7fc415f7c79eb8cb2729b2b6249aa5126f3e276036f963bb90dbce4310aff52e

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/09/2026, 06:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_18b924c57989f5806e9b9f319567369e_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe
Size 50.9MB
Sample260909-g4algaserc
SHA256 7fc415f7c79eb8cb2729b2b6249aa5126f3e276036f963bb90dbce4310aff52e
MD5 18b924c57989f5806e9b9f319567369e
SHA1 990d258dab83afcfd57049bb15dc6b5db239066d
SHA512 263fd312305a7cf33296a815aabd853dcb9ac68e53f0fd7a2716590468e89ed98a8f71b7560512df0211d169da88d3d0e4421f5e71761420ab658c7e50bd4bdc
SSDEEP 786432:+5O5y5O5y5O565y5O5y5O5y5O535O5y5O5y5O565y5O5y5O5y5O535O5y5O5y5Oa:a
TLSH
T19CC75B49BBEA5161F5B346708CAAC2B65D31BC204F3187EF6684F32D5E326C0E935B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BABBCCCBAACCCCAABBACAACACCAAABCABBCABBCBAAACCABBBABCAAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BABBCCCBAACCCCAABBACAACACCAAABCABBCABBCBAAACCABBBABCAAA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2516	svchost_BABBCCCBAACCCCAABBACAACACCAAABCABBCABBCBAAACCABBBABCAAA.exe
2504	svchost_ABBBACBBCBBBBBBBBBBCCACAABCBBCCACCCAACACCBAABACACCBBBBB.exe
1472	svchost_BABBCCCBAACCCCAABBACAACACCAAABCABBCABBCBAAACCABBBABCAAA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBCACCCABBAABCCABACCACBCCAAAABABCBCACCCBBABCBACCBCABCBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABBCCCBAACCCCAABBACAACACCAAABCABBCABBCBAAACCABBBABCAAA.exe"	2026-09-07_18b924c57989f5806e9b9f319567369e_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBBBCACCBCBBBCCABABACBACBACCCCCAAABCCBABBCCBAABCBCAABAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBACBBCBBBBBBBBBBCCACAABCBBCCACCCAACACCBAABACACCBBBBB.exe"	svchost_BABBCCCBAACCCCAABBACAACACCAAABCABBCABBCBAAACCABBBABCAAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5076	sc.exe
976	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3828	cmd.exe
404	cmd.exe
3916	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_18b924c57989f5806e9b9f319567369e_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBACBBCBBBBBBBBBBCCACAABCBBCCACCCAACACCBAABACACCBBBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABBCCCBAACCCCAABBACAACACCAAABCABBCABBCBAAACCABBBABCAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3808	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4252	2026-09-07_18b924c57989f5806e9b9f319567369e_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe
4252	2026-09-07_18b924c57989f5806e9b9f319567369e_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe
4252	2026-09-07_18b924c57989f5806e9b9f319567369e_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe
4252	2026-09-07_18b924c57989f5806e9b9f319567369e_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe
2516	svchost_BABBCCCBAACCCCAABBACAACACCAAABCABBCABBCBAAACCABBBABCAAA.exe
2516	svchost_BABBCCCBAACCCCAABBACAACACCAAABCABBCABBCBAAACCABBBABCAAA.exe
2516	svchost_BABBCCCBAACCCCAABBACAACACCAAABCABBCABBCBAAACCABBBABCAAA.exe
2516	svchost_BABBCCCBAACCCCAABBACAACACCAAABCABBCABBCBAAACCABBBABCAAA.exe
2504	svchost_ABBBACBBCBBBBBBBBBBCCACAABCBBCCACCCAACACCBAABACACCBBBBB.exe
