4414452104b74bc342eee12629b62e2989d3ba0f01a8f892d1a3d8460e65935b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_ea299dfc4fe9ae74d752dad12cc3d996_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Size 43.2MB
Sample260819-ejs6zach33
SHA256 4414452104b74bc342eee12629b62e2989d3ba0f01a8f892d1a3d8460e65935b
MD5 ea299dfc4fe9ae74d752dad12cc3d996
SHA1 a989e7fb537b35e407d7caacb7d450d99b8eb281
SHA512 2dd467a12343832e1699130290354c74403a0c837090e71ca373821c8328042063a91eb16c86dab26a38b1013966a0227410d4915bf35e948673fc1abd3bd88d
SSDEEP 393216:QooooCgOLlcooooCgOLlcooooCgOLlcooooCgOLlRcZEIvb:V///2EIvb
TLSH
T18FA79E06FA8340B1D97B31B009DFE3BF4979772185318DAAF74D8B2B6933B51582835A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCCAAAAAAABCAACABACABCBCCCCBBBBBBACCBBACAAABCBBCBCAAAAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCCAAAAAAABCAACABACABCBCCCCBBBBBBACCBBACAAABCBBCBCAAAAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5092	svchost_CCCAAAAAAABCAACABACABCBCCCCBBBBBBACCBBACAAABCBBCBCAAAAB.exe
2648	svchost_AACBABCABCAAACACCACBBBAACBCCCCBBBCAABAABAAABCBAABCACACA.exe
4468	svchost_CCCAAAAAAABCAACABACABCBCCCCBBBBBBACCBBACAAABCBBCBCAAAAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CAACABBBABCCACBBABCBBBBCABAACBBCCAABAAAABBABBBCBBBCBBCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCAAAAAAABCAACABACABCBCCCCBBBBBBACCBBACAAABCBBCBCAAAAB.exe"	2026-08-19_ea299dfc4fe9ae74d752dad12cc3d996_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BAAABAACBABBBBBABBCCBACBABCBCCCCBBBCCACACBAABCAACCCABABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACBABCABCAAACACCACBBBAACBCCCCBBBCAABAABAAABCBAABCACACA.exe"	svchost_CCCAAAAAAABCAACABACABCBCCCCBBBBBBACCBBACAAABCBBCBCAAAAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3328	sc.exe
1716	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
804	cmd.exe
1140	cmd.exe
3464	cmd.exe
3784	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCAAAAAAABCAACABACABCBCCCCBBBBBBACCBBACAAABCBBCBCAAAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_ea299dfc4fe9ae74d752dad12cc3d996_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACBABCABCAAACACCACBBBAACBCCCCBBBCAABAABAAABCBAABCACACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1288	schtasks.exe
5028	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3540	2026-08-19_ea299dfc4fe9ae74d752dad12cc3d996_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
3540	2026-08-19_ea299dfc4fe9ae74d752dad12cc3d996_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
3540	2026-08-19_ea299dfc4fe9ae74d752dad12cc3d996_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
3540	2026-08-19_ea299dfc4fe9ae74d752dad12cc3d996_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
5092	svchost_CCCAAAAAAABCAACABACABCBCCCCBBBBBBACCBBACAAABCBBCBCAAAAB.exe
5092	svchost_CCCAAAAAAABCAACABACABCBCCCCBBBBBBACCBBACAAABCBBCBCAAAAB.exe
5092	svchost_CCCAAAAAAABCAACABACABCBCCCCBBBBBBACCBBACAAABCBBCBCAAAAB.exe
5092	svchost_CCCAAAAAAABCAACABACABCBCCCCBBBBBBACCBBACAAABCBBCBCAAAAB.exe
4468	svchost_CCCAAAAAAABCAACABACABCBCCCCBBBBBBACCBBACAAABCBBCBCAAAAB.exe
4468	svchost_CCCAAAAAAABCAACABACABCBCCCCBBBBBBACCBBACAAABCBBCBCAAAAB.exe
