5c897dd099a3716aab7e6fae981c77700d0c9dc3164f8214c2243fd4926ac78c

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 03:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_6cd76166487dda715267dc26d75d03ae_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Size 28.2MB
Sample260818-dsq8aswtft
SHA256 5c897dd099a3716aab7e6fae981c77700d0c9dc3164f8214c2243fd4926ac78c
MD5 6cd76166487dda715267dc26d75d03ae
SHA1 3bde5b7ea86d3feee0f78944aa326ea1951a4bfd
SHA512 912629312a3b225dbe292e3f661219b71b59901f4e27226cdce97ec366a1c5c79864e7e85fe5b9f81e9223858c67e81f64ba90d919dee0ae28e2ecdc4a359664
SSDEEP 98304:FKRuy5aUKRuy5aUKRuy5aUKRuy5aUKRuy5aUKRuy5aUKRuy5ayKjKWQckVgtev5X:FqFqFqFqFqFqFq0KWQc0gEYnvLe
TLSH
T1A2576C05F98340B1D97B11B04DCBE3BF8974BB2186228DEBF74D8B2F6933B915428656
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CACABCCABBABBAAAAAACACCBCAACBCAACACBCCBACBACCACCCBCCACB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CACABCCABBABBAAAAAACACCBCAACBCAACACBCCBACBACCACCCBCCACB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CACABCCABBABBAAAAAACACCBCAACBCAACACBCCBACBACCACCCBCCACB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CACABCCABBABBAAAAAACACCBCAACBCAACACBCCBACBACCACCCBCCACB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1688	svchost_CACABCCABBABBAAAAAACACCBCAACBCAACACBCCBACBACCACCCBCCACB.exe
1148	svchost_BBCBCAAAAABACAAABABAACBCBBAACCBAABCCCBABBBAACCACCBACAAC.exe
4924	svchost_CACABCCABBABBAAAAAACACCBCAACBCAACACBCCBACBACCACCCBCCACB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBBAABBAAABBABBABACACAABCBACBCBBBCABAAABACBBCBBBCABABCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCBCAAAAABACAAABABAACBCBBAACCBAABCCCBABBBAACCACCBACAAC.exe"	svchost_CACABCCABBABBAAAAAACACCBCAACBCAACACBCCBACBACCACCCBCCACB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAACCCBBCCCCAABABBBCABAAABBAACBBAABCAAABBCAAAAAABBCBCAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACABCCABBABBAAAAAACACCBCAACBCAACACBCCBACBACCACCCBCCACB.exe"	2026-08-17_6cd76166487dda715267dc26d75d03ae_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2692	sc.exe
1432	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3092	cmd.exe
4416	cmd.exe
4680	cmd.exe
1608	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_6cd76166487dda715267dc26d75d03ae_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACABCCABBABBAAAAAACACCBCAACBCAACACBCCBACBACCACCCBCCACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCBCAAAAABACAAABABAACBCBBAACCBAABCCCBABBBAACCACCBACAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3176	schtasks.exe
5592	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4108	2026-08-17_6cd76166487dda715267dc26d75d03ae_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
4108	2026-08-17_6cd76166487dda715267dc26d75d03ae_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
4108	2026-08-17_6cd76166487dda715267dc26d75d03ae_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
4108	2026-08-17_6cd76166487dda715267dc26d75d03ae_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
1688	svchost_CACABCCABBABBAAAAAACACCBCAACBCAACACBCCBACBACCACCCBCCACB.exe
1688	svchost_CACABCCABBABBAAAAAACACCBCAACBCAACACBCCBACBACCACCCBCCACB.exe
1688	svchost_CACABCCABBABBAAAAAACACCBCAACBCAACACBCCBACBACCACCCBCCACB.exe
