBBAABCBACAABBACACAAABCBACCBB.exe
4684	svchost_CBACCABABCBBBCCACCACCCABAACAACABBABABBCCBBBABABCCAABBCC.exe
6864	svchost_BCCACCCABCCBCCACCACBAACCABBBBAABCBACAABBACACAAABCBACCBB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCACCCACBACACBABCAAAACACBBACACCAAAABBABBBACACBABCCABBABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCACCCABCCBCCACCACBAACCABBBBAABCBACAABBACACAAABCBACCBB.exe"	2026-08-14_98264db0185ff98e3bfe4123b08ea6af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACCCABACABABCCBBABBBBCAAACACBABCABCBBACCABBBBBBCBCCBBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBACCABABCBBBCCACCACCCABAACAACABBABABBCCBBBABABCCAABBCC.exe"	svchost_BCCACCCABCCBCCACCACBAACCABBBBAABCBACAABBACACAAABCBACCBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6732	sc.exe
964	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2448	cmd.exe
3680	cmd.exe
1180	cmd.exe
4716	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_98264db0185ff98e3bfe4123b08ea6af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBACCABABCBBBCCACCACCCABAACAACABBABABBCCBBBABABCCAABBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCACCCABCCBCCACCACBAACCABBBBAABCBACAABBACACAAABCBACCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1944	schtasks.exe
2760	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4088	2026-08-14_98264db0185ff98e3bfe4123b08ea6af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
4088	2026-08-14_98264db0185ff98e3bfe4123b08ea6af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
4088	2026-08-14_98264db0185ff98e3bfe4123b08ea6af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
4088	2026-08-14_98264db0185ff98e3bfe4123b08ea6af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
1364	svchost_BCCACCCABCCBCCACCACBAACCABBBBAABCBACAABBACACAAABCBACCBB.exe
1364	svchost_BCCACCCABCCBCCACCACBAACCABBBBAABCBACAABBACACAAABCBACCBB.exe
1364	svchost_BCCACCCABCCBCCACCACBAACCABBBBAABCBACAABBACACAAABCBACCBB.exe
1364	svchost_BCCACCCABCCBCCACCACBAACCABBBBAABCBACAABBACACAAABCBACCBB.exe
6864	svchost_BCCACCCABCCBCCACCACBAACCABBBBAABCBACAABBACACAAABCBACCBB.exe
6864	svchost_BCCACCCABCCBCCACCACBAACCABBBBAABCBACAABBACACAAABCBACCBB.exe
4684	svchost_CBACCABABCBBBCCACCACCCABAACAACABBABABBCCBBBABABCCAABBCC.exe
4684	svchost_CBACCABABCBBBCCACCACCCABAACAACABBABABBCCBBBABABCCAABBCC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4088	2026-08-14_98264db0185ff98e3bfe4123b08ea6af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Token: SeDebugPrivilege	1364	svchost_BCCACCCABCCBCCACCACBAACCABBBBAABCBACAABBACACAAABCBACCBB.exe
Token: SeDebugPrivilege	6864	svchost_BCCACCCABCCBCCACCACBAACCABBBBAABCBACAABBACACAAABCBACCBB.exe
Token: SeDebugPrivilege	4684	svchost_CBACCABABCBBBCCACCACCCABAACAACABBABABBCCBBBABABCCAABBCC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 3680	4088	2026-08-14_98264db0185ff98e3bfe4123b08ea6af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	93
PID 3680 wrote to memory of 1944	3680	cmd.exe	95
PID 1364 wrote to memory of 2600	1364	svchost_BCCACCCABCCBCCACCACBAACCABBBBAABCBACAABBACACAAABCBACCBB.exe	96
PID 4088 wrote to memory of 1180	4088	2026-08-14_98264db0185ff98e3bfe4123b08ea6af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	99
PID 1180 wrote to memory of 6732	1180	cmd.exe	101
PID 4088 wrote to memory of 4716	4088	2026-08-14_98264db0185ff98e3bfe4123b08ea6af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	102
PID 4716 wrote to memory of 964	4716	cmd.exe	104
PID 1364 wrote to memory of 2448	1364	svchost_BCCACCCABCCBCCACCACBAACCABBBBAABCBACAABBACACAAABCBACCBB.exe	107
PID 2448 wrote to memory of 2760	2448	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-14_98264db0185ff98e3bfe4123b08ea6af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_98264db0185ff98e3bfe4123b08ea6af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBCCABCABABCABACBCCCACCCABCCBCBACABCACCCBCCCCBACBBACACBCAACACCAACACCBACBBCBAABAAAABBAACBABABBBCABBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCCABCCBCCACCACBAACCABBBBAABCBACAABBACACAAABCBACCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBCCABCABABCABACBCCCACCCABCCBCBACABCACCCBCCCCBACBBACACBCAACACCAACACCBACBBCBAABAAAABBAACBABABBBCABBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCCABCCBCCACCACBAACCABBBBAABCBACAABBACACAAABCBACCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCAABABBACABAACABACCCABBABACBACABABAABCCBAAAACCBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCCABCCBCCACCACBAACCABBBBAABCBACAABBACACAAABCBACCBB.exe" start= auto displayName= "UserDataSvc_BCCAABABBACABAACABACCCABBABACBACABABAABCCBAAAACCBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCAABABBACABAACABACCCABBABACBACABABAABCCBAAAACCBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCCABCCBCCACCACBAACCABBBBAABCBACAABBACACAAABCBACCBB.exe" start= auto displayName= "UserDataSvc_BCCAABABBACABAACABACCCABBABACBACABABAABCCBAAAACCBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCAABABBACABAACABACCCABBABACBACABABAABCCBAAAACCBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCAABABBACABAACABACCCABBABACBACABABAABCCBAAAACCBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:964

