8c40634a275e2f0cd5bc56e5a50db854556d8ba2815b2e3005ed54fb559c53f9

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_d09de24040359f5b50c57589a547b95f_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 14.4MB
Sample260910-c265fadk4y
SHA256 8c40634a275e2f0cd5bc56e5a50db854556d8ba2815b2e3005ed54fb559c53f9
MD5 d09de24040359f5b50c57589a547b95f
SHA1 957b0e18a0d3ed5e57d4e966875ef92d5259fb4a
SHA512 d76ca396e2a9f3f3b7a306c975c872ebb460bfe0793b64c4ed94f92272f971670200422e4a135985c9c5d598a60799b8c2b2c325e4b6a43f1c7ec89e0cf6b54b
SSDEEP 98304:3KRuy5axKRuy5axKRuy5axKRuy5axKRuy5axKRuy5axKRuy5axKRuy5axKRuy5aG:3qUqUqUqUqUqUqUqUqxKWQc0gEYnvL1
TLSH
T1E4E6B012F6C20071EAB7357009AFE37A5D7D772146358D9EE7884A3F5E32E80692835B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBAAAACCBABCCCCBCACBABCCCBCCABACCAACBCABABACCCAABBBAABC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBAAAACCBABCCCCBCACBABCCCBCCABACCAACBCABABACCCAABBBAABC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBAAAACCBABCCCCBCACBABCCCBCCABACCAACBCABABACCCAABBBAABC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBAAAACCBABCCCCBCACBABCCCBCCABACCAACBCABABACCCAABBBAABC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2312	svchost_CBAAAACCBABCCCCBCACBABCCCBCCABACCAACBCABABACCCAABBBAABC.exe
708	svchost_BAACCBBBAACBACCBCCCBACBBBCCCACCCCCACBCCBCBCACBACCAABACA.exe
5780	svchost_CBAAAACCBABCCCCBCACBABCCCBCCABACCAACBCABABACCCAABBBAABC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACACBABCAAAAABACACBAABCACBABACCACCACACAAABCBBCCCAABBAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBAAAACCBABCCCCBCACBABCCCBCCABACCAACBCABABACCCAABBBAABC.exe"	2026-09-08_d09de24040359f5b50c57589a547b95f_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCBABABABACBACBABBBBACACABABCBBBCBABAAAACCABBBABCACCCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAACCBBBAACBACCBCCCBACBBBCCCACCCCCACBCCBCBCACBACCAABACA.exe"	svchost_CBAAAACCBABCCCCBCACBABCCCBCCABACCAACBCABABACCCAABBBAABC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5724	sc.exe
2608	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1688	cmd.exe
3800	cmd.exe
1396	cmd.exe
4952	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_d09de24040359f5b50c57589a547b95f_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAACCBBBAACBACCBCCCBACBBBCCCACCCCCACBCCBCBCACBACCAABACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBAAAACCBABCCCCBCACBABCCCBCCABACCAACBCABABACCCAABBBAABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4124	schtasks.exe
3436	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5196	2026-09-08_d09de24040359f5b50c57589a547b95f_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
5196	2026-09-08_d09de24040359f5b50c57589a547b95f_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
5196	2026-09-08_d09de24040359f5b50c57589a547b95f_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
5196	2026-09-08_d09de24040359f5b50c57589a547b95f_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
2312	svchost_CBAAAACCBABCCCCBCACBABCCCBCCABACCAACBCABABACCCAABBBAABC.exe
2312	svchost_CBAAAACCBABCCCCBCACBABCCCBCCABACCAACBCABABACCCAABBBAABC.exe
2312	svchost_CBAAAACCBABCCCCBCACBABCCCBCCABACCAACBCABABACCCAABBBAABC.exe
