201946bfbfee32350f56c3f0a2d895c915b3be898c1366f3637dd609d80130b8

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_e375a9d281620b748e081ed4b100289a_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Size 6.4MB
Sample260827-hamvdazfrb
SHA256 201946bfbfee32350f56c3f0a2d895c915b3be898c1366f3637dd609d80130b8
MD5 e375a9d281620b748e081ed4b100289a
SHA1 b73658cadb5b22c95daf1418dc7c3858d5ea77b9
SHA512 27d201cd8d3706a7bb474e733c331fbc191aaed2c20af8164dd5fc1cb7e43beb6b7a53a69fee3d90a1a791f10a185c6be81559697f364a37be78140847ebb014
SSDEEP 49152:U+EWz+ES+ES+EkqatglxQ+ES+EWz+ES+ES+EkqatglxQ+ES+EWQhOBhOp+EWz+Ex:5Q7Q7QQ3Q7Q7QQl+4j5
TLSH
T1D3667C09B69548F1D9774130899BC2BAC672BC214F21CBDFA294D73E6E337D0A939B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABCBAACBABCACBBBABCAABAABCACABAAACCCCACABCBCBACACBAACAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABCBAACBABCACBBBABCAABAABCACABAAACCCCACABCBCBACACBAACAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3264	svchost_ABCBAACBABCACBBBABCAABAABCACABAAACCCCACABCBCBACACBAACAB.exe
1216	svchost_CBABBBACAACAABBBBBBBACACCACAACABABBBACBBCAACACCAACACBAA.exe
5624	svchost_ABCBAACBABCACBBBABCAABAABCACABAAACCCCACABCBCBACACBAACAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AACBBAACBBBCCACAACBBCCCABCAABBCCBAACACAACACCBBCCBBCAAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCBAACBABCACBBBABCAABAABCACABAAACCCCACABCBCBACACBAACAB.exe"	2026-08-27_e375a9d281620b748e081ed4b100289a_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AACAAACABCCABBCCCAAACCACABCBAACCCBBACCABAABAABCACABCABBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBABBBACAACAABBBBBBBACACCACAACABABBBACBBCAACACCAACACBAA.exe"	svchost_ABCBAACBABCACBBBABCAABAABCACABAAACCCCACABCBCBACACBAACAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6064	sc.exe
3104	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1980	cmd.exe
4176	cmd.exe
1324	cmd.exe
5600	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBABBBACAACAABBBBBBBACACCACAACABABBBACBBCAACACCAACACBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_e375a9d281620b748e081ed4b100289a_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCBAACBABCACBBBABCAABAABCACABAAACCCCACABCBCBACACBAACAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1148	schtasks.exe
2668	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3612	2026-08-27_e375a9d281620b748e081ed4b100289a_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
3612	2026-08-27_e375a9d281620b748e081ed4b100289a_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
3612	2026-08-27_e375a9d281620b748e081ed4b100289a_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
3612	2026-08-27_e375a9d281620b748e081ed4b100289a_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
3264	svchost_ABCBAACBABCACBBBABCAABAABCACABAAACCCCACABCBCBACACBAACAB.exe
3264	svchost_ABCBAACBABCACBBBABCAABAABCACABAAACCCCACABCBCBACACBAACAB.exe
3264	svchost_ABCBAACBABCACBBBABCAABAABCACABAAACCCCACABCBCBACACBAACAB.exe
3264	svchost_ABCBAACBABCACBBBABCAABAABCACABAAACCCCACABCBCBACACBAACAB.exe
1216	svchost_CBABBBACAACAABBBBBBBACACCACAACABABBBACBBCAACACCAACACBAA.exe
1216	svchost_CBABBBACAACAABBBBBBBACACCACAACABABBBACBBCAACACCAACACBAA.exe
5624	svchost_ABCBAACBABCACBBBABCAABAABCACABAAACCCCACABCBCBACACBAACAB.exe
5624	svchost_ABCBAACBABCACBBBABCAABAABCACABAAACCCCACABCBCBACACBAACAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3612	2026-08-27_e375a9d281620b748e081ed4b100289a_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Token: SeDebugPrivilege	3264	svchost_ABCBAACBABCACBBBABCAABAABCACABAAACCCCACABCBCBACACBAACAB.exe
Token: SeDebugPrivilege	1216	svchost_CBABBBACAACAABBBBBBBACACCACAACABABBBACBBCAACACCAACACBAA.exe
Token: SeDebugPrivilege	5624	svchost_ABCBAACBABCACBBBABCAABAABCACABAAACCCCACABCBCBACACBAACAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4296	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 1324	3612	2026-08-27_e375a9d281620b748e081ed4b100289a_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe	109
PID 1324 wrote to memory of 2668	1324	cmd.exe	111
PID 3264 wrote to memory of 2444	3264	svchost_ABCBAACBABCACBBBABCAABAABCACABAAACCCCACABCBCBACACBAACAB.exe	113
PID 2444 wrote to memory of 5864	2444	notepad.exe	114
PID 3612 wrote to memory of 5600	3612	2026-08-27_e375a9d281620b748e081ed4b100289a_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe	118
PID 5600 wrote to memory of 6064	5600	cmd.exe	120
PID 3612 wrote to memory of 1980	3612	2026-08-27_e375a9d281620b748e081ed4b100289a_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe	121
PID 1980 wrote to memory of 3104	1980	cmd.exe	123
PID 3264 wrote to memory of 4176	3264	svchost_ABCBAACBABCACBBBABCAABAABCACABAAACCCCACABCBCBACACBAACAB.exe	126
PID 4176 wrote to memory of 1148	4176	cmd.exe	128

