4414452104b74bc342eee12629b62e2989d3ba0f01a8f892d1a3d8460e65935b

Analysis

max time kernel
151s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_ea299dfc4fe9ae74d752dad12cc3d996_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Size 43.2MB
Sample260819-ejs6zach33
SHA256 4414452104b74bc342eee12629b62e2989d3ba0f01a8f892d1a3d8460e65935b
MD5 ea299dfc4fe9ae74d752dad12cc3d996
SHA1 a989e7fb537b35e407d7caacb7d450d99b8eb281
SHA512 2dd467a12343832e1699130290354c74403a0c837090e71ca373821c8328042063a91eb16c86dab26a38b1013966a0227410d4915bf35e948673fc1abd3bd88d
SSDEEP 393216:QooooCgOLlcooooCgOLlcooooCgOLlcooooCgOLlRcZEIvb:V///2EIvb
TLSH
T18FA79E06FA8340B1D97B31B009DFE3BF4979772185318DAAF74D8B2B6933B51582835A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCCAABCCAACCAAAACCBCCBBBBBBCCBACABCCBABBACAACACBCBCBCAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCCAABCCAACCAAAACCBCCBBBBBBCCBACABCCBABBACAACACBCBCBCAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5948	svchost_CCCAABCCAACCAAAACCBCCBBBBBBCCBACABCCBABBACAACACBCBCBCAB.exe
1540	svchost_BBABACCCAAACCABBBBABBAABACACBBBCACAABCABBCBCAAAABCCAACC.exe
4772	svchost_CCCAABCCAACCAAAACCBCCBBBBBBCCBACABCCBABBACAACACBCBCBCAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCCAABBBAABBAAAAACBBACCBCCABBABCCBBAABBCBCCACBBBBAACBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCAABCCAACCAAAACCBCCBBBBBBCCBACABCCBABBACAACACBCBCBCAB.exe"	2026-08-19_ea299dfc4fe9ae74d752dad12cc3d996_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBAAABCBABCCCABACAABAACAAACAABCCACBCCABBCBBACAAAAAACCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBABACCCAAACCABBBBABBAABACACBBBCACAABCABBCBCAAAABCCAACC.exe"	svchost_CCCAABCCAACCAAAACCBCCBBBBBBCCBACABCCBABBACAACACBCBCBCAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5724	sc.exe
4240	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2316	cmd.exe
1984	cmd.exe
6064	cmd.exe
5392	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_ea299dfc4fe9ae74d752dad12cc3d996_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCAABCCAACCAAAACCBCCBBBBBBCCBACABCCBABBACAACACBCBCBCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBABACCCAAACCABBBBABBAABACACBBBCACAABCABBCBCAAAABCCAACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5988	schtasks.exe
5444	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4664	2026-08-19_ea299dfc4fe9ae74d752dad12cc3d996_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
4664	2026-08-19_ea299dfc4fe9ae74d752dad12cc3d996_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
4664	2026-08-19_ea299dfc4fe9ae74d752dad12cc3d996_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
4664	2026-08-19_ea299dfc4fe9ae74d752dad12cc3d996_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
5948	svchost_CCCAABCCAACCAAAACCBCCBBBBBBCCBACABCCBABBACAACACBCBCBCAB.exe
5948	svchost_CCCAABCCAACCAAAACCBCCBBBBBBCCBACABCCBABBACAACACBCBCBCAB.exe
5948	svchost_CCCAABCCAACCAAAACCBCCBBBBBBCCBACABCCBABBACAACACBCBCBCAB.exe
5948	svchost_CCCAABCCAACCAAAACCBCCBBBBBBCCBACABCCBABBACAACACBCBCBCAB.exe
1540	svchost_BBABACCCAAACCABBBBABBAABACACBBBCACAABCABBCBCAAAABCCAACC.exe