2648	svchost_AACBABCABCAAACACCACBBBAACBCCCCBBBCAABAABAAABCBAABCACACA.exe
2648	svchost_AACBABCABCAAACACCACBBBAACBCCCCBBBCAABAABAAABCBAABCACACA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3540	2026-08-19_ea299dfc4fe9ae74d752dad12cc3d996_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Token: SeDebugPrivilege	5092	svchost_CCCAAAAAAABCAACABACABCBCCCCBBBBBBACCBBACAAABCBBCBCAAAAB.exe
Token: SeDebugPrivilege	4468	svchost_CCCAAAAAAABCAACABACABCBCCCCBBBBBBACCBBACAAABCBBCBCAAAAB.exe
Token: SeDebugPrivilege	2648	svchost_AACBABCABCAAACACCACBBBAACBCCCCBBBCAABAABAAABCBAABCACACA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1428	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 804	3540	2026-08-19_ea299dfc4fe9ae74d752dad12cc3d996_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	96
PID 804 wrote to memory of 1288	804	cmd.exe	98
PID 5092 wrote to memory of 2412	5092	svchost_CCCAAAAAAABCAACABACABCBCCCCBBBBBBACCBBACAAABCBBCBCAAAAB.exe	100
PID 2412 wrote to memory of 736	2412	notepad.exe	101
PID 3540 wrote to memory of 1140	3540	2026-08-19_ea299dfc4fe9ae74d752dad12cc3d996_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	105
PID 1140 wrote to memory of 3328	1140	cmd.exe	107
PID 3540 wrote to memory of 3464	3540	2026-08-19_ea299dfc4fe9ae74d752dad12cc3d996_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	108
PID 3464 wrote to memory of 1716	3464	cmd.exe	110
PID 5092 wrote to memory of 3784	5092	svchost_CCCAAAAAAABCAACABACABCBCCCCBBBBBBACCBBACAAABCBBCBCAAAAB.exe	113
PID 3784 wrote to memory of 5028	3784	cmd.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-08-19_ea299dfc4fe9ae74d752dad12cc3d996_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_ea299dfc4fe9ae74d752dad12cc3d996_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCBBCBBBCBABBBABBBAABABBCCCCACAACCABBCBBACBABCCCBBBACABCACBCBAACBBACBACABABABAAABCCABCACACBCACAACCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAAAAAABCAACABACABCBCCCCBBBBBBACCBBACAAABCBBCBCAAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCBBCBBBCBABBBABBBAABABBCCCCACAACCABBCBBACBABCCCBBBACABCACBCBAACBBACBACABABABAAABCCABCACACBCACAACCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAAAAAABCAACABACABCBCCCCBBBBBBACCBBACAAABCBBCBCAAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABBCABABCCABBACBCBCBCCABBACABAACCCCABBCCCACAABABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAAAAAABCAACABACABCBCCCCBBBBBBACCBBACAAABCBBCBCAAAAB.exe" start= auto displayName= "UserDataSvc_AABBCABABCCABBACBCBCBCCABBACABAACCCCABBCCCACAABABAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1140
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABBCABABCCABBACBCBCBCCABBACABAACCCCABBCCCACAABABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAAAAAABCAACABACABCBCCCCBBBBBBACCBBACAAABCBBCBCAAAAB.exe" start= auto displayName= "UserDataSvc_AABBCABABCCABBACBCBCBCCABBACABAACCCCABBCCCACAABABAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABBCABABCCABBACBCBCBCCABBACABAACCCCABBCCCACAABABAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABBCABABCCABBACBCBCBCCABBACABAACCCCABBCCCACAABABAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1716

