cad07b0ebd63e5cffd93964bb146e65f47bc7a4c4feaad9b48ca45feaf057b19

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 05:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_ef40145dc1d09f170fc2d661845bf7f5_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Size 19.5MB
Sample260815-fr5emsfj4x
SHA256 cad07b0ebd63e5cffd93964bb146e65f47bc7a4c4feaad9b48ca45feaf057b19
MD5 ef40145dc1d09f170fc2d661845bf7f5
SHA1 1865424b685f549305d71a70fc5477302abd548d
SHA512 3fdee3ccee61eb2c8373708749458ed1327ffd2ed843cc3c7314d18ff933f615e00faaa9119d845ec90854c5725030aafb62eb72723c658af91fc9c486b40115
SSDEEP 49152:U+ES+ESm+ES+ESgq+ESm+ES+ESm+ES+ESm+ES+ESgq+ESm+ES+ESm+ES+ESm+ES/:BOU/jIEeQfoR/IuOFVjUu5M
TLSH
T13C274C09F98340B1D92B11B04DCBD3BF8A70BB25C6128DF7F74DCB5BAA32BA15428655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBCAACCAACAAABCBCACABCBCAACCBACABBCACBBCAABCCBBAAAABBAC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBCAACCAACAAABCBCACABCBCAACCBACABBCACBBCAABCCBBAAAABBAC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBCAACCAACAAABCBCACABCBCAACCBACABBCACBBCAABCCBBAAAABBAC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBCAACCAACAAABCBCACABCBCAACCBACABBCACBBCAABCCBBAAAABBAC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4496	svchost_CBCAACCAACAAABCBCACABCBCAACCBACABBCACBBCAABCCBBAAAABBAC.exe
4168	svchost_BBAACBBCCBCBCCACAACABAACACCBBCBCCBCCBBABCCBABAACCABBCBB.exe
4268	svchost_CBCAACCAACAAABCBCACABCBCAACCBACABBCACBBCAABCCBBAAAABBAC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABCBCBBABCACCBBBBBCABACBCCBACAACAACAACCBACCAACBBACABAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCAACCAACAAABCBCACABCBCAACCBACABBCACBBCAABCCBBAAAABBAC.exe"	2026-08-15_ef40145dc1d09f170fc2d661845bf7f5_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACABABACBABBBCBAACCBCCBCACAACCABCCACBCBCBAACACCBABABCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBAACBBCCBCBCCACAACABAACACCBBCBCCBCCBBABCCBABAACCABBCBB.exe"	svchost_CBCAACCAACAAABCBCACABCBCAACCBACABBCACBBCAABCCBBAAAABBAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2332	sc.exe
2076	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4312	cmd.exe
1644	cmd.exe
3500	cmd.exe
2992	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBAACBBCCBCBCCACAACABAACACCBBCBCCBCCBBABCCBABAACCABBCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_ef40145dc1d09f170fc2d661845bf7f5_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCAACCAACAAABCBCACABCBCAACCBACABBCACBBCAABCCBBAAAABBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2828	schtasks.exe
2396	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2900	2026-08-15_ef40145dc1d09f170fc2d661845bf7f5_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
2900	2026-08-15_ef40145dc1d09f170fc2d661845bf7f5_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
2900	2026-08-15_ef40145dc1d09f170fc2d661845bf7f5_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
2900	2026-08-15_ef40145dc1d09f170fc2d661845bf7f5_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
4496	svchost_CBCAACCAACAAABCBCACABCBCAACCBACABBCACBBCAABCCBBAAAABBAC.exe
4496	svchost_CBCAACCAACAAABCBCACABCBCAACCBACABBCACBBCAABCCBBAAAABBAC.exe
