84934998c5e4099a1f1329a85596fb99b1c910fff692f9761807edd5c0f9bfe0

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/09/2026, 09:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_f8557b165e7dbf77670e5df5c96fbf32_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Size 21.0MB
Sample260909-k2thcathrb
SHA256 84934998c5e4099a1f1329a85596fb99b1c910fff692f9761807edd5c0f9bfe0
MD5 f8557b165e7dbf77670e5df5c96fbf32
SHA1 0e88d7a8136c52933b24bcdfeddc20e3a857bb73
SHA512 061c2f726df7a319ca884f630502f3a4e40412a56962be4ca02bccc2e526b86db881de6e96d54a8b6b70f08d36cd4d13d601e26e31a6cbb65d56dd2d3f3b2b06
SSDEEP 98304:UOU/jIEeQfoR/IuOFVjUu5qOU/jIEeQfoR/IuOFVjUu5K:UFIF0wuMFIF0wuQ
TLSH
T1E4274C05B7ED4464F4B771304DB6C669DAB2B8518B32C6DFA288863E5F33AD09C34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BAACAABACBCABABAACCBACCBABBABBCBBCCCCCBBAACBBBBBCACBBAC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BAACAABACBCABABAACCBACCBABBABBCBBCCCCCBBAACBBBBBCACBBAC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1664	svchost_BAACAABACBCABABAACCBACCBABBABBCBBCCCCCBBAACBBBBBCACBBAC.exe
3580	svchost_ACBCACCAABBCAAAACCBCBCCCAABCBACBBBABCAABACACBBCABBCCBAA.exe
3648	svchost_BAACAABACBCABABAACCBACCBABBABBCBBCCCCCBBAACBBBBBCACBBAC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBCCBAAACBACABCAABACAABBACCCCCCCACBCBACAABCCCAACBCCAAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAACAABACBCABABAACCBACCBABBABBCBBCCCCCBBAACBBBBBCACBBAC.exe"	2026-09-09_f8557b165e7dbf77670e5df5c96fbf32_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBBCBCCBBACACCBBBABCACCABCBACBACBCBBCABBABBBCACBBCBBAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBCACCAABBCAAAACCBCBCCCAABCBACBBBABCAABACACBBCABBCCBAA.exe"	svchost_BAACAABACBCABABAACCBACCBABBABBCBBCCCCCBBAACBBBBBCACBBAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1300	sc.exe
812	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2996	cmd.exe
4356	cmd.exe
2004	cmd.exe
5044	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-09_f8557b165e7dbf77670e5df5c96fbf32_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBCACCAABBCAAAACCBCBCCCAABCBACBBBABCAABACACBBCABBCCBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAACAABACBCABABAACCBACCBABBABBCBBCCCCCBBAACBBBBBCACBBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1768	schtasks.exe
2248	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2508	2026-09-09_f8557b165e7dbf77670e5df5c96fbf32_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
2508	2026-09-09_f8557b165e7dbf77670e5df5c96fbf32_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
2508	2026-09-09_f8557b165e7dbf77670e5df5c96fbf32_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
2508	2026-09-09_f8557b165e7dbf77670e5df5c96fbf32_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
1664	svchost_BAACAABACBCABABAACCBACCBABBABBCBBCCCCCBBAACBBBBBCACBBAC.exe
1664	svchost_BAACAABACBCABABAACCBACCBABBABBCBBCCCCCBBAACBBBBBCACBBAC.exe
1664	svchost_BAACAABACBCABABAACCBACCBABBABBCBBCCCCCBBAACBBBBBCACBBAC.exe
1664	svchost_BAACAABACBCABABAACCBACCBABBABBCBBCCCCCBBAACBBBBBCACBBAC.exe
3580	svchost_ACBCACCAABBCAAAACCBCBCCCAABCBACBBBABCAABACACBBCABBCCBAA.exe
3580	svchost_ACBCACCAABBCAAAACCBCBCCCAABCBACBBBABCAABACACBBCABBCCBAA.exe
3648	svchost_BAACAABACBCABABAACCBACCBABBABBCBBCCCCCBBAACBBBBBCACBBAC.exe
3648	svchost_BAACAABACBCABABAACCBACCBABBABBCBBCCCCCBBAACBBBBBCACBBAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2508	2026-09-09_f8557b165e7dbf77670e5df5c96fbf32_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Token: SeDebugPrivilege	1664	svchost_BAACAABACBCABABAACCBACCBABBABBCBBCCCCCBBAACBBBBBCACBBAC.exe
Token: SeDebugPrivilege	3580	svchost_ACBCACCAABBCAAAACCBCBCCCAABCBACBBBABCAABACACBBCABBCCBAA.exe
Token: SeDebugPrivilege	3648	svchost_BAACAABACBCABABAACCBACCBABBABBCBBCCCCCBBAACBBBBBCACBBAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1220	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 4356	2508	2026-09-09_f8557b165e7dbf77670e5df5c96fbf32_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	99
PID 4356 wrote to memory of 1768	4356	cmd.exe	101
PID 1664 wrote to memory of 3508	1664	svchost_BAACAABACBCABABAACCBACCBABBABBCBBCCCCCBBAACBBBBBCACBBAC.exe	102
PID 3508 wrote to memory of 3044	3508	notepad.exe	103
PID 2508 wrote to memory of 2004	2508	2026-09-09_f8557b165e7dbf77670e5df5c96fbf32_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	107
PID 2004 wrote to memory of 1300	2004	cmd.exe	109
PID 2508 wrote to memory of 5044	2508	2026-09-09_f8557b165e7dbf77670e5df5c96fbf32_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	110
PID 5044 wrote to memory of 812	5044	cmd.exe	112
PID 1664 wrote to memory of 2996	1664	svchost_BAACAABACBCABABAACCBACCBABBABBCBBCCCCCBBAACBBBBBCACBBAC.exe	116
PID 2996 wrote to memory of 2248	2996	cmd.exe	118

