4e36d190360d0ab4a4985871d3a90789f65a5442dcdbbe42b3d2b2e28b178d8b

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 11:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_bf118f792ba2efe900f8761504fa83ee_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Size 21.3MB
Sample260826-nfgs7scp21
SHA256 4e36d190360d0ab4a4985871d3a90789f65a5442dcdbbe42b3d2b2e28b178d8b
MD5 bf118f792ba2efe900f8761504fa83ee
SHA1 73704d1fb0ce9a7a6b2be6e4bef1822723e28d0e
SHA512 b6dea60dcadc6ac97828d0081d15a0266a51a81c3bae463844fd5af00d5205550cf98a31dd43578d45ae77ed2dd983a8f83456e61e90fc23537952cd78a0f06d
SSDEEP 196608:O1tIDewjqkjiqM+1tIDewjqkjiqMsqajq:O8Kweky+8KwekyNa2
TLSH
T14D279E29FAA580F1F96F94789CABC376EA717A1048334B5BCA95C61F6F336514C28331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBCCABAABCACABCCCCBACCAACBBCABAAAABABACCCAABBBABCBCABAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBCCABAABCACABCCCCBACCAACBBCABAAAABABACCCAABBBABCBCABAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBCCABAABCACABCCCCBACCAACBBCABAAAABABACCCAABBBABCBCABAB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBCCABAABCACABCCCCBACCAACBBCABAAAABABACCCAABBBABCBCABAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5412	svchost_BBCCABAABCACABCCCCBACCAACBBCABAAAABABACCCAABBBABCBCABAB.exe
2648	svchost_ABCBAABABBCACAACBCBACBAACBCCBABBABABACCABABCBBBABCCCBAC.exe
2976	svchost_BBCCABAABCACABCCCCBACCAACBBCABAAAABABACCCAABBBABCBCABAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABBBBAACBACBACCBACBBBCBBCACBBABACCACBACBCAAACCCAACCCCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCCABAABCACABCCCCBACCAACBBCABAAAABABACCCAABBBABCBCABAB.exe"	2026-08-25_bf118f792ba2efe900f8761504fa83ee_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBAACCBBCACBBBBABBCBBBACBCABAABCCABAABCBABBAABABBBCABBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCBAABABBCACAACBCBACBAACBCCBABBABABACCABABCBBBABCCCBAC.exe"	svchost_BBCCABAABCACABCCCCBACCAACBBCABAAAABABACCCAABBBABCBCABAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5136	sc.exe
6996	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4508	cmd.exe
3260	cmd.exe
6384	cmd.exe
2504	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_bf118f792ba2efe900f8761504fa83ee_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCCABAABCACABCCCCBACCAACBBCABAAAABABACCCAABBBABCBCABAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCBAABABBCACAACBCBACBAACBCCBABBABABACCABABCBBBABCCCBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4428	schtasks.exe
5816	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1900	2026-08-25_bf118f792ba2efe900f8761504fa83ee_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
1900	2026-08-25_bf118f792ba2efe900f8761504fa83ee_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
1900	2026-08-25_bf118f792ba2efe900f8761504fa83ee_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
1900	2026-08-25_bf118f792ba2efe900f8761504fa83ee_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
5412	svchost_BBCCABAABCACABCCCCBACCAACBBCABAAAABABACCCAABBBABCBCABAB.exe
5412	svchost_BBCCABAABCACABCCCCBACCAACBBCABAAAABABACCCAABBBABCBCABAB.exe
5412	svchost_BBCCABAABCACABCCCCBACCAACBBCABAAAABABACCCAABBBABCBCABAB.exe
5412	svchost_BBCCABAABCACABCCCCBACCAACBBCABAAAABABACCCAABBBABCBCABAB.exe
