d8bad1e75b84a00d7ce1decad6dad12fcf5e31ed985a6f861967cc45289f3e53

Analysis

max time kernel
151s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 00:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_d2d01d3b6cffa71abd1c331c8f9c25d4_amadey_coinminer_darkgate_elex_glassworm_hawkeye_hijackl.exe
Size 23.7MB
Sample260807-ahs3csterb
SHA256 d8bad1e75b84a00d7ce1decad6dad12fcf5e31ed985a6f861967cc45289f3e53
MD5 d2d01d3b6cffa71abd1c331c8f9c25d4
SHA1 c2ebce389e35f69a26d4f7471e8d0139c1080aba
SHA512 262a89f64b68409b39573bea008f3fc5b4b5877722c27016d37d6007759a005e5ff3174bd05573bb5129ecb5244126fcb1453d700da64788b293dce99f430d3f
SSDEEP 196608:kFlfFlfFlfFlfFlfFlfFlfFlfFlCnS11tIDewjqkjiqMM:i33333333s28KwekyM
TLSH
T18047D05AFE9480E0FD7BA43458BBD232D9327E364433870B99D5F60A6F33A515C1A632
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c527-18.dat	UPX
behavioral2/files/0x00080000000182bd-385.dat	UPX

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_AAABCCBCABAAACCCBAAACABABCBACCCBCCCABBBBBACBABBAAABCABB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_AAABCCBCABAAACCCBAAACABABCBACCCBCCCABBBBBACBABBAAABCABB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_AAABCCBCABAAACCCBAAACABABCBACCCBCCCABBBBBACBABBAAABCABB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_AAABCCBCABAAACCCBAAACABABCBACCCBCCCABBBBBACBABBAAABCABB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4816	svchost_AAABCCBCABAAACCCBAAACABABCBACCCBCCCABBBBBACBABBAAABCABB.exe
5292	svchost_BAABCBCBAABCAABACBCBAABCACBCBBBCAABBBBBBCBCCCCCCBABAAAB.exe
1848	svchost_AAABCCBCABAAACCCBAAACABABCBACCCBCCCABBBBBACBABBAAABCABB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAACABCABCBABACCAABAACBBBBBAAAAAABCBABBCCACCBCBBAABCABBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABCCBCABAAACCCBAAACABABCBACCCBCCCABBBBBACBABBAAABCABB.exe"	2026-08-06_d2d01d3b6cffa71abd1c331c8f9c25d4_amadey_coinminer_darkgate_elex_glassworm_hawkeye_hijackl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBAACAABABCABBCACCBABBBCBBBBBACCBBABCBBCACBAABAACAACCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAABCBCBAABCAABACBCBAABCACBCBBBCAABBBBBBCBCCCCCCBABAAAB.exe"	svchost_AAABCCBCABAAACCCBAAACABABCBACCCBCCCABBBBBACBABBAAABCABB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2792	sc.exe
5984	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1720	cmd.exe
5088	cmd.exe
2444	cmd.exe
5336	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAABCCBCABAAACCCBAAACABABCBACCCBCCCABBBBBACBABBAAABCABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_d2d01d3b6cffa71abd1c331c8f9c25d4_amadey_coinminer_darkgate_elex_glassworm_hawkeye_hijackl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAABCBCBAABCAABACBCBAABCACBCBBBCAABBBBBBCBCCCCCCBABAAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5752	schtasks.exe
2032	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
820	2026-08-06_d2d01d3b6cffa71abd1c331c8f9c25d4_amadey_coinminer_darkgate_elex_glassworm_hawkeye_hijackl.exe
820	2026-08-06_d2d01d3b6cffa71abd1c331c8f9c25d4_amadey_coinminer_darkgate_elex_glassworm_hawkeye_hijackl.exe
820	2026-08-06_d2d01d3b6cffa71abd1c331c8f9c25d4_amadey_coinminer_darkgate_elex_glassworm_hawkeye_hijackl.exe
820	2026-08-06_d2d01d3b6cffa71abd1c331c8f9c25d4_amadey_coinminer_darkgate_elex_glassworm_hawkeye_hijackl.exe
4816	svchost_AAABCCBCABAAACCCBAAACABABCBACCCBCCCABBBBBACBABBAAABCABB.exe
4816	svchost_AAABCCBCABAAACCCBAAACABABCBACCCBCCCABBBBBACBABBAAABCABB.exe