4496	svchost_CBCAACCAACAAABCBCACABCBCAACCBACABBCACBBCAABCCBBAAAABBAC.exe
4496	svchost_CBCAACCAACAAABCBCACABCBCAACCBACABBCACBBCAABCCBBAAAABBAC.exe
4168	svchost_BBAACBBCCBCBCCACAACABAACACCBBCBCCBCCBBABCCBABAACCABBCBB.exe
4168	svchost_BBAACBBCCBCBCCACAACABAACACCBBCBCCBCCBBABCCBABAACCABBCBB.exe
4268	svchost_CBCAACCAACAAABCBCACABCBCAACCBACABBCACBBCAABCCBBAAAABBAC.exe
4268	svchost_CBCAACCAACAAABCBCACABCBCAACCBACABBCACBBCAABCCBBAAAABBAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2900	2026-08-15_ef40145dc1d09f170fc2d661845bf7f5_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Token: SeDebugPrivilege	4496	svchost_CBCAACCAACAAABCBCACABCBCAACCBACABBCACBBCAABCCBBAAAABBAC.exe
Token: SeDebugPrivilege	4168	svchost_BBAACBBCCBCBCCACAACABAACACCBBCBCCBCCBBABCCBABAACCABBCBB.exe
Token: SeDebugPrivilege	4268	svchost_CBCAACCAACAAABCBCACABCBCAACCBACABBCACBBCAABCCBBAAAABBAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 4312	2900	2026-08-15_ef40145dc1d09f170fc2d661845bf7f5_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	95
PID 4312 wrote to memory of 2828	4312	cmd.exe	97
PID 4496 wrote to memory of 5216	4496	svchost_CBCAACCAACAAABCBCACABCBCAACCBACABBCACBBCAABCCBBAAAABBAC.exe	99
PID 2900 wrote to memory of 1644	2900	2026-08-15_ef40145dc1d09f170fc2d661845bf7f5_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	102
PID 1644 wrote to memory of 2332	1644	cmd.exe	104
PID 2900 wrote to memory of 3500	2900	2026-08-15_ef40145dc1d09f170fc2d661845bf7f5_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	105
PID 3500 wrote to memory of 2076	3500	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-15_ef40145dc1d09f170fc2d661845bf7f5_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_ef40145dc1d09f170fc2d661845bf7f5_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCACCCCBBCBBCBCBACCBACBBBCCBACBABCCCBBCBCACCCAAAACAACACACBCCBCBBAABCBACCCAACAAAACAABCAACBBABCCABBCACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAACCAACAAABCBCACABCBCAACCBACABBCACBBCAABCCBBAAAABBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCACCCCBBCBBCBCBACCBACBBBCCBACBABCCCBBCBCACCCAAAACAACACACBCCBCBBAABCBACCCAACAAAACAABCAACBBABCCABBCACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAACCAACAAABCBCACABCBCAACCBACABBCACBBCAABCCBBAAAABBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACCBCBBCBCCCCBABCBBBBCCBBACCCBCAAABCCAABABABBCACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAACCAACAAABCBCACABCBCAACCBACABBCACBBCAABCCBBAAAABBAC.exe" start= auto displayName= "UserDataSvc_AACCBCBBCBCCCCBABCBBBBCCBBACCCBCAAABCCAABABABBCACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACCBCBBCBCCCCBABCBBBBCCBBACCCBCAAABCCAABABABBCACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAACCAACAAABCBCACABCBCAACCBACABBCACBBCAABCCBBAAAABBAC.exe" start= auto displayName= "UserDataSvc_AACCBCBBCBCCCCBABCBBBBCCBBACCCBCAAABCCAABABABBCACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACCBCBBCBCCCCBABCBBBBCCBBACCCBCAAABCCAABABABBCACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACCBCBBCBCCCCBABCBBBBCCBBACCCBCAAABCCAABABABBCACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2076