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCCABCCBCCACCACBAACCABBBBAABCBACAABBACACAAABCBACCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCCABCCBCCACCACBAACCABBBBAABCBACAABBACACAAABCBACCBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAACACACCBBBCCBBACCCCABACBCACBAAAAABABCACAAABBCCCAABBABCBCCBCAAACBBBAABAABACCBBACBCCBBCBABAABBCCBBBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCABABCBBBCCACCACCCABAACAACABBABABBCCBBBABABCCAABBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAACACACCBBBCCBBACCCCABACBCACBAAAAABABCACAAABBCCCAABBABCBCCBCAAACBBBAABAABACCBBACBCCBBCBABAABBCCBBBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCABABCBBBCCACCACCCABAACAACABBABABBCCBBBABABCCAABBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2760

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCABABCBBBCCACCACCCABAACAACABBABABBCCBBBABABCCAABBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCABABCBBBCCACCACCCABAACAACABBABABBCCBBBABABCCAABBCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4684

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCCABCCBCCACCACBAACCABBBBAABCBACAABBACACAAABCBACCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCCABCCBCCACCACBAACCABBBBAABCBACAABBACACAAABCBACCBB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 707bbf1881e265093af587e3ef3b6c8b702b29595c4491049cd140cb01a578a6
MD5 bc179d5d8a071a09b25f1bc4a29647c3
SHA1 26c3a5c035d7dd44802a7dd6cb0df9a320fef369
SHA512 efbca0ba702ad92bc8f27ad6909acd8c70e907e4086fdf12bcc95310294c6011e64945c67cac1b246e6d7d402c038234607c6ae47c935e417a280b2857cae707
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 73682eaa8585a7e2d8dfb9d4f9d011be52ec1f6e22f35a9ae1f2108dd0de74e6
MD5 1a3b517f68f0cedc184149a7d8a9d719
SHA1 10ccb30fa1c7c1dec93fcb553d725c6af9a13d05
SHA512 4e1a00751871c7f50bd4429b2c0d9390fb3eac0d32c3c25cc5f5b95c3a4fa63cff96291b78a317077b64252cd5ca9deffadc23a57193a79460fd97dc4d40de57
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.XGpuEjectDialog_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 fb2b45aacbd7d357fe137d9bd91671627cd863ef4db9c86ba71fcf5e4b71bc88
MD5 ca6d7cc0676cd4a3832ed5366e248a45
SHA1 4fd093cdef4b00a854a2353b8a4c2a8951c5cca8
SHA512 237154fb6a96ac4231883d96cd01cccd0cd8be290361279fab62d149ce38de61f5ce396f3264dcae6ad23627bc49e31b9fc315dbdd5dad555d8e80610b53349d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 30c1f7938569fbd94efae963f093b4dca049271717f65fa4a10a39d12c72eb43
MD5 dbb08a6c5fd9f4577a82306367973c97
SHA1 fcd36aacfb173bc860829113b9d7543533a74be3
SHA512 824842e4a85c30714c8df3d7aa5ef02fa5af4bfb6fc202e1df520bb2cd466b8b8296cb6fdd24ab0b8d9411b31f1239563bb82226f719b93cd683702ecd16961c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 08e2644c60d0e2cd4eff9801bd7f2446c522221ade9d43b153af7d83c870e3fc
MD5 962468e98738ed554182ea11b72a25eb
SHA1 84f0396aab82dafefd4c5d73943116c67d6ded00
SHA512 9ee5021d21872e6f76894ac7a7dd71b08676aceba0e7f8c8c1628ca6265b838400bd79a9075ef4bdf6b87e7d2f7c2613bab7115fab2ec7d944627ba36590a1c6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 c58264db6c796d153457f626a59ddb397a24313bb62267e5ba19f3e9ed1a9f2d
MD5 4f058ae23bc8ad50ae504b747c4ca27f
SHA1 10d1a4f6703d8ce925d25339b01ea0be1d5b5cc9
SHA512 a1e5458f0899e72b57db4ec11159825086cce2338ccf743683ecdfffca6ec48a476e648dd1640fc2cafaac8271f3cb3670780b2af2b4520328ea9bfb39484553
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 e91f144d8a266490dac5d18f260f11c47bf260d171ba6a285ae5e13afd54f88c