4816	svchost_AAABCCBCABAAACCCBAAACABABCBACCCBCCCABBBBBACBABBAAABCABB.exe
4816	svchost_AAABCCBCABAAACCCBAAACABABCBACCCBCCCABBBBBACBABBAAABCABB.exe
1848	svchost_AAABCCBCABAAACCCBAAACABABCBACCCBCCCABBBBBACBABBAAABCABB.exe
1848	svchost_AAABCCBCABAAACCCBAAACABABCBACCCBCCCABBBBBACBABBAAABCABB.exe
5292	svchost_BAABCBCBAABCAABACBCBAABCACBCBBBCAABBBBBBCBCCCCCCBABAAAB.exe
5292	svchost_BAABCBCBAABCAABACBCBAABCACBCBBBCAABBBBBBCBCCCCCCBABAAAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	820	2026-08-06_d2d01d3b6cffa71abd1c331c8f9c25d4_amadey_coinminer_darkgate_elex_glassworm_hawkeye_hijackl.exe
Token: SeDebugPrivilege	4816	svchost_AAABCCBCABAAACCCBAAACABABCBACCCBCCCABBBBBACBABBAAABCABB.exe
Token: SeDebugPrivilege	1848	svchost_AAABCCBCABAAACCCBAAACABABCBACCCBCCCABBBBBACBABBAAABCABB.exe
Token: SeDebugPrivilege	5292	svchost_BAABCBCBAABCAABACBCBAABCACBCBBBCAABBBBBBCBCCCCCCBABAAAB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 1720	820	2026-08-06_d2d01d3b6cffa71abd1c331c8f9c25d4_amadey_coinminer_darkgate_elex_glassworm_hawkeye_hijackl.exe	92
PID 1720 wrote to memory of 5752	1720	cmd.exe	94
PID 4816 wrote to memory of 1496	4816	svchost_AAABCCBCABAAACCCBAAACABABCBACCCBCCCABBBBBACBABBAAABCABB.exe	95
PID 820 wrote to memory of 5088	820	2026-08-06_d2d01d3b6cffa71abd1c331c8f9c25d4_amadey_coinminer_darkgate_elex_glassworm_hawkeye_hijackl.exe	98
PID 5088 wrote to memory of 2792	5088	cmd.exe	100
PID 820 wrote to memory of 2444	820	2026-08-06_d2d01d3b6cffa71abd1c331c8f9c25d4_amadey_coinminer_darkgate_elex_glassworm_hawkeye_hijackl.exe	101
PID 2444 wrote to memory of 5984	2444	cmd.exe	103
PID 4816 wrote to memory of 5336	4816	svchost_AAABCCBCABAAACCCBAAACABABCBACCCBCCCABBBBBACBABBAAABCABB.exe	106
PID 5336 wrote to memory of 2032	5336	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-06_d2d01d3b6cffa71abd1c331c8f9c25d4_amadey_coinminer_darkgate_elex_glassworm_hawkeye_hijackl.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_d2d01d3b6cffa71abd1c331c8f9c25d4_amadey_coinminer_darkgate_elex_glassworm_hawkeye_hijackl.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACACCABCABCCBCAACBACAABBBCACBACCBABCABCAABBCCBBBBCBBCAAACBBAABBBBAABBCBCAAABCBBBCAACCBCBABBCCCABABBBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCCBCABAAACCCBAAACABABCBACCCBCCCABBBBBACBABBAAABCABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACACCABCABCCBCAACBACAABBBCACBACCBABCABCAABBCCBBBBCBBCAAACBBAABBBBAABBCBCAAABCBBBCAACCBCBABBCCCABABBBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCCBCABAAACCCBAAACABABCBACCCBCCCABBBBBACBABBAAABCABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBCAACABBAAAABBABBCCACABCCCBBABCCCACACACCCACBBAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCCBCABAAACCCBAAACABABCBACCCBCCCABBBBBACBABBAAABCABB.exe" start= auto displayName= "UserDataSvc_ABBCAACABBAAAABBABBCCACABCCCBBABCCCACACACCCACBBAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBCAACABBAAAABBABBCCACABCCCBBABCCCACACACCCACBBAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCCBCABAAACCCBAAACABABCBACCCBCCCABBBBBACBABBAAABCABB.exe" start= auto displayName= "UserDataSvc_ABBCAACABBAAAABBABBCCACABCCCBBABCCCACACACCCACBBAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBCAACABBAAAABBABBCCACABCCCBBABCCCACACACCCACBBAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBCAACABBAAAABBABBCCACABCCCBBABCCCACACACCCACBBAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5984