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAACCAACAAABCBCACABCBCAACCBACABBCACBBCAABCCBBAAAABBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAACCAACAAABCBCACABCBCAACCBACABBCACBBCAABCCBBAAAABBAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABCACCCCBACABAABABACBCABACAACACAABCCCCCBACCABCBBAABBCBBCAAAACCCBCBACCBABBABCACACACCBABBCACACCACABBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBBCCBCBCCACAACABAACACCBBCBCCBCCBBABCCBABAACCABBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:2992
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABCACCCCBACABAABABACBCABACAACACAABCCCCCBACCABCBBAABBCBBCAAAACCCBCBACCBABBABCACACACCBABBCACACCACABBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBBCCBCBCCACAACABAACACCBBCBCCBCCBBABCCBABAACCABBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2396

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBBCCBCBCCACAACABAACACCBBCBCCBCCBBABCCBABAACCABBCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBBCCBCBCCACAACABAACACCBBCBCCBCCBBABCCBABAACCABBCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4168

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAACCAACAAABCBCACABCBCAACCBACABBCACBBCAABCCBBAAAABBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAACCAACAAABCBCACABCBCAACCBACABBCACBBCAABCCBBAAAABBAC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 8854d0b99ed7998b8866d9588588d6929056046229675fd633dc3053b66fa1c9
MD5 4f3ecef672188df76f20ee6bc731f010
SHA1 b43486d8fc9c39b1a7ded7a2d768222635fb423d
SHA512 0b47f9d4b993b5bdebc071310e79247a8bd9753e02f93464650ec3b4c26530bc6783499ed7aced823cc7c38ea5e3ae6c44f3b4c3bc3cbfa529d4ef3ec12ed4f9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 d546a18cfca21b55bb74832a9265e87e4dc9b204cdc0b192d781d79670c68e6a
MD5 a72d8b00594649d4cf790d1803ed0e0c
SHA1 6f135fdb496af2d14bffb4891ab7d9d63e3e53dc
SHA512 7b22dbbd1f8d59680820990458e0076b7dba49d14ec15c38ecad635f275e11ad6d4826fe29b8578d4259837d796a0c563c36927e48bec6a606e877e7e906ebd6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 c32138478f09a54db09ceeba846000bce4c6266174e69860be212b14e720b270
MD5 eda7c330b6ca52edafa99bc08a5e4c74
SHA1 ca9b99d685911cfbbba7d449312850f804b13713
SHA512 32e106aa94482d42bec68b328995c7d473d6aa24bcc84a68e423bb964dfbd0c0b5f3b51f4da5bdf9dc2197e119a719d59ec95a19641efa925284dd726f35d03a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\Parental Controls\settings\qap`g`v~dtlq
Size 10B
SHA256 7dce0a48abe4452251e3d121873ee572b0fd7c99f2f96a104097062ac6366e64
MD5 801393eddefdea6c5d51ce76e079a9e7
SHA1 abe0020a256746e3696062ec750dec701aa531b5
SHA512 5088a1973b6686d08342d6aabddb10ad2907a0c46376a035913e4472ffdc0b3ecf5fb50732dfbcd5b623a2518df874caebe6390fe9e3138cfd8f3d8e2bf81724
