1dabf4c6ac6cc3d068ea4be58299e8c7ec330a80ccbfb8e7ee2087bdaec30cd3

Analysis

max time kernel
138s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 04:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_89dea95c15629baed5a14f21d59c4409_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Size 19.3MB
Sample260910-ewkelaztdt
SHA256 1dabf4c6ac6cc3d068ea4be58299e8c7ec330a80ccbfb8e7ee2087bdaec30cd3
MD5 89dea95c15629baed5a14f21d59c4409
SHA1 18cef985391a7175042f71d544bbbd31275d5ada
SHA512 7f74266b07014fca516b19c28dd3ffee3cb895b055888931ce4b2cdcb14077e1b2e7eb84f144fe38da793d7eb111f8487d0f64a2747590aabecfb897c2fbfd32
SSDEEP 49152:U+ES+ES+Ek+ES+ES+E2+ES+ES+Epwth+E2+ES+ES+EpwtR+E2+ES+ES+Eph+Eb+7:5OU/jIEeQfoR/IuOFVjUu5H
TLSH
T13F176D05F98740B1D97711B04CDBD2BF8A30BE2186128EFBF78DD72B6A32B915834A55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACBAABBACCCCBCCBBBBACBCBBACABBCBCBCACBBBABBAAAABCACCACB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACBAABBACCCCBCCBBBBACBCBBACABBCBCBCACBBBABBAAAABCACCACB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
916	svchost_ACBAABBACCCCBCCBBBBACBCBBACABBCBCBCACBBBABBAAAABCACCACB.exe
712	svchost_ABCAAAABAABCACCBCABCCABCCBAAAACAAACBAABBCBAABABACBAAABC.exe
2564	svchost_ACBAABBACCCCBCCBBBBACBCBBACABBCBCBCACBBBABBAAAABCACCACB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBCAABACBBAACAABCABBBCBABCABBCACBAAABCBCBACCCBACCBACCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBAABBACCCCBCCBBBBACBCBBACABBCBCBCACBBBABBAAAABCACCACB.exe"	2026-09-08_89dea95c15629baed5a14f21d59c4409_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBCBBAAABAACBACBCBACBCACACBAABABCBBCABCCBACBABAABBCACBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCAAAABAABCACCBCABCCABCCBAAAACAAACBAABBCBAABABACBAAABC.exe"	svchost_ACBAABBACCCCBCCBBBBACBCBBACABBCBCBCACBBBABBAAAABCACCACB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5888	sc.exe
5124	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4120	cmd.exe
1436	cmd.exe
1920	cmd.exe
5436	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_89dea95c15629baed5a14f21d59c4409_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBAABBACCCCBCCBBBBACBCBBACABBCBCBCACBBBABBAAAABCACCACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCAAAABAABCACCBCABCCABCCBAAAACAAACBAABBCBAABABACBAAABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1256	schtasks.exe
1088	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4912	2026-09-08_89dea95c15629baed5a14f21d59c4409_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
4912	2026-09-08_89dea95c15629baed5a14f21d59c4409_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
4912	2026-09-08_89dea95c15629baed5a14f21d59c4409_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
4912	2026-09-08_89dea95c15629baed5a14f21d59c4409_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
916	svchost_ACBAABBACCCCBCCBBBBACBCBBACABBCBCBCACBBBABBAAAABCACCACB.exe
916	svchost_ACBAABBACCCCBCCBBBBACBCBBACABBCBCBCACBBBABBAAAABCACCACB.exe
916	svchost_ACBAABBACCCCBCCBBBBACBCBBACABBCBCBCACBBBABBAAAABCACCACB.exe
916	svchost_ACBAABBACCCCBCCBBBBACBCBBACABBCBCBCACBBBABBAAAABCACCACB.exe
2564	svchost_ACBAABBACCCCBCCBBBBACBCBBACABBCBCBCACBBBABBAAAABCACCACB.exe
2564	svchost_ACBAABBACCCCBCCBBBBACBCBBACABBCBCBCACBBBABBAAAABCACCACB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4912	2026-09-08_89dea95c15629baed5a14f21d59c4409_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Token: SeDebugPrivilege	916	svchost_ACBAABBACCCCBCCBBBBACBCBBACABBCBCBCACBBBABBAAAABCACCACB.exe
Token: SeDebugPrivilege	2564	svchost_ACBAABBACCCCBCCBBBBACBCBBACABBCBCBCACBBBABBAAAABCACCACB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 4120	4912	2026-09-08_89dea95c15629baed5a14f21d59c4409_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	92
PID 4120 wrote to memory of 1256	4120	cmd.exe	94
PID 916 wrote to memory of 972	916	svchost_ACBAABBACCCCBCCBBBBACBCBBACABBCBCBCACBBBABBAAAABCACCACB.exe	95
PID 4912 wrote to memory of 1436	4912	2026-09-08_89dea95c15629baed5a14f21d59c4409_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	98
PID 1436 wrote to memory of 5888	1436	cmd.exe	100
PID 4912 wrote to memory of 1920	4912	2026-09-08_89dea95c15629baed5a14f21d59c4409_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	101
PID 1920 wrote to memory of 5124	1920	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-08_89dea95c15629baed5a14f21d59c4409_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_89dea95c15629baed5a14f21d59c4409_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCABBACCCBCABBBBCCCBACAAAACACCCABACCCCCCBCACBCCBBBACAAAAAABCBBCABCBBAAABBBAAABAAAAAABBBBBABBAACBAABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABBACCCCBCCBBBBACBCBBACABBCBCBCACBBBABBAAAABCACCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCABBACCCBCABBBBCCCBACAAAACACCCABACCCCCCBCACBCCBBBACAAAAAABCBBCABCBBAAABBBAAABAAAAAABBBBBABBAACBAABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABBACCCCBCCBBBBACBCBBACABBCBCBCACBBBABBAAAABCACCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABACAABBBBBACBBCCCBCABCCCCAAACBABCBABBCACBBCBABCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABBACCCCBCCBBBBACBCBBACABBCBCBCACBBBABBAAAABCACCACB.exe" start= auto displayName= "UserDataSvc_ABACAABBBBBACBBCCCBCABCCCCAAACBABCBABBCACBBCBABCAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABACAABBBBBACBBCCCBCABCCCCAAACBABCBABBCACBBCBABCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABBACCCCBCCBBBBACBCBBACABBCBCBCACBBBABBAAAABCACCACB.exe" start= auto displayName= "UserDataSvc_ABACAABBBBBACBBCCCBCABCCCCAAACBABCBABBCACBBCBABCAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABACAABBBBBACBBCCCBCABCCCCAAACBABCBABBCACBBCBABCAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABACAABBBBBACBBCCCBCABCCCCAAACBABCBABBCACBBCBABCAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5124