1540	svchost_BBABACCCAAACCABBBBABBAABACACBBBCACAABCABBCBCAAAABCCAACC.exe
4772	svchost_CCCAABCCAACCAAAACCBCCBBBBBBCCBACABCCBABBACAACACBCBCBCAB.exe
4772	svchost_CCCAABCCAACCAAAACCBCCBBBBBBCCBACABCCBABBACAACACBCBCBCAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4664	2026-08-19_ea299dfc4fe9ae74d752dad12cc3d996_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Token: SeDebugPrivilege	5948	svchost_CCCAABCCAACCAAAACCBCCBBBBBBCCBACABCCBABBACAACACBCBCBCAB.exe
Token: SeDebugPrivilege	1540	svchost_BBABACCCAAACCABBBBABBAABACACBBBCACAABCABBCBCAAAABCCAACC.exe
Token: SeDebugPrivilege	4772	svchost_CCCAABCCAACCAAAACCBCCBBBBBBCCBACABCCBABBACAACACBCBCBCAB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 5392	4664	2026-08-19_ea299dfc4fe9ae74d752dad12cc3d996_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	92
PID 5392 wrote to memory of 5988	5392	cmd.exe	94
PID 5948 wrote to memory of 5752	5948	svchost_CCCAABCCAACCAAAACCBCCBBBBBBCCBACABCCBABBACAACACBCBCBCAB.exe	95
PID 4664 wrote to memory of 2316	4664	2026-08-19_ea299dfc4fe9ae74d752dad12cc3d996_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	98
PID 2316 wrote to memory of 5724	2316	cmd.exe	100
PID 4664 wrote to memory of 1984	4664	2026-08-19_ea299dfc4fe9ae74d752dad12cc3d996_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	101
PID 1984 wrote to memory of 4240	1984	cmd.exe	103
PID 5948 wrote to memory of 6064	5948	svchost_CCCAABCCAACCAAAACCBCCBBBBBBCCBACABCCBABBACAACACBCBCBCAB.exe	106
PID 6064 wrote to memory of 5444	6064	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-19_ea299dfc4fe9ae74d752dad12cc3d996_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_ea299dfc4fe9ae74d752dad12cc3d996_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCACAABABCCABAACACABAABACCBACAACACACBCABABABCCBBACCABBCCABCCAABABAAACBAACCACCCBBBACBCAAABBCBAABBABCBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAABCCAACCAAAACCBCCBBBBBBCCBACABCCBABBACAACACBCBCBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5392
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCACAABABCCABAACACABAABACCBACAACACACBCABABABCCBBACCABBCCABCCAABABAAACBAACCACCCBBBACBCAAABBCBAABBABCBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAABCCAACCAAAACCBCCBBBBBBCCBACABCCBABBACAACACBCBCBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABAAACBBAACBCCCCBAACAABBBCABABBAACACCBCBAAAABBCAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAABCCAACCAAAACCBCCBBBBBBCCBACABCCBABBACAACACBCBCBCAB.exe" start= auto displayName= "UserDataSvc_AABAAACBBAACBCCCCBAACAABBBCABABBAACACCBCBAAAABBCAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABAAACBBAACBCCCCBAACAABBBCABABBAACACCBCBAAAABBCAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAABCCAACCAAAACCBCCBBBBBBCCBACABCCBABBACAACACBCBCBCAB.exe" start= auto displayName= "UserDataSvc_AABAAACBBAACBCCCCBAACAABBBCABABBAACACCBCBAAAABBCAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABAAACBBAACBCCCCBAACAABBBCABABBAACACCBCBAAAABBCAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABAAACBBAACBCCCCBAACAABBBCABABBAACACCBCBAAAABBCAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4240