2312	svchost_CBAAAACCBABCCCCBCACBABCCCBCCABACCAACBCABABACCCAABBBAABC.exe
5780	svchost_CBAAAACCBABCCCCBCACBABCCCBCCABACCAACBCABABACCCAABBBAABC.exe
5780	svchost_CBAAAACCBABCCCCBCACBABCCCBCCABACCAACBCABABACCCAABBBAABC.exe
708	svchost_BAACCBBBAACBACCBCCCBACBBBCCCACCCCCACBCCBCBCACBACCAABACA.exe
708	svchost_BAACCBBBAACBACCBCCCBACBBBCCCACCCCCACBCCBCBCACBACCAABACA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5196	2026-09-08_d09de24040359f5b50c57589a547b95f_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	2312	svchost_CBAAAACCBABCCCCBCACBABCCCBCCABACCAACBCABABACCCAABBBAABC.exe
Token: SeDebugPrivilege	5780	svchost_CBAAAACCBABCCCCBCACBABCCCBCCABACCAACBCABABACCCAABBBAABC.exe
Token: SeDebugPrivilege	708	svchost_BAACCBBBAACBACCBCCCBACBBBCCCACCCCCACBCCBCBCACBACCAABACA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5196 wrote to memory of 4952	5196	2026-09-08_d09de24040359f5b50c57589a547b95f_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	92
PID 4952 wrote to memory of 4124	4952	cmd.exe	94
PID 2312 wrote to memory of 1328	2312	svchost_CBAAAACCBABCCCCBCACBABCCCBCCABACCAACBCABABACCCAABBBAABC.exe	95
PID 5196 wrote to memory of 1688	5196	2026-09-08_d09de24040359f5b50c57589a547b95f_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	98
PID 1688 wrote to memory of 5724	1688	cmd.exe	100
PID 5196 wrote to memory of 3800	5196	2026-09-08_d09de24040359f5b50c57589a547b95f_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	101
PID 3800 wrote to memory of 2608	3800	cmd.exe	103
PID 2312 wrote to memory of 1396	2312	svchost_CBAAAACCBABCCCCBCACBABCCCBCCABACCAACBCABABACCCAABBBAABC.exe	106
PID 1396 wrote to memory of 3436	1396	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-08_d09de24040359f5b50c57589a547b95f_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_d09de24040359f5b50c57589a547b95f_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCACCBCBBABCBABABAAABCBBCAABBCBACBABACACCBCCCAACCCCBCBABAAAABCBCBBBBBCCACCCACAAACCABCACABCCCBBBBCBACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAAACCBABCCCCBCACBABCCCBCCABACCAACBCABABACCCAABBBAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCACCBCBBABCBABABAAABCBBCAABBCBACBABACACCBCCCAACCCCBCBABAAAABCBCBBBBBCCACCCACAAACCABCACABCCCBBBBCBACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAAACCBABCCCCBCACBABCCCBCCABACCAACBCABABACCCAABBBAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBCBBACCBACBBBAABACAAAABABABCCAABBCACBBBCCCBBCBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAAACCBABCCCCBCACBABCCCBCCABACCAACBCABABACCCAABBBAABC.exe" start= auto displayName= "UserDataSvc_CCBCBBACCBACBBBAABACAAAABABABCCAABBCACBBBCCCBBCBBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBCBBACCBACBBBAABACAAAABABABCCAABBCACBBBCCCBBCBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAAACCBABCCCCBCACBABCCCBCCABACCAACBCABABACCCAABBBAABC.exe" start= auto displayName= "UserDataSvc_CCBCBBACCBACBBBAABACAAAABABABCCAABBCACBBBCCCBBCBBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBCBBACCBACBBBAABACAAAABABABCCAABBCACBBBCCCBBCBBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBCBBACCBACBBBAABACAAAABABABCCAABBCACBBBCCCBBCBBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2608

