8dcafcabe71a3b6734601d499369f47526757e37c8cc4e3aca307f46d594d9d5

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/09/2026, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-03_c0df25e07d799b405df52be762d8fd00_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat.exe
Size 7.5MB
Sample260903-3pp89st1f1
SHA256 8dcafcabe71a3b6734601d499369f47526757e37c8cc4e3aca307f46d594d9d5
MD5 c0df25e07d799b405df52be762d8fd00
SHA1 a655ed35a4a294e5fbda7ce6c5f655462ccb3710
SHA512 1cac1397d93c2e87e165695020a761bb89fea491171c9d0b0867915e566e4eea662c6393483596211402c4d5195ae29410cc101fb23408e44d47ef3202b78a4f
SSDEEP 49152:U+ES+ES+E2+ES+ES+E4f+ES+ES+Ek+ES+ES+E2+ES+ES+E4f+ES+ES+Ek+ES+ESK:eUUNKRuy5aEUUNKRuy5at+4j3
TLSH
T1A6868E05F58344B1D97B517049CFE37F8A75BB214A218EEBE7488B1B7E33B916828316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBBBBACBCCBBCBBBBBBACACCBBABCBCAAACBBCBCABACAAAACACABAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBBBBACBCCBBCBBBBBBACACCBBABCBCAAACBBCBCABACAAAACACABAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2872	svchost_CBBBBACBCCBBCBBBBBBACACCBBABCBCAAACBBCBCABACAAAACACABAB.exe
5536	svchost_ABBCAABCACBABACBACBAABAAABCCAAAAACCABCCBACACABBCBBBCCBA.exe
5792	svchost_CBBBBACBCCBBCBBBBBBACACCBBABCBCAAACBBCBCABACAAAACACABAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABAABABACABCCAAABAAABCAACCACBBAABBAACCBACACBCBCBBAABAACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBBBACBCCBBCBBBBBBACACCBBABCBCAAACBBCBCABACAAAACACABAB.exe"	2026-09-03_c0df25e07d799b405df52be762d8fd00_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCCACCABCCCAAACAAABBABACCCCABBAACBBBABCAACBABCABABBBABAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBCAABCACBABACBACBAABAAABCCAAAAACCABCCBACACABBCBBBCCBA.exe"	svchost_CBBBBACBCCBBCBBBBBBACACCBBABCBCAAACBBCBCABACAAAACACABAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5280	sc.exe
2460	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5288	cmd.exe
1188	cmd.exe
5300	cmd.exe
3816	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-03_c0df25e07d799b405df52be762d8fd00_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBBBACBCCBBCBBBBBBACACCBBABCBCAAACBBCBCABACAAAACACABAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBCAABCACBABACBACBAABAAABCCAAAAACCABCCBACACABBCBBBCCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1620	schtasks.exe
3956	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5124	2026-09-03_c0df25e07d799b405df52be762d8fd00_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat.exe
5124	2026-09-03_c0df25e07d799b405df52be762d8fd00_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat.exe
5124	2026-09-03_c0df25e07d799b405df52be762d8fd00_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat.exe
5124	2026-09-03_c0df25e07d799b405df52be762d8fd00_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat.exe
2872	svchost_CBBBBACBCCBBCBBBBBBACACCBBABCBCAAACBBCBCABACAAAACACABAB.exe
2872	svchost_CBBBBACBCCBBCBBBBBBACACCBBABCBCAAACBBCBCABACAAAACACABAB.exe
2872	svchost_CBBBBACBCCBBCBBBBBBACACCBBABCBCAAACBBCBCABACAAAACACABAB.exe
2872	svchost_CBBBBACBCCBBCBBBBBBACACCBBABCBCAAACBBCBCABACAAAACACABAB.exe
5536	svchost_ABBCAABCACBABACBACBAABAAABCCAAAAACCABCCBACACABBCBBBCCBA.exe
5536	svchost_ABBCAABCACBABACBACBAABAAABCCAAAAACCABCCBACACABBCBBBCCBA.exe
5792	svchost_CBBBBACBCCBBCBBBBBBACACCBBABCBCAAACBBCBCABACAAAACACABAB.exe
5792	svchost_CBBBBACBCCBBCBBBBBBACACCBBABCBCAAACBBCBCABACAAAACACABAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5124	2026-09-03_c0df25e07d799b405df52be762d8fd00_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	2872	svchost_CBBBBACBCCBBCBBBBBBACACCBBABCBCAAACBBCBCABACAAAACACABAB.exe
Token: SeDebugPrivilege	5536	svchost_ABBCAABCACBABACBACBAABAAABCCAAAAACCABCCBACACABBCBBBCCBA.exe
Token: SeDebugPrivilege	5792	svchost_CBBBBACBCCBBCBBBBBBACACCBBABCBCAAACBBCBCABACAAAACACABAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4540	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5124 wrote to memory of 5288	5124	2026-09-03_c0df25e07d799b405df52be762d8fd00_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat.exe	112
PID 5288 wrote to memory of 1620	5288	cmd.exe	114
PID 2872 wrote to memory of 1672	2872	svchost_CBBBBACBCCBBCBBBBBBACACCBBABCBCAAACBBCBCABACAAAACACABAB.exe	115
PID 1672 wrote to memory of 3764	1672	notepad.exe	116
PID 5124 wrote to memory of 1188	5124	2026-09-03_c0df25e07d799b405df52be762d8fd00_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat.exe	120
PID 1188 wrote to memory of 5280	1188	cmd.exe	122
PID 5124 wrote to memory of 5300	5124	2026-09-03_c0df25e07d799b405df52be762d8fd00_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat.exe	123
PID 5300 wrote to memory of 2460	5300	cmd.exe	125
PID 2872 wrote to memory of 3816	2872	svchost_CBBBBACBCCBBCBBBBBBACACCBBABCBCAAACBBCBCABACAAAACACABAB.exe	129
PID 3816 wrote to memory of 3956	3816	cmd.exe	131