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAABCCAACCAAAACCBCCBBBBBBCCBACABCCBABBACAACACBCBCBCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAABCCAACCAAAACCBCCBBBBBBCCBACABCCBABBACAACACBCBCBCAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5948
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACBCBACBBBCBCACCCBACCCBACCBBAACBBBAACAAABBCABCCACBBBABCCCBACCABCAACBBCCCACAACBBBBACBBBBACACCBCCCAAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACCCAAACCABBBBABBAABACACBBBCACAABCABBCBCAAAABCCAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6064
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACBCBACBBBCBCACCCBACCCBACCBBAACBBBAACAAABBCABCCACBBBABCCCBACCABCAACBBCCCACAACBBBBACBBBBACACCBCCCAAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACCCAAACCABBBBABBAABACACBBBCACAABCABBCBCAAAABCCAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5444

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACCCAAACCABBBBABBAABACACBBBCACAABCABBCBCAAAABCCAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACCCAAACCABBBBABBAABACACBBBCACAABCABBCBCAAAABCCAACC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1540

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAABCCAACCAAAACCBCCBBBBBBCCBACABCCBABBACAACACBCBCBCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAABCCAACCAAAACCBCCBBBBBBCCBACABCCBABBACAACACBCBCBCAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 bf48b126f8862771699e68af7beb3b6e1657c61bd52609c1c1a05720863d7962
MD5 d5959e545b8c79c321a851040b3154b8
SHA1 6527e17b81498261d24d041b785f70ebb60c496e
SHA512 aaf7582049ed94d6632f733211140673a581d55875595d5167573539fc7691dc84a96cef072ac58b8f4f1f13c8ffb1ef52a04b2b3a1c0d818a7b472c664cb8e2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 0896bfd935edfdcdd5a51052e75b2b6c8e253edb147469d568315b8362902a85
MD5 5fdfcf12afa6d1596aed875200a9c4bf
SHA1 685a33f7732d1320ce8df3c4d7e21ed4e20c4567
SHA512 a4c1a3edde1e5e70546fec966be486b6e5d63cf7ea38fd5da625d225043a8596e7cfb1dfe17b3e9d7f05abda638b8ee1dbc5a2784693b4f0f69dd1f03c2995bd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.Apprep.ChxApp_1000.25128.1000.0_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 bd157f94a54874666f64b5edf458ad9a34af8323aeb400d73c9994efc76865ca
MD5 95cf8ad6d57d5b20d50364e2cdf50b4f
SHA1 c2c91bc3464b8ed6c750ccbb7d74677b4564336d
SHA512 8a4cd8ba818f4d76718b2ff5b612979bdaf217448efc5544c6ca9ed59510ee847baee36e900cb88725b9404c6bd1572a26d8bdc171ead12b2d028fb1a4a17d3d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 c4bbdb241180864e39b31f45a79ea7f8f5d8dd594440540c4c3ecd5c2cbe9506
MD5 2f9c396f5cf8d5af5a2cd43b1c94acd3
SHA1 226e77abc28bd7c4d8155a2bac5e2ba42e88ef85
SHA512 58029cdcc51a63b4c3e9cefdf560349c8eb99f02f36306d168b3af8ee5520fe1d93070f76d59a97c14a1793b2675ec8e05fbe7a1726c629e8a2e419f525be253
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 43.8MB
SHA256 8d56ed0ac0ef6e1a8ddb72e0bda2575605dba9f7e3ec78c866ced50899a93d0d
MD5 ae1a790426bc35d66570a5a0c939c104
SHA1 fd30ecd1043c2e20965aa0cec9d9af56dccf323b
SHA512 62c48ac6550f032b865162bb587d0010787a3f438ed5a2a791c8c6888dbabfce2d99b594aba4726257ad52b2a233967251178bcebbb0a432b0a4ed8c54a12f77
