4f931769b271e3f07cc4211587bff8835c72fb0d76ceed6b8ff3bbdcd184e577

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 03:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_48cdecc5661c33bb92211f8e05d0e367_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Size 22.1MB
Sample260808-d7x96azarg
SHA256 4f931769b271e3f07cc4211587bff8835c72fb0d76ceed6b8ff3bbdcd184e577
MD5 48cdecc5661c33bb92211f8e05d0e367
SHA1 b3394fb9c6638e139e0f954055cc472f589f3828
SHA512 b44ec990eca1f5260f9a7d22d14b90cb6a5a76d1cbb3d4bd3994a2d590d105f10d96f81dd0f2efacd9f02370280e9bbf05dd192f81b057c2ccbfdbfac75048e0
SSDEEP 196608:dh47APhNNECwHrc8u3x3AEcq/fByuKlWH3CToud:dh4ahvQHrc8u3xXJ/f4uUWH+
TLSH
T1B437A012B29588E2D46AD2BC89978333D779BC90073197DB1394B72A2F33BE05B76351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Detects executables packed with Dotfuscator 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4e0-18.dat	INDICATOR_EXE_Packed_Dotfuscator
behavioral2/files/0x00080000000182b1-395.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4e0-18.dat	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/files/0x00080000000182b1-395.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4e0-18.dat	INDICATOR_EXE_Packed_Yano
behavioral2/files/0x00080000000182b1-395.dat	INDICATOR_EXE_Packed_Yano

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4e0-18.dat	UPX
behavioral2/files/0x00080000000182b1-395.dat	UPX

