4f58dd068e3806b4e7f5abd233c07c7c1be96242faa69b12469811482c2727fc

Analysis

max time kernel
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 06:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_d199ec8186a86e8097d7d3d84812fd21_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 14.2MB
Sample260816-g64mbsbf65
SHA256 4f58dd068e3806b4e7f5abd233c07c7c1be96242faa69b12469811482c2727fc
MD5 d199ec8186a86e8097d7d3d84812fd21
SHA1 fa622b8f5f4a1a0bd239e4abe96e3e5c45b86590
SHA512 c9d8d1eeb793bc6450442babc9a35bed5baf6ee31e420507795aaeb22c6ba2acaffddf6804f113493b1948d0063399ba9410d92c2af8ed4513bb2fb8049971a9
SSDEEP 98304:zKRuy5aCKRuy5aCKRuy5aCKRuy5aCKRuy5aCKRuy5aCKRuy5aCKRuy5acKjKWQcC:zqfqfqfqfqfqfqfqAKWQc0gEYnvL0
TLSH
T1CEE6AE06F6820071E97730708A9FE37A9979B721473189DFE7488A7E5A33EC0653875B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCCBCBCCCCBABBBCACBCCAACAAACBBABCAABABCABAABAABBABACCAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCCBCBCCCCBABBBCACBCCAACAAACBBABCAABABCABAABAABBABACCAB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCCBCBCCCCBABBBCACBCCAACAAACBBABCAABABCABAABAABBABACCAB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCCBCBCCCCBABBBCACBCCAACAAACBBABCAABABCABAABAABBABACCAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1188	svchost_BCCBCBCCCCBABBBCACBCCAACAAACBBABCAABABCABAABAABBABACCAB.exe
1568	svchost_CBAABABCABBCCCCBBABACCCCCBABBBCAABCBBABBBACBBACCACBBBAB.exe
800	svchost_BCCBCBCCCCBABBBCACBCCAACAAACBBABCAABABCABAABAABBABACCAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBBBABBABCCBCCCAABAABACCCABCABCBCCABCAABCBCABABCACACAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBCBCCCCBABBBCACBCCAACAAACBBABCAABABCABAABAABBABACCAB.exe"	2026-08-16_d199ec8186a86e8097d7d3d84812fd21_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBACABCAABACAAABAAACBCCBBCBACCBBACCBCCABCCBCCBBABABACAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBAABABCABBCCCCBBABACCCCCBABBBCAABCBBABBBACBBACCACBBBAB.exe"	svchost_BCCBCBCCCCBABBBCACBCCAACAAACBBABCAABABCABAABAABBABACCAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3720	sc.exe
3328	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1120	cmd.exe
4244	cmd.exe
2856	cmd.exe
5140	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBAABABCABBCCCCBBABACCCCCBABBBCAABCBBABBBACBBACCACBBBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_d199ec8186a86e8097d7d3d84812fd21_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBCBCCCCBABBBCACBCCAACAAACBBABCAABABCABAABAABBABACCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1412	schtasks.exe
2476	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3548	2026-08-16_d199ec8186a86e8097d7d3d84812fd21_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
3548	2026-08-16_d199ec8186a86e8097d7d3d84812fd21_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
3548	2026-08-16_d199ec8186a86e8097d7d3d84812fd21_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
3548	2026-08-16_d199ec8186a86e8097d7d3d84812fd21_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
1188	svchost_BCCBCBCCCCBABBBCACBCCAACAAACBBABCAABABCABAABAABBABACCAB.exe
1188	svchost_BCCBCBCCCCBABBBCACBCCAACAAACBBABCAABABCABAABAABBABACCAB.exe
1188	svchost_BCCBCBCCCCBABBBCACBCCAACAAACBBABCAABABCABAABAABBABACCAB.exe