C:\Users\Admin\AppData\Local\Temp\2026-08-27_e375a9d281620b748e081ed4b100289a_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_e375a9d281620b748e081ed4b100289a_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACACCABCBBBAABBBABBACCBBCCCCABCCAAAAAABAAABBCBABACBBABABBBBBCBCCCABBBBCCBBCCCCCCABACCAABCCCCBACABACBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBAACBABCACBBBABCAABAABCACABAAACCCCACABCBCBACACBAACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACACCABCBBBAABBBABBACCBBCCCCABCCAAAAAABAAABBCBABACBBABABBBBBCBCCCABBBBCCBBCCCCCCABACCAABCCCCBACABACBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBAACBABCACBBBABCAABAABCACABAAACCCCACABCBCBACACBAACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABABABACBBBCBCABACCCCCCCCCBCAAABABCCAAAABBACAACBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBAACBABCACBBBABCAABAABCACABAAACCCCACABCBCBACACBAACAB.exe" start= auto displayName= "UserDataSvc_AABABABACBBBCBCABACCCCCCCCCBCAAABABCCAAAABBACAACBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5600
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABABABACBBBCBCABACCCCCCCCCBCAAABABCCAAAABBACAACBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBAACBABCACBBBABCAABAABCACABAAACCCCACABCBCBACACBAACAB.exe" start= auto displayName= "UserDataSvc_AABABABACBBBCBCABACCCCCCCCCBCAAABABCCAAAABBACAACBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABABABACBBBCBCABACCCCCCCCCBCAAABABCCAAAABBACAACBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABABABACBBBCBCABACCCCCCCCCBCAAABABCCAAAABBACAACBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3104

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBAACBABCACBBBABCAABAABCACABAAACCCCACABCBCBACACBAACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBAACBABCACBBBABCAABAABCACABAAACCCCACABCBCBACACBAACAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBABACCABACBCCCAABCAACBBBCCACCBCABCCACCCACBCCCCABAAACCCBACACCABBCABCBACCBACAACCACAABAACBCCCBCBCBACCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBBACAACAABBBBBBBACACCACAACABABBBACBBCAACACCAACACBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBABACCABACBCCCAABCAACBBBCCACCBCABCCACCCACBCCCCABAAACCCBACACCABBCABCBACCBACAACCACAABAACBCCCBCBCBACCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBBACAACAABBBBBBBACACCACAACABABBBACBBCAACACCAACACBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1148

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4296

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBBACAACAABBBBBBBACACCACAACABABBBACBBCAACACCAACACBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBBACAACAABBBBBBBACACCACAACABABBBACBBCAACACCAACACBAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1216