SSDEEP 393216:QooooCgOLlcooooCgOLlcooooCgOLlcooooCgOLlRcZEIvv2s:V///2EIvv9
TLSH
T1E1A79E06FA8340B1D97B31B009DFE3BF4D79772185318DAAF7498B2B6933B51582835A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 783d0b299638d5b0db49f13fa71706d8f85edb7afaf85ce2db7ef70eb24683cb
MD5 29d2077dc9e58d4d17470d70b9c9043d
SHA1 302e8a4d896f4a8319d91e9b895acc2495aa82d4
SHA512 a82bbec832e2393dbc5a486b2c1e2e831a7d781cef34ca7d1f2538e67577584efe16ed0fea69df2786ad4989aa8a4edd9bbbd23a83391a98a77b7ecf52a8cdeb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 ead2d19b15073ce2e6ceb40167d18e8521535d0fa767c5acf6d94972f1027df8
MD5 2408ddde32ffa5df474157b1c3457bf0
SHA1 a05f0e02049d350822fd7592f18d599dc1d5d16d
SHA512 e3e661bdf764f58089d1f12282678e46d6749faec7bc3091733ad3ecc2cdc1c934e3a739ee99936dd2f314f7959a1e927a06c7c8102df2e187c7af044ddb028b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 b9a378ed536b9729ccd4aed78fb0977dcc2f1b386f74204d69e6b4de1f477929
MD5 7d491a7924d4709dd58e9407afbc0299
SHA1 63e02d84d35d315c2c7147036c55b46f2f8973d0
SHA512 c31e61f936c3c306fbdb36dddad3f9f6601444917a9e4b9f29a91a68b390ee15741512a1ed73a732521962b03de93a3b0b4c9562ea87e2fde25dd699b0a8e88e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\qap`g`v~dtlq
Size 10B
SHA256 6749717d2a7e24be06bbafbcd0af86dfa8b3e5166cd7ececbea9305e103a89f8
MD5 7b00244615ee883c1b35ba8b886debb8
SHA1 275365c55924e1c65941f93d71b27f8b01c83338
SHA512 327e8373fd4d2f848ab5987cb37e5b23703023ec1b5d2024bf4352ebd1642d415164d8abc2a4efefdfec6a67fe77c807ee30845640f0fdf897a3171cab7cdefd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 b39e4274149e0b24cd5725c7af1d5c4b4be54d1e329baf098eddfd37a9763f2c
MD5 85feb0ef47b534419667319346063f57
SHA1 c5be410fcaf8595e06053e0d8792962556ab5891
SHA512 592cb7354f72d81a11cfa565e7054e608510c4a99e78c31295c63b1ed1f2fe30b65c8b1f186b84637ce94470fef64a8d37534eef3647008dc07cfe644135a777
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 a20775de7ff212283099d4deb461440e25d7b6707856a09942686097188aa6c2
MD5 974eb877cde964ace85fc09ba6483072
SHA1 d4fe196d378f2c77fdfe28077e0d7d7f5cc78fca
SHA512 30dae9619d02d8530e98c5d8ed33b75f648de9ff658281e889a550566cdf2f9dc7b2706c0adc500e1868eea28e92d774111791bf47988a42577e154541c5de56
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 0dbf232864e8d1a7ba5a73d47e05cefef5fd66b2015b3ecb85f78947faa0da67
MD5 77e53dfeff174b1a65113d53b873725e
SHA1 c70d92f5d6b8c12d937de2b4a5af9a802e48a2e1
SHA512 b5bbceed6bed50076e4c76362033deb7d8af9080f8a10cd20226aa8f7e2a8c8c50f6261b29305690614b5aaaa6ecd16bc1f1e70d6f91181b21a93600fcefc6f0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\qap`g`v~dtlq
Size 10B
SHA256 379f1dcd4c2685c5c5171919077778fef1e1192376accaf043eeca65a900a683
MD5 9a60cd47ae7024bc1b44875249079412
SHA1 087e948f003853b0b623f732b35fe96d1788b9d6
SHA512 a66226ee4319ce73acc6cd48c914f8f51b4a1656f453779fff1a58d7de01c711336c91e82e7741092ebd703897d309a4301509af59087efab1979979ebff33d0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 f9f8206851d7565ae0362fe4e7af8ef754644a9651f3d08516dbd8871710d1b1
MD5 2a111e1353b81b30713940aa6e25bfe6
SHA1 1f6b5f4762d6a9a4d4583671c331410d29015351
SHA512 c3ae8f7573237323dce4ae41340ee281dd0384c74fca0b4a5847beff32370360be0b593f86b7fe429d2fb7c4ec0ff3c9c8105ba9695e1bd304ec8391a134f294