MD5 a77827054320c3a9ba29bc94fc565c71
SHA1 517a6d3cb7817e5b5b90b2d79433bdcb8a844bfb
SHA512 e423c59c5be0e4a952af0a4ed6a2f6d54895dad0ad07fa63716d0adca58cc97b9ab83c1ad873c34272442d9241d53ca4ce5219bca6e2edfb822cd2c2d7cdf9f8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\qap`g`v~dtlq
Size 10B
SHA256 43175558a716b2e1aa984f444eee0eb02002f8918fb4acffa16e6af1988c3650
MD5 9851c7f90a138f0e88703573b1b13ff8
SHA1 5dc20997298600140e4fb099b493f4b5b67f2954
SHA512 449adb4982113ad824df6187250b857b75521cd4ec1ff121f8f1170f58b9ec57221dbce19fda2fac3ff67bf9d053b1ed95fd2a09d91fcae2a70be13b74cf50f2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 f9438f50d17b448c15d9030f29e77149db8add09509b212a4ad7378720363fc7
MD5 0c79d1062c815ac6844a1d4263908d80
SHA1 e24397e064bae72852d2a6398b2d70929b3e9adf
SHA512 a974940496ac3685571efcb98117e234f3784de8ddba6f720e9be232fcf613399359308d462b18bb1289d7f1e4a9a0e0821f30929eb6665a70a2756d7e6585b3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\AC\INetCookies\qap`g`v~dtlq
Size 10B
SHA256 6584f87aa3f602b4297416078513efc2d4d86b9128ce26034c2930a9fc33b7b0
MD5 f8106cafe775e5e30ab75b08ccc85ecc
SHA1 5ab5960b8763847219ef987c0964f7cafcfadb62
SHA512 d175bdd1358d2b2e39f763ecac63622cd70e1909192630dce788690e305e5572cbc843c6c8532245c407c2dcce260cad0be78b310602cf41a50d3949d5a558e5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\qap`g`v~dtlq
Size 10B
SHA256 298d482b9ccfa3abd13075f9acc6d464c376c23283d38596a7ba0017f741a478
MD5 8d0670f951ee2372f4ad21251f40788f
SHA1 dd829346a568c9d38edf0a33a0e13e383590cf0b
SHA512 a470ce8a84c2f6b46ce79e44c5f0331eb7caa0aeef2b9dc66ae20c09eeeb3e3f69611035fa3845f6e9e9c2a490907dcf894e26cb17a77ef3c842bf93efe5e1f8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c3631c49152676cb1b8bed1f7a75303b6fc43f07483b1a59c4d9c2d11a3b5027
MD5 82d809f2f97711fd886fc6d534ac930e
SHA1 22bbbbcb1ea53012d58fce8842d47a0073891e61
SHA512 d3d58feea0590cee4708051c50434f5549cd7fdf8b8200689576943287e216dbda899324fc70c4e77ae56f0dd89edd1979e3bab691632bc66eb4cb7c85b7dd27
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6b99cda3edbc091710268278a98ae7dc9edfffad732089d917fff5e36b9a26ec
MD5 dd8de4068d5aabf7f7d08f179438560c
SHA1 ace7854cc6495e5570bbac60436612694663e63d
SHA512 bc9c84a4372b10a49bbf1dc1edb25dca258ec6100ceebe6a650e29097f8c17b02016bc85d8ccd0adee99f1db5fdeb343589891c3539a81462d1c19520c18a1c7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 10e992275cb57a90728da8238ad1657621f00bcebc3edb11e8f44eedbc19f5e2
MD5 7d0e4a1500cb1b45aa053c940a32669b
SHA1 23502b1d8a8cc092ecacf2a69f40e1faa3c8d828
SHA512 90cb58dde116b46e91d19a3917b7e3a0c1d13dd0c4c35939f40fd29d1cadd3e387898d5f3628ace76fd31776a2472e36b2e03a739f39a1a7ffa953a38eddc1c5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3e01ccbd13192106d63faffd305cd9902c412353a1e97dfe99ca49eb9468eec7
MD5 9943688a849b81dab3f42fccb918ed3d
SHA1 669180a35468070a73b321c186d72f271fc9c612
SHA512 15c99267f1e623dbd2a138685039329edf73616ee637bb4a6d5449d8be1b3d1d320f9a465b27c6abcd8c0f2086e73927cf90c651b414f87ebde1834fee21f154
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 37e338fd56614e1ca6ef22d4a2f2671b6dba6779d5fa7953ff3eeccb8b9a8037
MD5 a31da8986d634d2ed60576ff8d27218f
SHA1 5f18583c5e7588a04dfc923e53dbac9f7d3409d7
SHA512 6dd90d36935793276d512f605a944be764c3c2d47e1c8688f8fa2b4428d1760b7a46f1bdcb8110ef013be02a9bdb90e7b32f203ceea605e756d47eede0a0fa7b
MD5 SHA1 SHA512