C:\Users\Admin\AppData\Local\Temp\2026-09-09_f8557b165e7dbf77670e5df5c96fbf32_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_f8557b165e7dbf77670e5df5c96fbf32_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABBAACCABCCAAABCCACACCBAACBCABBACBACBACBCAABBBBBCCCABBCBBCACABCBACCCABBCBBBBACBBACCBBCBBABBCCCBBCBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACAABACBCABABAACCBACCBABBABBCBBCCCCCBBAACBBBBBCACBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABBAACCABCCAAABCCACACCBAACBCABBACBACBACBCAABBBBBCCCABBCBBCACABCBACCCABBCBBBBACBBACCBBCBBABBCCCBBCBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACAABACBCABABAACCBACCBABBABBCBBCCCCCBBAACBBBBBCACBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCCCCAABBCACBABCCABCAABBABBCACACABABCCBCCBAACACCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACAABACBCABABAACCBACCBABBABBCBBCCCCCBBAACBBBBBCACBBAC.exe" start= auto displayName= "UserDataSvc_BCCCCCAABBCACBABCCABCAABBABBCACACABABCCBCCBAACACCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCCCCAABBCACBABCCABCAABBABBCACACABABCCBCCBAACACCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACAABACBCABABAACCBACCBABBABBCBBCCCCCBBAACBBBBBCACBBAC.exe" start= auto displayName= "UserDataSvc_BCCCCCAABBCACBABCCABCAABBABBCACACABABCCBCCBAACACCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCCCCAABBCACBABCCABCAABBABBCACACABABCCBCCBAACACCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCCCCAABBCACBABCCABCAABBABBCACACABABCCBCCBAACACCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:812