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABBACCCCBCCBBBBACBCBBACABBCBCBCACBBBABBAAAABCACCACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABBACCCCBCCBBBBACBCBBACABBCBCBCACBBBABBAAAABCACCACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBBABACBACCBBBABABABACACABABABABACCABACBACCACABCBABCCCBCCBBBACAABBBCCBCCCCCCAABBACCAACCBBABCCCCACBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAAABAABCACCBCABCCABCCBAAAACAAACBAABBCBAABABACBAAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:5436
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBBABACBACCBBBABABABACACABABABABACCABACBACCACABCBABCCCBCCBBBACAABBBCCBCCCCCCAABBACCAACCBBABCCCCACBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAAABAABCACCBCABCCABCCBAAAACAAACBAABBCBAABABACBAAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1088

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAAABAABCACCBCABCCABCCBAAAACAAACBAABBCBAABABACBAAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAAABAABCACCBCABCCABCCBAAAACAAACBAABBCBAABABACBAAABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:712

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABBACCCCBCCBBBBACBCBBACABBCBCBCACBBBABBAAAABCACCACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABBACCCCBCCBBBBACBCBBACABBCBCBCACBBBABBAAAABCACCACB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 c9fd88fb372a21bfe9f7a51fefafb500b751c75649e426b682c1c8ccc5cbbead
MD5 b1a9df308b8a398914b061aeb65784f1
SHA1 708c7d7ac881e88c7f0987e7995134509e13b301
SHA512 4c4f68b16f3911085fb8dda62150fc90a575c096861986855f348fc996f3bf411c29d5cbb9b04c6e7bf1640d600b502208d87136039987e97d96442b6c42cdda
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 edd373d8fc6844ef9407cbbbb4ca558bb5377565699b4261421ac736c3927a51
MD5 87fc2e4773a71b8f91c2dc44d6bf5e1c
SHA1 1be0951c1b6996c20689329b321d457742224fae
SHA512 624484f465bde723d00e9cacefb737b1266feecce4a3e560e0ddb9f30b380c42c5bd8396338cd8f256053f6ee40588734f72e29e9c5b73c94edd9f67d221a6cc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 6557eb0a2b684a32dd6a737382b47ddae662be445e5f6bca402a2b57ef36ff9a
MD5 2d41a9679bccecc0b16ce1af19975e10
SHA1 f35b5f716d4af7abbb696c1875b4afc0eba450be
SHA512 6efa17d643f6bdfc577e1b69a78f3e348c507c0c703e09f31e83cac2b9aeaf77134b3d04385a52ce665d80f27be67c5a23bb90f9b516e3f274d10ca29e03426d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 1cd66789e05089bda2310964afec8d99354d45e3485fecd286c4bb2ae45680db
MD5 a56920fd78b62ec3284f5e91d4ea992c
SHA1 8d6124eae9280fd12c8b7fa2ec5d2e17ce701062
SHA512 e3c72268fe1c8b59f8dd2be77d1f26f5cba816a9875287bd62c35ce46edd1e9ea3da8b049e9c3a6a67df1477ea387b7bddae51ad553865dfd173d1aed1ed1982
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 76.7MB
SHA256 56be36446541d353f62dde151b9c98e249ab601689dd61f2773e5e36951e3918
MD5 8f6e6fb02f8d02770d3d217ed0b30529
SHA1 3c13242c642e7e4f7efd06b49bb00585246e31d7
