ac44edf6f2b8f210bdcfc2d7634e89e1d9908d1b16f7d4f7782d376de742097b

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 00:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_596e332d6bfa6a1ac373ddc96ae69da0_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Size 16.8MB
Sample260807-a4cmhadn3w
SHA256 ac44edf6f2b8f210bdcfc2d7634e89e1d9908d1b16f7d4f7782d376de742097b
MD5 596e332d6bfa6a1ac373ddc96ae69da0
SHA1 f143a43252ee3cbf2417d28f6828f86011991195
SHA512 7d496930fdeac64f9aa7ba0e7ae4158764d1673d771ce9c6efc029a7de7b5166c0d625c6ac0c3f824c19ae81e5951a5fe91d506efa83a368005c1fe582597efe
SSDEEP 196608:kFlP7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouH:iZahvQHrc8u3xXJ/f4uUWHc
TLSH
T1FB07AE13B35A81E5C02AE2B88A574222D7BA7C440334A7DF12D5B7692F77BE45B3B350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Detects executables packed with Dotfuscator 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c583-18.dat	INDICATOR_EXE_Packed_Dotfuscator
behavioral2/files/0x00080000000182bd-385.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c583-18.dat	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/files/0x00080000000182bd-385.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c583-18.dat	INDICATOR_EXE_Packed_Yano
behavioral2/files/0x00080000000182bd-385.dat	INDICATOR_EXE_Packed_Yano

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c583-18.dat	UPX
behavioral2/files/0x00080000000182bd-385.dat	UPX

