5f0e96bd37d27a52218cd4418183553ceb12085b9c6c229391716ee156d62f6d

Analysis

max time kernel
151s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 17:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_d64a949905dfd3c97cd9ab4afd5ddc32_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Size 28.3MB
Sample260808-vqyyss1ekf
SHA256 5f0e96bd37d27a52218cd4418183553ceb12085b9c6c229391716ee156d62f6d
MD5 d64a949905dfd3c97cd9ab4afd5ddc32
SHA1 951d2e4582a6fd042946a86b6de980ea2f9618cc
SHA512 46d98da1227b8acbdfd46040cb9a666fe56730c9a8c2803b491dae1878a72fc6407f762121e88b767b731517a0e4abb78152222679d3560b9de51727cb04cd1e
SSDEEP 196608:dG7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTou75g:dGahvQHrc8u3xXJ/f4uUWHK5g
TLSH
T1E6579E12B25584E5C02AD3B889578222D679BC500731A7FF96A4B7296F37BF05B3E370
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4b6-25.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4b6-25.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4b6-25.dat	INDICATOR_EXE_Packed_Yano

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4b6-25.dat	UPX

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBACACBBACCACBBBABBAAAACBBCACBABBABBAAABABABCBBCBCCCCAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBACACBBACCACBBBABBAAAACBBCACBABBABBAAABABABCBBCBCCCCAB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBACACBBACCACBBBABBAAAACBBCACBABBABBAAABABABCBBCBCCCCAB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBACACBBACCACBBBABBAAAACBBCACBABBABBAAABABABCBBCBCCCCAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5812	svchost_BBACACBBACCACBBBABBAAAACBBCACBABBABBAAABABABCBBCBCCCCAB.exe
4784	svchost_BBBBBCABABCBAABBCBBCACBACBACBBBCBAACCBBACBCBCCCCBACABBB.exe
4116	svchost_BBACACBBACCACBBBABBAAAACBBCACBABBABBAAABABABCBBCBCCCCAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCCABBACAABABCBBCBABAABCCCCCAACAACCABAACAACBAAAACBABCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBACACBBACCACBBBABBAAAACBBCACBABBABBAAABABABCBBCBCCCCAB.exe"	2026-08-08_d64a949905dfd3c97cd9ab4afd5ddc32_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCCAAABCAACABABBAACBBCABCCAACBCABAABCBCAABBCBAACBBBABAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBBBCABABCBAABBCBBCACBACBACBBBCBAACCBBACBCBCCCCBACABBB.exe"	svchost_BBACACBBACCACBBBABBAAAACBBCACBABBABBAAABABABCBBCBCCCCAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2832	sc.exe
4348	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3576	cmd.exe
4620	cmd.exe
1292	cmd.exe
3180	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_d64a949905dfd3c97cd9ab4afd5ddc32_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBBBCABABCBAABBCBBCACBACBACBBBCBAACCBBACBCBCCCCBACABBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBACACBBACCACBBBABBAAAACBBCACBABBABBAAABABABCBBCBCCCCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1716	schtasks.exe
3160	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4696	2026-08-08_d64a949905dfd3c97cd9ab4afd5ddc32_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
4696	2026-08-08_d64a949905dfd3c97cd9ab4afd5ddc32_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
4696	2026-08-08_d64a949905dfd3c97cd9ab4afd5ddc32_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
4696	2026-08-08_d64a949905dfd3c97cd9ab4afd5ddc32_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
5812	svchost_BBACACBBACCACBBBABBAAAACBBCACBABBABBAAABABABCBBCBCCCCAB.exe
5812	svchost_BBACACBBACCACBBBABBAAAACBBCACBABBABBAAABABABCBBCBCCCCAB.exe
5812	svchost_BBACACBBACCACBBBABBAAAACBBCACBABBABBAAABABABCBBCBCCCCAB.exe
5812	svchost_BBACACBBACCACBBBABBAAAACBBCACBABBABBAAABABABCBBCBCCCCAB.exe
4784	svchost_BBBBBCABABCBAABBCBBCACBACBACBBBCBAACCBBACBCBCCCCBACABBB.exe
4784	svchost_BBBBBCABABCBAABBCBBCACBACBACBBBCBAACCBBACBCBCCCCBACABBB.exe
4116	svchost_BBACACBBACCACBBBABBAAAACBBCACBABBABBAAABABABCBBCBCCCCAB.exe
4116	svchost_BBACACBBACCACBBBABBAAAACBBCACBABBABBAAABABABCBBCBCCCCAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4696	2026-08-08_d64a949905dfd3c97cd9ab4afd5ddc32_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Token: SeDebugPrivilege	5812	svchost_BBACACBBACCACBBBABBAAAACBBCACBABBABBAAABABABCBBCBCCCCAB.exe
Token: SeDebugPrivilege	4784	svchost_BBBBBCABABCBAABBCBBCACBACBACBBBCBAACCBBACBCBCCCCBACABBB.exe
Token: SeDebugPrivilege	4116	svchost_BBACACBBACCACBBBABBAAAACBBCACBABBABBAAABABABCBBCBCCCCAB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 3576	4696	2026-08-08_d64a949905dfd3c97cd9ab4afd5ddc32_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe	95
PID 3576 wrote to memory of 1716	3576	cmd.exe	97
PID 5812 wrote to memory of 2156	5812	svchost_BBACACBBACCACBBBABBAAAACBBCACBABBABBAAABABABCBBCBCCCCAB.exe	99
PID 4696 wrote to memory of 4620	4696	2026-08-08_d64a949905dfd3c97cd9ab4afd5ddc32_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe	103
PID 4620 wrote to memory of 2832	4620	cmd.exe	105
PID 4696 wrote to memory of 1292	4696	2026-08-08_d64a949905dfd3c97cd9ab4afd5ddc32_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe	106
PID 1292 wrote to memory of 4348	1292	cmd.exe	108
PID 5812 wrote to memory of 3180	5812	svchost_BBACACBBACCACBBBABBAAAACBBCACBABBABBAAABABABCBBCBCCCCAB.exe	112
PID 3180 wrote to memory of 3160	3180	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-08-08_d64a949905dfd3c97cd9ab4afd5ddc32_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_d64a949905dfd3c97cd9ab4afd5ddc32_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACBCCCABCCCCBACBBCBCABCABCCCABACAACACBBBBCABBBAAABACBBBCBCBBBCABBBABBCCBCBCBCAABABCCBCBCCCAABBBACBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACACBBACCACBBBABBAAAACBBCACBABBABBAAABABABCBBCBCCCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3576
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACBCCCABCCCCBACBBCBCABCABCCCABACAACACBBBBCABBBAAABACBBBCBCBBBCABBBABBCCBCBCBCAABABCCBCBCCCAABBBACBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACACBBACCACBBBABBAAAACBBCACBABBABBAAABABABCBBCBCCCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABACCCBBABCBCACACACBBCBCBBBCACABCCABCABCAACCCBABAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACACBBACCACBBBABBAAAACBBCACBABBABBAAABABABCBBCBCCCCAB.exe" start= auto displayName= "UserDataSvc_ABACCCBBABCBCACACACBBCBCBBBCACABCCABCABCAACCCBABAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABACCCBBABCBCACACACBBCBCBBBCACABCCABCABCAACCCBABAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACACBBACCACBBBABBAAAACBBCACBABBABBAAABABABCBBCBCCCCAB.exe" start= auto displayName= "UserDataSvc_ABACCCBBABCBCACACACBBCBCBBBCACABCCABCABCAACCCBABAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABACCCBBABCBCACACACBBCBCBBBCACABCCABCABCAACCCBABAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABACCCBBABCBCACACACBBCBCBBBCACABCCABCABCAACCCBABAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4348