1688	svchost_CACABCCABBABBAAAAAACACCBCAACBCAACACBCCBACBACCACCCBCCACB.exe
4924	svchost_CACABCCABBABBAAAAAACACCBCAACBCAACACBCCBACBACCACCCBCCACB.exe
4924	svchost_CACABCCABBABBAAAAAACACCBCAACBCAACACBCCBACBACCACCCBCCACB.exe
1148	svchost_BBCBCAAAAABACAAABABAACBCBBAACCBAABCCCBABBBAACCACCBACAAC.exe
1148	svchost_BBCBCAAAAABACAAABABAACBCBBAACCBAABCCCBABBBAACCACCBACAAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4108	2026-08-17_6cd76166487dda715267dc26d75d03ae_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Token: SeDebugPrivilege	1688	svchost_CACABCCABBABBAAAAAACACCBCAACBCAACACBCCBACBACCACCCBCCACB.exe
Token: SeDebugPrivilege	4924	svchost_CACABCCABBABBAAAAAACACCBCAACBCAACACBCCBACBACCACCCBCCACB.exe
Token: SeDebugPrivilege	1148	svchost_BBCBCAAAAABACAAABABAACBCBBAACCBAABCCCBABBBAACCACCBACAAC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 3092	4108	2026-08-17_6cd76166487dda715267dc26d75d03ae_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	94
PID 3092 wrote to memory of 3176	3092	cmd.exe	96
PID 1688 wrote to memory of 5892	1688	svchost_CACABCCABBABBAAAAAACACCBCAACBCAACACBCCBACBACCACCCBCCACB.exe	98
PID 4108 wrote to memory of 4416	4108	2026-08-17_6cd76166487dda715267dc26d75d03ae_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	102
PID 4416 wrote to memory of 2692	4416	cmd.exe	104
PID 4108 wrote to memory of 4680	4108	2026-08-17_6cd76166487dda715267dc26d75d03ae_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	105
PID 4680 wrote to memory of 1432	4680	cmd.exe	107
PID 1688 wrote to memory of 1608	1688	svchost_CACABCCABBABBAAAAAACACCBCAACBCAACACBCCBACBACCACCCBCCACB.exe	110
PID 1608 wrote to memory of 5592	1608	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-17_6cd76166487dda715267dc26d75d03ae_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_6cd76166487dda715267dc26d75d03ae_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBAACABBCCABACBBCABCBABAABAACBCACACAAABCBCCABCCACCCAACACBAABAAABABACCBAACAAABBBACCCBBACACACAAAABACBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCCABBABBAAAAAACACCBCAACBCAACACBCCBACBACCACCCBCCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBAACABBCCABACBBCABCBABAABAACBCACACAAABCBCCABCCACCCAACACBAABAAABABACCBAACAAABBBACCCBBACACACAAAABACBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCCABBABBAAAAAACACCBCAACBCAACACBCCBACBACCACCCBCCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCCCCCBAAACACCCABBBCBBABBAAABCCACAACBACAAAAAACACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCCABBABBAAAAAACACCBCAACBCAACACBCCBACBACCACCCBCCACB.exe" start= auto displayName= "UserDataSvc_CBCCCCCBAAACACCCABBBCBBABBAAABCCACAACBACAAAAAACACBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCCCCCBAAACACCCABBBCBBABBAAABCCACAACBACAAAAAACACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCCABBABBAAAAAACACCBCAACBCAACACBCCBACBACCACCCBCCACB.exe" start= auto displayName= "UserDataSvc_CBCCCCCBAAACACCCABBBCBBABBAAABCCACAACBACAAAAAACACBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCCCCCBAAACACCCABBBCBBABBAAABCCACAACBACAAAAAACACBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCCCCCBAAACACCCABBBCBBABBAAABCCACAACBACAAAAAACACBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1432