1188	svchost_BCCBCBCCCCBABBBCACBCCAACAAACBBABCAABABCABAABAABBABACCAB.exe
800	svchost_BCCBCBCCCCBABBBCACBCCAACAAACBBABCAABABCABAABAABBABACCAB.exe
800	svchost_BCCBCBCCCCBABBBCACBCCAACAAACBBABCAABABCABAABAABBABACCAB.exe
1568	svchost_CBAABABCABBCCCCBBABACCCCCBABBBCAABCBBABBBACBBACCACBBBAB.exe
1568	svchost_CBAABABCABBCCCCBBABACCCCCBABBBCAABCBBABBBACBBACCACBBBAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3548	2026-08-16_d199ec8186a86e8097d7d3d84812fd21_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	1188	svchost_BCCBCBCCCCBABBBCACBCCAACAAACBBABCAABABCABAABAABBABACCAB.exe
Token: SeDebugPrivilege	800	svchost_BCCBCBCCCCBABBBCACBCCAACAAACBBABCAABABCABAABAABBABACCAB.exe
Token: SeDebugPrivilege	1568	svchost_CBAABABCABBCCCCBBABACCCCCBABBBCAABCBBABBBACBBACCACBBBAB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 5140	3548	2026-08-16_d199ec8186a86e8097d7d3d84812fd21_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	91
PID 5140 wrote to memory of 1412	5140	cmd.exe	93
PID 1188 wrote to memory of 2008	1188	svchost_BCCBCBCCCCBABBBCACBCCAACAAACBBABCAABABCABAABAABBABACCAB.exe	94
PID 3548 wrote to memory of 1120	3548	2026-08-16_d199ec8186a86e8097d7d3d84812fd21_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	97
PID 1120 wrote to memory of 3720	1120	cmd.exe	99
PID 3548 wrote to memory of 4244	3548	2026-08-16_d199ec8186a86e8097d7d3d84812fd21_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	100
PID 4244 wrote to memory of 3328	4244	cmd.exe	102
PID 1188 wrote to memory of 2856	1188	svchost_BCCBCBCCCCBABBBCACBCCAACAAACBBABCAABABCABAABAABBABACCAB.exe	105
PID 2856 wrote to memory of 2476	2856	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-16_d199ec8186a86e8097d7d3d84812fd21_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_d199ec8186a86e8097d7d3d84812fd21_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACACAACCBCBBACACBCCBAAACCCCACABCABBBBBABCABCBACBBCAAABCBBBCCACCCBBCBACBCBCCCBBABCBCBAABABCACCBBABBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBCCCCBABBBCACBCCAACAAACBBABCAABABCABAABAABBABACCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5140
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACACAACCBCBBACACBCCBAAACCCCACABCABBBBBABCABCBACBBCAAABCBBBCCACCCBBCBACBCBCCCBBABCBCBAABABCACCBBABBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBCCCCBABBBCACBCCAACAAACBBABCAABABCABAABAABBABACCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCBBCBCCABBBCCBBBCCBCBCCAAACACCBAAABACBABACBBABCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBCCCCBABBBCACBCCAACAAACBBABCAABABCABAABAABBABACCAB.exe" start= auto displayName= "UserDataSvc_ACCBBCBCCABBBCCBBBCCBCBCCAAACACCBAAABACBABACBBABCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCBBCBCCABBBCCBBBCCBCBCCAAACACCBAAABACBABACBBABCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBCCCCBABBBCACBCCAACAAACBBABCAABABCABAABAABBABACCAB.exe" start= auto displayName= "UserDataSvc_ACCBBCBCCABBBCCBBBCCBCBCCAAACACCBAAABACBABACBBABCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCBBCBCCABBBCCBBBCCBCBCCAAACACCBAAABACBABACBBABCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCBBCBCCABBBCCBBBCCBCBCCAAACACCBAAABACBABACBBABCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3328