2648	svchost_ABCBAABABBCACAACBCBACBAACBCCBABBABABACCABABCBBBABCCCBAC.exe
2648	svchost_ABCBAABABBCACAACBCBACBAACBCCBABBABABACCABABCBBBABCCCBAC.exe
2976	svchost_BBCCABAABCACABCCCCBACCAACBBCABAAAABABACCCAABBBABCBCABAB.exe
2976	svchost_BBCCABAABCACABCCCCBACCAACBBCABAAAABABACCCAABBBABCBCABAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1900	2026-08-25_bf118f792ba2efe900f8761504fa83ee_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Token: SeDebugPrivilege	5412	svchost_BBCCABAABCACABCCCCBACCAACBBCABAAAABABACCCAABBBABCBCABAB.exe
Token: SeDebugPrivilege	2648	svchost_ABCBAABABBCACAACBCBACBAACBCCBABBABABACCABABCBBBABCCCBAC.exe
Token: SeDebugPrivilege	2976	svchost_BBCCABAABCACABCCCCBACCAACBBCABAAAABABACCCAABBBABCBCABAB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 3260	1900	2026-08-25_bf118f792ba2efe900f8761504fa83ee_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe	90
PID 3260 wrote to memory of 4428	3260	cmd.exe	92
PID 5412 wrote to memory of 3528	5412	svchost_BBCCABAABCACABCCCCBACCAACBBCABAAAABABACCCAABBBABCBCABAB.exe	93
PID 1900 wrote to memory of 6384	1900	2026-08-25_bf118f792ba2efe900f8761504fa83ee_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe	96
PID 6384 wrote to memory of 5136	6384	cmd.exe	98
PID 1900 wrote to memory of 2504	1900	2026-08-25_bf118f792ba2efe900f8761504fa83ee_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe	99
PID 2504 wrote to memory of 6996	2504	cmd.exe	101
PID 5412 wrote to memory of 4508	5412	svchost_BBCCABAABCACABCCCCBACCAACBBCABAAAABABACCCAABBBABCBCABAB.exe	104
PID 4508 wrote to memory of 5816	4508	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-25_bf118f792ba2efe900f8761504fa83ee_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_bf118f792ba2efe900f8761504fa83ee_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACAAABACBCCCABCBABACCCAACCCCAAACACBCCBABABAAAABBCAAACCCACCCAABAABCABBBCAABCCCCCAABCAABBBAACBAABBCCBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCABAABCACABCCCCBACCAACBBCABAAAABABACCCAABBBABCBCABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3260
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACAAABACBCCCABCBABACCCAACCCCAAACACBCCBABABAAAABBCAAACCCACCCAABAABCABBBCAABCCCCCAABCAABBBAACBAABBCCBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCABAABCACABCCCCBACCAACBBCABAAAABABACCCAABBBABCBCABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACACACCBCBBCBBBCBBBACACAABCBCBCABBBACCCBCCBCBCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCABAABCACABCCCCBACCAACBBCABAAAABABACCCAABBBABCBCABAB.exe" start= auto displayName= "UserDataSvc_CBACACACCBCBBCBBBCBBBACACAABCBCBCABBBACCCBCCBCBCCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6384
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBACACACCBCBBCBBBCBBBACACAABCBCBCABBBACCCBCCBCBCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCABAABCACABCCCCBACCAACBBCABAAAABABACCCAABBBABCBCABAB.exe" start= auto displayName= "UserDataSvc_CBACACACCBCBBCBBBCBBBACACAABCBCBCABBBACCCBCCBCBCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACACACCBCBBCBBBCBBBACACAABCBCBCABBBACCCBCCBCBCCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBACACACCBCBBCBBBCBBBACACAABCBCBCABBBACCCBCCBCBCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6996