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCCABBABBAAAAAACACCBCAACBCAACACBCCBACBACCACCCBCCACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCCABBABBAAAAAACACCBCAACBCAACACBCCBACBACCACCCBCCACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACBACACBCABAACABABAACAABCABBCCBACBAAACCACBCACAAACAAAACCCBCBBABACABBCCACACBAAABBACCACACBAABACBBCAABABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCAAAAABACAAABABAACBCBBAACCBAABCCCBABBBAACCACCBACAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACBACACBCABAACABABAACAABCABBCCBACBAAACCACBCACAAACAAAACCCBCBBABACABBCCACACBAAABBACCACACBAABACBBCAABABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCAAAAABACAAABABAACBCBBAACCBAABCCCBABBBAACCACCBACAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5592

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCAAAAABACAAABABAACBCBBAACCBAABCCCBABBBAACCACCBACAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCAAAAABACAAABABAACBCBBAACCBAABCCCBABBBAACCACCBACAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1148

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCCABBABBAAAAAACACCBCAACBCAACACBCCBACBACCACCCBCCACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCCABBABBAAAAAACACCBCAACBCAACACBCCBACBACCACCCBCCACB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 c904f4fecaaa0e0bb3ed064661a31e5ee548c49216a029266d24d086b0ed0fdd
MD5 70608a8e22a29a79380108d38c2e97e7
SHA1 36d4ffed3391719e9abf081fdec4c065fa58844c
SHA512 7ab94de3a9e850a77da46993d10539d61c1222a11f56cc109ce01ab33a94cf90cba2a410d7365a765e12052583f1fe0632046ae718fc8ae16b22ee323c1acfdd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 7f745e4c55a23a701daf34d643784c5aa7204b8e167ae39def8a5c3543a6193f
MD5 2ce56987e9364392e4cbbd3dc8226b7e
SHA1 6c1aca96638edce2282719b58510c7f6b6442ead
SHA512 16e0332a25a2998605cc761177f5e29fc2c9510e1723cfce843f2ca8dd6d5e063d6be535e7e78cfe235bf7f3f5aaee30c10b5fe15334bc67f38e18986032b7c2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 13bd23ae272e901b7095e70154c9b4fa9c20630a39aefc25b802cd86a12dfdc7
MD5 1216bd8525cb2337836bf8cb10a94d06
SHA1 d9a069632c8a3019b9dceb84845e6bffa0c80c6c
SHA512 99b800b157178c4b4185d73c45aef8fd1446d542611cc7dd62c6d83913a31602543be8bd4535aa26197b7833b287d06e133869130ed9999559332d91a9c29b07
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Network\qap`g`v~dtlq
Size 10B
SHA256 41d554d4dbbce4ad0e7f5b3b8a8c7ea9a397c5f4a92958e77346891e9f0b3cad
MD5 0c26c87912dfc81b4ff0c8b758a3d1e1
SHA1 4a802a287fd4fddddcc330dcb64f3644c791b673
SHA512 b988a08ff043c4bc6dd9ca9956a6c59ac4d5ba399718810517357523014db023797cdf419ba2abf19713f11c0412c0c783f92bd780eb005adc7089e19632112e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Temp\qap`g`v~dtlq
Size 10B
SHA256 b23ab2d363aa4df4ec7260d393e0c91385b8cd200e435353419b15324b9e3e19
MD5 ab48e5010c4dc2c85943fd7ae0a32310
SHA1 750440c116ff6c39c93fc2c7a70b19aeec71a1cf
SHA512 f581306105cb0b41cf07f94f271f32af71a7a340026d76bd031cfd712d0c01a53b9c6dd45610ac680b0db0006e1e7261877f66e167af1f9e29f5915460b80dc5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 ecc8ed083e16fb434ff331f930b947e7a82e98fa18b2d90911b0c22cf5b86388
MD5 a32881491ea15d4298943f7430f8fe3f
SHA1 5577d8c82c13bba3ad65150031d61ade0481b901