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACAABACBCABABAACCBACCBABBABBCBBCCCCCBBAACBBBBBCACBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACAABACBCABABAACCBACCBABBABBCBBCCCCCBBAACBBBBBCACBBAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCABBBCCBBACCCACABBBBABAACCCABCBCACAABABBABBABCBCCABCCACCACACABBBCCCCCCAABBCBCCCBBACAACBABBAABBBBACBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCACCAABBCAAAACCBCBCCCAABCBACBBBABCAABACACBBCABBCCBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCABBBCCBBACCCACABBBBABAACCCABCBCACAABABBABBABCBCCABCCACCACACABBBCCCCCCAABBCBCCCBBACAACBABBAABBBBACBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCACCAABBCAAAACCBCBCCCAABCBACBBBABCAABACACBBCABBCCBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2248

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1220

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCACCAABBCAAAACCBCBCCCAABCBACBBBABCAABACACBBCABBCCBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCACCAABBCAAAACCBCBCCCAABCBACBBBABCAABACACBBCABBCCBAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3580

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACAABACBCABABAACCBACCBABBABBCBBCCCCCBBAACBBBBBCACBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACAABACBCABABAACCBACCBABBABBCBBCCCCCBBAACBBBBBCACBBAC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 7d5ccb0c4fba9da8edf8c129e8c8f435ccf2fc6f6a362ed582d20d4e94d9cdc6
MD5 15f665b7451ec8084d1a7cdf75cd3344
SHA1 be689f2e16b4b35b3a0a6854f1471ae523222192
SHA512 2eaab4e2caffa76a3623cdc720e598234cf96dcf6f56a8a88a03cb447e212cafe374714178556b5bc0cc62fe53370b043501601cdef2ac50d0c5ba0323b8092f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\qap`g`v~dtlq
Size 10B
SHA256 8e63674894d8b08b11972120df8b72817cbe18bdd54324d5747bec9e1484d9ae
MD5 fa511b11a182d7f1dfe23e6671c31028
SHA1 aa6e09ed75d9e715558efab91b6e4a1115a4b359
SHA512 b4b1d2252005ccc1976fc5d5c571ec868be74a3d6216b420ace1b2a1ce4803e2c19106754f15ee705f5d154cdceffb68ad13ed3c990edc57192d5f54d1fd7dc5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 ac266c5723b9c7c0e557225a6c1971a0a5418594d4bf6307d73d664fd588044e
MD5 faf4a410ff6284205b45acee9832ab18
SHA1 3cee93390bd43bf24b3bbbf8c1a531bd126f6489
SHA512 adfb58d012a6ea8cfd7a87666ac6a42a55da16abc9ea3b17fea681f431b270ff49f0c2ef7cc1bd0fa30e3b9b8cd52d6372719f4ca6d81f07160677e7940f9d44
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 9ec3f8aa6f843e1cce39bd98b8bf041bb9d740abb17ec8ae5f88f41db634ee6b
MD5 e2c0e05b89a438aa1ea0d8bd45a2a028
SHA1 4940cdf55f0354488fdcbc13c824681da0ff90a5
SHA512 da3c1a79b2475e1072620d6f9757749334e76d33e69fe4d6a95214d78c7917e5fd30c2d7c7cd68e9cb1bbd9e06c5b39c366689296383ca44b7165fed31c23c36
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\bg\qap`g`v~dtlq
Size 10B
SHA256 dd8244028eda69452d2a62b6f0f1119474037d366822577e12a25b43eed25a40
MD5 e6105be68629c475c8e562d20743f0cd
SHA1 eee235779f4739ad905b8f99d077eda1b14a9ba4
SHA512 c1a614812b31b5fb4d702608a1e2b52e1f2f1aa986243c789f2ccbd68b86c07580d37896e926cd57a5bd66559b3cce3d67bedb82ff3384cebd2df7d050b5967f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\qap`g`v~dtlq
Size 10B
SHA256 b9d3c2fb52bfd77015208a8b91d3a48dde036fcf4cdb03e736e4c61be52593a9
MD5 094a485e1f7720a3644d9cb49640e4e1
SHA1 3f6e8e5f98306d4f29dbf9e542070d8f48cf7f84