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCABAABCACABCCCCBACCAACBBCABAAAABABACCCAABBBABCBCABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCABAABCACABCCCCBACCAACBBCABAAAABABACCCAABBBABCBCABAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5412
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBABACACAACBABCCBBBAABABCCCCCABBBABAABABACCBBCACACACABABCCABBAABCABCAAAABAAACBCCBBABABABBACCCCACCAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBAABABBCACAACBCBACBAACBCCBABBABABACCABABCBBBABCCCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBABACACAACBABCCBBBAABABCCCCCABBBABAABABACCBBCACACACABABCCABBAABCABCAAAABAAACBCCBBABABABBACCCCACCAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBAABABBCACAACBCBACBAACBCCBABBABABACCABABCBBBABCCCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5816

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBAABABBCACAACBCBACBAACBCCBABBABABACCABABCBBBABCCCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBAABABBCACAACBCBACBAACBCCBABBABABACCABABCBBBABCCCBAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2648

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCABAABCACABCCCCBACCAACBBCABAAAABABACCCAABBBABCBCABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCABAABCACABCCCCBACCAACBBCABAAAABABACCCAABBBABCBCABAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 512aab89a5d44392b21d392b6d149bdc287a003d2e4de94fe934ba66842ec00d
MD5 8f0e45017f43725985d6a79794d5c8b2
SHA1 05f072e82c1e250e0ab056c26215d18ed25b5f70
SHA512 1ca87529e308e3aa3e77d248da4337a962ff728c1ca4a58a303e046509084f5b8b78bfde9daa34a4116394cff1f6d5167708a614ada1e9b1f823ff535a5ff366
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 1c7e9b3574189454e2edb1c5f9fb0548429a20fd4b6399b15d4d28b971d1525a
MD5 d03be78fbf7a7710bbb92bac9eea7f58
SHA1 ce601632188864dd8d8da05a13a44a3199a1254d
SHA512 556f94a5867771a5b4a0be779d5735e8184d0bd0ca5f49a2d06642a3e43f64e1d8ef8479eb73ecb898e85054bcb3eb83b218a56cec0b3d17c98e24f4c3c59d2d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 421cf2b6b38571e67d30a6be22afc9a0c7c091047fdecc41c1d0f3aff80c3343
MD5 0df70b686560bf15339fb970026a3694
SHA1 d48a36cd67b77a29396113c7b47b57fb425e0d92
SHA512 a6970bc3d33f08cff26f06a5f11c03762b163f87e61a4f0c5ed56f336c5adde3a4402b187f4014a5010760a03c2530bc2194ae1b453ed7b4da444fe9e8856937
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.MicrosoftEdge.Stable_139.0.3405.125_neutral__8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 ce0939db6f811ae3ff075d34b38518ca49527a92a87471ec34797bf45185144c
MD5 d6c6ef698a3ba2e45c6d4b73feed0d70
SHA1 28ac3fdfd3aa18171db97aaa06d437509f6daec8
SHA512 66f6539a9332bbf0e925aeb1dcdf8c8b3e5cde8d5f303e2092b5c4b34e31c4191ddccdcc47a1e56f82c1d00f7169f68a4574766247a0850dd3d003133d63324d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}v56.64.8781\qap`g`v~dtlq
Size 10B
SHA256 9f4b2d3aa90cd95cfd5325658f5890daec4a57a607b579b732d19108128fae79
MD5 98c031f6c492f3f461cea2603ab3e043
SHA1 0f1b85d79d7d3410b806f7429b02b22feec9e0e5
SHA512 f06dd3beaad9a1db89531ddb80248e744f30357059e65d9a9054e14d29d9a7b0cc8d8cd7dd1b34b13700da9fad01540c15598f051376e6e0968e49d60914c773
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 21.9MB
SHA256 99f83211b86d2a15129258fe268777a47fed24bd8edfb47ad5dfc6a73bd1b95c
MD5 2f3a23a33e7b9c71d3a25b8a26e585a0
SHA1 daccef423aa50420288c348e220490e6826e2da6
SHA512 ee55c34dcfdb5cc28c8198c529937d7419cf1ea84e9cd0700a7e4901177be3d8f7ec59cc0525a624e716cc34c490672526f913dc9956f319266c89533336f1be
SSDEEP 196608:O1tIDewjqkjiqM+1tIDewjqkjiqMsqajtgZ2jS:O8Kweky+8KwekyNa82+
TLSH
T100379D29FAA580F1F96B94789CABC376EA717A1009334B5BCAD5C61F6F336514C28331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 2e5aaf8aed9d70c1c0f6174a3886ba026ee9b99272410fe61effa59df2e9ede7
MD5 0906209032ca8875edb3d8ba75981e31
SHA1 c822a2cbf7bd86bb54c2858ef736661313437141
SHA512 a3886c72ecaca5c73a3b59ff17f43cb5349787986f4cb781b9847a9b8ceab186affc835c78a41343395a27646ea46bc314570296dd77e13616bf8f40a16c7c8d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 475cd7d3c1a767a6f9523761075a70f15600ac961900eb93f952ef96cdb63bfc
MD5 e67ce0b7ef317ddc3950b260597462ac
SHA1 f09ebeae21d2149e01b57c65aeabeaa89dbfc6a8