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBBACCABBBCAACCAACAAACACCABACCBBBACAAABACCAACBACAAAABCA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBBACCABBBCAACCAACAAACACCABACCBBBACAAABACCAACBACAAAABCA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3404	svchost_BBBACCABBBCAACCAACAAACACCABACCBBBACAAABACCAACBACAAAABCA.exe
2880	svchost_BBBCCCCCBBBCBCAAABAABBACBCAAABAAABBACAACCBCBABBBBCBABBB.exe
5900	svchost_BBBACCABBBCAACCAACAAACACCABACCBBBACAAABACCAACBACAAAABCA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBBABACCCCABABABCACCBCAAAAACCACACACCAACAABBACACCCAABBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBACCABBBCAACCAACAAACACCABACCBBBACAAABACCAACBACAAAABCA.exe"	2026-08-08_48cdecc5661c33bb92211f8e05d0e367_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBACCBCACAAACAACAABBBABCCABCAACABCAACBABBABAAACACCABABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBCCCCCBBBCBCAAABAABBACBCAAABAAABBACAACCBCBABBBBCBABBB.exe"	svchost_BBBACCABBBCAACCAACAAACACCABACCBBBACAAABACCAACBACAAAABCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3388	sc.exe
3244	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4824	cmd.exe
4176	cmd.exe
4728	cmd.exe
5112	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBCCCCCBBBCBCAAABAABBACBCAAABAAABBACAACCBCBABBBBCBABBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_48cdecc5661c33bb92211f8e05d0e367_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBACCABBBCAACCAACAAACACCABACCBBBACAAABACCAACBACAAAABCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4788	schtasks.exe
4344	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5828	2026-08-08_48cdecc5661c33bb92211f8e05d0e367_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
5828	2026-08-08_48cdecc5661c33bb92211f8e05d0e367_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
5828	2026-08-08_48cdecc5661c33bb92211f8e05d0e367_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
5828	2026-08-08_48cdecc5661c33bb92211f8e05d0e367_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
3404	svchost_BBBACCABBBCAACCAACAAACACCABACCBBBACAAABACCAACBACAAAABCA.exe
3404	svchost_BBBACCABBBCAACCAACAAACACCABACCBBBACAAABACCAACBACAAAABCA.exe
3404	svchost_BBBACCABBBCAACCAACAAACACCABACCBBBACAAABACCAACBACAAAABCA.exe
3404	svchost_BBBACCABBBCAACCAACAAACACCABACCBBBACAAABACCAACBACAAAABCA.exe
2880	svchost_BBBCCCCCBBBCBCAAABAABBACBCAAABAAABBACAACCBCBABBBBCBABBB.exe
2880	svchost_BBBCCCCCBBBCBCAAABAABBACBCAAABAAABBACAACCBCBABBBBCBABBB.exe
5900	svchost_BBBACCABBBCAACCAACAAACACCABACCBBBACAAABACCAACBACAAAABCA.exe
5900	svchost_BBBACCABBBCAACCAACAAACACCABACCBBBACAAABACCAACBACAAAABCA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5828	2026-08-08_48cdecc5661c33bb92211f8e05d0e367_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Token: SeDebugPrivilege	3404	svchost_BBBACCABBBCAACCAACAAACACCABACCBBBACAAABACCAACBACAAAABCA.exe
Token: SeDebugPrivilege	2880	svchost_BBBCCCCCBBBCBCAAABAABBACBCAAABAAABBACAACCBCBABBBBCBABBB.exe
Token: SeDebugPrivilege	5900	svchost_BBBACCABBBCAACCAACAAACACCABACCBBBACAAABACCAACBACAAAABCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5828 wrote to memory of 5112	5828	2026-08-08_48cdecc5661c33bb92211f8e05d0e367_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe	92
PID 5112 wrote to memory of 4788	5112	cmd.exe	94
PID 3404 wrote to memory of 2352	3404	svchost_BBBACCABBBCAACCAACAAACACCABACCBBBACAAABACCAACBACAAAABCA.exe	95
PID 5828 wrote to memory of 4824	5828	2026-08-08_48cdecc5661c33bb92211f8e05d0e367_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe	98
PID 4824 wrote to memory of 3388	4824	cmd.exe	100
PID 5828 wrote to memory of 4176	5828	2026-08-08_48cdecc5661c33bb92211f8e05d0e367_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe	101
PID 4176 wrote to memory of 3244	4176	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-08_48cdecc5661c33bb92211f8e05d0e367_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_48cdecc5661c33bb92211f8e05d0e367_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACCABABBCCABBABCACABBABBCACCACCCBCCACBBCACAABABAACACCBBACCBBAABABCBBABBCCABCABCABBBAAABCBACACBBCACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACCABBBCAACCAACAAACACCABACCBBBACAAABACCAACBACAAAABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACCABABBCCABBABCACABBABBCACCACCCBCCACBBCACAABABAACACCBBACCBBAABABCBBABBCCABCABCABBBAAABCBACACBBCACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACCABBBCAACCAACAAACACCABACCBBBACAAABACCAACBACAAAABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBCABBACAACBCABCCCAABAABCCACAABCBAABBAACAACCBACCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACCABBBCAACCAACAAACACCABACCBBBACAAABACCAACBACAAAABCA.exe" start= auto displayName= "UserDataSvc_BCBCABBACAACBCABCCCAABAABCCACAABCBAABBAACAACCBACCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBCABBACAACBCABCCCAABAABCCACAABCBAABBAACAACCBACCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACCABBBCAACCAACAAACACCABACCBBBACAAABACCAACBACAAAABCA.exe" start= auto displayName= "UserDataSvc_BCBCABBACAACBCABCCCAABAABCCACAABCBAABBAACAACCBACCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBCABBACAACBCABCCCAABAABCCACAABCBAABBAACAACCBACCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBCABBACAACBCABCCCAABAABCCACAABCBAABBAACAACCBACCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3244

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACCABBBCAACCAACAAACACCABACCBBBACAAABACCAACBACAAAABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACCABBBCAACCAACAAACACCABACCBBBACAAABACCAACBACAAAABCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCBCBCBBCBABBBACCABCCBAABCACABBACCBCCBCBCCCCCCABACCACABABBACCCABAAAACCCBCABCCBABBBBBAABAAAABCCBCAACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCCCCBBBCBCAAABAABBACBCAAABAAABBACAACCBCBABBBBCBABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:4728
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCBCBCBBCBABBBACCABCCBAABCACABBACCBCCBCBCCCCCCABACCACABABBACCCABAAAACCCBCABCCBABBBBBAABAAAABCCBCAACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCCCCBBBCBCAAABAABBACBCAAABAAABBACAACCBCBABBBBCBABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4344