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCCBCABAAACCCBAAACABABCBACCCBCCCABBBBBACBABBAAABCABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCCBCABAAACCCBAAACABABCBACCCBCCCABBBBBACBABBAAABCABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1496
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBABCBAAACACAABCCAABCACAABACBBCBABBACCBCACAAACCBCBACAACCBACCCBCCBACBCBAABACBBCACBACCACABBCBCABACBCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCBCBAABCAABACBCBAABCACBCBBBCAABBBBBBCBCCCCCCBABAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5336
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBABCBAAACACAABCCAABCACAABACBBCBABBACCBCACAAACCBCBACAACCBACCCBCCBACBCBAABACBBCACBACCACABBCBCABACBCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCBCBAABCAABACBCBAABCACBCBBBCAABBBBBBCBCCCCCCBABAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2032

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCBCBAABCAABACBCBAABCACBCBBBCAABBBBBBCBCCCCCCBABAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCBCBAABCAABACBCBAABCACBCBBBCAABBBBBBCBCCCCCCBABAAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5292

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCCBCABAAACCCBAAACABABCBACCCBCCCABBBBBACBABBAAABCABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCCBCABAAACCCBAAACABABCBACCCBCCCABBBBBACBABBAAABCABB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 308199f9299351016c071f6f0cdb86ce56921ca0e7b2ba418ccee13296329f83
MD5 0780e5e97c587b47fe46e61a351ea383
SHA1 52f82ad7eedc54b543bebca310dcd752582a4759
SHA512 e6b6dbf594e846d10ebc4dbd1005d327a146cc02756708b056de8f7d2781ba6107432527d661f2d0babb291b999219e4855b9ac0984ccfc667e8bc6ded0ab00e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows Defender\LocalCopy\qap`g`v~dtlq
Size 10B
SHA256 77d0944ecb81cb3476dd8736e1fc9e3103c737f4d41100f2a681370c00ff548d
MD5 0980648be8e89b7657a909287fd6fd19
SHA1 3d31511db97ee3e78c7bdea2dd0dc02948396de8
SHA512 1ea494a2c5840fb9a6ca6c772046802c6d78df311e46d02a08f26e2fb4fb18feb2f9805fe0334988b78285cc1ebaabcc120938131efa3365dfc55d3e54f30401
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\qap`g`v~dtlq
Size 10B
SHA256 3604487caed24a354bcec9eec0ef15f21dfe8c602012e6ce622e0daa4169498d
MD5 737e98e2e1f6f71ce68cbe2841fb4a49
SHA1 5aaaacbd1e5bda834ca156a0e29b63ccbccecaf0
SHA512 e605dd5b53c7a0c51cd7068fb16a84044cacc149f4f55cf032c6aca32e404270fa6d5e78a55c597995d58101e0964291fd62fae582deefa787a2a0f258958bfe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\qap`g`v~dtlq
Size 10B
SHA256 4cfc5d68a9fa26f216662c0c990555f0329cbff21ce65a3e7357d4eb86ff7a72
MD5 33aa1843101385829b3e9446996ec7ad
SHA1 38667f9c426f496789d570e7624177ee8b9a4664
SHA512 57c94b1256cdd6882581b7715a8c2fc23ed06a2d73e0afccb4e109163ae8f5e636833f146f0b3481818352a3b1f314ab021893db0824ea5b4bb2cd535f5c1c35
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 bdf75c51807ec89ea3b77be0a5d43cf6004f1fbec008552a698a9a0c0ca18461
MD5 551a2bb58d8a104dc36f4eb18233d2cf
SHA1 130133b663aff511f32e80b53094ebea6f06b5e2