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAAACCBABCCCCBCACBABCCCBCCABACCAACBCABABACCCAABBBAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAAACCBABCCCCBCACBABCCCBCCABACCAACBCABABACCCAABBBAABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACCAACAACBBBACBAAAACCAABBBCABCAAACCAACBAABBBBACACAACCCACBBAAABCAAACABBBBCABABCBBACABABCCAAAACABBBCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCBBBAACBACCBCCCBACBBBCCCACCCCCACBCCBCBCACBACCAABACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACCAACAACBBBACBAAAACCAABBBCABCAAACCAACBAABBBBACACAACCCACBBAAABCAAACABBBBCABABCBBACABABCCAAAACABBBCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCBBBAACBACCBCCCBACBBBCCCACCCCCACBCCBCBCACBACCAABACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3436

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCBBBAACBACCBCCCBACBBBCCCACCCCCACBCCBCBCACBACCAABACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCBBBAACBACCBCCCBACBBBCCCACCCCCACBCCBCBCACBACCAABACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:708

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAAACCBABCCCCBCACBABCCCBCCABACCAACBCABABACCCAABBBAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAAACCBABCCCCBCACBABCCCBCCABACCAACBCABABACCCAABBBAABC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 f84cdfef59c0e1ddccf0fed39b139cd6228e8afc6907fd5f9d9dcfb50e5d6a8a
MD5 c94ef1cc3a9d2598aaa8d7bcb3d26a4b
SHA1 e98da43cd1c260bcea3c30c02cb068524dd62462
SHA512 7ac2e56565fd4c9aeedb5d803067858dc29d4fe7a456a8ebe1aa04afab0801411879cab9a729f5f45bcc125976961eef7643869a41691b72e71d89ec598f2742
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 d48ec5d234f2fbe186d8d38ac03ab465da230c3b5046a1a736cfdb3c7a2958f3
MD5 a02582b98ce72f0f6995e0f07264b875
SHA1 4724b200b900ca1aa17c99e8ec08ed86d159723e
SHA512 f183a2241d92ac11897e1193e14f84cb24d935a7a32ee11c02494a47de4b69033b86558784998f738cc1d3f59da341c18a3ef321e2a5877a6718b000ec7cfb19
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\ClickToRun\UserData\qap`g`v~dtlq
Size 10B
SHA256 008fdff0a440e42ba6032f50ea9fb20814b96df0c391173dc97a52d4fcbcd758
MD5 c730e5470bd5f78d93d03249b6bf9ca6
SHA1 9f4203e21bf752d121402d3fee4cbdf0a271d061
SHA512 bbd70ecaeb16aa908015d65ba5fc4f1dffed872460e4b534e8a3d7da2159dd4e5a3f1981696b42de34ca37263c78060f73a218fa4925593742ba679f7938c6b3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 667e3e893076477b5ab880c3d9c43d811786652685c5af76728571af024c7fc5
MD5 1afc74b8def357dae792ddfce6c18564
SHA1 704119903df32d9b3b9ba5b98c1ff82500970c87
SHA512 470635b889a489eec2d71a678facc25d8424b32e500a6ab6ef0ea2cf9621fbd2ce9537b45f026909e9747e78cf77201ba0a3b5e4d1d83c2d30e9f6d38e80586a
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 15.0MB
SHA256 34767302c8276c06234eece44259ea5439f508cd12a0b911188e7c4418da6bc7
MD5 a408076437c7ab6cca0f911263b973b2
SHA1 dbe2f52aa16326770b17032424362e296d8c1f96
SHA512 9102204157c40725446bffcb70863efe7710e05396d4c9f2f460a12f0aff48bf0e1a0d2473e419b216d45d3cda4dd74fe1dd02908a7cc61447f0521e916367e3
SSDEEP 196608:3qUqUqUqUqUqUqUqUqxKWQc0gEYnvLEgZ2js:6llllllllYcZEIv92Q
TLSH
T1E0F6B012F6820071E6B7357009AFE37A5D7D772147358D9EE3884A3E5E32E806A3935B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 f3b45006c2e53043b7ff93156ff0b425989808fd9e04d2488adf1c189cd2fff9
MD5 218321b6c5312278eadf168ee0952596
SHA1 28d011b5b0daa87e7f65c377db52ff70e5f401d6
SHA512 da8f3d805d077671a17863dcf3f3fb6981c4043dd78fd260adb926520ecae89cca9f80869a42070dd432689b15c192a50a0cc194d1274f491253155794ff43fc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 7c67a458380be09de0725d87320de9b0e203ffe339ebb6e3b0feda1704a50370
MD5 db868937028c17c81f62d8eab237650c
SHA1 4755f975355ad96e5a237cab12ad8d91fefd55b9
SHA512 6d5ba6aa63346b7dbdcc4ee534ff374e8157d709494b6c6e59e6351e397373a95b3cc074d6707939577e049676565e3a94ed7e225d3151e7c4cf7751aacb6583
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 8ab819d83440d135d6f13f850c8c377c5223c5a071f6039fbe91429403b2c998
MD5 5dd9ddd5277751deb2e0cc70606f17f3