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBCCCCBABBBCACBCCAACAAACBBABCAABABCABAABAABBABACCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBCCCCBABBBCACBCCAACAAACBBABCAABABCABAABAABBABACCAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCCBCCABCACBCBBBBAACCBBACABBBABABACBCCACAACCCAACBBCABCAABBABBBBBCCBCBBBCABCCACBACBABCCBABAACBBBCAABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABABCABBCCCCBBABACCCCCBABBBCAABCBBABBBACBBACCACBBBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCCBCCABCACBCBBBBAACCBBACABBBABABACBCCACAACCCAACBBCABCAABBABBBBBCCBCBBBCABCCACBACBABCCBABAACBBBCAABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABABCABBCCCCBBABACCCCCBABBBCAABCBBABBBACBBACCACBBBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2476

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABABCABBCCCCBBABACCCCCBABBBCAABCBBABBBACBBACCACBBBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABABCABBCCCCBBABACCCCCBABBBCAABCBBABBBACBBACCACBBBAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1568

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBCCCCBABBBCACBCCAACAAACBBABCAABABCABAABAABBABACCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBCCCCBABBBCACBCCAACAAACBBABCAABABCABAABAABBABACCAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 661f37ec2a1e69e0d15070881c725ab30d2b653ee0b56ba793235283a8df2885
MD5 4d952edeec71d935cb79b3ff62357a40
SHA1 f4c0ae328feb7b583f55dcbbba3c3cb4fc035c8d
SHA512 870ec531c721148943fda92786aaac0659bcb6fce91131003bb19d8af78c1bcf42de13b9b295962d53ebf15d95337988b4330471ec98b6326c7f4d69779e178f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 4843280cdbc8042479b16a4b0b19aa7f2b6a80941fd4e6f174c10101225faead
MD5 da409447b1e5866155458b4365c27796
SHA1 edd342bf6b3eb1640422f3ebf8c96bf242017b06
SHA512 662d4ebc0651a37e1b09eab7e0d2e514d36c44101a7e76b127f47950ca32caed4b568cd058753d0886056ed8c4adf53efdff411a09f55e2b438f062d5ead87b1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 3f33b7e49ce3bc0d3d7a9e51e3e98c598f681a196283ab4a91e0c8dd5e90335f
MD5 40b9145d4b15cb2ce58d9c6aab9ef9b9
SHA1 7a0e49fcebfabe41d87395448cf4fe3651dd98ff
SHA512 9fea40400c79be9c7b1ed5c6b6c396fa8d9f4630c0bf7184b4f5b55496208a1eb5ca904e4aecc4d1f997a9f72cdff5d833b54fa2d69fdcf2316363e30dcf5c73
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 51e4909fa017e6fca2bc5247c0b733595bd6f1a1eeff783a7916b3e85f6c859e
MD5 9c585bc305660652f5ed1ac72ab25d8a
SHA1 730808d2af31588a68156e075c7c9d26bbe94165
SHA512 e550a335b160742238e3e75fe9b22701f032824caa7cd7a12901e30f531c9bc8298d10a67cc76cbeb4464928ab9073816bea04cb6390d688e696a55ff98e6bf3
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 14.8MB
SHA256 761379af73c033b6c41b00471e49b99c16f86a26a778692f044592a86aa71950
MD5 6947a3cafcbca60c5f020c5b8531f0ef
SHA1 b38ff40429ce973fe6d31731d135a46e46f10d00
SHA512 82f25fdfeaeef301c016c36ef9ee3c282734be466d1280e611728c2e7d8ac8ac47211d865442e934e30a68adafe35a2125e959178ce22028dbba51f2ba89689e
SSDEEP 196608:zqfqfqfqfqfqfqfqAKWQc0gEYnvLTgZ2js:eSSSSSSShcZEIve2Q
TLSH
T1EBF6BE06F6820071E97730708A9FE37A9978B721473189DFE7488A7E5A33EC0653975B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 e0714867c5b41b5d35475a627b086d72c7d526c8d50653e47ffe24da76af804b
MD5 96e9ab255c0aa0c72a87d55fa8440c48
SHA1 a3911f50169d015242450fd0df4a648cbba2875d
SHA512 dcc34d4957178dabe8d59e8036c0e8a73702b1b7b834070659894c141bb9fa2477bc591b31b9d95e507d3148a9ade585e02f293c0bff4a8cedbe2813eea82303
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 76faf7a0704d61bf7c2c4cc8092c87b6a26732c039541aad1ccd03aa16a50751
MD5 aa0b38a50f1b615b81bbdf2188d1ce31
SHA1 3bfef1c9c88d3119c16f0c938c843ab6ccb86da6
SHA512 372d74240b5d93c0483ed3b8720ca50cc50f39a073a7d3768b4babaeb786bd23fbfca36bf2a55d3e0912729c87c0f6132e2d60a3f2b0cd8e2f44ce93574e91ea
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 17cd155d033927ee93e6c1485d5364eba6c6e1be25ee474edbee059f8a50c52d
MD5 0d0f75588d8df23b4bbc32895941d72e
SHA1 c1ee1fbef59561a700f3db0815e0e7789c0659a4
SHA512 a38e2e8d73789064db4dc6b5b1b111b122d9f3c798c018003f2537677196d89bd374e44be29932484b80556521a99f58ecbaa27c24fea9d951fe970345901181
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 596b76dd170ea7311116039af795cac92cab3d6562aa3ae19740f103b16daac4
MD5 b8b809b5a5d8a77e0503e10025c1085a
SHA1 003d3485e8789411cf04085a2bc7928af1bbd5de