C:\Users\Admin\AppData\Local\Temp\2026-09-03_c0df25e07d799b405df52be762d8fd00_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-03_c0df25e07d799b405df52be762d8fd00_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAACBAACCBABCBBBABCBBCCBCCBABCCCCACAACBCBBAAACCBCCCAABBBABCCBACAABBCCBAACCBBAACBCCACACABCBBCCCCBABBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBACBCCBBCBBBBBBACACCBBABCBCAAACBBCBCABACAAAACACABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5288
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAACBAACCBABCBBBABCBBCCBCCBABCCCCACAACBCBBAAACCBCCCAABBBABCCBACAABBCCBAACCBBAACBCCACACABCBBCCCCBABBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBACBCCBBCBBBBBBACACCBBABCBCAAACBBCBCABACAAAACACABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBACBCBBCACCCABBCCCBACBABBCBBAACCAAACABCCCCCAAABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBACBCCBBCBBBBBBACACCBBABCBCAAACBBCBCABACAAAACACABAB.exe" start= auto displayName= "UserDataSvc_CCBACBCBBCACCCABBCCCBACBABBCBBAACCAAACABCCCCCAAABCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1188
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBACBCBBCACCCABBCCCBACBABBCBBAACCAAACABCCCCCAAABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBACBCCBBCBBBBBBACACCBBABCBCAAACBBCBCABACAAAACACABAB.exe" start= auto displayName= "UserDataSvc_CCBACBCBBCACCCABBCCCBACBABBCBBAACCAAACABCCCCCAAABCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBACBCBBCACCCABBCCCBACBABBCBBAACCAAACABCCCCCAAABCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5300
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBACBCBBCACCCABBCCCBACBABBCBBAACCAAACABCCCCCAAABCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2460

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBACBCCBBCBBBBBBACACCBBABCBCAAACBBCBCABACAAAACACABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBACBCCBBCBBBBBBACACCBBABCBCAAACBBCBCABACAAAACACABAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCACABABACBABCBBAAACBBCACCACBABBCACBCCBBBAACCCCCCBABCAAAACBBCCBCBCCBCCCABACABCBABBCCBACCACBCACACCBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAABCACBABACBACBAABAAABCCAAAAACCABCCBACACABBCBBBCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3816
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCACABABACBABCBBAAACBBCACCACBABBCACBCCBBBAACCCCCCBABCAAAACBBCCBCBCCBCCCABACABCBABBCCBACCACBCACACCBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAABCACBABACBACBAABAAABCCAAAAACCABCCBACACABBCBBBCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3956

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4540

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAABCACBABACBACBAABAAABCCAAAAACCABCCBACACABBCBBBCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAABCACBABACBACBAABAAABCCAAAAACCABCCBACACABBCBBBCCBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5536