SHA1 6c811a871dbdc520223da8f737f1e18712c2eb18
SHA512 8868b156babf3cb29e1b36b98fc7fd8b07614624b08f11a8c30e7af6bb52a4b3e1325bf80269282536a04b1bf940ad2bfb39a996e9251f236b41a97f03c95637
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 b2f61cc5a725e34ceddbf006b123b504834bccbaa307e901477074e25a09593e
MD5 f8f5b00dc4a0d3929f20e71850a76eb5
SHA1 e4bc9077f875448b951eaa744ababd5b8d022473
SHA512 61abbe9c33331ce204e8bfd44114ab54e250f7a19069726ff33504428d344210f478bddd71036bc5b9b725305bbdf9e892ac956e1a04e179b2ba1478288b40c5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 78912d19af5913f8cba7ddc00c5ebcb60cd8d9d678919f91d81aedd8299628b9
MD5 1285e46e576bf615cd53665a5c5659dd
SHA1 11c0f3a82a085c6104e83601b69f99231f06d012
SHA512 9e3c45d6cbf44e2fc04370ae138b417aeaee3a7ae54f81b0cd83f44cb92ac64eaef2abac8430aee93d604022cd37bd2da688f5196b306f61c436c9e5e08ffde6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 2b03ce60492334c4760c9686bf3643ac5db86c380dd27185ff1ff9d81e0ca310
MD5 559b7f78e956ea68ce72f6610a362aca
SHA1 dbea97dd3f35d545aa6727e2a7fe279a362fc6fc
SHA512 47395ded2099a0da6d9ad6df699a4ecaa3a70077f46dda742439834751dedaeeb2928b24be1a878ed5e04b2e041dee3e24e3cd6ae3a68bab628508fa0d91cd0c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Temp\TCD48B8.tmp\qap`g`v~dtlq
Size 10B
SHA256 23c93d96f8a1322b9d5fb428bcce2a20f2e25f921cf59c46641e4e70d8d60828
MD5 11e97a949347bf8dcdc0850aeb0eee88
SHA1 1956f95ebb0e32658ec5a539e77ba24e9e069f16
SHA512 b2bafdee97f55b47de576f2047c681f89b14fa44155ab4de68fe8990bb6c278f2cbf06b35d73dc97fb0a9ca0832dba9d2f6139e606bbbc3beb59f5698b055e2a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d648d646df2c5729546c510dabd618ea0a1c0401be3da9a20a628bd231eaf9e8
MD5 9a73be14d352fbe693321c8d5049ddf7
SHA1 c8482dc8cb796734e8875063d7cde54c67395e1f
SHA512 1adc392f419f0e42b1d9d1cd35d514230779a7d1606a78a68194b8aca452052910e25f87e07860a607ea5e4ef0ed833b9d484110e19d4b7338977687ea1aaa25
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8ba26501c8114e5ccb35defc8749229a6103988dd71646687f418527cd4b8dc1
MD5 9a27029843b409227ec379c2e07d916f
SHA1 43c518cf013e9f009a6272419193d372159df755
SHA512 fdfd1da2771f2358b5dbc8f95417fe50e7a15b951b49dd5cdf9a2bc3521a5834df7f5598dae1ac686dbc5e696676f413243674997a60a3ac23029a1307a00c25
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 13f35d2b6d14830a675282f02f464470da3a749e432ea8195f6481f777da70cd
MD5 5637d77b6023a58d2cc97b43ab9a842c
SHA1 7e546545e1d372d999c8e28d637537762467a4f9
SHA512 863e16115752ee0a404af2274dae00939db8bed3ff391fd0cc77b5ce1f0f5f9e055916a7a414a0da1bf5d41d0cacbd2065b25ea6a46bf22f5b42f7adf6486b81
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c9652b903ba1327523d2ceb14f0b73a523396797c6547a9cd06370e58d66a039
MD5 dd4043180fa7cf8515fcffe02d29b374
SHA1 9143219eefc6c772d29f7350c71590cd9f968a1e
SHA512 8f86b62ff56511005077a0946aa79dd8e93d542014f559c1f5c187c610c3fb8bdeadbd76c3061fda07b48a95d3ed1bed08f364dc70aa5ccd300e83b707a3a03c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 966da5cab9721db9342c8a2b626806dbdc11d07efad447a79fdb05125fbfc2fc
MD5 35ae833d850f330314e93faf3f628c69
SHA1 16f454e2131714ab05a3ed02dea993a8b0eb560f
SHA512 112e76d16f09814d69a79e0152bb7644596aa1f4d94262c1a3f0f3c55387631b7a07bfb9c4f101bc253b97f205bfdcecb2830947d298bf6d4671eff445fc557b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 545f81c23aef18a072f73d6e38d95cb93f1b61106ad5848f34ccf0345c49082b
MD5 c7b90395211237297b5c3f284e0d4b96
SHA1 fa76130bb1374aafe1f3bb9e0ae85e265f1459db
SHA512 f756178c0c6caef283e3733eb580d86a899ddd1c9e4ec5414856ea721286cee74ccb0c5245eecf12cc4aade155356c472cf9de99e726a464efa1598b961f9e55
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c95f9490ff2af46f4d97322f8cca585146879a9378e7b11ce549eaed430fe394
MD5 c4946530cbc98c12dc25036c27d52369
SHA1 65447aef1ac5e6661300087e02485110a8e834f3
SHA512 85878dcd4896dc6f6e8e987ab187c65e34bb7d3da5a8334a806306715934fc72a0f07ca832fc4df1bfadbf0d7e9ce776905ca26418580877edc69877523ad489
MD5 SHA1 SHA512