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AC\qap`g`v~dtlq
Size 10B
SHA256 4a50a9e1aa2ee1dbed1a14a9e3ce5230ddb35b1edc6284e292e182b221c154cf
MD5 e2d12d4c7b67a2ea5921f73ea3ffbfd6
SHA1 ef7925f3e19d0f1ab7b16de4183c1fce1aa44657
SHA512 97408b6d2234f998e4ec3f201a52a2348b07770cc4f427e57df80db7138fcbdf93bcb2b5b66bfd60a650e7e1c4063f17128b6fc43e6f2cd01133aa410c51924e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Sun\Java\qap`g`v~dtlq
Size 10B
SHA256 31e7021a0eaa04e2c71a9221f74e9026692d5e5d2ca81e915b6a5907bb3b4c2a
MD5 f2b0d4ca610ff49ae9f091c68edcbc09
SHA1 ca31d3862142b72f40a3f763ffc51ebd3d74d65c
SHA512 9dbbf66abe706d22116d632af601c66e4df96529aa5f5e9e207f6009590834db9d686cb0f222b1426c0aa1611138d036e505ab7e05bf35622e11815bd99e91fd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dbd10b5a43d5a4e6e360be2feddb6f751bf599cda485a665749475c051ce4584
MD5 f85b062bd038bd38990a7d50cc1f31c4
SHA1 13bac2d2f33cf6fb9e31df47f3654476e4f1bade
SHA512 540376ffdbb39a1b7459b0beda5106e355a2c4de80191ac3c4ce6fb9db0ebddc5b331d312eb9d8c4d44828020b3cd7734bbbd781c7c7d579991d5c97f4149dc2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2cbc71b6422cb872fee4ecb17e371e7f8f48092bab810e3cb257e3dedca1a657
MD5 51e27bb6c2341c9b711aa71951b1efd2
SHA1 b128f2c8fe82d8d684f1e5a88e8e02598757f2b5
SHA512 f55d1bb5b8f1bd60523f62940dceeadfdf96ab23520f88a9f631dd224d22c4a8fb8008023b4d2be003093de10fe32f050bf8ec4e122a2a4769a1873bb9a047d0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a955a899b803794417c9c1c23bfa51a53326a72e8be83c740debb13b15ce6831
MD5 e646f78ea432126471fa71a786dc44f6
SHA1 8bc17467b341a31a18ceb86b33955e0290bb3954
SHA512 9c136d552af8e906b625f5e3774bdda66d1e2b715b02423597365acc78abc20b5127128b18f5223c3b897a487492000ba0c5599dcbcb40c56c8a5e5fefa29551
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f86e74eba054f62d00d2efacca34985a37ff6a1a5e07bbf4e5517e0b0631e4ba
MD5 eea4c623bb77ad4da08c667b4fbdffa1
SHA1 9a153721c46de0c79b675e3bdf20568eb37ea32b
SHA512 e649a77dd176c0ba8d7068ce5964d120d30013b99e6e99f484dbae5f5cae45a7c29381ccfaec80dc393695a685fbd97a693355c6066bad1e11cab44e22304a30
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 37f1bff8f57638b23b18b788b90893a1fce39fdace302fb68ede12b0df2c3838
MD5 5d7862a40312c7e9484d3339109a6511
SHA1 aab5c840c438a6d368848f059ea519b9664ed588
SHA512 07480227a45b59ccff13862b1e2e284a6f90eeb8a9e667e07266a3072d1c5c7cab2ddd161b16a6ef1315ef0a8a5d9ce24cab032fd0a12b23ab73d04249038a90
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 518d9c44924291c39d4443f7a87e319bb61f0fc2e9795bcf9d0d1d572d7a1c9b
MD5 c8969811fb8229f04b7c4f6350295ab6
SHA1 92e47c32320762ec2478792c9717ea4473c9de98
SHA512 f06d2945433fd1124302e324efb41e5d563c4bd8095e18187d15485eea6305c2d0c579ae7ca4c273a9aefb2017c1763ed80d2d3a4794856b73bbbce6d6649afa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 732837b10d9e0398bd6144e191e87819012e7aee717ac104a55f2b8e7ab3390f
MD5 1d31ed45ee32c9954d29a23a509a1c61
SHA1 b500e099263d453619c989c0c5deafb73bae4d8c
SHA512 da917bbf47c66334d5e88d43ee1b241ec92688ab98e4b63c4fc2c4dd9d230b65c7912c99e90a7bfc1aa4055bcaa2a22ce0102a19334968f9ee832fca9bdc7fd8
MD5 SHA1 SHA512