SHA512 2d2e12d04ec57a2406fbb45306136f7088e739d08ae8a321ce341d1908d6d88f04079a90f035c13e253148e1d4e928c899d8bb1830049c0c9008cad5c847a176
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\ckkx3h66.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\datareporting\qap`g`v~dtlq
Size 10B
SHA256 f1c6a810eeab2efd41ed634b16d3f4874ce1c14c52ed931604b0919bb265d6bd
MD5 e7e9f270a6c236dc6023d03cca314c65
SHA1 12733cb05d26c0896cdd4d69d1f45e19c1980a76
SHA512 72171c361d58f8b48b52921cd63e2852f5f8b23c4ca6c4712f0b2f2929f3067499857cdf203aae6d8f657fbb071c3ba083876be5ce0fdd3a0aae4bf8d9652df3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5159d4967ea007ca653e9b7c5b4455757ae53b18b592dda6b1178d67a686f517
MD5 e2f749f3907ed8b227610add32e897f9
SHA1 654c8c5e214abbcd98c761acab2cba52066bf60f
SHA512 1a74a3e26398776d281b3d06484f8fb252952263f9860ac6a3ab9b06a2b90c1f8008889bedb2bea5289ab0d5c8d07b0fc223183664ab766954f2b42d89d0e30c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8d96ac656ef6974ed96a9b6b1b09878e872d09368f6904519369ed79466fc42b
MD5 5a060dabbc0a69a5067e4125e469e8a0
SHA1 038e21ce66d84831e8276936a58799e347485b17
SHA512 e45f86341274924a98af63bcab460e76ca177925a00c7eb2daa1a2b1034bb41d9831da8655740fda7c910c5a181229df1d7c2d70416ce0125a4a5655b641b44f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c00df712a28899f854aa85f00d7da43f453300017f1f3cc2b1e6dd0266ffeab0
MD5 5ffc5dba1e86d3b6d7d1e8ad732dd4c8
SHA1 348212587b9312b76236135775783b01afe3cc7c
SHA512 f7496405de55e34254ad198d57b5448260bc024dc50a47f6e438bff6dcf121e36c72256bd10b3f13acf125ffe39ff7f4096f721dcf17b5a4b42c4aa4314e8b91
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 233195b1a1affd0fc977aa20e4d06dd9cefda7814893174b81478024cef3666b
MD5 f0334111bdcd2338c155b291758479e1
SHA1 0e3f39d49c1501f866e37c610a598376aca2e111
SHA512 1cff1888d580274a6a2d9e168671dff5b45fa026e3aa7217876a3cc5ea5404c4d2888ba2448528bd1ae77b3d3bc3f8c251a77aebba920c4a956612d314c478bf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 161e0e50661c8ee48e67fffaf3df114ab8526979aab6f423ac3ecff7f5d21a98
MD5 b0a212094d532b07376b95a129f54764
SHA1 3d3fa271a39d12ded31bd6d080c96a8939165901
SHA512 04d9fa7577819067b4e87709dcaa873c12544a6f8f63eef8b1193497b29ece56e5f6a9ef71249fd5e5e8cf27d42ebde991c3472369de444168a921d4853b4826
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0c7437e747d403c613bf99c13d294fe4c696d9865886ac8b0509eb91cc353f50
MD5 30fe9ab5026b7767d734229929bce210
SHA1 256bcc2320f143c5bccfd81b427276880dde882a
SHA512 a87d48f3e0bb7d33a6d91740395f4da3788fa1495b6ebd3f2810254f500b8281fc65b2c4b01ef528744e6144098772aedc017dee13fe9454a57d9e1353414769
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d245fd330242762dbef9b7bf956d4ee05f881a51e79e3a00eafa0f8a839de8e2
MD5 dbb36e025460810b02fdb996360f1f18
SHA1 df83ea52ee29a436d285b11b6d3e231118774036
SHA512 5fd3bdff2a6addedec94370bd52112b1dfd28bd9720afd4d56397c6e2d8bfae4e7f6beb64cee336f054eebf4950290f63513fa3b8eb924b4b9234cd1c1ad6ebf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Music\qap`g`v~dtlq
Size 10B
SHA256 9b9c17ea0dd1d43d7004b23149aab74cacf459778c85863a58575d131ed2ea06
MD5 ce55fa6d093d93d172425be60fdd16e7
SHA1 904cc46ce6f49d5e624edd1562d045cbc736f422
SHA512 886e58e9ec5b09d81569c527981b48c1790bdddd3c55dd011192de6099ec9a0f0c008eff1f2478a68811099ba1e4e7a4e7e697bf646f18dce58e4228d05b57d9
MD5 SHA1 SHA512