2504	svchost_ABBBACBBCBBBBBBBBBBCCACAABCBBCCACCCAACACCBAABACACCBBBBB.exe
1472	svchost_BABBCCCBAACCCCAABBACAACACCAAABCABBCABBCBAAACCABBBABCAAA.exe
1472	svchost_BABBCCCBAACCCCAABBACAACACCAAABCABBCABBCBAAACCABBBABCAAA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4252	2026-09-07_18b924c57989f5806e9b9f319567369e_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe
Token: SeDebugPrivilege	2516	svchost_BABBCCCBAACCCCAABBACAACACCAAABCABBCABBCBAAACCABBBABCAAA.exe
Token: SeDebugPrivilege	2504	svchost_ABBBACBBCBBBBBBBBBBCCACAABCBBCCACCCAACACCBAABACACCBBBBB.exe
Token: SeDebugPrivilege	1472	svchost_BABBCCCBAACCCCAABBACAACACCAAABCABBCABBCBAAACCABBBABCAAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4536	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 3828	4252	2026-09-07_18b924c57989f5806e9b9f319567369e_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe	101
PID 3828 wrote to memory of 3808	3828	cmd.exe	103
PID 2516 wrote to memory of 3172	2516	svchost_BABBCCCBAACCCCAABBACAACACCAAABCABBCABBCBAAACCABBBABCAAA.exe	104
PID 3172 wrote to memory of 1172	3172	notepad.exe	105
PID 4252 wrote to memory of 404	4252	2026-09-07_18b924c57989f5806e9b9f319567369e_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe	109
PID 404 wrote to memory of 5076	404	cmd.exe	111
PID 4252 wrote to memory of 3916	4252	2026-09-07_18b924c57989f5806e9b9f319567369e_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe	112
PID 3916 wrote to memory of 976	3916	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-09-07_18b924c57989f5806e9b9f319567369e_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_18b924c57989f5806e9b9f319567369e_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACBBCCBAABCBAABCABCACBCCBABCBBBAAACBCCBBAABCCACCCABACABACABBBBACACACBCABCACABBAAACCBBCACCBAACBACCCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCCCBAACCCCAABBACAACACCAAABCABBCABBCBAAACCABBBABCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3828
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACBBCCBAABCBAABCABCACBCCBABCBBBAAACBCCBBAABCCACCCABACABACABBBBACACACBCABCACABBAAACCBBCACCBAACBACCCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCCCBAACCCCAABBACAACACCAAABCABBCABBCBAAACCABBBABCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3808
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBACACCCCCBBABCCAACABAAAACBBBAACABBCBBCABABBBBAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCCCBAACCCCAABBACAACACCAAABCABBCABBCBAAACCABBBABCAAA.exe" start= auto displayName= "UserDataSvc_CCBACACCCCCBBABCCAACABAAAACBBBAACABBCBBCABABBBBAAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:404
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBACACCCCCBBABCCAACABAAAACBBBAACABBCBBCABABBBBAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCCCBAACCCCAABBACAACACCAAABCABBCABBCBAAACCABBBABCAAA.exe" start= auto displayName= "UserDataSvc_CCBACACCCCCBBABCCAACABAAAACBBBAACABBCBBCABABBBBAAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBACACCCCCBBABCCAACABAAAACBBBAACABBCBBCABABBBBAAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBACACCCCCBBABCCAACABAAAACBBBAACABBCBBCABABBBBAAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:976