SHA512 29c39fddbb19f01221b1ef63efbe2f22282235a3d1756a2cbe7c6ec0b417052422fb8238e49dae6ac48201dabe76d5a7281eded8930e0510cfc77a8fd36ba7eb
SSDEEP 98304:5OU/jIEeQfoR/IuOFVjUu5ZOU/jIEeQfoR/IuOFVjUu5ZOU/jIEeQfoR/IuOFVjt:5FIF0wurFIF0wurFIF0wurFIFc
TLSH
T18E086D05F98740B1D97B11B04CDBD2BF8A30BE2186128EFBF78DD72B6A32B915834655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 b5d929a63e0a8c2a3dd382fa61fcd6680a3df01946980733f9557717822a2fb1
MD5 d9ec7e359706d551172ae9c1969b7137
SHA1 93270d79eafc5f6fd0e008353eeb902187f3dadb
SHA512 103113c7505c18a274c6d0733856ebe96f85d08f564273ececebad7360a135c3015290b2ef38b0d873e14ae067ec46ea31ff4b66c359202887934e0aff4096c3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 59901b3e3c70cdbe40d3aef3bd29b713120d2ca7cf2e32bc1492b882b78e851f
MD5 712fe014ac176ff1ee74b337acab537c
SHA1 4b318654c4ddb0e2eeccfdaaaef463a864f28b9b
SHA512 b750186c899653d8d3d979ba20e3eae92b96c13b174171bf272d447fbd3d3f115fe669db2f9046742a12b7d8c32a9264eed73d2b908e37c49cf15f53ce060af1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 08b73745e9c00cc94b780b7ad58d1ef70c8b172d87b14cb56a65e41610871bd8
MD5 eb85b723f5828e0bd6d9eeea2f2394ef
SHA1 e60fe6389b0ea267b9f5e9f46e8df8d97c71efbd
SHA512 b8b552773c11c0bc8511588a449cd4090f2660fc16f5882b465315d101100efca231b49c9b24e0659e01cf6ac1c9706f81de161d7d61ee36e165e8b7ffc718af
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 042160cdc26c912397d571fda69809670243ffd91fde8915cca9918f4ea78eb3
MD5 b5f8cfe30953efb99dfd948c560826f5
SHA1 851936a5bed1874bc25394b96f2c09aea56206d2
SHA512 7e983d87ebae2efcf1939edbb6e1ad074f68c3c75cbc0abf528a96a31eafdf5166034172e198de270500d04530f482fb755c9e5d414b48985f1a3f54d44b6e3b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 7965a7027de9467449827af3d317f980264734d5233e3ccf059e7089f391a482
MD5 9f39a135509550e47fb071c159ce4110
SHA1 dddfa479f921cc3e08c07bd17b9d244076d36bbe
SHA512 5843c107f53e35c22675c3ec23b79efc11f77ac3ff91c375931b9767ac26685e94f234ec7fd1c2585afbf10d058787b9b711c85f59115efc67b330b1b22f38e3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\qap`g`v~dtlq
Size 10B
SHA256 25a91f0131053d73e0716528404e99834c78d2a276738fd24ae4dc966b09cb34
MD5 0fc0daeccbb475294914a4b97c38fa0f
SHA1 7dc54e7806b0b30e6fdbb2fcce5253db17434de5
SHA512 f6bc188d27b4ff27186d1665eff1201dabd098ec45dd4c4b83c862347fe9fcc10468117f1c7dd588d1e8742885b52e74f3a064ef9eb56ba4022ff01f9a517f74
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 6b55950006cd6a7f0db5e64600ffa68ea85a4856366d246d4e83ebdbd22d5671
MD5 6426d7aa14d28421192fb630d4b2d864
SHA1 4934210bda1bacf2242fc76436d4e9ddb8d48ca2
SHA512 9595e2705b5629427097a6589f476d96e666e7ab6d46564ce6e23f1d118611ce06b901875e887815d52a237d7db4230b6ec19383eeca63d67de7850611090970
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\qap`g`v~dtlq
Size 10B
SHA256 f4ec87e3b51761d483c6f8b8cc66845fda6f24357fd92a3648a8555a7ff217c7
MD5 3db628bd293751f9b4a6cb36b0d9ea17
SHA1 dff52489a5b70cafac720e827782153db9dd02e6