SHA512 2af39ee75d2fd7293125f714bf52e1068c953d66573ff237d26e58f17499d6c5a171e6b6524aaad21ccf78a4bad310e59037e63ec03020fe1348c0362d1e93bd
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 24.3MB
SHA256 c4c7d2a672caf66ff130d51dc4377d66366c9d0b59624fe056103db87be636b6
MD5 08e88ada54d89e7a778149d25c9a0553
SHA1 661a75772eeadd02e0d13e23072efe8ef9b7c768
SHA512 fee97ceb1e5975adcd46d7f60785533b0d626c301ef7b2e05c4bca6f3c73de5c5f3bc40bcb7089ba6f88a806c87bde74825876545305c0d3ab3397d603d62c16
SSDEEP 196608:kFlfFlfFlfFlfFlfFlfFlfFlfFlCnS11tIDewjqkjiqMrgZ2j6:i33333333s28KwekyC2G
TLSH
T1C447D05AFE9480E0FD7BA43498BBD232D9327E364433874B99D5F60A6F339515C1A232
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 cd450071cfd129a0e578970affc5f673b86ba36e77704a0ebb368a991235b5ad
MD5 e45d7eb8ec8f187bab86f50421c64507
SHA1 6fb494989fc54160019649a1bed6fbe01c29b0eb
SHA512 248eb1cc85f877bf3b431b5b35a435c380c6c4c9d1a76eda934423256d0eb1229c7290f9f8880305f3853205cb43e659c6be16271125c1ab25ca93679828512a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 e1a81c35d76d5acaf3f9f6b906e27839ad1e2b93532308e407446e32ed1d2410
MD5 5227d9240194f917a868363b17622378
SHA1 6ea644d90df3ee31c12ea49686dae8655e1e3e74
SHA512 faf8dfb4bc588093a7785f0de4dc657cf0826c34969df14b243942017a4b8c9d1501ea8634a2379731e0991b1c394e1e37448f3f4da997e2690cb25f74d58a58
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 b2142e47bfe9117eb4a0292a1c0e55ed8c8674062adb06bda78f7caf2b3eb17e
MD5 83151c063b29640de7f204fc7de67da5
SHA1 fb5350807fcce684b8cbda393f036704a88715ed
SHA512 942c8a89a7f122648af8684cca971df6460db49941899ee4413cdef874e0c96a33a40b590f17dfd3bfa1085b7086c2ff50cb0639b59a632c29f5f7f2c006aff2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\Cache\qap`g`v~dtlq
Size 10B
SHA256 1d8733410eebbfb8a04ffa2dbbe4213eaa59b10b2b3b29c0daf54ede32b1863e
MD5 048ff34833d0e1d140dedd15ec1b9441
SHA1 d9c50c2d402adb218106e72629f5d0a35b39c766
SHA512 7bf4109e24df7deddee4ad065ed04e04788451e83522418ba4c89ec8d613a8c79f9c5d1a5ec471ea85df92c12fb212c99f30da9dab61f21ff9e2f0623a2438b7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 aa51f5b1cc15b496b6ae82c1643b62807e4c49fdc0b28ccecedaceabe20c0f6f
MD5 134b90d3d775aaa8b1f3b93cc291da1e
SHA1 79264d08aa2a36eeb77e514bcfe0fca3925b4a35
SHA512 1c9f7b7667448a6b9bcd08eb914449516b904f1ebf0539b9912e71bd15f6da5b5d04a87312d79232993ed7f0c720dd21e86da5a60fb9a76a417e254618b1d1ab
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 c9d0352684f23925d54ad3f268106274dc00d3bdc751d707229e029182379ffc
MD5 b88d484dfa3796f6d79576ec2b22f4a5
SHA1 ecf6f4793bcdbd68f52ec1e5196edbf81b34946f
SHA512 54430c6cd117ad897ff3f1868816dfcee9b679c013ff7a94f64a53bd41b77be7a387eadfeb3dd5bcf6813467efc84be8a9935d612d46350ed0fc9e6aafcc2a90
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 731d7c72fc16516a54e66b2d8901d25d4b6e63ef688757d29690775b4a2c3926
MD5 d12b8a62cb82c66ecf6e352f9276cf13
SHA1 51f41f326467ec118d651bdeb86124aa6db2d6ae
SHA512 fec703b9aa3cd9c6a01c180f4bd911871a87e90a7b7509fab3e30aae8a970f03399a11fa781f9c323b5f0b712834f31232957b21364a424354dec7167ead05bf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\MergeApprove\qap`g`v~dtlq
Size 10B
