1c56a39cb402b7a46d3351be67a6f8ff8c16f108a0fbd8da21a3e4935f3f070e

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 04:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_04b3c7b3f1427b58a3d3c1ab9685f209_amadey_cobalt-strike_darkgate_elex_glassworm_icedid_luca.exe
Size 21.4MB
Sample260808-et8dmszflb
SHA256 1c56a39cb402b7a46d3351be67a6f8ff8c16f108a0fbd8da21a3e4935f3f070e
MD5 04b3c7b3f1427b58a3d3c1ab9685f209
SHA1 753b0dfe6e35c7b29ae75c62d4614dd001637491
SHA512 e8b331dac0c4e2eede468ac3ea92e5c270d9f2a26c7abefc1cced1d4433806844965e868b9f7d432d4d11e92b559d3760448ec32e77e26ef339758b73a328460
SSDEEP 98304:wMMMMCVNBw4MLMMMMCVNBw4M7MMMMCVNBw4MLMMMMCVNBw4MHA91pH2WpjHrgBFL:dhXhumHpn6F44IAWvi
TLSH
T18F379E90B5E648E5E57A913D49B7C332DA38BDE20632874B537CE6271F23B902CA5713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024752-20.dat	UPX
behavioral1/files/0x000200000000071b-99.dat	UPX