SHA512 0acb9f23c60cb4c57416ec6cdffc6a8bfea289e06981d293c40ebec5dbfc986973b98833580ab2596670098c919c41abfa7e4b161f0c48c41c510987f5f2692f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dd34d6cd0e56b6f92e4e994575d6a984b1c03a60affe10e1ef09f8a6e64f9a63
MD5 4f8cbc74c2e96aa9094ccf77c95d6750
SHA1 c5a30e7a99537f1ee48daea23fa23bf8a3b59971
SHA512 2c7445e6af51a10cfe3aebb93b341c07e42247038a5d151d690d6ac63501b340736356cff937a658229bf08919deeaea4d3f6616a89842424c80e05523428824
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4196ea070a2a23d85be63d91a418f5a751c912269a16ea69b2e1bb93bc9e208d
MD5 527891b63ca3eb5cead378db1d735b84
SHA1 947bb74ee5fcc080310f4afa9f62c653196dc193
SHA512 cbeff7b1041e653987d8f84daee5b95ca28b7c9d22bd17f111c51807e103180308cfbf9f0afecc9c725cb6909e92a70b3fb619d393f85e4c6831fe72eef28617
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5eaea384683a9c8ffac19d34599b0d7793b5793a95db9062507f76340134f6b0
MD5 e444bfbf17fa2ebaa386e07945e31854
SHA1 7c8ceef91f8de365794269a0a87ab9e74eabf66b
SHA512 1b124299010c0b182f6298fb3c91dc298091eece4d41889371d1291e4ccf689eeea8d75668f2a5e9086aa0a78bfff9b087f579f58b66717e4b1942cceee47fe7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 07514448fbaf1fa02e841bcd657e31b5ab7bd9adc966ae14132386d64e0a246f
MD5 8beed5c0cc6f417080171ec93a6ca221
SHA1 292a792e22229c5a18280ac113ceafb52a932f83
SHA512 e664d5133b9965dd96a4a05cc74c58245d938ed9239b4c3e520e5361a54719d4d7fe077bab4a655a5fe22d2cd01358c5d8fc0e57f7f4c93b2fa9621f413be716
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f5fe4eca0b082c4883893a02bdd29cd23d5e44e9b99807fca60803c2feaf0b76
MD5 6d67ecedf608fefacd9c0d8e008d100b
SHA1 5973d42e47b13e60fdb311f615d0abf783615576
SHA512 83ad613f8f580aeec2aed10f5f37e9209c6f70f6142bd3f83973846049811f870d2a1388c7c505208456924a4207d66f353e35c501d5b943c7f8ebd41247c142
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2b9c69f5b10e751457d11b4ae83aa84a0b21b1bfe3a4c490b572dea71aa908cc
MD5 534dc34ccf24a5debcf58522e7e7488f
SHA1 950a0d680a38151bface3031e46b35a89f079685
SHA512 f9c5430a5f3d8bb65bc1afcfa906915d5e7bce0f66a1246109e8a65b10b00b83ead736df1b5e9bca6f274ede8b86c306a4927c55a680fb44717cb6da88e084cf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Documents\qap`g`v~dtlq
Size 10B
SHA256 e9c24b228d440f496416f304e2cc5d7af72c5b029b00a32c1a61ef52a4369758
MD5 6486835339c841a68839cbe5dc591ce4
SHA1 f86c3a0c86d494bb2997ffb6d6b79b1853f37790
SHA512 d501725e759e6ef5db0bde36eed882a994492813db7ffedc617231c19488abf699d933b8c546f8f45fdbe04ca510130289a97d6d3287d002c62922d05a03e5fa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 55617a18c036e688f5c32529f8560d05f5945b05bf36e62b5ef0b9e460aa5585
MD5 ed68177fb8aedfd92e90572360f8fd7a
SHA1 9521645a9294026b1bcda646505566892cbfe6ab
SHA512 db97735ed0802d1edbb53d55dff35cc9afd61c1dc6fe37175f832cf362b1e417e94ae6f0951384f3c26a011b2a6f37057f4060ba806cf66a4d5379149fbb9dbc
MD5 SHA1 SHA512