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBBCCACBABCCACBBAAAACABAABCABACBAAAACCCAACCAABACCCACABB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBBCCACBABCCACBBAAAACABAABCABACBAAAACCCAACCAABACCCACABB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBBCCACBABCCACBBAAAACABAABCABACBAAAACCCAACCAABACCCACABB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBBCCACBABCCACBBAAAACABAABCABACBAAAACCCAACCAABACCCACABB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5240	svchost_BBBCCACBABCCACBBAAAACABAABCABACBAAAACCCAACCAABACCCACABB.exe
5588	svchost_ACCACBABBAACBCACABBAABACAAACCAAACABCBBBCABCCCCABACACAAB.exe
5056	svchost_BBBCCACBABCCACBBAAAACABAABCABACBAAAACCCAACCAABACCCACABB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBBCACBACCCAABABAACBCABABACBABABAAACCCAACCBCCBCACCAABAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBCCACBABCCACBBAAAACABAABCABACBAAAACCCAACCAABACCCACABB.exe"	2026-08-06_596e332d6bfa6a1ac373ddc96ae69da0_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABABCABCCBABCBBCCABCBACACCBACCBCCABACCCBABABAABCCCAACABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCACBABBAACBCACABBAABACAAACCAAACABCBBBCABCCCCABACACAAB.exe"	svchost_BBBCCACBABCCACBBAAAACABAABCABACBAAAACCCAACCAABACCCACABB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2984	sc.exe
4824	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5812	cmd.exe
4804	cmd.exe
3116	cmd.exe
2024	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBCCACBABCCACBBAAAACABAABCABACBAAAACCCAACCAABACCCACABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCACBABBAACBCACABBAABACAAACCAAACABCBBBCABCCCCABACACAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_596e332d6bfa6a1ac373ddc96ae69da0_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4392	schtasks.exe
4596	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5000	2026-08-06_596e332d6bfa6a1ac373ddc96ae69da0_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
5000	2026-08-06_596e332d6bfa6a1ac373ddc96ae69da0_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
5000	2026-08-06_596e332d6bfa6a1ac373ddc96ae69da0_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
5000	2026-08-06_596e332d6bfa6a1ac373ddc96ae69da0_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
5240	svchost_BBBCCACBABCCACBBAAAACABAABCABACBAAAACCCAACCAABACCCACABB.exe
5240	svchost_BBBCCACBABCCACBBAAAACABAABCABACBAAAACCCAACCAABACCCACABB.exe
5240	svchost_BBBCCACBABCCACBBAAAACABAABCABACBAAAACCCAACCAABACCCACABB.exe
5240	svchost_BBBCCACBABCCACBBAAAACABAABCABACBAAAACCCAACCAABACCCACABB.exe
5056	svchost_BBBCCACBABCCACBBAAAACABAABCABACBAAAACCCAACCAABACCCACABB.exe
5056	svchost_BBBCCACBABCCACBBAAAACABAABCABACBAAAACCCAACCAABACCCACABB.exe
5588	svchost_ACCACBABBAACBCACABBAABACAAACCAAACABCBBBCABCCCCABACACAAB.exe
5588	svchost_ACCACBABBAACBCACABBAABACAAACCAAACABCBBBCABCCCCABACACAAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5000	2026-08-06_596e332d6bfa6a1ac373ddc96ae69da0_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Token: SeDebugPrivilege	5240	svchost_BBBCCACBABCCACBBAAAACABAABCABACBAAAACCCAACCAABACCCACABB.exe
Token: SeDebugPrivilege	5056	svchost_BBBCCACBABCCACBBAAAACABAABCABACBAAAACCCAACCAABACCCACABB.exe
Token: SeDebugPrivilege	5588	svchost_ACCACBABBAACBCACABBAABACAAACCAAACABCBBBCABCCCCABACACAAB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 5812	5000	2026-08-06_596e332d6bfa6a1ac373ddc96ae69da0_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe	92
PID 5812 wrote to memory of 4392	5812	cmd.exe	94
PID 5240 wrote to memory of 3712	5240	svchost_BBBCCACBABCCACBBAAAACABAABCABACBAAAACCCAACCAABACCCACABB.exe	95
PID 5000 wrote to memory of 4804	5000	2026-08-06_596e332d6bfa6a1ac373ddc96ae69da0_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe	98
PID 4804 wrote to memory of 2984	4804	cmd.exe	100
PID 5000 wrote to memory of 3116	5000	2026-08-06_596e332d6bfa6a1ac373ddc96ae69da0_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe	101
PID 3116 wrote to memory of 4824	3116	cmd.exe	103
PID 5240 wrote to memory of 2024	5240	svchost_BBBCCACBABCCACBBAAAACABAABCABACBAAAACCCAACCAABACCCACABB.exe	106
PID 2024 wrote to memory of 4596	2024	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-06_596e332d6bfa6a1ac373ddc96ae69da0_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_596e332d6bfa6a1ac373ddc96ae69da0_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBACABACBACBCBBBCACBAACACACABCACABACACBCCCBAABACACAABCCCBBACCCACCAABBBCBAABBAACACACCBBCBCCABCBCCCBCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCACBABCCACBBAAAACABAABCABACBAAAACCCAACCAABACCCACABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5812
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBACABACBACBCBBBCACBAACACACABCACABACACBCCCBAABACACAABCCCBBACCCACCAABBBCBAABBAACACACCBBCBCCABCBCCCBCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCACBABCCACBBAAAACABAABCABACBAAAACCCAACCAABACCCACABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAACBAABABABABCCABBCBBBCACABBCBACCCCACABAABBBCBCBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCACBABCCACBBAAAACABAABCABACBAAAACCCAACCAABACCCACABB.exe" start= auto displayName= "UserDataSvc_CAACBAABABABABCCABBCBBBCACABBCBACCCCACABAABBBCBCBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4804
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAACBAABABABABCCABBCBBBCACABBCBACCCCACABAABBBCBCBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCACBABCCACBBAAAACABAABCABACBAAAACCCAACCAABACCCACABB.exe" start= auto displayName= "UserDataSvc_CAACBAABABABABCCABBCBBBCACABBCBACCCCACABAABBBCBCBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAACBAABABABABCCABBCBBBCACABBCBACCCCACABAABBBCBCBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3116
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAACBAABABABABCCABBCBBBCACABBCBACCCCACABAABBBCBCBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4824

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCACBABCCACBBAAAACABAABCABACBAAAACCCAACCAABACCCACABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCACBABCCACBBAAAACABAABCABACBAAAACCCAACCAABACCCACABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5240
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBACCBACCCCABBCACCABCAACABBCCCCACABAACBABBABBCCBCCBCACCCCCBACBAAABBACACACACCAACBCABBCACACBACCCAAABABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBABBAACBCACABBAABACAAACCAAACABCBBBCABCCCCABACACAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBACCBACCCCABBCACCABCAACABBCCCCACABAACBABBABBCCBCCBCACCCCCBACBAAABBACACACACCAACBCABBCACACBACCCAAABABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBABBAACBCACABBAABACAAACCAAACABCBBBCABCCCCABACACAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4596

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBABBAACBCACABBAABACAAACCAAACABCBBBCABCCCCABACACAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBABBAACBCACABBAABACAAACCAAACABCBBBCABCCCCABACACAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5588