SHA512 b8a2789a14ca0948cb74100b19c481e83924d43e6c78441d61447bdefc5158ae03b17381a57b7a74c10afdf308e7afa2105ef3286659a131fc3ec285825c97fe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 46ee4f3ec664caa0b87c8f27639a02413b9f7206a3feaf6c01dd16b9813515f3
MD5 e36f7cf61ef84570a6fd83165090d342
SHA1 145f1efb5064f53cc4890aa1c5f391f856dfa553
SHA512 a7f9945bb425dd37135b4249be0ae6f04a05f36bf3a1585bb7db28e3a18baf6fb2fee95161d54d604551784fe1e55fd2af533b28f17e8ef693f4f0996e294117
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 46f71158e0654e88d84b5df610b880ba905e8310c885f3cad08cd8683309552c
MD5 7d511ce7bd74df83e47e78cfc364f550
SHA1 064784067ec5aeb344565b2a140ad4e73e2fc42e
SHA512 41246da04a9f8f70adbe14221a3a8f53ff1862f4ffcee24c2451b4475dd588d4d261550a5e409543448c0d57f4b7f8c3b6c1cdb2edfc020f91bde123436c52d0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 fdd725d16acddd73ac04d43a9e7ccd23d1ba0f25e8cb5a72644ffce2dfd4bfe2
MD5 9c865aeca6ddc456846831351429b00a
SHA1 3cb4f033b4b2f1fe702e372b210fd6dce57ae2e2
SHA512 447f2e49e2dbf005a79dc62c846b1573fa4106a7c96d3b2122426f39daf097119011250c4838c30ff23a8e43c019331fbdbf2e5b958df056a394af61ae304787
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\qap`g`v~dtlq
Size 10B
SHA256 81585c067d7c38a593eef2819fc1a83412f691e8375d00bdfb1461e88362f996
MD5 c4e4924173f07bc86cc3f612df2c9bd3
SHA1 56e1baa391470df87ffea52d999521e96b360af5
SHA512 7e0a609515f90b502643376ab36b44c9537e8a59201e195ff7c93f816102a947f31e87509945c73f0a9214eac9ba5e0e8be524812373d693dae0f501b301e98c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 9213656876bd60f5c417b9a1eb26925918fc5047071837c79970449ce645625f
MD5 1af913b9a4bf1acada41d73cb24b674d
SHA1 c6d50ec63b68e11972cc3729eadc58e13a71dd85
SHA512 6fe3ad84d9cd9b65255b9f18c888cd8d7e583df73a47a930167e5751e6184a07d18804c70812cfd5705c57d5365301448b3696c3b95d0be9d217bf21ac793a91
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 ff81a3218f3e9cc95df7a23f1ba63deaf7e4bf5682ef6af067de6712089b9e6a
MD5 56d8237c54d98023cb608ced8ead4c91
SHA1 977460489d6c4abc0e026cab57551b3269ee8cd7
SHA512 e20f214aee6cb590aa35c5b429ccef67caecb0598fb1cef8315ed0da680e22833971adadbebd05055999ced0f1eda91ae8219369201c4e4c8305a5ccc0dd4057
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\windows_ie_ac_001\AC\INetCache\qap`g`v~dtlq
Size 10B
SHA256 c8a5b28c890c6ed945804d06606fb4c9bf266b395c0f7bb7fa92bf0a85601ff4
MD5 e0480a2dc3c5cdcce3544b71343342a4
SHA1 0899398ae5e7762a0f932954399784587e4eeed2
SHA512 576e8061697a1dc9759c9d6170f3ea826e004a2e69f14db9db21d55062a9d41d4533c9063584806d549764d2900696bb0bbfbad4854e933989dcf68d2c7f4a48
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5e76bf50d9968c39ee2a0c76565878c444d9c7777c07df2d37a452d030f63b59
MD5 5e6b40f7fe3c2b7d1cf91681ebe2a870
SHA1 b08268cde6f4ca6ed526bb16e09c012bb0dcecad
SHA512 3ab50ea00da881133939f0968c3fb9d08bdb96544d3cdfd1be94e72625b3076477677d82bc15301a093db74fbefbb168bd6c985a6df37de7f83a8d811b64c2f6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6df6dd456c58f740d41ed5f1d05c17c6c7665cdde5ac3f7d1551fb1b06f71b3e
MD5 9c8fc1cd0774e50c5533a46eb39d6948
SHA1 b22f156d19e5ef1b033ebeaf030c6da2fc78d6e5
SHA512 949a6f5a875b12817f3068730f40b7f2ee0f54d60fffde5a5076793a5a9778108ebd91bd0b25cd62f93308e6e457c872dcf6bc6b1cb6e982122c033471900f68
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7434caed9e9e2119cdd93ec5a2e328ec66f71e8e96b52cadedc9223cca392ff0
MD5 53234ec534f2178bfaaddbf75ac7d41b
SHA1 2c6e19fa335e1f5a3066fe677ed6ac14df97c75e