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAAAAAABCAACABACABCBCCCCBBBBBBACCBBACAAABCBBCBCAAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAAAAAABCAACABACABCBCCCCBBBBBBACCBBACAAABCBBCBCAAAAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBBBBABABBAABAABCCCAABBCBBAAAACCAAACBBCCCBBACBBCCBCCAAACAABACCAAAABCACAABBCABBABBABABBBCBABABBACCBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABCABCAAACACCACBBBAACBCCCCBBBCAABAABAAABCBAABCACACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBBBBABABBAABAABCCCAABBCBBAAAACCAAACBBCCCBBACBBCCBCCAAACAABACCAAAABCACAABBCABBABBABABBBCBABABBACCBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABCABCAAACACCACBBBAACBCCCCBBBCAABAABAAABCBAABCACACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5028

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1428

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABCABCAAACACCACBBBAACBCCCCBBBCAABAABAAABCBAABCACACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABCABCAAACACCACBBBAACBCCCCBBBCAABAABAAABCBAABCACACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2648

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAAAAAABCAACABACABCBCCCCBBBBBBACCBBACAAABCBBCBCAAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAAAAAABCAACABACABCBCCCCBBBBBBACCBBACAAABCBBCBCAAAAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 dbd67258cea013dc827278705de8cfd4c538b6683b24fa10297707834475db43
MD5 3e5c3a722b1ce4287d39133231871317
SHA1 2a01f0284af606c5e1b1585f950027c8b0e73c05
SHA512 e3c80de805838117ab9abf13a71a4baf80d4358440a0a752c3ab28f4fa3242611949a534261aa2241685bea35b25c8cdaf80aef35511dd43c8c35a9ce80979a1
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 43.7MB
SHA256 f00a0fe1863e230f4f76103b5348670f2780c631cad4228c0a9e9ae46ff0d32c
MD5 a2f02bbe8e3862451b381a2915917313
SHA1 1b0b8d4fa336083ed54fb68863836d18705fff7d
SHA512 41392f031292b426524410549198ded39b5c391921ef376439cf3fd819055c2e2b694312344d595ab4d02200ff3931fe8f7900c010f79f60ae0ce7804ec55188
SSDEEP 393216:QooooCgOLlcooooCgOLlcooooCgOLlcooooCgOLlRcZEIvs:V///2EIvs
TLSH
T198A79E06FA8340B1E977317009DFE3BF4A79772185318DAAF74D8B2B6933B51582835A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Diagnosis\TenantStorage\P-ARIA\qap`g`v~dtlq
Size 10B
SHA256 bf48b126f8862771699e68af7beb3b6e1657c61bd52609c1c1a05720863d7962
MD5 d5959e545b8c79c321a851040b3154b8
SHA1 6527e17b81498261d24d041b785f70ebb60c496e
SHA512 aaf7582049ed94d6632f733211140673a581d55875595d5167573539fc7691dc84a96cef072ac58b8f4f1f13c8ffb1ef52a04b2b3a1c0d818a7b472c664cb8e2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\WDF\qap`g`v~dtlq
Size 10B
SHA256 783d0b299638d5b0db49f13fa71706d8f85edb7afaf85ce2db7ef70eb24683cb
MD5 29d2077dc9e58d4d17470d70b9c9043d
SHA1 302e8a4d896f4a8319d91e9b895acc2495aa82d4
SHA512 a82bbec832e2393dbc5a486b2c1e2e831a7d781cef34ca7d1f2538e67577584efe16ed0fea69df2786ad4989aa8a4edd9bbbd23a83391a98a77b7ecf52a8cdeb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.CapturePicker_10.0.19041.1023_neutral__cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 b39e4274149e0b24cd5725c7af1d5c4b4be54d1e329baf098eddfd37a9763f2c
MD5 85feb0ef47b534419667319346063f57
SHA1 c5be410fcaf8595e06053e0d8792962556ab5891
SHA512 592cb7354f72d81a11cfa565e7054e608510c4a99e78c31295c63b1ed1f2fe30b65c8b1f186b84637ce94470fef64a8d37534eef3647008dc07cfe644135a777
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Windows.CBSPreview_10.0.19041.1023_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 0dbf232864e8d1a7ba5a73d47e05cefef5fd66b2015b3ecb85f78947faa0da67
MD5 77e53dfeff174b1a65113d53b873725e
SHA1 c70d92f5d6b8c12d937de2b4a5af9a802e48a2e1
SHA512 b5bbceed6bed50076e4c76362033deb7d8af9080f8a10cd20226aa8f7e2a8c8c50f6261b29305690614b5aaaa6ecd16bc1f1e70d6f91181b21a93600fcefc6f0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 379f1dcd4c2685c5c5171919077778fef1e1192376accaf043eeca65a900a683
MD5 9a60cd47ae7024bc1b44875249079412
SHA1 087e948f003853b0b623f732b35fe96d1788b9d6
SHA512 a66226ee4319ce73acc6cd48c914f8f51b4a1656f453779fff1a58d7de01c711336c91e82e7741092ebd703897d309a4301509af59087efab1979979ebff33d0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 0896bfd935edfdcdd5a51052e75b2b6c8e253edb147469d568315b8362902a85