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCCCBAACCCCAABBACAACACCAAABCABBCABBCBAAACCABBBABCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCCCBAACCCCAABBACAACACCAAABCABBCABBCBAAACCABBBABCAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3172
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1172

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4536

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBACBBCBBBBBBBBBBCCACAABCBBCCACCCAACACCBAABACACCBBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBACBBCBBBBBBBBBBCCACAABCBBCCACCCAACACCBAABACACCBBBBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2504

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCCCBAACCCCAABBACAACACCAAABCABBCABBCBAAACCABBBABCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCCCBAACCCCAABBACAACACCAAABCABBCABBCBAAACCABBBABCAAA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 bf0304e822b40ee29219f9a6e4d61f826c747a31b0be1e46af7b02aa42549df3
MD5 ffb0c1afca5ebbccc9471a5754a4780a
SHA1 d8468ebefe57965fef128f38b5ba040818ac3d28
SHA512 717ae27dbec01ff36a313188fed292af0f38666bfe1e44cacba6b2f29b207d047063bf4574634c70cbe4a9e1d8cce47361ed31db4eb02336f1c93b1eb785d7b0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.LockApp_10.0.19041.1023_neutral__cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 460781b9694c3db21fecbaf44e86776cbbf30ef39afedd99ec52147af15e9071
MD5 ee26147a868a95f3f3aac13f390053a1
SHA1 5db450b74a8212ee3adec3f17b6ff9d448a02606
SHA512 19190ed83e1a6e6cd45b159faf9d041af12255718ad457f606439233cfba54fa3416600dc449545ab96079d09aef6eaabf98b3720f23da6d87bdd5fa75a3f041
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\wfp\qap`g`v~dtlq
Size 10B
SHA256 d8c379579719d15e934a0bd93857f6bda3c48f2699fe339c993d71e987c9a2b3
MD5 0ee44cd93f908751eadbb516596ed2dd
SHA1 907a0d6d2310e462e532b0949bfdf8b050064707
SHA512 ef2e09abbc25359a6483d2704c4cb0d40be5de165899b661ca87610583c41829fc334fd86016d96c5abec26e60061e0dc67fec3b19b6db6bd03cb65a430c738c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 9b660b9bdaac3a15e021339000b2fa7d21c3b25dd71b497d3ab4e6c25dae3a01
MD5 dc40533c84a733508fafd734301654d3
SHA1 0c313602fe12e8503c4571927a52c624ab25aaf9
SHA512 ca630bb618b265d314e2c49a4d8b38a4f0d64c2e0fc73bef55fbb661e826a83261fa615a7e074d7821412562a80f0f8168ca4ef767afa609006b530b95847d1f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\qap`g`v~dtlq
Size 10B
SHA256 ecc37c3a98a04c6367c48a5d21a82c38745743916ec9e06bdef177132bd6f460
MD5 aace4eaabe5a92461a907ec6a61319c4
SHA1 e962fe25d7135bf74d7a5c18afdb94a075a9a140
SHA512 61a04d9ce4ea5ac718f6cdbd98fbed78f96c6a568200a075a814c83f6de426d2c329a7c3295b441092e01d20bd8bb92c226e89cae2444ada48d57cf9aa79451b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\qap`g`v~dtlq
Size 10B
SHA256 e685c806d36d38f7f8eee44d8019a28e1edd15dbb22f7617181b93af4f79f944
MD5 1e7fd1de94133fce9209db9c18d5f092
SHA1 cda556253d94430490cfaf9cb1ce9aa1c0088c6e
SHA512 77794861f103dd10ff4aa5bf1bf88c8d689a54a336ffcb7bc3a5a9ae2a38166e7b40388db8cecdfd669f136849d8e83f1cc550a9f97f121be93b2cda6967cc6d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 69505669c14b0aee81b37b17997b929649ff8322c305986482fe69cf06b8bfef
MD5 1490706c33afb5714ca7e66ab7e1e44d
SHA1 f4ad26ae2d330779718e8c9d6e306c90cfc8913a
SHA512 4a9aa5c876f3ab32ec36ab6c577e50e084cfefe872684c177e44c7ae75f43758d0e02c7359dc0d1043981f2576f651c98c3654521e40fb98d97c8058203d6df2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Advertising.Xaml_8wekyb3d8bbwe\AC\INetCookies\qap`g`v~dtlq
Size 10B
SHA256 df570d3c23c2febb3f3245aca5ae28caebf4fb7df3d1e1d941b9c7946ddca7cf
MD5 9acf915fe80aaf4dfcaadad5477b3611