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCACBABCCACBBAAAACABAABCABACBAAAACCCAACCAABACCCACABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCACBABCCACBBAAAACABAABCABACBAAAACCCAACCAABACCCACABB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 4f803a19787d6f82a58eb74446f90907278096de33c96878b8a6fb6b4e596f0b
MD5 4502e5ee9d038a98773c7151e697d63b
SHA1 31f5bf582d2324cb0cf80203c87a8002bc5f8502
SHA512 dbc4de0cc920b42d4895b549d75a0f46f31642b1ec81296977ca84aecd70b3c88746133e76aaffa11a107e2fa0f50bb45539663456b60e268a46058628749da0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 f6491ea7559675544e860052c4405f172dd23cec28cd7a8aff82ddb2fbb2ea23
MD5 8ad0d88514ca5997d730fde61a77e51f
SHA1 9a1e9cd91a01c8b4d7f9d16266ad051eef91506f
SHA512 0ff23f23a2a77aaec26186ef60c8160fe01830a90cceb64c0fd61ae79ec51e8e812efa1c244eecaa28615b3d42222a6ba4623df4cbd2d437c8c5b5b806eb2564
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Diagnosis\Temp\DiagTrackTraceSlot_diag\qap`g`v~dtlq
Size 10B
SHA256 2f4e809934a75d80a898a64fb662d6d10946ae8c950f6ea0c2268806fda9b836
MD5 2f1ae0dba1e1d456db065a4a402e589c
SHA1 d0881a39512271fe5c8facf566219cbd2bb1a208
SHA512 fde07a99e68286d27ed0754859dc460c24adffccb92c493bc622c8013e87d8f517b309aaadb720749d88c7a03bc6f4fa036aa4b2e740ba1bf4984d6402d2a8fb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 db4be6cfc0e242cfcd0270b8966ffcd116f35b798537339175c0299428ae403f
MD5 dd69893934d8588a844d1dfc5bf0a532
SHA1 7d05d5a6bc080e87388fc568a35c4613c1cb66fd
SHA512 534edffadf2350869ba8598e875fafec87a0c51ca1a5e40650c0bc67e5d3c3aa073a79afe4935e71128993d3ad1c5e34547182d8ade416be52f173be99193e79
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 17.4MB
SHA256 fbf92d73e9777eab28bc2103cdcacf3c4ef969e6bfd4fda735fd9e0dc4038462
MD5 2522bde2c82bfb80a8045e1e0f7ae72f
SHA1 d7a396e284ee76e73c7e7572f4e55d3163f5d80c
SHA512 670bf39e0d1428a0ebcd7e1c5f63aba8388405a6357527c8a9f04fd006130bf343e5817382f987de74a1515eed276b9a01be7ec3c23271eb6218d4d3a568fd55
SSDEEP 196608:kFlP7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTou6gZ2jd:iZahvQHrc8u3xXJ/f4uUWHS2h
TLSH
T1AD07BF13B35681E6C06AD2B88A574222D7BABC440334A7DF12D5B7292F77BE45B3B350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 054d11565254f7d2e7df71155fac2a72dbfa15553fa30a5d44da27b07c24890e
MD5 b139e18c9867a5caecfbc6d9adc881ee
SHA1 0c63806b99ea61b2ed2ecdc9065a32e440828ce5
SHA512 399737ef087bdf3b9e03ae39cd2d4936f1a031998bdbfd483f634cfbde42c96c2571b327205ec1047a5943f0aa26ad2952c67279a541c2b795b3f0697a1d3d58
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 f6b6f02088d318cc1d63277080bf0e06a395be55b1060aef8e4c495d6bc88e79
MD5 99a5004df668a2891b8df6c0f5f87fce
SHA1 a4534bad9b5c64aecac55c12951a1487f9af9498
SHA512 52354d027d1bbc6a44541bc6a6f4f14e191a226aa1814be6d410baa6f518ce0ba32d595cedd51bdcaef70cd5dc208f96632cc58087fe2e8e30711da17b307140
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\qap`g`v~dtlq
Size 10B
SHA256 cea7d732be02122eb9a746cc44ddae6c0ded46372221f649fa193e1f32f180f3
MD5 4a3dd225be75a16a59857042ccd3fa86
SHA1 580ffdb8257816d5f58c712b19d1b8628e527faf
SHA512 a0fd5155124fb5d9ad4f9fdfbc3bf1811ef0751375237f9433475a9d8c62043be4e14c05c3abe26678bdf2095fc2be5ea937b671cd7a1f9bf32eb668b6903a3f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\qap`g`v~dtlq
Size 10B
SHA256 1de12404af128e511253b7ece6637312377053f44a5b34c3291517819db5e171
MD5 fc2be61db2d39d884506ee0bd0d334ee
SHA1 408d30818d567f2c121b44341a54bce10123f4f6
SHA512 eb1c9915ba98310712ca5c66de41c6aed200ed62369dd4505d47245342da8bc18560231d3ef86bf102f4d2282d2369cc1334c53ebb96f8141eb75c288ca0d9a6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\es_419\qap`g`v~dtlq
Size 10B
SHA256 778f65e22456145894fe7a5316a8379f5bde40a364880aa8918342469c9e6963