SHA512 7b612c12df29501bcabe085c8a146998b674ac4af20d54cd95acbfd719e7dd856db0540fff1f472442a103ad8eb168bfa6f433e34f93ec522f767e1a50532130
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CertificateRevocation\qap`g`v~dtlq
Size 10B
SHA256 6797873e481d1b7d1f4d47f249baf3ee824b66dcce7f576f11403001b6d22f53
MD5 73c08815d10d4ce8cea55aa143af1555
SHA1 007d22391b24d870c5ecef502bc4aca859e2c196
SHA512 afa13b2fa33807e1c380fdddfdd492bfb4a5315cfd43fe00f13a0e0b13bb8cf8ed11ac5c613aa82ba8592faefc41565be9d884d7d9caa1b737a4a9b5546c1144
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\bn\qap`g`v~dtlq
Size 10B
SHA256 b2945c7d1a722780225ba85b68262bff3b951c236502abb4cd5f5fcc1b56aad6
MD5 723b5202a5939a31f83aa1a86ebbcede
SHA1 34c7f0302709f095e19511bcdb214c773d191436
SHA512 78862ff6296843bde8078ac0a03a810ffe30dac27104529ee35a3330cf9ba5dfec323830722095dbfcd556a802a6247731cf22d9628b3db9e80e709d6b009478
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 a2844d8a1ea33e027f32ea6400895bebc5949b6f9a5f08ca71e962bb33ecc1ef
MD5 e6b141f4fab1967a5838a020ae3c3c90
SHA1 d450aa0deb7c45713d9421763e6bb9101cf9f2e0
SHA512 ffb9301692970dea0644f7a1c202dd51cc68ab5d0aab4cb6c7ca22cadea28d35fe87915002a748c9bdd03594969cb4999dea9df36651ebde66cd58f533e4a8bc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 25915f821472c02640673a7988dad28bda671398c826c5085dfebdcf009a19c9
MD5 59325ef839ff3b72e118e1fd48b3ca17
SHA1 a31d59d2910a06f1ba29ea5e02b1a7e033e093cc
SHA512 f373bc6ef3ad160a35dd20e9f2a7610f677bec0bc05254219fefcd9dc5148e89bbc9ddf51124c4978d662806c600062ff51e6bca6e10d549579dd389f766bf5d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\Keys\qap`g`v~dtlq
Size 10B
SHA256 df77088f6fcafca47a35321023f49104a6defd5d6f59a6fb21ef0899a528cf48
MD5 ee8d8a6e8340576d6e1389ed276161f6
SHA1 a538e17cbd499c2a5a105d6eb57c1799dcf6505f
SHA512 72a206ff1fdcc6544cca743d4b5f6ea49d1023ed25b9490e982ef2ada184be949476f0449e6a909b4ea215f12a31de1709ebfb32aac95166ceac833d6e2e0f35
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\qap`g`v~dtlq
Size 10B
SHA256 9e6bab0c8b86f2746fea2250de5d663c1653c1aa0e05c5ee510526693e145a3c
MD5 d8d948784b9269a45aead143c2ab0fa8
SHA1 e9077931e30da547baf62b305fa726eb51eac90b
SHA512 f47366b50a52a5f854aeb8f89457a9b87ea5d473e5ccd4423e5af37e0d66d67afd498c128b7981b3aef98e74d3574122e817266a4fbc7d0927eaf3605c3cdfa0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f56c7349eb735e9b9ee42d323eb332ab5345ab35135e2170737fe4529c5325e3
MD5 539acc5aa0316a17a2c872eddb960670
SHA1 8e5e82eb4817300512d8211e70f5bc0664c24d54
SHA512 b418e3a19ec3fe310bd48430e30228a5111a7a7b606fa83a10497fad423934acd3d956bd9c0f6708939203e585acd0cffa53d8f76a16969c1f0cdc1590b5484e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d6bd92b6a19698503f29d5f4d03d2beddebe11b7f2c2d28891cfc361f9584744
MD5 19e5477701646fe1322999862625701f
SHA1 be296eb258a8ed9e7a29b92363fefd47f344f6a9
SHA512 ba459c2c85f8d814cb1bed06945e295d471c01bbb7625c40e78b098843b5e5ff8e437b74b9266bd0c9619f7d9add398df3e22072f131eb89c2c58919fcba3ef2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6546e1d0cbc234f4b3389b1800e2074c7a3b7f1fcf7ff7a4421b73a799178522
MD5 a9d709252f7252b853705659f47a7c0c
SHA1 dda1a5fba57c02f82f2700bf0d1802d6b5c58fa7
SHA512 9efc63cdb1e36ef1833fbed28ff7a9d24763b8157ae99981ec26b6eeeba404fae23368b88e0aa6634ae8aa995311bdfe6c8b1f24eea9194342e963be7f083985
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c1ec19e114233d489eee9b5c8a7811fea216a6a26ba65bc749e7a66693f3362f
MD5 a6f03688df1e41985b9580cad5729025
SHA1 2a85698dad0f3968a4587d3d95d62f31b62dbc52
SHA512 737fb5a04c3035e8846013f13060af25690fe8233121736789427dc1875da4f15894afa13a5f525cff847e97d9277d342f9c6f6393f1fe9efeb9bbfdb34ef805
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 43cefab13cb944b709d0f211edf3fe0b1ea33a45fbb87e7ad2f60159b59b58a4
MD5 4dd3d5ae795d399c83fb3a8c688a55b7
SHA1 a4e39f6c8c33c2440dbaf0a0151ba058bb69978c
SHA512 e45f5d7d26424f3b38af7981ac13ebfe031f92cb624e8b6f7419e2362015551c027110fe802dbf5a7d42d1377183e3471655f35e7d418d8abc7b7c7fbd2f18b4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 589bc50b8b9a4281e55d8d74404ba55d0d7cfa2a989950e98075438e5368caeb
MD5 28700349bad1192c15a3a440cbf1fb5e
SHA1 dff8fbf64f4c5e50ba709097f85a640a65e92246
SHA512 cf784ecabed578d3a9d73b1eed4800fac0eef72377a37b55f6947f5c6a7183b1d8bebd1635c390731b80843d7a199fef65a01263ffc423348050ec32edc05115
MD5 SHA1 SHA512