SHA512 01a1fd40c47dabaa15cc00dbbc5bb5cef29f4ce978116f66a95c2158062df3ae8adaec9d592e5415e755f2a51c1ee15338731a1a1eb1d2b8302967d9e08066b0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d431c00edf7dbc574ccaea1c56401998609fd5a6475500c0027e74b55191b5d2
MD5 2b8d3f730b35f5fc8d3bd1d6d0dcc3c5
SHA1 935102a905dded01ccb78b454d4b081fa9108ab1
SHA512 d7e4d7768a13038ad0196eabd3d268c54a1b7af78409fefeeea2200ae89f9ec02607a18fc4b89c4a931744b248237ff3005fef2addb6c726c66d984d950f57af
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e97b2f6997091b95ed09e28b5014343010170653c52e6d25332841e157f63651
MD5 68d2122694a973d3ca1e8f0d3ab5dba9
SHA1 6c3aa8ff383efc52c6a95408dbb4f3b2f451253e
SHA512 989b478ed39f5b876222d9dddbc048e415a25b68b7f52340ca1e6827945cece3a871f8c53d1af18c2af3664ed0b0e178cb9a585107f8677d821bd823b3d48660
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3b31966374e7b45aa339b79d35f79d61caceb996d14ed9c847a8e461618af410
MD5 35865d5cf82f1675f6ea8e3dde57a4ec
SHA1 bb2a6fec80a4d3fa52bc5cfe45638726492028b5
SHA512 aecbad78afc744c10ded338b5e00eca994a9bb5d41c5cdb337006a17b4d74c7f5f20ef4f383f2f5dab23526592573a22babb0333fbcec176267b8903db3a7aaa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Documents\OneNote Notebooks\qap`g`v~dtlq
Size 10B
SHA256 e8903c29402bd7d7dff7e4b324de35b0351bff03aa3e78f3c062c87ee3b6c4f8
MD5 47106dc0630a065083b6842be09f4885
SHA1 dab5b839394f8cc672500c6de3579cedd113b66e
SHA512 8c446a3695c6b065c53450adc5ac88f97f57af9585e75e2ff8c3a7aa7aceb9867f023554c2af36735f19ed45064586fa0a954e2625f389fc757bd1a37dddc9af
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Documents\OneNote Notebooks\qap`g`v~dtlq
Size 10B
SHA256 f395774c0086d32aa238975374df783962aad7f5060ab9a8d4599e641efa5ac5
MD5 381734bcbe2a17a23c0ad7a691d6a3c6
SHA1 541bf48d7ebedaa9357d6555fd1f177593794e79
SHA512 133759009e798bb96252aa2a1a1d20c40cc79efe03ae810b1beb028517885647ab6dc098f4f80a0b5c9a53fe703a1f0c35752bdf34444b04874c1ad23e72be22
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b076a5a20a47b3baf1afdd553675efa272a89303df36351300b142bd939779b4
MD5 29451337fa6a76062b48692d58b0a780
SHA1 62a2fee8b2914a55c575dd6463e881dbd369feda
SHA512 79f7c374dd8308042cd01413880c715db16f16dd9e3a3435b468e003fd7a212a2694eea2523e8eeb0f96562366da5383e7b1124d5961b99216b920dbbedfce7a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9b0354cfc565b4bc8221b9dde4b973d3db6fdf9c68a8e2e0457ee70e0c323364
MD5 d83e4a064edb660a6bcf178631709532
SHA1 b616c19c9f197a3d3fbc71b5b84401d45a926501
SHA512 5016e356f9458c5a0475d3a33bd4ce974ea42136f615244cf15965d1fb132342f57e3ad413031ba2a474df77cb0400a6abf269e644df5cd6dfdb67993419ee6c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8891a6379e82810c3790ec05255156486e7dd11f885a09f6290b2721bd45fb53
MD5 86245699294684f30d526e87e251437a
SHA1 e2db6856344e504938e6b9e62e1a19e7a005bb69
SHA512 dfab344dd9d0411a74a1563acea760bba0e489b17f2bf42a4ffd8b487d18a29dc1c5015e97f84088c98271221d1b0746c18e32a5284a79fe55b8e1adc8d57e38
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 acf2a35ff9594c76559d57325cb0b0ac8a10f6008598eed0356c949f2b468213
MD5 433c0075a0a70f38b33281c8299119fe
SHA1 710bcbf517c3dae356ce68f7b7069157c0554376
SHA512 7e73fe79139bcb144ac07edf095443ef877cc9fad6106e3a6c07bd9a7b0db5a0cf34cac4e31d01da46e5a3120ef4edb7d74f61c46db42caa424521b6c706b4ad
MD5 SHA1 SHA512