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCCCCBBBCBCAAABAABBACBCAAABAAABBACAACCBCBABBBBCBABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCCCCBBBCBCAAABAABBACBCAAABAAABBACAACCBCBABBBBCBABBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2880

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACCABBBCAACCAACAAACACCABACCBBBACAAABACCAACBACAAAABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACCABBBCAACCAACAAACACCABACCBBBACAAABACCAACBACAAAABCA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 2bb2aee4ab241a09c9a65956a66853d8281f7963ed0a51f5d9780f4fd34fab26
MD5 d3a69abe02eb02aafb4f8d5e3f7c1b45
SHA1 7c27c59e2dea9be207fcbcafadd5a36a84de5914
SHA512 6707f296edf293a61b4c59a4d5c8febf776d4d1e498eb3c7fec0ecf4df18b98e43bcfaa7fa0c826c1d7d01f791dc75c53d316a5038d43f044ebaa518f747caad
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 b6619eb8f2077d52d0fbd7db95baf01b41748d06a02a9cd35f9b1072f7b0db59
MD5 5fb52f3958ae5a7e85fcb18660de9599
SHA1 fee86a439c04a2067909f5dba481177625d68ec5
SHA512 2b9b8ff38db11db3bafca14c98c8168b3e11813b7cb3c2785fca91cf89b122090f08a7bc34b2d310007eba144c8a08a4bffa2b9dc95e8e405d1ad2a1c168c959
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\3A89FC4F-05D6-4457-98E1-3925F3D0FE84\qap`g`v~dtlq
Size 10B
SHA256 4808917b334516c3c33c23524788ce0993fef4067ebd912a559964ca664a1bc1
MD5 a82ac87eef4cd56fa254464372afc98a
SHA1 fc88816e71b5c949158a2677edfbfd467dcdb9d7
SHA512 edaaac5c93f15bee6590942c35df5ae2739ad55ae89bbe07f42058fefa781f41ad73eae6c47b0f666319daa12e0677c31e0566557dad719a510509fd6fdd8e54
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\PowerGrid\qap`g`v~dtlq
Size 10B
SHA256 cb86299567d6c321bdb89240037a22def607d480ddcab6349363d0483f0035ef
MD5 fea34aefd20d3e0abdcb6b564d9f9c55
SHA1 d0931ae7de524dec8d4b7c7615fab1fca7a8ed54
SHA512 aa120274560d1a3a0a547c73633e90b7fb021e5709c121f8ef590b8583098bb3bd1c7d6a017de7a414d6e670fd5bfd66edc92b89c7b32bac119a765ef17573d3
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 22.7MB
SHA256 038bc59288031fa63f151be518401c0c3d340a5a1b81816e36f8d52dfd2bf7f5
MD5 13db5ca13dcce4088ad1ed392007d3af
SHA1 09b7888c47579fc0c74a8f16d1427b2afd89dfc2
SHA512 d630ad21c21adf4821b6a75fb2c8540d0b2ed7969bc3a4e2adf6a907e87b6043717f9a9748bc530dcfe3236928768a1cc2494003da2ac39adf7fa06af9ffc987
SSDEEP 196608:dh47APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouMgZ2jQ:dh4ahvQHrc8u3xXJ/f4uUWHU28
TLSH
T16A37BF12B29584E2D46AD2BC89978333D779BC90073197DB1394B72A2F33BE05B7A351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 629a0c1594ebacf45168d906634b52319f3b5b33338a5ee53c2d3a316d9eb986
MD5 3e55fd18eab4cc6f1bb69eedb66acfc5
SHA1 d7a53bd005eb12f474be6eef13717a6d72e121be
SHA512 3084f23f4b337f5464967304a121050a72513c1f8a37645e6216cd54cf0a03a63b039a1bd82cbd5d1cd74ef822baedd1ede5e28f45453ce860100aa9d0800ff4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 c3620100508fc5cef19183a11a3fade5ec5c6ee40fd96bfd2cf9784ad4bb7e53
MD5 dad43c72b5564a71f3bcdfc289527abf
SHA1 de2e0af9af47ba3dec44cf49d51a8bea38ddfb76
SHA512 386c92954a8c0d7045ffe94110e54690d8b37332b52bf7232b18dfd82339029e26164c28ac9971224f294193901271f3de6371abfcd8173ce9f63822000914a0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 c66245c088bf707dd1288224ac385dd9d2fcdd0b9aff4ce5e0288e2179a30d83
MD5 d1cd9ac594f2bae1ec13f82b7b03ffa2