MD5 5fdfcf12afa6d1596aed875200a9c4bf
SHA1 685a33f7732d1320ce8df3c4d7e21ed4e20c4567
SHA512 a4c1a3edde1e5e70546fec966be486b6e5d63cf7ea38fd5da625d225043a8596e7cfb1dfe17b3e9d7f05abda638b8ee1dbc5a2784693b4f0f69dd1f03c2995bd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 f9f8206851d7565ae0362fe4e7af8ef754644a9651f3d08516dbd8871710d1b1
MD5 2a111e1353b81b30713940aa6e25bfe6
SHA1 1f6b5f4762d6a9a4d4583671c331410d29015351
SHA512 c3ae8f7573237323dce4ae41340ee281dd0384c74fca0b4a5847beff32370360be0b593f86b7fe429d2fb7c4ec0ff3c9c8105ba9695e1bd304ec8391a134f294
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\qap`g`v~dtlq
Size 10B
SHA256 4a50a9e1aa2ee1dbed1a14a9e3ce5230ddb35b1edc6284e292e182b221c154cf
MD5 e2d12d4c7b67a2ea5921f73ea3ffbfd6
SHA1 ef7925f3e19d0f1ab7b16de4183c1fce1aa44657
SHA512 97408b6d2234f998e4ec3f201a52a2348b07770cc4f427e57df80db7138fcbdf93bcb2b5b66bfd60a650e7e1c4063f17128b6fc43e6f2cd01133aa410c51924e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 31e7021a0eaa04e2c71a9221f74e9026692d5e5d2ca81e915b6a5907bb3b4c2a
MD5 f2b0d4ca610ff49ae9f091c68edcbc09
SHA1 ca31d3862142b72f40a3f763ffc51ebd3d74d65c
SHA512 9dbbf66abe706d22116d632af601c66e4df96529aa5f5e9e207f6009590834db9d686cb0f222b1426c0aa1611138d036e505ab7e05bf35622e11815bd99e91fd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\INetCache\qap`g`v~dtlq
Size 10B
SHA256 bd157f94a54874666f64b5edf458ad9a34af8323aeb400d73c9994efc76865ca
MD5 95cf8ad6d57d5b20d50364e2cdf50b4f
SHA1 c2c91bc3464b8ed6c750ccbb7d74677b4564336d
SHA512 8a4cd8ba818f4d76718b2ff5b612979bdaf217448efc5544c6ca9ed59510ee847baee36e900cb88725b9404c6bd1572a26d8bdc171ead12b2d028fb1a4a17d3d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Temp\TCD3B74.tmp\qap`g`v~dtlq
Size 10B
SHA256 ead2d19b15073ce2e6ceb40167d18e8521535d0fa767c5acf6d94972f1027df8
MD5 2408ddde32ffa5df474157b1c3457bf0
SHA1 a05f0e02049d350822fd7592f18d599dc1d5d16d
SHA512 e3e661bdf764f58089d1f12282678e46d6749faec7bc3091733ad3ecc2cdc1c934e3a739ee99936dd2f314f7959a1e927a06c7c8102df2e187c7af044ddb028b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3236fc27626711e6f9061fe17b3dbd7f628a3ca0b0db4b7c8df4c7aea9847e69
MD5 9e73116b9dadef53fd87a5d1d49c9771
SHA1 ffcea103fd3d7dea4d95ffed9421c10b9008a202
SHA512 54a4755d1cec0b2bd914e974ed8a1d8b8da29579e2545bee2542dd63bcd9916d00e0e2db3ec2c1f118fa877a45f26d50f02dd556c72345acb5737c5b136875f9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 62732a325444f9f9ef904dea367cb37c9ae8b8247a640a71987d36e928c7a836
MD5 10fb03d645473eaa2999e63f8bd28dab
SHA1 7f68b75d6aba6fa600b3e7faef880401b105856d
SHA512 7e4e69c7ff4eeb23c5bf5620d1b8703d8fc24a25f9fe19124e75be8c6a4b24e21264bc2d1f4c92be2cf4c43b062f56a4fea054c00833e1cdc0dd27c08bc76094
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c90c555327ff6b6317eee0616eea3d6aa5c8ce744d3a633e44ee2de39d3f9bc8
MD5 4bc5109100d9fe651339de5eaf601738
SHA1 c606a27a4ecca5bb692a8a8b2dd8a41447886153
SHA512 604d06cd229f3ba824abdb03403e8d0d140fee4aaff35dde3fefcfb851126eeb8b5f024605dddc34e34585740811d9f3eac5d18640fd6a0e3f1aca491b566281
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 36c0cb8afbc4c6f7f7f865ab93a7dbaa1cc7b86493db547db3ecc7ec3c419b04
MD5 8dc79e8c3997a41a4f46dcf8fec1b873
SHA1 c23498b183cbe2903e7596b008b58a0d33e6dd40
SHA512 db0e08f5cf1917078ea6eaa4731fadebddb8f68b4630b36bf65d6483c2e576c3fc0578b4def312f75f04faa96f1e4b092ccb3fb6e4a70fb2085fe66169d26f44
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a3b01dc8c689d5f355c30a37f099a1d588c521ed897555ae14099f99451e1a6e
MD5 15181b5b8eb474f5df0deba34ccf87e0
SHA1 cc7e83d25cde17bf26e78c0cd6c2065268774fb8
SHA512 1a9671debc1aeea99bb395ad317b6cda80bbbf66abab009e27512d3ccfdefa956321d067983baf452535fb98fecaedb28a0c6968c9e0c48897eec42ebe3ebad9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 12473da6157ae4791bca81f030e52888cdbe5f35d7e3f0c44b010465c220229f
MD5 20415a5409c03295391d9d40ea9f1ce0
SHA1 2c90208cbc2cabeba9efe321b90dac8246422d08
SHA512 65900eeec691b4203d2c0422327a419aeda4b1c84f73f9cadbd7cf2f867646d4d9d179d952420fcc21a4d99c71cf0fb6f9fb396e5797b5c4e9a3f4b0e08ca822
MD5 SHA1 SHA512