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBACAAACBCABCCCAACBBBBAAAAAACBCCBCCCACCBACCACBCBBBCBCCC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBACAAACBCABCCCAACBBBBAAAAAACBCCBCCCACCBACCACBCBBBCBCCC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4980	svchost_CBACAAACBCABCCCAACBBBBAAAAAACBCCBCCCACCBACCACBCBBBCBCCC.exe
3168	svchost_CCBBCBBABABBABABCAABACCBCABCCCAABABCCBACCACBCCBCBCCCBBA.exe
2668	svchost_CBACAAACBCABCCCAACBBBBAAAAAACBCCBCCCACCBACCACBCBBBCBCCC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CBBBBCAAAAABBABBCACBBBACAACBACBCBCCBCBCCABABCABABACCBBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBACAAACBCABCCCAACBBBBAAAAAACBCCBCCCACCBACCACBCBBBCBCCC.exe"	2026-08-08_04b3c7b3f1427b58a3d3c1ab9685f209_amadey_cobalt-strike_darkgate_elex_glassworm_icedid_luca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BBCBBBCCABBCBBACBCABABCCACCBCBABBACACACCABCABAABBCACBCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBBCBBABABBABABCAABACCBCABCCCAABABCCBACCACBCCBCBCCCBBA.exe"	svchost_CBACAAACBCABCCCAACBBBBAAAAAACBCCBCCCACCBACCACBCBBBCBCCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3812	sc.exe
1992	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3512	cmd.exe
4220	cmd.exe
3284	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBACAAACBCABCCCAACBBBBAAAAAACBCCBCCCACCBACCACBCBBBCBCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBBCBBABABBABABCAABACCBCABCCCAABABCCBACCACBCCBCBCCCBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_04b3c7b3f1427b58a3d3c1ab9685f209_amadey_cobalt-strike_darkgate_elex_glassworm_icedid_luca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2412	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2920	2026-08-08_04b3c7b3f1427b58a3d3c1ab9685f209_amadey_cobalt-strike_darkgate_elex_glassworm_icedid_luca.exe
2920	2026-08-08_04b3c7b3f1427b58a3d3c1ab9685f209_amadey_cobalt-strike_darkgate_elex_glassworm_icedid_luca.exe
2920	2026-08-08_04b3c7b3f1427b58a3d3c1ab9685f209_amadey_cobalt-strike_darkgate_elex_glassworm_icedid_luca.exe
2920	2026-08-08_04b3c7b3f1427b58a3d3c1ab9685f209_amadey_cobalt-strike_darkgate_elex_glassworm_icedid_luca.exe
4980	svchost_CBACAAACBCABCCCAACBBBBAAAAAACBCCBCCCACCBACCACBCBBBCBCCC.exe
4980	svchost_CBACAAACBCABCCCAACBBBBAAAAAACBCCBCCCACCBACCACBCBBBCBCCC.exe
4980	svchost_CBACAAACBCABCCCAACBBBBAAAAAACBCCBCCCACCBACCACBCBBBCBCCC.exe
4980	svchost_CBACAAACBCABCCCAACBBBBAAAAAACBCCBCCCACCBACCACBCBBBCBCCC.exe
3168	svchost_CCBBCBBABABBABABCAABACCBCABCCCAABABCCBACCACBCCBCBCCCBBA.exe
3168	svchost_CCBBCBBABABBABABCAABACCBCABCCCAABABCCBACCACBCCBCBCCCBBA.exe
2668	svchost_CBACAAACBCABCCCAACBBBBAAAAAACBCCBCCCACCBACCACBCBBBCBCCC.exe
2668	svchost_CBACAAACBCABCCCAACBBBBAAAAAACBCCBCCCACCBACCACBCBBBCBCCC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2920	2026-08-08_04b3c7b3f1427b58a3d3c1ab9685f209_amadey_cobalt-strike_darkgate_elex_glassworm_icedid_luca.exe
Token: SeDebugPrivilege	4980	svchost_CBACAAACBCABCCCAACBBBBAAAAAACBCCBCCCACCBACCACBCBBBCBCCC.exe
Token: SeDebugPrivilege	3168	svchost_CCBBCBBABABBABABCAABACCBCABCCCAABABCCBACCACBCCBCBCCCBBA.exe
Token: SeDebugPrivilege	2668	svchost_CBACAAACBCABCCCAACBBBBAAAAAACBCCBCCCACCBACCACBCBBBCBCCC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2816	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 3512	2920	2026-08-08_04b3c7b3f1427b58a3d3c1ab9685f209_amadey_cobalt-strike_darkgate_elex_glassworm_icedid_luca.exe	98
PID 3512 wrote to memory of 2412	3512	cmd.exe	100
PID 4980 wrote to memory of 4312	4980	svchost_CBACAAACBCABCCCAACBBBBAAAAAACBCCBCCCACCBACCACBCBBBCBCCC.exe	101
PID 4312 wrote to memory of 4728	4312	notepad.exe	102
PID 2920 wrote to memory of 4220	2920	2026-08-08_04b3c7b3f1427b58a3d3c1ab9685f209_amadey_cobalt-strike_darkgate_elex_glassworm_icedid_luca.exe	106
PID 4220 wrote to memory of 3812	4220	cmd.exe	108
PID 2920 wrote to memory of 3284	2920	2026-08-08_04b3c7b3f1427b58a3d3c1ab9685f209_amadey_cobalt-strike_darkgate_elex_glassworm_icedid_luca.exe	109
PID 3284 wrote to memory of 1992	3284	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-08_04b3c7b3f1427b58a3d3c1ab9685f209_amadey_cobalt-strike_darkgate_elex_glassworm_icedid_luca.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_04b3c7b3f1427b58a3d3c1ab9685f209_amadey_cobalt-strike_darkgate_elex_glassworm_icedid_luca.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACBACBCACBBBCBACACBBAAACAACBABCCCACAACABAAAACCCAAABCCABBACCBACACBCCACCCAABBBBBCBABCBACCACBACBACACABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAACBCABCCCAACBBBBAAAAAACBCCBCCCACCBACCACBCBBBCBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACBACBCACBBBCBACACBBAAACAACBABCCCACAACABAAAACCCAAABCCABBACCBACACBCCACCCAABBBBBCBABCBACCACBACBACACABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAACBCABCCCAACBBBBAAAAAACBCCBCCCACCBACCACBCBBBCBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBCCCABCCBBABBBBACACCAAABABBCBCAACAACBACAAACCBBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAACBCABCCCAACBBBBAAAAAACBCCBCCCACCBACCACBCBBBCBCCC.exe" start= auto displayName= "UserDataSvc_ACBCCCABCCBBABBBBACACCAAABABBCBCAACAACBACAAACCBBBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBCCCABCCBBABBBBACACCAAABABBCBCAACAACBACAAACCBBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAACBCABCCCAACBBBBAAAAAACBCCBCCCACCBACCACBCBBBCBCCC.exe" start= auto displayName= "UserDataSvc_ACBCCCABCCBBABBBBACACCAAABABBCBCAACAACBACAAACCBBBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3812
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBCCCABCCBBABBBBACACCAAABABBCBCAACAACBACAAACCBBBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3284
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBCCCABCCBBABBBBACACCAAABABBCBCAACAACBACAAACCBBBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1992