Submit Download

InstallGet.exe

Path C:\Users\Admin\Downloads\InstallGet.exe
Size 2.3MB
SHA256 c4770a97c3c55ba6e40b4564b448e0c1e0e71ec74cb9b10485583db9abde9b3e
MD5 211762d98b13312fd68ddbb6c9ad24de
SHA1 a546145dafdfa1275262d01bd8243f8c4b35086f
SHA512 635df1e6bb16a121db27b4df2839cfdb7d71e1270b966e6840ef4200bb86e3a2a6b1b01d495816b9addec97953164b35760e233fbf029ec93aad1f046c8917f0
SSDEEP 49152:U+ES+ESm+ES+ESgq+ESm+ES+ESm+ES+ESm+ES+ESg2LgVLKRWTQ6Zs5DhgP9H:KKRuy5ax
TLSH
T1A5B58F06F98340B1D97B24B00DDFE3BF49757B2186218DABE74C8B2B6933F91552835A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d7ea63457592370d3d653ae8ec427946fd36979a5a85eed636b953676fd95728
MD5 ff5e613762f776cf8dbdb1b9879bb7d0
SHA1 08325178ee522e254a6a63e31dbad32a006553d6
SHA512 5225639fab8b262daa5a4108f229df189995944181b843d66db91ba592da6c6b7dfe115b8a59594e69bea9c4284e9fe1c4da40b37c4ca5a90ef33d5f55acf31e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 785fbd31a9747d3f3ee6b90c31cb6634b96edaddc0ec439f2a8bfdf574017037
MD5 f2ba8ed44034f2fa80d5301af7053beb
SHA1 07532b2b26ad0b8d3cde7df02dafaffa6cb13a24
SHA512 6597ff58e350a230a09969f2d264d53761bb2ae0632d1c49705fd48651a14bbc366659a6e380dd80f860240552f094a886851bb340f0479b38df39ac914e9f8a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Music\qap`g`v~dtlq
Size 10B
SHA256 cf30e300fca2d929a871e0a8ccd1451dffcec0cebc86f2c19c2244f474de63c0
MD5 6ab20e25f722c755d6108bee7294a4c2
SHA1 6275e0cbc26760dae0e6e2f9571709bfa29a0400
SHA512 f15300bc14a44443fe68a8ffc58a292340c4465b597d3f8d6bc1bbd5135d2c2b0bcf41d59a5b952f56bda2f8e35d8197bb0659813afab0282bb009fc30c20da1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Music\qap`g`v~dtlq
Size 10B
SHA256 b65a1b445dd885aff8cd060c9754e4a7a9ba3a03dc9002d121c3da3fd56e05f2
MD5 b49f5f331218b55a47437769cccf59df
SHA1 7a73ef5116aea8fb41e654f8dcf184221557735e
SHA512 9a810e2fce271f179e5d770fa7eb47deaba61e0fe449a72df7a220a221e4d6e9761b445b8115e8a6ab7724dac7e3a5d97d0ee592b32bac184f44e1e6e44d81c4
MD5 SHA1 SHA512