SHA1 9eb3049ab022363ae312a378a16396e96aada168
SHA512 834ebf8df0713cd5976abe05a7419e0f993a6426bb1d8e90613dabe5401d4d3caa2b09b786339e8d062fc4b77d918b5b9fb87723e35a043664f6a3cf0647a900
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\qap`g`v~dtlq
Size 10B
SHA256 7e815f01c7df5f53a261b26b204f265457e1334b31527f725dbdcb5147945c89
MD5 3a5273ffe1b5436a077ca3b09eb1029a
SHA1 77c151dd2e03304005e83e4e621a703211ebc28f
SHA512 bcdc8a577ec693435d00c16622131ccdcec48c5caaeb5970fc1aee74ab4d563c24eb2ad5a25509f14a795911d6161683c5e360ce09fd8c460e524ca2c90c8ac7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 8119c3f7f0daac74cb8a7c6e80ae2ef127a5cb511838c71146a65628f9f5a96c
MD5 e2eeebabb86ded998a5ca4c6ffe65262
SHA1 107f893e4c5f7cdc0460bf34b7c733d294158fa7
SHA512 e8f2e60a14854ebb61b80839d6edbc438b1c6ddba3e01989a24ab10fbcac407c5f6c9e8969f0c17f7b4461dd31c307858d01738128fc5cf1c1d4a88475cc34d9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\qap`g`v~dtlq
Size 10B
SHA256 caca0a97bec4b99ea432f13988533fc9a1179635c6fff562c03fb56d4ae213d4
MD5 2ba89a1dd9691de07bf1683df4920512
SHA1 57319dd60f39164f4da130b25aebb9baebc2d739
SHA512 8365709361c4ddfac2838a44639a3605087c4a57cb659cb75c9570840abefdf701cea42487c6051c64984934afbfa35a5fec44bb02ae13113321cd4bf7308419
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2c77689df91a56f5b4484e09463514b5aca1fba0be3f17e4bd7b4349c5965f02
MD5 02e4dbde29c4b8a02507373bd8e4c09b
SHA1 748721cc7f9771db4f73b06444aee14f9fcf0dcf
SHA512 1cea71e3c6ac7a0b25b3d43605991f2e4c43fb4611420670eea676476497cf800cfd007dbac30d988ba08b9843af56862d7e2bcb4930d8c9bd8cfe1cb3696df2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8d714ae4f4242011d69dfb83a56d60455b6026324d8c39c484aa4b63e33f92ee
MD5 f797c5a0df738917bcaa39e461ba64a9
SHA1 5918a1a5e6efe24f4fae00f962a261564a581907
SHA512 398084f5b6bc3ba5c2b59a926c911948581ccf1d0b8bcf0c3fc4a615d33044c33db1524b604af3a99bc4412c399ab7ee7848b267bee659def291ef37dc76ea0e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fcb65c05fdae12456b3e498ddf961c70c1d72881160f659dc0922bb2aeddeddc
MD5 25275260aa80f5dfb277cad2a87d77c4
SHA1 732c906b478a6c68de2d664491ebadd03fc2cb48
SHA512 573fcecb1edea1ba368bf53963bf01ab31a97b0b80dd4d1087c62e704e5fb1947dee8ac3343a53ef7709f0bfef035a528c59311b178a583664d9e9ba524741f9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5264b677671b48a144b51d3b5bc218c58fb8ddfada775a8b7f57a71abce4f07b
MD5 6eb4cad50d24e050594d894cc975e54f
SHA1 5ea6f8bd19dcdfcd52629d37e905f2bb8aaed066
SHA512 9582eea4cf8dcd8551de26bd8c88f55173447b507fc3a47276f183108a27cec3f4cf171b3cfb6a76064ad24c00ede463c6ea54568a8c3bf43b80c49d2c866578
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 797a092e9c1baf67fc183d1667748712b2d836b3fce5c081442aba72fc18cf49
MD5 17f008cd02e323c47bf76c68404e12d4
SHA1 1f40441cbac123815bb640a53ff135f82cdba998
SHA512 a5add7123f46c43ddff0a1a943c24a356d4c6b8d7d6594892011cc1c189617d6c8d8215b774300a98b86edbce50c1abae9c11ec91ed73c285b972ad416b088de
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 45c289e07b6d727109477faba876744800a43ae01ea8b66b14764a8a856b43f3
MD5 928e259e659b2598ab6fa7e1a419c144
SHA1 2489bd387f55eee06ee00ea7eaeaacb3fa29048c
SHA512 67acbbe989679d657f086e52bb8ee6f46b8b0473c80a5d1fa5f3f5a5bd8626a8c121162cead1e53e8b705e32ffe55d92a32bf6d7a2d6958bfe5f9c6d176a423c
MD5 SHA1 SHA512