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAACBCABCCCAACBBBBAAAAAACBCCBCCCACCBACCACBCBBBCBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAACBCABCCCAACBBBBAAAAAACBCCBCCCACCBACCACBCBBBCBCCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4728

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2816

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCBBABABBABABCAABACCBCABCCCAABABCCBACCACBCCBCBCCCBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCBBABABBABABCAABACCBCABCCCAABABCCBACCACBCCBCBCCCBBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3168

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAACBCABCCCAACBBBBAAAAAACBCCBCCCACCBACCACBCBBBCBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAACBCABCCCAACBBBBAAAAAACBCCBCCCACCBACCACBCBBBCBCCC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 cc0cf0a8882800ecb0670507d8cd56a495c6dec959c6ae34be1327ecfa8a4024
MD5 11bda5168fa95a45389ec81a707c96bf
SHA1 6ac3ead7e08f7fdfa75a39f901ffb0494aaa32df
SHA512 89bb40e10793c9db1e73a6da5c6b0a1ac62725a0e95a0eadd65f63960aa7b1a9336953998aacb8b4dc6125e599fdbba0922a3c0ad31840b35250c4bc1635fa29
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 21.9MB
SHA256 495bfef05463c5a843c37a5c5c0182b7138b1dbb51fdbf2d46c1ae11585b924c
MD5 f3384de3e9706a49e8d2f455b2f7ac3e
SHA1 f91a430b757d3fa9f4d283be603c91d9f4da8643
SHA512 66d6ba95ee2d98a2f67c66b616c13a02e4daa5dd390a04d300bebdee8f70cfcf5350145918afac216494aa0ae7a52b9a2da351250a6e1990de48038b1afd655e
SSDEEP 98304:wMMMMCVNBw4MLMMMMCVNBw4M7MMMMCVNBw4MLMMMMCVNBw4MHA91pH2WpjHrgBFM:dhXhumHpn6F44IAWvX
TLSH
T169379E90B6E648E5E57B513D49B7C332DA38BDA20632874B537CE6271F23B902CA5713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Diagnosis\Temp\DiagTrackTraceSlot_miniTrace\qap`g`v~dtlq
Size 10B
SHA256 c8ddb4491a91de486d46f5f93e3d8d36cba19ee834f0d9d5204ead8bba45aa01
MD5 b6058437ac16760d16f128ba7ee138b2
SHA1 701d20c4ecb2f4e0eb2046fe4f77b29b8c61f32a
SHA512 afd16ec033cc57eda8bf19970dddafceb5fb2f370e28ef2e2ca89738b38db4ac9fe9a7e97c90dbaab23ce184144c7c60d9cb75a48d382663e56a376ee30ae4c4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 3fa89f56bd4523030061851711ef0d89fe68e8debdc142be28e127dd73bc7ca5
MD5 1de03f8ebded9a088ad15e7e84376517
SHA1 5c4ec21457be892a1c7c0e1801e2c97d2931413f
SHA512 55882c925a8801802ccc567e549fa330bc9e2b1b56c38606307204165dcd8a0a363a73c7f990e3e6760fe9cbb3478b4d36a48e53bd124b43cce550dc2b9f0129
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 6d91485c57a194fcafc088d4048dd012c4005f6bebbecf3afea6b75eb2177508
MD5 edd4637cdc580dca69c8f85eda486a77
SHA1 bca55d81182b4a7f452a5fe3fee79a9f91ce96a7
SHA512 95211076246208917edf013d101e12363e2bf216866775221acf8b6d6e3c5c9792966e91a97cf284e55fe0fb983144059b5cbdd53d3dcd64ee4c9f19ca66883a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OptimizationHints\qap`g`v~dtlq
Size 10B
SHA256 c34fb475cc2e61748a15b7c5c3c27e6f0e14917248b052ba0dba92c21650a608
MD5 d57bd817314289d96786f9bc5f559efb
SHA1 619a55e729d6e2cdaf4846c0c6b6ec9925dc0bad