SHA512 ec1416d826512b0b56ced7612f07bca5a60726762c34a9842b2e4732ed4a9881322c540ef08b39dcc1a925d36948c2de8134c60af78cd97ec0c76473e4070c1d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 ebbbc61c8dba1176e72a11e234d1103f6dab4d3f4afe3607b6ae0959447163ef
MD5 af5d7c57120d492d32e72da152c9a080
SHA1 843e9ec73574af21b0dda2d37bfa843212cfd626
SHA512 88ffb200c3ded42711d64d17b7a55d478bfebd0c781853be0f7271d0669cf054a67af93c32db5099150f3f62edbdf0c64c60e03219ea3d65002b227c053a3a2b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\System Volume Information\SPP\qap`g`v~dtlq
Size 10B
SHA256 70b596d61b3bf0cfddef1d1e093687d7c3562f1854c10d3fb50936112fe409e5
MD5 ea23feaddfc146c306e280856d4658ea
SHA1 e7446db59c49bd02d9040876428f590b4b52e21b
SHA512 bf5fbfb9577d1a60f4caadbe3644a72f70a6f4813f0c80c7db047d917a08b98cb970498b3bf641d14b2e4c58f437cc6c83c9ec130e28e9e27c03e0cc59f31d43
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24\qap`g`v~dtlq
Size 10B
SHA256 105f7c7675697e7635f79e64c156be9e83dd3d0d786e7237d43758347f81bf1d
MD5 e724b152001936128c49925a9d6590f2
SHA1 c03280d2616cf73872f51c7cd47f08ad88cd65f7
SHA512 4607885382a2c99a88163caa538226c5d493ca1216d2ec28b3b768f33f9743ee24e55245c68e73073e12e8247a58dfb7072e1aa7109602638bbbb06bf8650f19
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 f948e3916b671574c69aa60b7946486f5c1bf6dee4f365ca7349b33ca27fa18a
MD5 311e396b69c64647813503b2665268ec
SHA1 7aed9a5a876b6650f0b1427bc1c8c17b0154186c
SHA512 8855192acee76ad1389e5f98e98ca9177d8319bc8ea0da5358adf30348a50c812f0b28d366584600744584e3df6ca3c44ed42441db1b9c907f5987d0201bc991
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 bef461dccc5ec10751132cedbe9379c49958e2c85792abeac1776dc1022626d4
MD5 66776dd252bb401bde3c8d85433d201e
SHA1 37d4fd68b840b7827feacd6512babce919334d65
SHA512 6c86a00af59eb2e33a539a7825bd6f8fb1e47c881fdc49ff9afd15a8e0beb2e2d04fcebd2ba4880b7bd402f3146a1488ae46ed9fd86ec8ca258249a17f22dc53
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Win32WebViewHost_cw5n1h2txyewy\AC\INetHistory\qap`g`v~dtlq
Size 10B
SHA256 4ae92814b64c528e913fc3ea4967695ce5af4792814277581ac9412c8c98dda4
MD5 c7161e81d462fcb696c63047b041eecf
SHA1 37879e3ed2763cd5c8a17934c210bb48255f7d3a
SHA512 a4f4a1e5eafe61bf47e4fa1695fdd1473ce45f13b7909d3b056f2b875820d9741083150c838bbebc244f8fc0ea19467ebea36a8f9c0043b2e2300ed8ec0cc763
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 242940b29c2da69b3de2db087e2aba356707a0d88e2b32857f222eb31eb6ed82
MD5 7284784559de34e8cb5cd54ab84e78e8
SHA1 6a62b9245a3c8a2ea20d81556d3464742003eb51
SHA512 3bcc0a30ae4da3e96f6cfb3b214b04bf5b4ad68cc7fd1a0ccb6c058fb3388ba66e5b46836f4f177c1eecb331736c725349f23f47ee3c1210240fd851caadc7c7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 74331514243ab654f281dd42d80839a4cb8319620cefc4586df7eb3dcb7a70d6
MD5 5fa20a16e3393a9cbdf9e68cd35d86c3
SHA1 41e96c6a7c59e0ce6ac979e60cffecb8de6da3a8
SHA512 34106143b144183d15ba697f8e9a2d2a243dbdd0a8846d02b2e8d4ef89111e5e8d43e88e02ff3a5d230fff49c259b61e17f5a6735c6ecef5f655bf4802dd7d5e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 61b4c9d82db85e0a4ae46ce4c2439d912de0ab40b628accecda88999355b9628
MD5 f668d7e8ba70938b6177c2b14e7e04e3
SHA1 54ac81d7c5181d1ea279b43e864d532545059f3c
SHA512 e6c30615f17530491770d73da04b895bf8518081826a6a3c0d3b78fe1b396e17d1155460ff56e2e36753b5ee150977390ebf30bdec363802193799b147c418b7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 981d4db58739a8deff3171a4fd3003576fe79c05defc6a010938d658e96cf8ed
MD5 5e6e755cd4e4e3caec11548d797b6a68
SHA1 5eafa2fb302ca3572a1e0d86bae57dccdec5dac5
SHA512 7bab87c83d837dca24bbfd8cb97792b8843f2bc6e0c0ce9b6f9c0d7d96ffc1c6f30c1a8e996cbec6b5e1b18c98b0624e84cfb8bb96ac72184f9a9c44a1a0fdf8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 48607609a4b20152148565d8cb8483b229498dcf5260102ac9dbc586fcfccf38
MD5 e01bfb717d89d91f446765fc17a0ee57
SHA1 b708dfcaf2446bcbd44bc5dfeaaee9bdd9b2616c
SHA512 01cffefb73d42b4aa932f4b4afc43db1c30dbe374eb97f8be0e883174c89df0a2ac22436e9e5819d04105a05edb6aca9735f3a1d8b55ecf146b1611e328dd562
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b0760c5b38c8564e6c46ea9964d3ddf6d2efbcf96e7adc4523dfa84840a94738
MD5 9567a36d4d4311f3f1a0e77502a134c6
SHA1 d1d54dd3a4ead816f63ef9d83582dffbe56086d0
SHA512 66b0ad9131893c105d3f7c2db22791dfdb7f59e940500f24f21220c0c46ff254ea6f42c31b86ade6b064442ace1bd32e5a9a31d6bb796be44c3529f2b949c0f3
MD5 SHA1 SHA512