Submit Download

svchost_CCCAABCCAACCAAAACCBCCBBBBBBCCBACABCCBABBACAACACBCBCBCAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAABCCAACCAAAACCBCCBBBBBBCCBACABCCBABBACAACACBCBCBCAB.exe
Size 43.2MB
SHA256 4414452104b74bc342eee12629b62e2989d3ba0f01a8f892d1a3d8460e65935b
MD5 ea299dfc4fe9ae74d752dad12cc3d996
SHA1 a989e7fb537b35e407d7caacb7d450d99b8eb281
SHA512 2dd467a12343832e1699130290354c74403a0c837090e71ca373821c8328042063a91eb16c86dab26a38b1013966a0227410d4915bf35e948673fc1abd3bd88d
SSDEEP 393216:QooooCgOLlcooooCgOLlcooooCgOLlcooooCgOLlRcZEIvb:V///2EIvb
TLSH
T18FA79E06FA8340B1D97B31B009DFE3BF4979772185318DAAF74D8B2B6933B51582835A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 4ec45b3dab5b512c9e88570b08c07f43bf8f048760927aa3f8d6e93e2c8f6467
MD5 a959576821c47964886efb0975759b3a
SHA1 51f67d7b60f0824a6b9dbe3b3355c7aa546ab470
SHA512 01d9e5510f415ca0e1b0b38ae194f1fe03063bf63e8d31306f889e9eea85c82a88b677edf8f5c3469225561f7b8dba158296923f36d17502cb14905ac946eec1
TLSH
T11521D550E4F5C86BF9336CCB522DEBD39CA4779F5C9C9A442204A118AB85C72CD1D8D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 589d8f73827443c4b77b066bca0acd14b245e5cc8ab0996239c80e96d618c29c
MD5 ce71435f935410daf9a98ac92aa68b79
SHA1 7cf7959ee11bedea6ea74194b91c04f3e94c64d2
SHA512 6ca6a84190c3c79310d968694f72c130246fe2f6b5ac4b7ec3e46b4133b72bb7da6e48729a7858e4ab40407d43491f0daab7fc568b5ff9e12b501ee8795703e6
TLSH
T14F11E651A4F5C86BF9332CCB622DEB839CA4729F689CAA5433016518EB45C75CD198D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 29fc1de37d6da127dec502d9310a228e72909205943156f8c6b56009c88e5d70
MD5 ba8d069a1d60f92c971bc3bfb01a7fe3
SHA1 f17da9e9f0bcc419ab523081c8663286cba2b2ab
SHA512 a0dfe29ca300293ceb0bac0edf8a61b33a28eb1496f236ede605d0cd8062e1964d49ba776b9cf5f40f09a59ab65d5410dc6cd83eb51d93d430259728bb0ab5fb
TLSH
T10521C851A4F5C86BF9332CCB622DEFC39CA4769F5C9CAA5433016118EB45C71CD198D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1540-922-0x0000000000CE0000-0x0000000000D01000-memory.dmp

Download

memory/1540-67-0x0000000000CE0000-0x0000000000D01000-memory.dmp

Download

memory/4664-6-0x0000000000A40000-0x0000000000A61000-memory.dmp

Download

memory/4772-1142-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download

memory/5948-32-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download