MD5 a979319bde0e3dfa3baf4ed75795c615
SHA1 68019962fad5139fcccb46620af45f12b1f5ea04
SHA512 9f59e19172a52f5d9e322a31ecf9422149e9de69ce75f35f377dc447f2f9e2da5910439d05a754c39f29096dd0f4a8261dd424eb9335a1232596d6ee656981cf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 960d7757480230e315af43d7c5eb5b39e2e70aed7c2aeb8300d57cab743457e2
MD5 cc3889845fd1cf8644f989256e5dfe12
SHA1 300f76ae75a0771fb52fc734d4d422fdef9265c9
SHA512 a8b4b46f1c0df508483e6a60c16ef5bf809e298640de697a2caf9b8e30ad5d46a56197622eaccdc76c026370fe2db09aa7298fc546012bc33a7464b50cd86390
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 582b2fad634dcd6c1e359999cb833d60b85ad91b50a25755d81f49f9aad6167d
MD5 4c2057037874a9eb41fdb237c679d8ac
SHA1 af0bea3f03df3d8602e1c4df5c6cf434a8ddace1
SHA512 278ed1b03a25966be13c5d7fd120c1d5e0c9590c7f07e14cb12d9562445b790fb1cdd6f8c2c08d32860cb19b970d65a8138232ba97621f3829f877dd82b84150
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\CopyOptimize\qap`g`v~dtlq
Size 10B
SHA256 6310c96530edeab30d05d67d75ad21ebc5a2356c65616b70f478342cfe688791
MD5 0b3b4f22ec05746a6c664349d93ea508
SHA1 ffae33e91f99ee8026f44da917a01648056166ca
SHA512 2024a2eba905ea6885f8fd45dd6355b1c3da55aef1ee01e7e0b0f8d6d9fc8e0a549ac77eebc3ee4b5ea6ea1a8fa9c7536701072ee5c5526a134b0fb7cb1cdc1f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\sessionstore-backups\qap`g`v~dtlq
Size 10B
SHA256 d24255a92486e88b86d6e8c732ccedce8f45f2832b39b74de02d956f0da74476
MD5 005f741749b8a9092df5b123f96ab7bc
SHA1 d46bf22dfd480e867383e978eb88f879dccbae7f
SHA512 49bf6cab40b3530576f686d4cca3c09c142d38a1234d9cda60891692353d3bf4340d0eb27ffdcf44de064281fe7c04c954728c9cd25fc78b1a230b14e795a2f4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5db3c436b7b41b008acc882d4c8699da7ab744417bcf662da1ee2e750d63241d
MD5 6bddae5994aad7b36b14a3cf3f67004b
SHA1 d15511cf8a6086c1747c76beff8aab2b946f447c
SHA512 abd4e9a3682649cbadd7032f6125950e1614a2c5c13517215b890056c898eb009b9f9a78b3152e65f96aa8d027a0728c7373d226571895818f0a5fc451ced3d9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6522d52e8177845be7cdb47d0d413e1ca0487186150c4896722e5c4debdd4145
MD5 1b4c0f4aa197979f9bbadc0cdf48d8eb
SHA1 224dc2064e893f5e4ab4aa39be16eec8147555fc
SHA512 4596ff58305f9264377a4b0cde0a289a07559df6ae066ff6bb35632d1c914bb8af6950f01d10ecab6eca11671eecce1213c1cce3f210e8638a00af1912983279
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 eb73384b613f790b42cff2e833844b45d33caa1bbff5e539083a5f1b1f56f46e
MD5 cc7635813fe7c8bb6f5062b678bfefbd
SHA1 18875aa49a1b63cb6654992155d065a8dff8370b
SHA512 125ba6c8629f40021e42856afda33e442fb8d66e5ff30075e1c1c8cf614c5bc740fb2cca72a15632c1bee05181ae9094ff2ce62dff10f4d4d3a333a39b5b9443
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c9c2d45e2343825b1b0d33dc13f75e8527a2cc4ccea57983cf2b88cbfdb96229
MD5 bd1261cb234131079befa777064a440b
SHA1 ba303bef689d991fe190fad8964c3431c6d81ec3
SHA512 1985996d29ea7cd78dcce89feb9402a75f3c1b660fc37c8a6e3d1535d60463b8a720f0f1b50194453be60cc2db66b1e8df5af5a5909a2a464be46cdec66fd066
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4101eebf56e21915a70fc8992be88206f625e56e6ba7081a30d1324d46f20e78
MD5 835d21bdcc2799c85da66c03261e4d8e
SHA1 0dbcba85bc2b84565218bc9960c8cfcaee59719c
SHA512 4a42b7acae190814948070cc797357bc9085d4d33706824dcde0a9d2d6b32fdd9250d2713ac403c10e344f5ae4aa0872297f30c5563f9323205e3cc52eda7c3d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d0eb65eb5e43b064c052c03fe0310f6b1ba2b35491ffa80bb9f4d79e7914c770
MD5 c8cf16ac600df73819c4df909b4e3184
SHA1 08920ab4de4fa09173d20b5448fa34bc3682bc8e
SHA512 926548293e43e6c55dd49284883dc8007f0f314c8c355ee866cdaadac488a2451362807e285073ffead02eef2cd703d4ff12f92be070531bb73137916384de9b
MD5 SHA1 SHA512