Submit Download

svchost_BBCCABAABCACABCCCCBACCAACBBCABAAAABABACCCAABBBABCBCABAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCABAABCACABCCCCBACCAACBBCABAAAABABACCCAABBBABCBCABAB.exe
Size 21.3MB
SHA256 4e36d190360d0ab4a4985871d3a90789f65a5442dcdbbe42b3d2b2e28b178d8b
MD5 bf118f792ba2efe900f8761504fa83ee
SHA1 73704d1fb0ce9a7a6b2be6e4bef1822723e28d0e
SHA512 b6dea60dcadc6ac97828d0081d15a0266a51a81c3bae463844fd5af00d5205550cf98a31dd43578d45ae77ed2dd983a8f83456e61e90fc23537952cd78a0f06d
SSDEEP 196608:O1tIDewjqkjiqM+1tIDewjqkjiqMsqajq:O8Kweky+8KwekyNa2
TLSH
T14D279E29FAA580F1F96F94789CABC376EA717A1048334B5BCA95C61F6F336514C28331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 247245555a0babc49b0d746a23b53040b6b9eb5fa9f6b2c7b35c567169e0e7b9
MD5 593a45aa35b95cfdcb22d91c800f1f2f
SHA1 702f2fc5fb8c18402b4f851b55de460206e3e109
SHA512 f72f16d3c22188ce2a73058e754a48bbba9184b1d776e3f6c049b924896c35b3e992ea221954fd41114b56efd764573ec11374f73f06c4152c60f65f54a86686
TLSH
T1902107B6F0F5C853E63264CA812DCE921CA573AF58DC6A84230B861877FD835CD599E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 27ea6f6d3a68ec7e6d540bfc5f5850023d7835e5840cbb36efa275ec02222a2d
MD5 6d3397947a69a7d6786701302eb38d9c
SHA1 90670f1503532fd1f675899b49bb745052346e78
SHA512 378c297969cb8dd13778ad75632ed2ebeb37903517120369ce1664eedea744cb7747d03ff152deacf569f1f44d87ebcbc9c8e3d0a0e14a689cc17d3e5e3433f0
TLSH
T18C115BB5F0F5C853E63234CA4229CD921CD673AF18DC6A98230B851873ADC34DD559F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 fc0094c4a41f4155d50c21554d9139d7826ff8c2def9aaa6b635bb0d2594e9c2
MD5 88f6fe2c5e437c0cd954d8745a610365
SHA1 95d1d6cd80d3eb3e6ff883a447d851c90063cee4
SHA512 9f48ed789f44bb57bd75571d26bd67e8e0b12e44a53fe3e6c21fa2f9af5979d9fca09970ce5a44657d38cc567aa5af9832ad084e6790985f4459d176a4a6fb3e
TLSH
T1F5214CB5F0F5C853E63224CA4129CD921CE573AF18DC6A98230A851877E9C34CD559F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1900-6-0x0000000000100000-0x0000000000121000-memory.dmp

Download

memory/2648-78-0x0000000000FC0000-0x0000000000FE1000-memory.dmp

Download

memory/2976-515-0x0000000000F60000-0x0000000000F81000-memory.dmp

Download

memory/2976-3823-0x0000000000F60000-0x0000000000F81000-memory.dmp

Download

memory/5412-32-0x0000000000F60000-0x0000000000F81000-memory.dmp

Download

memory/5412-22-0x0000000000F60000-0x0000000000F81000-memory.dmp

Download