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBAACBABCACBBBABCAABAABCACABAAACCCCACABCBCBACACBAACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBAACBABCACBBBABCAABAABCACABAAACCCCACABCBCBACACBAACAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 fe2f805f9a080c37f971ed107eb1de8523e8ec2216b79cfe6f41fb4065f915ea
MD5 71b4947e1a3e829ebea73cfc1153d994
SHA1 fe2db3562e6736aa5b36bb21439c99ecb6f6cfa1
SHA512 0d41079531c871a9f84c5776d8af5a27ec44a1e4b4ab4867d9f801a8c2c01373463f684584db2aca82c0d069f6a66d4fcb587a6796c9d79041b4784e3f71de5d
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 6.9MB
SHA256 a2155e024c4743c911907ebe1c73aaf384f67ecc1c2831dcbab7e00e9bd23118
MD5 1421bc35e6d965ef93ffbd408d860d46
SHA1 a7038a17d5749298b5d3a148438b14cce1dbdd40
SHA512 afc49e951a2e622d12c67e4a43ea0b9059d01b661cfe1b1bc9a0b8b10b0bbfb9d4d77fcb8349d940a0ade9b9d579f027f15fa81f07dc86b2fba3880797f892b2
SSDEEP 49152:U+EWz+ES+ES+EkqatglxQ+ES+EWz+ES+ES+EkqatglxQ+ES+EWQhOBhOp+EWz+Ed:5Q7Q7QQ3Q7Q7QQl+4j2piN
TLSH
T1DD767C09B6D544B5E577413089ABC2BA8672BC214F21CBDFA384D73E6E337D0A935B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\qap`g`v~dtlq
Size 10B
SHA256 d1248c5be02359ef5c1210567ef6b847a4ab2f078ca29081b3f5a28fb022b315
MD5 8685ae090bb8ecb67cd7ce3d1c485931
SHA1 e77303654868aac1be4f7341ce510042455a3740
SHA512 21ad01240f54c1c2498983df752c544c622de0b3dbb3e11200aac6d065a0d820801720fc387843a28c112b077e3328193a67ab8f4ca982133ce48d8120a52dd7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\de\qap`g`v~dtlq
Size 10B
SHA256 4f57c9f02195e275efef058883e97036a1fa48201972e44e8935c1f808e7d525
MD5 92ca7f63f68c21086b34664796e0bd5e
SHA1 7392775a01b3f3a9553aab524d903c0dbadec104
SHA512 b5424d33387e6cdd5d0ebfcb8a5a98fbdefcbee227ad0cb24cdc49ecd90be92653ec03e5f2d1a4b825b9a000534e9febe20acedcd48f3736223569bdfb7350a6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\AppData\qap`g`v~dtlq
Size 10B
SHA256 f1b7fee12f4b70caee5cf32d07d2968788c05286dcece9c04ae6e21ee08ec337
MD5 074f4b08e7cc8dbe589946e980a3801d
SHA1 80b9a4040b14d5df8c41912d89c50558ca082a54
SHA512 08138f69f1c5b41e32e8791341864321a5ef0f03066708ab66b3cbc75135b1831d190a047fcb6be5ee8711d3147a707d90ddccfa001ba77bafaaa18fe3841e4f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\qap`g`v~dtlq
Size 10B
SHA256 1051458e6e811a0d183eab1dcc5158daaff95516050a9004617040919a5779fc
MD5 2d92b6a0153c0dba92c892ababba7e9b
SHA1 3371082ba3bb4f4c22a1b05c0b65977511977a07
SHA512 823fb4eb7f17d0cf4b8c30da9855279de1beec56334800f00a6c19472fe3fc1111f8de63b420f283dba5ea0be33986b3b69fc6bc752d5a0ec391c5623dc4093c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 41ca276b2add22204e377d79b1907d1a50e13c1cbbab4361c5e3cd44bf7c3f09
MD5 75ce9c40769839814b665c08e1d50e71
SHA1 1d68d1b58909ad4406add4fd567b7fead5cb8bb8
SHA512 856b3d877c315955d74327ca1ecf808252fa05956582cc81a46cd4b78881f9764ba4fb3b7fc1d86c52fbf9d89a6852507d905cc7c7720c37ea5d3361e73ff941
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e96d505f7b97be40cf30be8148f418f77f50e356a7db95641ba14733c7b07f7b
MD5 6c4b478d329481fa9e2c165545b43c64
SHA1 228d25a76a5520b88ee793c47f1e2e7291106b9b
SHA512 2e51ad28bdeba0fb5375d2096c8cbd5e54aa32c993761ba7b19037b96fc396f49e42199939f9dc9cd5a349b78f9e617d45d8aea93ef1e9131fdeb822ed57b2e1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3aa3873041f49ad0984795ad3f2dca6344b090e454fa9ac60987444a275aa8f6
MD5 b3882b8a6ff7081fa5ed2c9ede7d9145
SHA1 ac03682f1e166f7d234c54ae8fd562d4fd61c924
SHA512 b91831dcbc68cc431d1ded66221810479f8aecd836ff87860f482f40c9e5acbb462747106ff442cec0598244f4aae91bb639d748a1b26f490383f5da9ec40740
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 789fb782325ec4ffd4f4b41e4f847f6cbfc9c54285d87ac579558e2616dd285d
MD5 52f3ebd6f7c8d5e05fdb761397a2ca1f
SHA1 add6f541a1287f0375aa84641fa5daa20dd3a5ac
SHA512 a6367564500613efdfd82822fc9a680508ddce0139c35cafbaee00a82e3872077300390bcec77a897442aba791a926af50e085730e9fd87d3142fad380844138
MD5 SHA1 SHA512