Submit Download

svchost_BBBACCABBBCAACCAACAAACACCABACCBBBACAAABACCAACBACAAAABCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACCABBBCAACCAACAAACACCABACCBBBACAAABACCAACBACAAAABCA.exe
Size 22.1MB
SHA256 4f931769b271e3f07cc4211587bff8835c72fb0d76ceed6b8ff3bbdcd184e577
MD5 48cdecc5661c33bb92211f8e05d0e367
SHA1 b3394fb9c6638e139e0f954055cc472f589f3828
SHA512 b44ec990eca1f5260f9a7d22d14b90cb6a5a76d1cbb3d4bd3994a2d590d105f10d96f81dd0f2efacd9f02370280e9bbf05dd192f81b057c2ccbfdbfac75048e0
SSDEEP 196608:dh47APhNNECwHrc8u3x3AEcq/fByuKlWH3CToud:dh4ahvQHrc8u3xXJ/f4uUWH+
TLSH
T1B437A012B29588E2D46AD2BC89978333D779BC90073197DB1394B72A2F33BE05B76351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 0ef377b099a7272ad834b33d7b1edaa1c79bc9071a27c0a848aad06e2b13b425
MD5 e4dda74836a82cb1df4415d8271d5831
SHA1 672722b729ab326ced3fea21b8c42678e6560651
SHA512 c477e0a736b97ae9a492b7a4f418df19f274a8948bab6623685d65f17851ac91b87c5052bc4d83b41e277ac6d5b8d7a0a2967fb2092f20a01fe1af293481b1f4
TLSH
T170113A21B0E9CC13E532688F8A29CDC34CE42A4B5C5C6A65E3089A18A7C9C32CD56CF2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 966B
SHA256 0314d474a440255726de92c3a1b98c33355a5829bf94da00c70c7865c0c8c12f
MD5 10d0793b1f447a50940f3664c1aebf9e
SHA1 ff9f95cc46a96065a7288b7f458cbe5f0bd85a6c
SHA512 9aa6fc338bb08614729d2938af88a11c2aff943e38eeb2e31dafa0a14810e48119bdf93ecdb1a5ef86ac0ac4f4f67015dab0f32f3cbc74c27ce8e5cb3b16d53c
TLSH
T1C6117D61B0E8CC13E533688F8A25CDC34CE43A4B9C5C6E65E3085618A7C5C32CD46CF6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2880-78-0x0000000000410000-0x0000000000431000-memory.dmp

Download

memory/3404-32-0x0000000000D00000-0x0000000000D21000-memory.dmp

Download

memory/3404-22-0x0000000000D00000-0x0000000000D21000-memory.dmp

Download

memory/5828-6-0x0000000000410000-0x0000000000431000-memory.dmp

Download

memory/5900-80-0x0000000000D00000-0x0000000000D21000-memory.dmp

Download

memory/5900-2299-0x0000000000D00000-0x0000000000D21000-memory.dmp

Download