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 a78f98ee8556823b0fbe483fabb3f3e3641ead5203673996fe6005ae7c7f3a06
MD5 a05b5f9dc7406cf39889a73ccec46732
SHA1 c9e4824df099561f5236df78d040f0e5f9855c97
SHA512 5954eb5152a61304896548b86f1f1d91d7a825ad92fa6584bf64b46c9ca2db05dd52a69d08e9aeb8c68577461bdc7ba5505bf11461ecabcbb876b854cb9bbbb2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 c2e60f9555ec4c5c0c36ee7018f58e42b16e3038b4ca0f5f883b9578a3b91de0
MD5 4480cce1833d20427e6b5c8049c8e382
SHA1 8e36ed2ca1a97cc0e5aff65ca8bf9235ec59fe18
SHA512 375871350b1413318856b1b4d07cfa80e735463abcd2def15591f404f4f86d6694332ca157e8e212bdeb349157a3b7236db5f98d1fc4bce794e234aa51684a85
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 ccbeb675ea10cf6fdf6be1b641e50edfe3902db0a2b68dba6759ce0761dd4521
MD5 67d01e62a1315e156d849e70bff76d0f
SHA1 fec948d4d45f30d43e62b9117beb9fe8e110c9c8
SHA512 ca991eb0ca950b750c3dd529db6dfc99b15c344b602d31ace40429b84885d17abd1bc43dcc87f56299ab602af9201e2ceae368033c9a2679d01cf7293c349479
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 69609dfde9bac3cc90f14ddef5ac07029e14f57b46b22d49a0b7a9a6c9130189
MD5 6be6b65958572d11f0f8f54d2afbaff6
SHA1 4071b97006172e3a86015815c2134e9ea69c8a2c
SHA512 92a02b959a3b24c4ce693898dbbe7d139700ee3e59f2b80a31b9f680b1801a1dbb6a0d086ebf3ba596cd3c7a1995ba6a04b81ee2b01db487579888d551ede3f2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 0fd04a901125817ead44817d1a41a908010bc79eabeb788b92ff30e9196f795e
MD5 5466feff6bd6dd84534bd925cae42722
SHA1 79b3e763e402c9a8b5cef5e206a5fc5a6dd2ae45
SHA512 bba8d90f2d1522b80020469d72461d1af93dad91a8df3466de65863d0b352edd6e84f46dc0a811abfa23624dd654829f186d3cfa2c30effab2013bab477b2e60
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ti\qap`g`v~dtlq
Size 10B
SHA256 0f902ade3667e273a79de6ca33e53cfeebbcc0d6673f2a02ff0625c8c65bd6d0
MD5 0dc19faad758e942e0662a484f3df7e0
SHA1 fe6f97c7056aa3b5d8ead17a06eb625995616002
SHA512 3de72bf8f1a239d11e47299d5c8ad503301c99d43aec02ac5d838595263dbc19318f05a6470483e1e16885a12fd0e663e559f962f02f65266a1806330bd303aa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\qap`g`v~dtlq
Size 10B
SHA256 7462f1d4f19ee780e49cc9b23ea7aae311a7e75e20578585142584525debc800
MD5 11f382c8e5435d2e28a08ab495c69697
SHA1 d6ed32329622d77fe8894c0d00597d148855b020
SHA512 226a6af8f81027341ec5de15c1bd389962e2d6a76e9a32bb2d22880b91491a0868846e80a1d248d452402b39b2fe3c6509d6676b6dafc0f1c7877ee1236c7fdb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Credentials\qap`g`v~dtlq
Size 10B
SHA256 077cd0a163abb93072059f2bdd8e04f438c5ed854dcf76b553bc3c7cca04bdf3
MD5 fa98e34821d438e2a5d418a527ec82a0
SHA1 0fd9df242cbfe0223c18a857e3679d99b0224bd6
SHA512 3e7711c4a53826e79d65a5855711385d64ac07d4e822db9e2172a5a71e685721cf5b30ce63d2e2b244d17c93754a1c8e899b53d1f0d08b9da2eb620a9d1424e7
MD5 SHA1 SHA512