SHA512 4abcc45087f1b9a9bfe770d47d9330f5f03b98108996d041ad4d20934d2da56e4945e9bbac373d13b7a2a4d39018cb2fd37061ab6fd0bacf6dcf2a1c6afc080b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\qap`g`v~dtlq
Size 10B
SHA256 244df3b938d2952d7299ccbfaf7dc042f2504b5ac3444a5b1eacfc511d254fe1
MD5 b73edcad7db4cc30f238a0f1c0bf07ff
SHA1 4b8f81aad4bfc521d26cfd05a5d604c54851a913
SHA512 fde6f16449bff8c3e6ba7e5f8770064530ddbbd91c5d0208aaff2c55045642621df4cea13f88d810ff299caa8eadbfaeff0317f997306e9f88f6e092a3e5563d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\AC\INetCache\qap`g`v~dtlq
Size 10B
SHA256 6d4131b6f411b09f1f5406ebec82b1adb3f391e2cfc57f67aef0d5201334c4bd
MD5 cc345b0a0a1e792fd9f60b55e573e481
SHA1 4f75c1130cf44ed5b7d55e175f0192a063281dfa
SHA512 6a289b74e9bbe34b17619eeeddf52bc0de0c2e0ed85d8543c0a0104f92310d778d5d1cc6ae80da2320cea850f93271d1758978df54afeb1b50f23068ac56186b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\qap`g`v~dtlq
Size 10B
SHA256 27daddb32bedb2d17e221bc44ace8cce4450d74bc85dc8820cd897558be767e7
MD5 747e7dcf97ebda021b9703caf89004e5
SHA1 b7aefa2303dcd5e4cc4d5af529eba688f5d40a27
SHA512 fdbde8f96fa9d9ff71743ec61ddbe2877d9a558eaff0fbee3889c4eef9f26666aa868cedc6e9c02cc67df50ba9c76d55197d631a0d78567616b23960bb777b7c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2dabaeb8bd72f012e04e76dd943447d95b0728b483d42b617838eac9f842b258
MD5 6fb68f4fe11c04670451b8e2cc402b18
SHA1 76e03ea6752dd5f8c995ac3980fbcb2b921b3338
SHA512 2d239990d2709d47d3ed08f1e3b4ca48b43529845af92b55aa2f9216c98f23827dcf955554fdd4ff783d76d8bb7fea68955a2c600ccee7e511027100a6295450
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 652c170fd6ac693a544b3ac344aeb429cf5e9caed1cd286fd4e6ce050c40faf1
MD5 4db977d34e4b76f6371ec510c2bf5acd
SHA1 5fbb32fbf6e7c53fa4fcc8737ea09991b2e26976
SHA512 6295d365a4c7784102f3b8bb1802464c2b3ae1c70fa65b345d004d14892dc9d88297a45d93d809c4dbe48763bc26f5742afadce5d922d410d1e282400f37b4da
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 46b8978c9257f105b0f3c1f358062713998a03ef9562b0afe356bc0f8090e35a
MD5 5bf8ec98542c36fe66a9f99b396d756e
SHA1 a7cb86e6c76179e174acd70208d7821052d8709e
SHA512 47ddf5df59d07f92045cf0563cdaedb9586f9242006654f3b0a0f8eb4e5446c2100a8ccd8fb7fa180acbf9e74a4caca723aaff7f202adffb6dd75078aa5ad60f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8cdf969fe428e85a513ab2669a3149292d77ce20410fd6d7498bb60e26961350
MD5 62bc50f97cc984a3c1ac06daac85bedd
SHA1 735c07b08f0ba4547a2474a00f4c751ba43435cc
SHA512 a1dac821b8d5396bf08a0ce4a5dd25266de6fd27df6b3b56c27d715a76a339bc7ffc7b729ac833049840ad9ec3351f0d106061e6f22ef232e18445a3315cff76
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 163c3b84ff3d234c9d76f9b7e43e03106ec93fd3bf07b4d16d648641d3b26d26
MD5 60d067b0dd3877c371d699693988e724
SHA1 839fca7ce5fb67cc21b8c2aa23f6bfd41fcaaf8b
SHA512 24e560a35943852f561de1e3aba899a0eae782ef05271efb38775d89bc70f6a9149f5048fecd8f925baf9255aad38e3d1b027bce0c5ed490cdb750d08498592f
MD5 SHA1 SHA512