Submit Download

svchost_CACABCCABBABBAAAAAACACCBCAACBCAACACBCCBACBACCACCCBCCACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCCABBABBAAAAAACACCBCAACBCAACACBCCBACBACCACCCBCCACB.exe
Size 28.2MB
SHA256 5c897dd099a3716aab7e6fae981c77700d0c9dc3164f8214c2243fd4926ac78c
MD5 6cd76166487dda715267dc26d75d03ae
SHA1 3bde5b7ea86d3feee0f78944aa326ea1951a4bfd
SHA512 912629312a3b225dbe292e3f661219b71b59901f4e27226cdce97ec366a1c5c79864e7e85fe5b9f81e9223858c67e81f64ba90d919dee0ae28e2ecdc4a359664
SSDEEP 98304:FKRuy5aUKRuy5aUKRuy5aUKRuy5aUKRuy5aUKRuy5aUKRuy5ayKjKWQckVgtev5X:FqFqFqFqFqFqFq0KWQc0gEYnvLe
TLSH
T1A2576C05F98340B1D97B11B04DCBE3BF8974BB2186228DEBF74D8B2F6933B915428656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 43f6b010731ff731d0628a0fa0e8b44e4727c5177c1bec0163942790b3e817c4
MD5 bb916cbdf7b88d7608c3075fdd164931
SHA1 0c52b1731ea44dd0072d8acd79b0f74172117e36
SHA512 cbc2cbc311d9a88b75f19e41e37a5411808380a159fc847ae5f6dc7f5be8844cb6d31491d4229212a39da05f2537340fdd40f42a9a3842215c49b8f0e2618ae4
TLSH
T1F421A171E4F6DC53FA2328CB96299B420CA4379FACACAA48530D8218BB95C35DF154E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 01bbf9af976da3c00df6b3f17d00c92e79d76824f68c0b47c00d3f4ec45ce6bb
MD5 5ab277d04859b253724ace8534b1127b
SHA1 330d338c4180da6e0bbe9d568e84655369f3cbbd
SHA512 73f5ec658653f346de0b5b66f6befa937c444934c5c8f68af5889c48ff68387dd977d4e7c2c936ce52f896e79d69e0dc09cb9f0a55a42fba5f46e4166d86a0ea
TLSH
T19621C360E4F6D853FE3328DF96298B420CA4379BAC68AA58130D821DBF95C359F154E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 a49e99c8cc80f9aec3c9b96e76dee80b6427e9e4087da5336ce9742a7ab74f0d
MD5 f70cd37ed91f330d49dad6c569449c9f
SHA1 b4bef9e62ac248376054648f64e57a474d8beba9
SHA512 1186b4201a1593693a2b80e10ae0a598e939118f44aa7bd1be9de8e93d4bec0a4ddca0ce8312323f392dcafafdbd9bd190fd1d19c8444d59015d59278774a8ca
TLSH
T19011E360E4F6D813FD3328CF92298B420CA4378BAC68BA18130C821CBB95D359F150E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1148-333-0x0000000000960000-0x0000000000981000-memory.dmp

Download

memory/1148-80-0x0000000000960000-0x0000000000981000-memory.dmp

Download

memory/1148-2473-0x0000000000960000-0x0000000000981000-memory.dmp

Download

memory/1688-46-0x0000000000180000-0x00000000001A1000-memory.dmp

Download

memory/1688-89-0x0000000000180000-0x00000000001A1000-memory.dmp

Download

memory/1688-68-0x0000000000180000-0x00000000001A1000-memory.dmp

Download

memory/4108-10-0x0000000000C50000-0x0000000000C71000-memory.dmp

Download

memory/4108-47-0x0000000000C50000-0x0000000000C71000-memory.dmp

Download

memory/4108-69-0x0000000000C50000-0x0000000000C71000-memory.dmp

Download

memory/4108-93-0x0000000000C50000-0x0000000000C71000-memory.dmp

Download

memory/4108-21-0x0000000000C50000-0x0000000000C71000-memory.dmp

Download

memory/4924-1248-0x0000000000180000-0x00000000001A1000-memory.dmp

Download

memory/4924-3466-0x0000000000180000-0x00000000001A1000-memory.dmp

Download