Submit Download

svchost_BAACAABACBCABABAACCBACCBABBABBCBBCCCCCBBAACBBBBBCACBBAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACAABACBCABABAACCBACCBABBABBCBBCCCCCBBAACBBBBBCACBBAC.exe
Size 21.0MB
SHA256 84934998c5e4099a1f1329a85596fb99b1c910fff692f9761807edd5c0f9bfe0
MD5 f8557b165e7dbf77670e5df5c96fbf32
SHA1 0e88d7a8136c52933b24bcdfeddc20e3a857bb73
SHA512 061c2f726df7a319ca884f630502f3a4e40412a56962be4ca02bccc2e526b86db881de6e96d54a8b6b70f08d36cd4d13d601e26e31a6cbb65d56dd2d3f3b2b06
SSDEEP 98304:UOU/jIEeQfoR/IuOFVjUu5qOU/jIEeQfoR/IuOFVjUu5K:UFIF0wuMFIF0wuQ
TLSH
T1E4274C05B7ED4464F4B771304DB6C669DAB2B8518B32C6DFA288863E5F33AD09C34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 080493cc44887d2d1ded6b67a31172f7d923da1ba45993340f0e358203d426b5
MD5 717eb53363c7da1ae976a568239d31d8
SHA1 8439687f4e7676a014672f3d6eab7d80e7e178bc
SHA512 cf5b42fae67215373b2bf7c485809c2e5c2666d596e84a6d7ce95e0bff6fafb24cf64a587dea424204adadbef8f9edc7a6503d09501e74e1e8d1509798e8ac5c
TLSH
T16C21D460B165D897F132F8C7622ACADB0CE83B9A6458BB04334D6319BB15C358E158E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 d3149a757b8aa41ba9628e3e0eec2183855e42170125ac640f5a1e7365a34e99
MD5 13ea0a320651292157119100c2dc8915
SHA1 acde0b68a82052eac7615ef9633c66c11a813435
SHA512 b606bdcb09a9a923718e59464ec0c05941c6149409b65cee51906dd163a61930a1a6f50ead11b77a6f2ccaa8c8c5a5f0a764cd8b51bbe86d52a4918547fc1662
TLSH
T19D21D330F1A5DCD7F132E8CB6629DBDB0CA83B9EA89CAB00234D9309AB55C35CD154E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 fbad2b4ce63f61aaa4c98c80f84d8a2ca1e9c1a69dfb5a09e12b056c89b9b865
MD5 54e719081beda73c2e2c97b5cb47ff5a
SHA1 37a8b4f9eda01ccb1459bea4f4032fd5d8913554
SHA512 46efbdf61dbef1e25020f18df44a38fffb5452e11bc4c9fac57acc7076da57655e543dd5733b1fb0853bf9378fc05a9292866f362f03fc34986fd3f9e5b60ea5
TLSH
T1C511B260B165D897F133F8C7622ACADB0CA83B9A6858BB04234D931DBB059358D158E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1664-455-0x0000000000860000-0x0000000000881000-memory.dmp

Download

memory/1664-112-0x0000000000860000-0x0000000000881000-memory.dmp

Download

memory/1664-73-0x0000000000860000-0x0000000000881000-memory.dmp

Download

memory/1664-50-0x0000000000860000-0x0000000000881000-memory.dmp

Download

memory/2508-75-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/2508-10-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/2508-49-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/2508-23-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/2508-72-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/3508-77-0x0000000005840000-0x0000000005841000-memory.dmp

Download

memory/3580-99-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download

memory/3648-456-0x0000000000860000-0x0000000000881000-memory.dmp

Download