Submit Download

SwitchReset.exe

Path C:\Users\Admin\Desktop\SwitchReset.exe
Size 58.6MB
SHA256 ac697ba5aa469fe9233eb0bd6b6c0913d1f8076267369b4b86f627b25a7f9d73
MD5 2a88402f0d867b2288497295e6c84646
SHA1 cf6ea7a438af93d853bb62531b41cc407e970a99
SHA512 a867aa230692e153edc718fbb1266429d39530dcafacabf960293ed8798673327ce06f0b01eaa266ee3cf72255d7eed382fee54b4581db5e98600ee98f5994b9
SSDEEP 98304:BOU/jIEeQfoR/IuOFVjUu5KOU/jIEeQfoR/IuOFVjUu5KOU/jIEeQfoR/IuOFVjR:BFIF0wuIFIF0wuIFIF0wuZZF
TLSH
T1EFD74C09F98340B1D92B11B04DCBD3BF8A70BB25C6128DF7F74DCB5BAA32BA15428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 60e17a77878a68dc2599f69eb1a227bad298454e81bafac939bb7f9e94739544
MD5 d73c8fd7229f2fc12a027712f029a947
SHA1 e96f402168f5a406558c762407ffeefc141c1c4d
SHA512 843ac333ae2ffc4fe1f0f7034d5c57a57aa1e85d293acdb0924759366f772f38fc670a74016947fe4a8990e024da8b14bb9ee10be227ae812283bfe37b515daa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e6289353df2266bab20a9cd15b0c9e2cdb0eb18c7afbb4b0e57b217082ee594b
MD5 be01c993641b01dc289f8a0079bc31b8
SHA1 42948c7acd9863e06a2a8f6ffa90392486dace09
SHA512 94cd3cf22d07b82289a2147c0de0436eb035ed98664e536f260230132d327466b6b3091717046c369433b30c2eb0d552e557c782b7c079d7a14565cbe6e17504
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 89b3f02ad0818e59c72f2e43099ed52ef2c1713f612652d6e3bcfe5470670b05
MD5 5704491682b0e7c2ac8a5de892a847db
SHA1 8dcf18e05c79849351bd93f284612a7a62bb42a1
SHA512 e8f09e549f126b24e2a058b7656f228750a1d729177c503e0c7ae835ffa4d1b8501533e2c87cd3c6833c0ad41b1a534386f989807aeebd6697d0c46af80ebf8f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 860b8798f60ab241027ddd19344e32d8249d05b7cc04fd2d88f8d74b18ae54a2
MD5 246560110530d83daab62f8445fcafef
SHA1 b0160b7050bf22a0ad5ac94b88cb5b28f5be6d9e
SHA512 5db06b2820b8253a6a87d6eb9b25d50a3b679da4fe55fe2b9e859f3c2c0868891d409b33c2be96a2815c1fb3fbaf57decb94cc2fba393fa6eb253eb95ce0a6e7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c9f54760b5f18cdf6c906a20f672c8495d88103855c7323105e3dae36d758571
MD5 9d9066b5d78fa20bc8d931b87ac6e285
SHA1 9de377528a67a3f8e63f45fed4631d40ebd9d964
SHA512 83605c499d927eac1a1be1bf7b823b4703791a142a47d68e84e0d6cacb5bbd0136f3f0a2d94016ec1c8b8cceda07f0da448e656e83c44158e14f697125217e17
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Documents\OneNote Notebooks\qap`g`v~dtlq
Size 10B
SHA256 b4b70698d2a4ec7d3f81602e9166c1806e4a455ece0b9f42cda7f94c3fe28a1c
MD5 0fc480b9da885ed36396ddf5dc4efe0b
SHA1 041b71b2f7efa166f60d9df95561c2411bd6f707
SHA512 2a12bbe36198b10050712e0da3c0031d4e24c427ecff691926aa883918cc5f71f0d4607e6fc16fc1e3cd971675c24c753be07ebedb650a594c323933e59e0d72
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 33868e08f27800e6bfc89e8267dea98ca2a026d38ee5695198df30d98a0fd023
MD5 6edbce65967d96c67a270ab8ab783aa6
SHA1 c9b3d1c85a248c087193ea4570433492ebe7ce01
SHA512 4c09f5a7ea5c8a581ad14500113ddf9147c4d984d3f764f808410b7af3f211eccc236d3ec3c9bae3050d1d90668f76be4c0629f294505bf463a6c56f9aaf933b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f0e448d5ddaba0eb7cd11ab64dfd1da8cbed48142873556d1c476824faed8e55
MD5 c37cbd7d2c8a4eb0561e13f55f31f739
SHA1 626348dc3f23ee5f26b9f25c27b83f5a14450812
SHA512 15ca1082011f3e5cf839b5232cd2a152e19b31797eaa0a6936607c3320aca0f76586964ccfd661dd135a64d2d7ded2f90795d245dbec33f307ad43b53647c8ff
MD5 SHA1 SHA512