Submit Download

svchost_BCCBCBCCCCBABBBCACBCCAACAAACBBABCAABABCABAABAABBABACCAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBCCCCBABBBCACBCCAACAAACBBABCAABABCABAABAABBABACCAB.exe
Size 14.2MB
SHA256 4f58dd068e3806b4e7f5abd233c07c7c1be96242faa69b12469811482c2727fc
MD5 d199ec8186a86e8097d7d3d84812fd21
SHA1 fa622b8f5f4a1a0bd239e4abe96e3e5c45b86590
SHA512 c9d8d1eeb793bc6450442babc9a35bed5baf6ee31e420507795aaeb22c6ba2acaffddf6804f113493b1948d0063399ba9410d92c2af8ed4513bb2fb8049971a9
SSDEEP 98304:zKRuy5aCKRuy5aCKRuy5aCKRuy5aCKRuy5aCKRuy5aCKRuy5aCKRuy5acKjKWQcC:zqfqfqfqfqfqfqfqAKWQc0gEYnvL0
TLSH
T1CEE6AE06F6820071E97730708A9FE37A9979B721473189DFE7488A7E5A33EC0653875B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 c3416fa794b216d38af673e3e9c672b59bb7df20ca380caeba50c0078ddbcbc8
MD5 37542e5e0d5d4ac0492d58ae973fa3b1
SHA1 68f75e055c7e7ebc8e4d7968d6ec2dae13ad8932
SHA512 28fa35ea339b849ecf5c26a2b1da34f96eb367aca2e01c50a96f5cf1f23d9f3625e32ca8938076de0bff1520c4b9331bb101059ce72d1b31813bfc53d9284117
TLSH
T11E21DEA0E4A6A453AD3224D6573DCF8208B53757949C7EA413064718F7A6C315D2B4E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 5c2ec0dd23931c90c8fe5cc08ba2583e3ad18b2c31fdefbe15abdf47a353f74f
MD5 f8545d7a57f856667a2850c9a4c9cbf0
SHA1 6a4fb779dd3295e20af5468a66b7068e2dab9951
SHA512 443695e0628089d9523cbe0a8720b16a6b3816c1b377824fd0b7b2bfaeeb9a46a4449f1ccbd40741491303a1587258384f6cdbd25d8e21e735ca130011a3c8ff
TLSH
T12C21FE60E496E863A93164DB572DCFC208A5375B989C6D90530B4318F7EAC315D1F4E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 9fb27115e41329c4fba834a1d871440043caab20ef4fb6b4df513185f6ac395b
MD5 0d3b58761cf6197db54a1ed700daa347
SHA1 d808fcdfe67a22efee089901e437909bd3c6f1b4
SHA512 d3e75079a88dbd108a8d734bc0f8a3523f62c35d7b6cf47925946fe1d332df12192637b5dfe37309e993e869514d407c3206b454f8b4511c62205b75b0e7c249
TLSH
T1E811ABA0E4A6A453F93124D6573DCF8208A5379B989C6EA46206471CF7A6C315D2B4E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/800-934-0x0000000000B40000-0x0000000000B61000-memory.dmp

Download

memory/1188-33-0x0000000000B40000-0x0000000000B61000-memory.dmp

Download

memory/1568-63-0x0000000000740000-0x0000000000761000-memory.dmp

Download

memory/1568-3601-0x0000000000740000-0x0000000000761000-memory.dmp

Download

memory/3548-6-0x0000000000360000-0x0000000000381000-memory.dmp

Download