Submit Download

svchost_CCCAAAAAAABCAACABACABCBCCCCBBBBBBACCBBACAAABCBBCBCAAAAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAAAAAABCAACABACABCBCCCCBBBBBBACCBBACAAABCBBCBCAAAAB.exe
Size 43.2MB
SHA256 4414452104b74bc342eee12629b62e2989d3ba0f01a8f892d1a3d8460e65935b
MD5 ea299dfc4fe9ae74d752dad12cc3d996
SHA1 a989e7fb537b35e407d7caacb7d450d99b8eb281
SHA512 2dd467a12343832e1699130290354c74403a0c837090e71ca373821c8328042063a91eb16c86dab26a38b1013966a0227410d4915bf35e948673fc1abd3bd88d
SSDEEP 393216:QooooCgOLlcooooCgOLlcooooCgOLlcooooCgOLlRcZEIvb:V///2EIvb
TLSH
T18FA79E06FA8340B1D97B31B009DFE3BF4979772185318DAAF74D8B2B6933B51582835A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 bc157e7c53b542f6e4e7df92f71d7331140a5702c1bd845387004acf37391f11
MD5 791be1e3f45840d540f67e3a73968b59
SHA1 72794d28ac954418ecd63b4a329229debd40b0a8
SHA512 f8abecda22fbb28600e51396e88e030d6071dc6f310e210cd6ec3990fddac8b5b0710d03a6b3e22a23d409045a127bb4e8b74925cf0f5086b4919691e3ed3f95
TLSH
T1AA21F832A8E5D857E93328CB963DEBD38CB4778F989C9B0453094108E7C5D71CD198E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 881e43e57ddceb32874e6a7ee520d442485edc60dad2b93ebc67194d7b594fff
MD5 99bdb3c824b3d1b1c490a69e197b2710
SHA1 7af144f929a0f07661df84950573e0d59114e00b
SHA512 d987f48a09c5aad7e54898dd994e47feb031a2580a488e4e04acdda2e9dc8f9542b74a86f0a4256b348d79ebdfb0ea154427196c7555117ad3bd3c5224e7579e
TLSH
T11721F261A8E5D81BE933288B563DEB938CF4768FA89CAB0823084108E785D75CD594E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 586e6136346dfc7b54ee499da4a4a908dc53a34d49017308bc0ed363fd355faf
MD5 9cc711c2401c9f0688bd22785b2a4b59
SHA1 a6c18ca1037d91d8d59d635e0679073beca135e2
SHA512 1c58b860e987406d23305f3765222af75823e229262ef4cbbd59f6476dcf53813d1edc0156394b5ace80a6d7ec659363dd62aa87fac058a6c263e95b4d3212c6
TLSH
T17211E62168F5D80BE9332987423DEB938CF4768B585C9B0823084108A785D65CD594E3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2412-59-0x0000000005890000-0x0000000005891000-memory.dmp

Download

memory/2648-2159-0x00000000003E0000-0x0000000000401000-memory.dmp

Download

memory/2648-71-0x00000000003E0000-0x0000000000401000-memory.dmp

Download

memory/3540-6-0x0000000000EA0000-0x0000000000EC1000-memory.dmp

Download

memory/4468-171-0x0000000000A30000-0x0000000000A51000-memory.dmp

Download

memory/4468-2838-0x0000000000A30000-0x0000000000A51000-memory.dmp

Download

memory/5092-35-0x0000000000A30000-0x0000000000A51000-memory.dmp

Download