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBACBCCBBCBBBBBBACACCBBABCBCAAACBBCBCABACAAAACACABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBACBCCBBCBBBBBBACACCBBABCBCAAACBBCBCABACAAAACACABAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 a70ead9b0c175446ac0e84dbdb1dcfa5337c425b327ca895bcf02a2f757b173e
MD5 8fa99fa92f8ba711f17823cce8b2f63a
SHA1 d6c62511fb977a3b9e4c1d9a3e6c44240b903322
SHA512 28736b7c9887db2020e687fe408e66c8736e9c27eda80ea04d63e83c27f4623b1eafbb55b30cc51c2caa871d802d331ae8ffa7cc9a7bf036c5f071f7f341c961
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 8.0MB
SHA256 0f91ca0d2c2afef0967e44c43c9563a44d9f4376012d6e308a32dd3e0764251b
MD5 ce7ddac9c5b7cfc327000ab492924093
SHA1 a19e8ba58377418a6bac7d70ca383937049bbbdd
SHA512 e312be820d5b6af55763a34104e48b9ba5cc037b09fbbcfbeac1e5dde5260a0d874c3a3a8f3a6d6c927a4b6c302c85fb284b752b63c1b0bd6cb50f519ec5f967
SSDEEP 49152:U+ES+ES+E2+ES+ES+E4f+ES+ES+Ek+ES+ES+E2+ES+ES+E4f+ES+ES+Ek+ES+ESE:eUUNKRuy5aEUUNKRuy5at+4j8pi7
TLSH
T105867E05F58244B1D97B11704DDFE37E8A757F214A218EEBE7488B1B6E33B91A838316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 064f6bd278590adc211589cafba9460a64705bdeda1818e69fd92a17e7306d62
MD5 aa3cf2e8d9fdcb4a4db01dd76a03bd96
SHA1 77fa725aba3f61b7792b443bcf00eab824c4d9c0
SHA512 f5c3b10ea70cd2ae0623937328745225483b87556d6b96ac2591163a743da338778ccd8fc356d011448a8ae994c6d30395c4453dc4ff7a380893153c0526c432
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59\qap`g`v~dtlq
Size 10B
SHA256 cdf13867c6d4707772a067916d02ee31626cafd2dd5f8a053419119fc20c5a9b
MD5 9df6082a15c0676c7d7d6d99774b52c8
SHA1 100a72c3ea78a8223176683321a7373b470d95cb
SHA512 f807f1151a20b892f5bb0ff4b4011a8ab127ea9b47c2e13b384bd331c1fc9dca379f170291732ecbfddcae832444aecb789063f46f77566bbea58e033636eb1a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\qap`g`v~dtlq
Size 10B
SHA256 c220b06060b4a06d60ef17317c8e39fd04024dcfe374202f44a36e5dc24dd99e
MD5 0978d7e55347c845029abcf362d344a6
SHA1 bb3c2582c675c808bd5da24d2b492a2d1ae6fd39
SHA512 9dafa4c0d731368420d50e466f1a124962ef67403858ff538af84628c1be23ec59075e9fdc75e0fa9f0f142e2cdcef08e15b4194947036440f6e720dbf6d13b4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\qap`g`v~dtlq
Size 10B
SHA256 a603ad9999b2b9fda7e608a46f4344befa70e669fd7e1fc83bfcc999e526106d
MD5 f50f7dc44378bcf89b32c5e2402b481c
SHA1 e484d4ad5b2720268746d3e7feeb7bac60a335fe
SHA512 2db4702960208cc56c3abf7ae91c468f01b3412f6e3d5cf2ec3ea473fa46274d25b67d0defac71984ad3177c77c9fd57008d9590f0bcdf95c6939cf9950605fc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 14c15db261e7fe35c07e009c2e785ba53d4456e54addc90e4150ca6df03acb29
MD5 916829c38cabe01f111b75122f83df4e
SHA1 1aa238fff51620feb50da3235136e2b115833bd8
SHA512 c9bdf66c8f842563ad2ae5ac5ff5730d754f4641efe9c3183f81dbe28c46d9ce69bb958a7d49a0f30cd59cbe1355fb1e77132f1a95490a8ae5a27cb64e43a917
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6c70f567ddf8530acbce71a19aa45af2d38e48ba539517c439d4d0073e7c9f5a
MD5 3ca4313ae829cdb5c4d1f4d87d531493
SHA1 7a08b6421a8a9fed6dcd14412a999a06e5fc3531
SHA512 9315ae0ea0eaefad7924a3aff11d383553cd484b91cdbbc8e25017fc97b9b4ece79f4662c241b99385480c1c504d0924af3fd2c01f83c99d67370f55470b775d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7cda6b8603f86bb74e5fcdf15b0cf37fdb505cf7ca13061bc684c515839d34fc
MD5 49729b2fb9dd2ff28c3d265cbd3593ce
SHA1 8f612945ae2a6690ed822f7c2c2cea6e5f010cef
SHA512 ba3c8e6b859e2ca50bc0f8c1dd87680cbb436bc2774d3eeda542b9765c3f0856fc1cf972e671b9d933f74a4fe74a65cf2f6416ad9490ee6c5d2cf1138848aba4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 cab4fb5146186fe468cd21cbad45b965a7087b77d1c8429e108f9107c186de56
MD5 1a8f8824b3ce2ae4701b424ad08668cc
SHA1 e5e8c6267c4ce8b611b0234226438627494db43a
SHA512 f8b47b95a34887a5fec5e0eef8e999203cae486ecad17b292e9f0004e51a3492a6de0a4c8aa0e2d7186550bb609933ad1126b0185c12cbec75f1c7b043e84dcf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 94c61378ab4948006a11138bcff4fe34a6a4557b0bdfb06f42b924e715ba1035
MD5 907effc9cce0e33f7e10ce6667ff6936
SHA1 3b027bb660cd2ebf0086c24354e95e4dcd2b7a43
SHA512 b28aebeaf0302f2165508ef1d852d3d4375a6bcb9f6beef8c4e7ed598e276e99d105f2c98dd95cfe1d0595b442462b5bd4eb11509bc773ce383fe866c03d8de8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 634f6ac5f4e092b394e5f0a7fce7b818418e347bc551f7e57677b25d21123fac
MD5 9cd59bd1193fec81ad27d545fa17320b
SHA1 19a36ee7aaf3705acc1a86e7d9149c36fbf0147c
SHA512 903bec86e81928a28429cd34b6670c0c6043d925694c3d6781b05e8a96cccf6b6033c449c794814de8f3ce3585480567dfc6ef79f7bf01ca85c6ac239181f20e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 26024b189bc822958535d89394640552d6922d598089bf07f95f099049f09dd3
MD5 ade9227f90d5f72a7316f7266b30f425
SHA1 ebc133fd10770b11a93672a6a0588498707c513a
SHA512 1699ab660ee7bdf7bd0ff86adab3d56845bc26ef731a107acf4113361dd26caff3d57c31e833fde13abeb92e0dbc511b17c8da16ec938a371fcdab41cfae44b9
MD5 SHA1 SHA512