SHA256 03cb478b5e5902d0c7cc695777d3d4fe11e2ab8ac0fa5a1ef4becd6dee68a103
MD5 72d740eb9126970a27d67781f8cc7739
SHA1 182130b1b86956ed8692f6ee3ba6d8a722e7787f
SHA512 f1007196e7fe65c2c86b8bb63a07625c3409c5ace9022bdd62d6e0b32bb1e22de5a0461839818e25eca7aecf097a3dd126ec2417b519ae19f1eb5f2478222e9b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\qap`g`v~dtlq
Size 10B
SHA256 d5e17ac39901b5bf4fec59dcb7dc98d5ed195bbf20cbd1c35b53fc33a7f99862
MD5 9b6cc5446871bf8cb6de6e6af2c2de99
SHA1 4e583ec57aeb1a9717fd97dfca3f70b7e1609599
SHA512 a50efb8f045eac5d8c606defa2f60e6c9678fde993b919e79eef184f537910accf74dcb31cb107be07c0f987451ec84295cffdd5aace9179fe76c57436a09371
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 98151332bcefe56f3b401631530d7e6f98fb85b31c5608eb0d74322b9332b908
MD5 fd1c3220578f442667fe89121268fd4b
SHA1 1ee9ef19c23d2a2e4147972b9998ce12aa281560
SHA512 08a0471b8064bd6c32c20fa7c6ad1a5b0d93291f915721be7a2b7a078179b36e7b0e805ab035c2ed02129bc1b33b44e5209083accf5a50c3924321630c3510f1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dc4f8b5074c4130349b1f4d49beacf37c2d02a7338e256f0c5dc467d08b6acf4
MD5 0bde3d924969f3fa3d890b0fa54d426d
SHA1 1bb0b2c8c8b158cd6fe35f3838628eeae72ebea1
SHA512 1706e5b48706901e321cc83627efc2d8056602540d8389866baa734d28eeff6b988caa500cdc597839631347bc45d74b7e99233f756840992a28527deb69053b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 664f7ad7338f9bf5ee641271feff48c5291628c6b50a2f25a60e87c3294c2767
MD5 ae15b779bab93108ab51d13bc7c23da0
SHA1 03b4ed6bcb517b4048e429186a176ed6dcf6d8d8
SHA512 466fe42a2e569091bb6fd76f8a24ea733cafac20d97e1bbe9a34a968f688ead98819ca1fa508984c17a9f1323e56171423e775a701896069c478ee43a6c44620
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9044329de4a5c5c05c2a9035ee84453b19a18d44c3508756ee523d382972891d
MD5 93643322afccc8a20553d1c74655cd92
SHA1 48048745d46381db2f9c61e503a7d7434bc0ec90
SHA512 ac7787acbf1be0a9b0e91859ee3e5a75d175c55967546608bafb953b4f1d7eb18439662a9b2aa186f407f1ac8267da246c896001c4359e04d8c117c16187dc15
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5a7b9ab29e5ee913ad1fce423c0a56ace78cbccb984f75a38fb391e6a7c1cde4
MD5 62d0d19d60e044d9ca013979e2cff566
SHA1 6706d4ac427fa6b46df74875068b3540b95c59db
SHA512 2ce5f017b674c976f455d91da45de4486d00bfa1fdc5e29addfc50dfbd71c840c06365dcc373ea82b65ad82156fbc6c6399c4e080dc22428c9b00fab531b7837
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 db72116d1acb83eab67350ce972b2149b471c028ad2333243f4272df5a870507
MD5 f0bd738fca14748978672f352a7a07c6
SHA1 1912c67fe584fab2ae47c04a06f567f55051aa50
SHA512 f2dc375256b8802a1a02f59c8d1c70a52ee35672320fc32984321553e23bb20c88cd4caeee36d4ac0fb0e7ef5f043dae245b4aa23e35164face181636f690984
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Music\qap`g`v~dtlq
Size 10B
SHA256 d5a5597080c05f0313959d9f00ee76f55362563c5fdcb5b7e5d0dd1fb1693ab0
MD5 bade52bd598bfe88814302067a61c998
SHA1 7fb8ce9da1de48d501ce2a1723f160406ffb26d0
SHA512 572e050409cb30ad3411f8c1188be8c4ceb6738c8d51cfe5181fe102449367ae45abdd47ef5e5185cda161f72a70670475e6b40a1e608f19e9880507ee31e669
MD5 SHA1 SHA512