Submit Download

svchost_BBBCCACBABCCACBBAAAACABAABCABACBAAAACCCAACCAABACCCACABB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCACBABCCACBBAAAACABAABCABACBAAAACCCAACCAABACCCACABB.exe
Size 16.8MB
SHA256 ac44edf6f2b8f210bdcfc2d7634e89e1d9908d1b16f7d4f7782d376de742097b
MD5 596e332d6bfa6a1ac373ddc96ae69da0
SHA1 f143a43252ee3cbf2417d28f6828f86011991195
SHA512 7d496930fdeac64f9aa7ba0e7ae4158764d1673d771ce9c6efc029a7de7b5166c0d625c6ac0c3f824c19ae81e5951a5fe91d506efa83a368005c1fe582597efe
SSDEEP 196608:kFlP7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouH:iZahvQHrc8u3xXJ/f4uUWHc
TLSH
T1FB07AE13B35A81E5C02AE2B88A574222D7BA7C440334A7DF12D5B7692F77BE45B3B350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 09984815ee4db1113ecfe3fd28b3560fde9598f44eeb5c9576c4016b2f0f1d40
MD5 351d69aaea9741d241df7137b032dbd9
SHA1 7c0f49d1d3e2ddacb0cc7fe1d5a16c6434c08b1d
SHA512 f7619ea11b3f541f4a67d93df5771cb040d6d7bfaa2474db5ba5d63bc38bc148638077860291f47055ce24379c89eab4d603e724b0670492dc404ca05b752b45
TLSH
T12B218771A1EADC23F9232CDEB1599BC30CA8366F595C6A185204931D7B95833CE25CF2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 6ad67eb215d867a4decb7295d9ec1b5328b2945c6dd315f7451bf57e05afada9
MD5 703ce28018a8f1986f914977afe3cc32
SHA1 e928b5047932a356197b9dfb2d7251aed823fea9
SHA512 cc5194a2d00716d86e8c77b8629ab5dcdcca54696b7fe222a4c89c5e7a8069dab4288a811106d6baa69f1021a55cd7f48218ec4b6f8edd6c9b0dabe7eb676e2d
TLSH
T168219771A1EACC63F52368DEB5199BC30CA837AF9D5C6A14920993187B95833CE15CF2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 40b7a7b8dee18f4d88a65887f60ce3fb74fda36dede0491cae616243e320f075
MD5 b33348cac5356460b12911bc4ab92fdb
SHA1 7385609752021d0782f7e6384f0af1c7f7bdd90e
SHA512 215954d8217cf6154f9bd48bb07b9f4e92e493ccc9b210fa306dfdd41e6b609a08ffe0bdefb1b08bc4e7cb524321c512d80525558d3204e1b83e4bed503615e1
TLSH
T17911A771A1EEDC23F9232CDEB1599A830CA836AF5D5C6A186304831D7B95933CE15CF2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5000-6-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/5056-868-0x0000000000EE0000-0x0000000000F01000-memory.dmp

Download

memory/5240-33-0x0000000000EE0000-0x0000000000F01000-memory.dmp

Download

memory/5588-3325-0x00000000007D0000-0x00000000007F1000-memory.dmp

Download

memory/5588-68-0x00000000007D0000-0x00000000007F1000-memory.dmp

Download