SHA1 51fa6241fb6b4af8c657ea40ff2c9030013ce9ba
SHA512 8f3ab577f665fdc8a8a9e9aa448e5972d1bfcb3bfc190e7e5abba682d6bd6d6fa3e8712f8d6d6fffe56ca15e98bebfdba0130eb75c70ee30b5c637798a41d3f3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 af83fe5d79f0d65def9f6a18598b48135dbb39b561933112b6e2ac338864b538
MD5 59c51e9fea239c4bf4813f91a0c58976
SHA1 cf8fdcc38a7c957654d9f91ec23b05ce9343d78d
SHA512 0a504785bca3f4b324590b6720ba19274152f99d177039dba5d6db2f60b5353c543012b9948aabc26f26092054cde9cdff62446759ad16f2eedaa28f3f973a7f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c6165047e6f5641e7f96176dd27faaa11c26b43cf9eb1824349aa2b8d9fb5cca
MD5 296250e488646f285249dce936443b74
SHA1 000e452a201e8686a030f81eb04a900865533327
SHA512 91e822337e873e97e4080c3527c97d7092776e91c9da887d8a53f0c016869e2067c54462469bdc88afcb4a3c8267a52698a5dd278d6b12040abf929b14d2efe9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7a0015b8dab02f16cb5ad85d927ae0dc0bd734ee0975cf47ee09a2184a34f982
MD5 49e2b4992282302879f555a60588f9b2
SHA1 397e81fcc53bdb666efaabf7939d3b0d4ecd0b7b
SHA512 301b6f17eb09dcca2c6ba1932d0924de172b6e81012988d729bb739f26d909ca1cc9edc05d4f2da60391bac50dffc23c40411b3d72c984357c943db0bbc27e80
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 67063d3fd77de314ee8b87395d24a3d77d02b472b4ece2075793a8b4448b57a0
MD5 816271a5fcef3e15fa4c1653413d5853
SHA1 9c0be7b19d2d2824982d3d80c679524b95a9cd08
SHA512 e2d2ff377742507ffac93a230dd9934186373f7f6137d4807e50e5dc52dd1f4a4db76710aecbbaee983cbbfb98304d83eca5fbb526729443c4994bf9b7b0450c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9689a247b5a4ce42c0d7732dff3efe3b4da470ce08c038bc84f3b28c9fa0f6a9
MD5 1ea0b71e5a661e0a0f5d6a69c65907fc
SHA1 52a2c925cf8dfaaac851d24f43f6507d64431990
SHA512 f744ff3374154073f99ad864cadc5c24bbcfe9d333d6ae794091854b4a2d29f55c3ea5a6f62ec524d18ea1016dd747a866cafb8da4b1a6e46152282397be8dc8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 08d5d61a2f33418491e9cec901ce33751d971651fed9977af2b58b986268c413
MD5 81be8d7b904b927ead4ea3933ceb7189
SHA1 3438e43266c75408b60601a7871bc22a30f3c747
SHA512 6a696b4a3b7b7a67548c8c60e8d1f27b666459086e59bf13e48eb647c0c131ba388fcdf472c9ebeae582c05cbbd2addc0ecf80dd672130c752f6b8518cdf7aea
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 b3b1e9c86ed233aebafe63d9e8279d29c12427e2a4083c7ae6c368e4f6d6461f
MD5 67dbe7c0a6aa5a0356ea0e7cf359e73f
SHA1 b5a2b495aec9339fa4c36076d05ffddbe5647bd7
SHA512 72f2a92449163521fad47f6ca6652377eb42ac57a263ed17bed2b2b906d1b41b62cf0a3b12eea052515ec1e94a162a4630177ed13db509a349c00e70e6880ee4
TLSH
T145119B90A0A6E813F131E8CF571DEBCB0CEC3F8A6C58AFA4134447187B15CB64D264E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 f3c9106711c198023738214382b67ed5ee65709d829dde035818d1f1758d2311
MD5 eba3672e589160a12c55b4c8b803c176
SHA1 9bd5d0e7b8ad493f199b6496abf5d20455e835bb
SHA512 40739a1428f68b6e42a3645d05c367f92542554808d6caf1bb8dcf6e522852447550e51737d3b49082099707ca20dfa7b7838c256bc6abe56a60e003aa1a49f9
TLSH
T1DA21A190A0A6E813F131E8CB571DEFCB0CEC3F9A9C58AFA4134557187B15CB64D268E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1472-89-0x0000000000040000-0x0000000000061000-memory.dmp

Download

memory/2504-421-0x0000000000BF0000-0x0000000000C11000-memory.dmp

Download

memory/2504-77-0x0000000000BF0000-0x0000000000C11000-memory.dmp

Download

memory/2516-36-0x0000000000040000-0x0000000000061000-memory.dmp

Download

memory/2516-26-0x0000000000040000-0x0000000000061000-memory.dmp

Download

memory/3172-57-0x0000000002EC0000-0x0000000002EC1000-memory.dmp

Download

memory/4252-6-0x00000000003A0000-0x00000000003C1000-memory.dmp

Download