Submit Download

svchost_CBAAAACCBABCCCCBCACBABCCCBCCABACCAACBCABABACCCAABBBAABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAAACCBABCCCCBCACBABCCCBCCABACCAACBCABABACCCAABBBAABC.exe
Size 14.4MB
SHA256 8c40634a275e2f0cd5bc56e5a50db854556d8ba2815b2e3005ed54fb559c53f9
MD5 d09de24040359f5b50c57589a547b95f
SHA1 957b0e18a0d3ed5e57d4e966875ef92d5259fb4a
SHA512 d76ca396e2a9f3f3b7a306c975c872ebb460bfe0793b64c4ed94f92272f971670200422e4a135985c9c5d598a60799b8c2b2c325e4b6a43f1c7ec89e0cf6b54b
SSDEEP 98304:3KRuy5axKRuy5axKRuy5axKRuy5axKRuy5axKRuy5axKRuy5axKRuy5axKRuy5aG:3qUqUqUqUqUqUqUqUqxKWQc0gEYnvL1
TLSH
T1E4E6B012F6C20071EAB7357009AFE37A5D7D772146358D9EE7884A3F5E32E80692835B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 fdf740cffc78ca67bde054a944eb1ad4dae8ab9a2012aa5e4a197df87e99d0b3
MD5 ae6884d7a0d5fd1bba68d58f4d7eeb02
SHA1 dc65c8a3120bc6bb2e3e7be1cd95b9354594da29
SHA512 d63fd13bbb525f4571e2635fc1955d72b76c0067f02abbfb646b69025d3eaddd49f8afe48551794af4d334c138ac74b4b0aa04271e4f0b8afb8b785f7b2a2eb0
TLSH
T11811D864F0B5C873F2236CCA95299B660CE037BFBC98DF0012098318EB65C36CD198E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 c9f8d432e54684d11a12b8823302a600f5174b5fdf70c412349b80e9f6ac2003
MD5 9175458e0d8aeb182d9ba3cd7d4a8bac
SHA1 c63cf2fa8513847ca41ae635d1cfa4380e58bff9
SHA512 5e715169035058c4b0304556ecdb4ad5eb177d0baa7a3605432d8ed5fed3fec4a45acc72e3b927f0d87f521fe7f8bf7ccd417ca3339035c9862c7aa653116ec0
TLSH
T17F21C964F0B5C873F1236CDAA5299B660CE0377FBC98DF5012088219EB65C36CD198E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 3d8f392a340a1f8e3ce8a162cca5ac956ad1dae89c17c7076760895ba57f9e46
MD5 0d89217483f143f060c47eebc47bf8f6
SHA1 2871a8a2ef90e5086aa68183284d9c49da4a7c45
SHA512 bf7453bdd438391165eeff0579f2c60343f411bdef3f3edf922b58a7c735167d46257a834c02840a861d29709c1619d0ebc84d810da7d790b6e9f0c24ce8cdc6
TLSH
T1CC11C694F0B5D877F13368CBA1299B661CE037BFB858EF5412098218FB65C3ACD154E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/708-69-0x0000000000A50000-0x0000000000A71000-memory.dmp

Download

memory/708-4022-0x0000000000A50000-0x0000000000A71000-memory.dmp

Download

memory/2312-32-0x0000000000EA0000-0x0000000000EC1000-memory.dmp

Download

memory/5196-6-0x0000000000610000-0x0000000000631000-memory.dmp

Download

memory/5780-1533-0x0000000000EA0000-0x0000000000EC1000-memory.dmp

Download

memory/5780-4024-0x0000000000EA0000-0x0000000000EC1000-memory.dmp

Download