Submit Download

svchost_CBBBBACBCCBBCBBBBBBACACCBBABCBCAAACBBCBCABACAAAACACABAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBACBCCBBCBBBBBBACACCBBABCBCAAACBBCBCABACAAAACACABAB.exe
Size 7.5MB
SHA256 8dcafcabe71a3b6734601d499369f47526757e37c8cc4e3aca307f46d594d9d5
MD5 c0df25e07d799b405df52be762d8fd00
SHA1 a655ed35a4a294e5fbda7ce6c5f655462ccb3710
SHA512 1cac1397d93c2e87e165695020a761bb89fea491171c9d0b0867915e566e4eea662c6393483596211402c4d5195ae29410cc101fb23408e44d47ef3202b78a4f
SSDEEP 49152:U+ES+ES+E2+ES+ES+E4f+ES+ES+Ek+ES+ES+E2+ES+ES+E4f+ES+ES+Ek+ES+ESK:eUUNKRuy5aEUUNKRuy5at+4j3
TLSH
T1A6868E05F58344B1D97B517049CFE37F8A75BB214A218EEBE7488B1B7E33B916828316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 0964f045cbcbdb0808a45f82a42b9f4d1a4d988f764d86d7b1255986e9c3cdd6
MD5 b17dc09946ab9beb6ccc9e370b138eac
SHA1 addcc0a827f588e01d647f3f5498a8ab402c84aa
SHA512 715ea5a47ec29c4318fe5db6403da6c3a0d5f62d78ea6c10434adcb65897d663ec688da344460fcfda2ddbb53110ad32e90f281e91d56311383cbe6b5e1d79c8
TLSH
T17921EA30B0B4CC13E132A8CBA615FBDB0CA97BEB985C9B01135992187FA6C36DD154E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 50bd0e5bf72ca9fbfd0c16d46be317ce9e86e2ee2f310416208f1b444e4f3555
MD5 48c0fad3002baacfa17e19f31c55e6ab
SHA1 24444ce2cb68cb47db7432966eedb271c79ad95c
SHA512 67d66ba67d5d5973434b0a43774dbf6198ea66b69838ffccd582d9b3ee655a022f67235570bf6a8ac5d1ffb74353a5f73022d0649821c091c93f912b1dfc43e5
TLSH
T11711CB60B075DC53E1326CDBA215BB8B0CD57BEB681C9B052358D218BF66C36DE154E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 49d9b77cf2e8a1373fe41a1fd039baf62639712850f6b00717af178f1c6baad9
MD5 d1d9843190752da2c93e8c6228a070a4
SHA1 51de7f408fff27ba8bbc4bae1d5ca42bf9183f03
SHA512 3c22074d6fe5c73f9f450a1d960eed99fcce666a9c3c41b546a3ca34077410b56c894827a5e322e9e8d832a657888279787b6903db831a68a5207c925c35309b
TLSH
T12621F960B075CC13E1326CDBA311BBCB0CE57BEB685C9B0023489218BF66C36DE154E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1672-59-0x0000000005890000-0x0000000005891000-memory.dmp

Download

memory/2872-36-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download

memory/5124-6-0x0000000000880000-0x00000000008A1000-memory.dmp

Download

memory/5536-81-0x00000000005D0000-0x00000000005F1000-memory.dmp

Download

memory/5792-92-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download