Submit Download

svchost_CBCAACCAACAAABCBCACABCBCAACCBACABBCACBBCAABCCBBAAAABBAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAACCAACAAABCBCACABCBCAACCBACABBCACBBCAABCCBBAAAABBAC.exe
Size 19.5MB
SHA256 cad07b0ebd63e5cffd93964bb146e65f47bc7a4c4feaad9b48ca45feaf057b19
MD5 ef40145dc1d09f170fc2d661845bf7f5
SHA1 1865424b685f549305d71a70fc5477302abd548d
SHA512 3fdee3ccee61eb2c8373708749458ed1327ffd2ed843cc3c7314d18ff933f615e00faaa9119d845ec90854c5725030aafb62eb72723c658af91fc9c486b40115
SSDEEP 49152:U+ES+ESm+ES+ESgq+ESm+ES+ESm+ES+ESm+ES+ESgq+ESm+ES+ESm+ES+ESm+ES/:BOU/jIEeQfoR/IuOFVjUu5M
TLSH
T13C274C09F98340B1D92B11B04DCBD3BF8A70BB25C6128DF7F74DCB5BAA32BA15428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 923e08f9d2d7fe5da6347a13feca1948be0f2246f83bf542c0c70fef9d9fe4a7
MD5 8e2328eca66d3750f166cc1b404d50dd
SHA1 52d43550c4c20bd09fd039b05b7f254e37b63891
SHA512 2e16cdfa7eec793a4acea93312e0203f7cd3729cc4f317496a9527a2f1e1f81042bf59980f83971cd7a107a7700d8a335a2c38b1e2fad5310a9f523877c4e385
TLSH
T1D7210850F5A68C23FD7268CB6A299FD30CB07B9B9C546F14230C4218F799C32CE560E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 428d10e9b3e7a04817b8cdd03590574a175045988dff8baac2890f3de3e65bd0
MD5 490168109c6e9676f68757c5df36db3e
SHA1 2d5c9156d1ec4e0b7b0487647fe05c4daee6dc53
SHA512 03f1416fe49fcb977534e9d883fb18f6dc1ed418997ec3550a5fe3a202e89db2d6b951978ca7b3b6ab1d86504b25eece05c6329ded04f0828ea952530793a6ec
TLSH
T194112710B5A68C13FE7268CB5A299BD308B07B9B9C587F04220C4218F799C328E520E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2900-65-0x0000000000330000-0x0000000000351000-memory.dmp

Download

memory/2900-10-0x0000000000330000-0x0000000000351000-memory.dmp

Download

memory/2900-46-0x0000000000330000-0x0000000000351000-memory.dmp

Download

memory/2900-101-0x0000000000330000-0x0000000000351000-memory.dmp

Download

memory/2900-21-0x0000000000330000-0x0000000000351000-memory.dmp

Download

memory/4168-105-0x0000000000D40000-0x0000000000D61000-memory.dmp

Download

memory/4268-1071-0x0000000000CD0000-0x0000000000CF1000-memory.dmp

Download

memory/4268-3972-0x0000000000CD0000-0x0000000000CF1000-memory.dmp

Download

memory/4496-69-0x0000000000CD0000-0x0000000000CF1000-memory.dmp

Download

memory/4496-47-0x0000000000CD0000-0x0000000000CF1000-memory.dmp

Download

memory/4496-32-0x0000000000CD0000-0x0000000000CF1000-memory.dmp

Download