Submit Download

svchost_AAABCCBCABAAACCCBAAACABABCBACCCBCCCABBBBBACBABBAAABCABB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCCBCABAAACCCBAAACABABCBACCCBCCCABBBBBACBABBAAABCABB.exe
Size 23.7MB
SHA256 d8bad1e75b84a00d7ce1decad6dad12fcf5e31ed985a6f861967cc45289f3e53
MD5 d2d01d3b6cffa71abd1c331c8f9c25d4
SHA1 c2ebce389e35f69a26d4f7471e8d0139c1080aba
SHA512 262a89f64b68409b39573bea008f3fc5b4b5877722c27016d37d6007759a005e5ff3174bd05573bb5129ecb5244126fcb1453d700da64788b293dce99f430d3f
SSDEEP 196608:kFlfFlfFlfFlfFlfFlfFlfFlfFlCnS11tIDewjqkjiqMM:i33333333s28KwekyM
TLSH
T18047D05AFE9480E0FD7BA43458BBD232D9327E364433870B99D5F60A6F33A515C1A632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 b7dac937e1fc0c3fd34c31fe60cf51be184fa815c3fbb0f178ce44ab2712c1dc
MD5 1e3314755d3163fe11b9b7ab0fafd15f
SHA1 57d1b34ac4dc8aba2231d09c29eab1c88f80fcb8
SHA512 a1d1e53040c7ad3ae41ea3cadbfa7a74f36ff61c699b330d3ef73704421a46e60a48fa3ef8ff97f40822d3cb0b0a016d2196bc2a1f314d692d2df81fa94cbd39
TLSH
T1B321C365D0EAC9D7E5372CCFA22ADDD60DEA37C7546C6A24A3085118F3898318F198F3
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 fa76b00ff54d604ac60e8ae6d7d0a4ab0ed3ba28326641297f87087f31e77809
MD5 4c7331a68d4f36df196755c26e836141
SHA1 c6c57f8f635524abc7349fbf2dccbe80bb02646a
SHA512 22aaeb18ea445b792c880aac5dc2e3687f2231350ce0a1778a69ddceae284e15264ce753349b950fc16c102f5bbebed4d296225c602d8f4931ceb463365851ec
TLSH
T15D21F965E0EACCD7D5376CCFA625DDD60DA937D7945C6A24A30C4118B3C98318F158F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 aa7d2a647871cba811fe6f7a7cbe43e55e7e66edcb9846574bc60f6fce198da2
MD5 32a7ea49759eb20386913149edc2bbf2
SHA1 142a4ded983b180cefeb18da454333f372c2d327
SHA512 b5f6c8a6217b7cabed6bc14638e069ac2e1fd8765119f770b4c740f82447eb2c2f78f0489dd7e417ca4c770d8782e27f217818e83965c273f2666984e7daca0c
TLSH
T16511E365D0EAD8D7E5372CCFA229DDD60EEA27C7545C6A24A3085118F3898318F198F3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/820-6-0x0000000000B50000-0x0000000000B71000-memory.dmp

Download

memory/1848-1482-0x00000000000A0000-0x00000000000C1000-memory.dmp

Download

memory/4816-32-0x00000000000A0000-0x00000000000C1000-memory.dmp

Download

memory/5292-63-0x00000000009E0000-0x0000000000A01000-memory.dmp

Download

memory/5292-3439-0x00000000009E0000-0x0000000000A01000-memory.dmp

Download