Submit Download

svchost_ABCBAACBABCACBBBABCAABAABCACABAAACCCCACABCBCBACACBAACAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBAACBABCACBBBABCAABAABCACABAAACCCCACABCBCBACACBAACAB.exe
Size 6.4MB
SHA256 201946bfbfee32350f56c3f0a2d895c915b3be898c1366f3637dd609d80130b8
MD5 e375a9d281620b748e081ed4b100289a
SHA1 b73658cadb5b22c95daf1418dc7c3858d5ea77b9
SHA512 27d201cd8d3706a7bb474e733c331fbc191aaed2c20af8164dd5fc1cb7e43beb6b7a53a69fee3d90a1a791f10a185c6be81559697f364a37be78140847ebb014
SSDEEP 49152:U+EWz+ES+ES+EkqatglxQ+ES+EWz+ES+ES+EkqatglxQ+ES+EWQhOBhOp+EWz+Ex:5Q7Q7QQ3Q7Q7QQl+4j5
TLSH
T1D3667C09B69548F1D9774130899BC2BAC672BC214F21CBDFA294D73E6E337D0A939B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 210bf4c82af74426fe2295dcc02239568d3fab11202cf32748ff62cc198d5c14
MD5 8f00ad286a0f4e0141dcc11db86df0c3
SHA1 d816dcdc4c8d04ea3c2ebf8e79124cec5c954e55
SHA512 4906f10f5705cd88c5c11da16b27d10c20934e0580da9c13bc3a6286e7d226b20956b281d63543aec2c327de0cb01673ab9e1616d2d3dae1cc55a1206046b285
TLSH
T1ED21A771C0E4CD73FA3214CBAB1ABBC258B8374EEC5C9614130D43087758C308D598A5
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 784B
SHA256 c1ef642e068a032e2d3805e15143d6fb242966e359d940dbb3f63907af47cd33
MD5 9b915cbace854622ac5ed4c9e1adadb6
SHA1 94c034e7d645209b76384a7ea953d7de914dfe38
SHA512 acc507acb0619194d23603a1371fa967c2941b434be16eda60203796098c4bfce93b8cf93035efaef1375da7e0dffb88756f8bcafdab515c20d049bc690df849
TLSH
T1BE01F9A180F5DD23F93324876B06BBC368F8364BEC9CAA28134D435D7748C70CD598A6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 f0148969fc326de012db66c7125155028d1c99886f419d2114ad7322537d7c24
MD5 8cdebdad3b10abd28effcc66ac8f8d35
SHA1 72ed849d5fc2904965a364cb9975c93d071a0026
SHA512 53d48ce4209a7d961bc7b56197c514e0e795367bd69f5bed9a98877cdaa7dd1f168e8cf293f01d24ad3d02a5e23d4eb520dc0b9563a3a1833cda9a0190bf3359
TLSH
T1D821A7B180F5DD63F9332487AB06FBC358F8364AEC5CAA64230D43597649C70CD598A6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1216-88-0x0000000000330000-0x0000000000351000-memory.dmp

Download

memory/2444-59-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/3264-36-0x0000000000920000-0x0000000000941000-memory.dmp

Download

memory/3612-6-0x0000000000650000-0x0000000000671000-memory.dmp

Download

memory/5624-2246-0x0000000000920000-0x0000000000941000-memory.dmp

Download