Submit Download

svchost_BCCACCCABCCBCCACCACBAACCABBBBAABCBACAABBACACAAABCBACCBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCCABCCBCCACCACBAACCABBBBAABCBACAABBACACAAABCBACCBB.exe
Size 20.5MB
SHA256 4518a6bd5246602b45e0ba53c9676a603aeb9abccc9de90ef023c97fcbc98cb0
MD5 98264db0185ff98e3bfe4123b08ea6af
SHA1 c75cf61e8c2f70403006035bdaed549e368d493e
SHA512 c4e1225667c5cbf5419e695daa7117dfb07eff670d6d3f0afabfd61a0607c5f7fec2866470508eb6a35c4d16f03812e335aa5dd50ecfef5c259d45ea0db52f5c
SSDEEP 98304:KKRuy5a1KRuy5a1KRuy5a1KRuy5a1KRuy5a1KRuy5a1KRuy5a1KRuy5aoOU/jIEB:KqKqKqKqKqKqKqKqpFIF0wux
TLSH
T1A0278F02F9834071E97721B00DDFE3BF49757B2186318DEBF74C8A2B6A32B91552875A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 0f62cd6a94687e55a83ca7e48e801a0728b5d3c2881137e35605109063392908
MD5 1535029b73ab4fe87c189b5405e67586
SHA1 2ab977f001523b1d5113802a837357c29101e30e
SHA512 c10d951002a85bd0450fe719e8e8168a8643451a32bbd25194b2cc750549f69a720df280215adddb90d200f6ee46aa3a7a3767647928b067ff6abf5982378dd6
TLSH
T13E21FC60C4D5DC73E932685E962EDBC208B47BAB9C586A61230945287FD9C33CD194D6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 fba4522febe213808048954cc4c284ac3c194551056afbc3e3a9b0c92db257cf
MD5 7c14f9bad2d46e8b1deaa469a997a773
SHA1 a3ee6df3e00a363cada27a78b20d8701001a102e
SHA512 9291498648ddc4bb4ef05f219ee2fac7252a005cf465cfa443b365906a64434e6f2c39db45bcf03329616b9a1dac14cec8ac3c7d3e64ba9b8f5bb57a0cc969d7
TLSH
T13721EA21D4D5CC73E93268DE962EDBC208B47BAF9C9C6A51230986287FD9C33CD094E5
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 2929996af16d58587df04e28cfe22c7a904b5fe85f39c30a50e41c38dcb66113
MD5 899a66910e41dbbd930dfef3e8aa3d62
SHA1 5a14332281b66fc528a64cee80607ab1fc86f978
SHA512 16c775964bf76a5d1777fdf349425cf597bec8a8d4a65c686563636ecd3521694c9621555adce6c33d01a4782bc9d44d27fe58c5fd664a73b5d69e15b4e27cb0
TLSH
T1D7112B10C4E5D873E932685E962EDFC208B47BAF9C586A21230D422C7FD9C73CD194E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1364-85-0x0000000000990000-0x00000000009B1000-memory.dmp

Download

memory/1364-46-0x0000000000990000-0x00000000009B1000-memory.dmp

Download

memory/1364-68-0x0000000000990000-0x00000000009B1000-memory.dmp

Download

memory/4088-10-0x0000000000C70000-0x0000000000C91000-memory.dmp

Download

memory/4088-21-0x0000000000C70000-0x0000000000C91000-memory.dmp

Download

memory/4088-69-0x0000000000C70000-0x0000000000C91000-memory.dmp

Download

memory/4088-93-0x0000000000C70000-0x0000000000C91000-memory.dmp

Download

memory/4088-47-0x0000000000C70000-0x0000000000C91000-memory.dmp

Download

memory/4684-86-0x0000000000AA0000-0x0000000000AC1000-memory.dmp

Download

memory/4684-4045-0x0000000000AA0000-0x0000000000AC1000-memory.dmp

Download

memory/6864-2077-0x0000000000990000-0x00000000009B1000-memory.dmp

Download

memory/6864-4048-0x0000000000990000-0x00000000009B1000-memory.dmp

Download