Submit Download

svchost_ACBAABBACCCCBCCBBBBACBCBBACABBCBCBCACBBBABBAAAABCACCACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABBACCCCBCCBBBBACBCBBACABBCBCBCACBBBABBAAAABCACCACB.exe
Size 19.3MB
SHA256 1dabf4c6ac6cc3d068ea4be58299e8c7ec330a80ccbfb8e7ee2087bdaec30cd3
MD5 89dea95c15629baed5a14f21d59c4409
SHA1 18cef985391a7175042f71d544bbbd31275d5ada
SHA512 7f74266b07014fca516b19c28dd3ffee3cb895b055888931ce4b2cdcb14077e1b2e7eb84f144fe38da793d7eb111f8487d0f64a2747590aabecfb897c2fbfd32
SSDEEP 49152:U+ES+ES+Ek+ES+ES+E2+ES+ES+Epwth+E2+ES+ES+EpwtR+E2+ES+ES+Eph+Eb+7:5OU/jIEeQfoR/IuOFVjUu5H
TLSH
T13F176D05F98740B1D97711B04CDBD2BF8A30BE2186128EFBF78DD72B6A32B915834A55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 2f84e88c5f23db2c0ba8fa4f6d6b53640b3584a2dad1dae96c2061ba631b7de1
MD5 6fccb2b0ef86ff27c0905c16e52a1d96
SHA1 4fbc2b87c0088175f73a82fb96afff7b1b923d6a
SHA512 a1048b0cce3355ee1cb4e1d7bf8358b47845b72b77994907d2d2354defd109ccf02c0725485977e7f119dc452b9a9241835bef51f15d9f641e1d7db8bd221d62
TLSH
T131113861F451DC63F13128CBD629CBA70DB433AB7C6CAB4052098218FB99D36CE554F6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 b76d186f4c00803010af55878b36e32efa8f53a4fa3fc5aa4b5d4f4dd9f2afa7
MD5 d0c1fbe0794a9c4fa31fb2e20299335f
SHA1 41ae7075c833b187c24a4c2e5d252cf20977b74a
SHA512 1eb1a2ed36f559b3292426e1fca14224b045d059be52d839cd511243b06303e3a0a8525c1cc0f2bfbf675853f49d892bc62d3d476efd0f968d940a12de714ac5
TLSH
T1A5213761F455DC63F03128CBD629DBA70CB433AF7C6CAB4052098218EA89D36CE558F6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 a46d42eeb8801586cfe51fc8511fcb162bb5d6bfb340f9507b4749a4cb37d253
MD5 f8f468687122193232c25cc0719d2106
SHA1 dd5923eaab930cbf882db22b9b8421ac2ab1b2a6
SHA512 621a64b3d9acbe23eb21c68bf23038e6e270ad84d7217f0f2cf14d3e3c790fbc68ad08be6f3c31a2ebd00801b6b21ed8b69b329badcaeaef7ed89f1e34e8b868
TLSH
T193115762F461DC13F03128CB9625CBA70DF4379B786CAB4462088218EA85E36CE558FA
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Public\Libraries\qap`g`v~dtlq
Size 10B
SHA256 c3a3ae3d60531a0329e53422495a1a168693547a74edbb8b8481d662a5f5c173
MD5 cb63fde07d6196ff32a52be786f049b9
SHA1 6853f9edfcdd9bed38867142f91ece2bd0103eaf
SHA512 97a1f74e43e07ff7532d6b980f12b5a10a7bf8195d08a1675b6c7c279ba822d028bd408c79c016b78edb685aaba7731ae8e944c65b813e6c1dc5713b7d4b47e7
MD5 SHA1 SHA512

Submit Download

memory/712-3927-0x0000000000CD0000-0x0000000000CF1000-memory.dmp

Download

memory/712-69-0x0000000000CD0000-0x0000000000CF1000-memory.dmp

Download

memory/916-32-0x00000000009C0000-0x00000000009E1000-memory.dmp

Download

memory/2564-3928-0x00000000009C0000-0x00000000009E1000-memory.dmp

Download

memory/2564-1963-0x00000000009C0000-0x00000000009E1000-memory.dmp

Download

memory/4912-6-0x00000000000A0000-0x00000000000C1000-memory.dmp

Download