Submit Download

svchost_CBACAAACBCABCCCAACBBBBAAAAAACBCCBCCCACCBACCACBCBBBCBCCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAACBCABCCCAACBBBBAAAAAACBCCBCCCACCBACCACBCBBBCBCCC.exe
Size 21.4MB
SHA256 1c56a39cb402b7a46d3351be67a6f8ff8c16f108a0fbd8da21a3e4935f3f070e
MD5 04b3c7b3f1427b58a3d3c1ab9685f209
SHA1 753b0dfe6e35c7b29ae75c62d4614dd001637491
SHA512 e8b331dac0c4e2eede468ac3ea92e5c270d9f2a26c7abefc1cced1d4433806844965e868b9f7d432d4d11e92b559d3760448ec32e77e26ef339758b73a328460
SSDEEP 98304:wMMMMCVNBw4MLMMMMCVNBw4M7MMMMCVNBw4MLMMMMCVNBw4MHA91pH2WpjHrgBFL:dhXhumHpn6F44IAWvi
TLSH
T18F379E90B5E648E5E57A913D49B7C332DA38BDE20632874B537CE6271F23B902CA5713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 780B
SHA256 70d81bc75ebc64d8582cde3e9d45aeec17e441189b93e481651dce6e9829dfd9
MD5 c8586c7fd159a8777ce4301497c9be74
SHA1 785e24a57f3871b26e1283e4e5ab47a5136eff64
SHA512 003b9f72e540b439bb381c470a03a28beb34be417b886d93d726a754309adc2d2aaa074c3e1ec86683c1558fa59f874295dfb0614b907152649205f6b79343b8
TLSH
T106014E50F4E9D813E43234CF96258FD68DD4379A6CA46A0DA34A830C6795C338F45CD9
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 47299652159a10837012c8f4d6e2f473a409aa577e1d90eb9eb4a3e2ca7ed1e9
MD5 573c7eb6671f0f41c03ee6b6bfd7726d
SHA1 3301932fab962a33918160a6a96d816e57ec3e36
SHA512 8bbb7e0dc9352d37cbfcf7c6a69642088fbf238340643ea8d6d6af171cae646b77a82f6d44499eb059f13706377378abc4af0a5833a5d675b5ace7e55a2e412b
TLSH
T167210B50F4E9C813E43234CF9625DFD68DE8379A5CA46E1DA24A831C6795C338F49CDA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2668-229-0x0000000000E20000-0x0000000000E41000-memory.dmp

Download

memory/2668-3160-0x0000000000E20000-0x0000000000E41000-memory.dmp

Download

memory/2920-6-0x0000000000D00000-0x0000000000D21000-memory.dmp

Download

memory/3168-86-0x0000000000100000-0x0000000000121000-memory.dmp

Download

memory/4312-57-0x0000000005730000-0x0000000005731000-memory.dmp

Download

memory/4980-35-0x0000000000E20000-0x0000000000E41000-memory.dmp

Download

memory/4980-25-0x0000000000E20000-0x0000000000E41000-memory.dmp

Download