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACACBBACCACBBBABBAAAACBBCACBABBABBAAABABABCBBCBCCCCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACACBBACCACBBBABBAAAACBBCACBABBABBAAABABABCBBCBCCCCAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5812
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACACABCAAABACBBAACACBBCAAAAAABCCCCABABBABBBAABACACCAACCCCAAAABCBABCACABBAAACBBCBBCCCABCCABCBCACAAABBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBCABABCBAABBCBBCACBACBACBBBCBAACCBBACBCBCCCCBACABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACACABCAAABACBBAACACBBCAAAAAABCCCCABABBABBBAABACACCAACCCCAAAABCBABCACABBAAACBBCBBCCCABCCABCBCACAAABBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBCABABCBAABBCBBCACBACBACBBBCBAACCBBACBCBCCCCBACABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3160

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBCABABCBAABBCBBCACBACBACBBBCBAACCBBACBCBCCCCBACABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBCABABCBAABBCBBCACBACBACBBBCBAACCBBACBCBCCCCBACABBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4784

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACACBBACCACBBBABBAAAACBBCACBABBABBAAABABABCBBCBCCCCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACACBBACCACBBBABBAAAACBBCACBABBABBAAABABABCBBCBCCCCAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 5d356e7a49abb02e02deb07f94c9fafa5c731208b3ac9f7e2304210fea5f9051
MD5 a39ff10ba0b29c1008b045e7218a09b1
SHA1 f7b70d8a29522055b770c3232ceb171e3d06e82a
SHA512 f823a1631042800e4f30228a28f49f16f02a91bab36758e7502ab9d527309198dddb6d8be349dfc6372052a3107505e68f9405fad2da7dfcd189b1cdf5acf776
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 d75a1a5bc3ef462c78d48f127829c84a7daa359591a46570f0c6de36e826f08f
MD5 7108b8d309825380cbd9c47c9ebe6373
SHA1 6a7e7b52c05f4ca104f114e79810811bc3b4eba1
SHA512 f6885b6d3633f183c483c1db2778cff9cec642ed2c150b504ee465ff1fe2d670ed11297f5b319e849b86ec0ee46fe50cd7f3e870ef098d9ca2dae67adf4da20f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 f3303a64904f660e12c4e423b33016f1f6c2991f4d58a2985f0c5e7a7316dff7
MD5 c7f2f91223f6a141aeed664d7ab8b265
SHA1 95c24bff222d244dae68782a235de625d533d547
SHA512 f029e98e867fdc27cc7831af3a82b6ca2885b21f91b9db3ef6a6942360abdd749c658c29b45b7d2a6f4380f2f0665770307172d82d4fdf85073f3bbf0403fe13
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 160c53316bd5d56a2b69db106df4bf7098068fd254db5a8b03fc9e0faca74afc
MD5 01206f03345e9ca780a996394f930814
SHA1 d63ab00b21368851a220a4d821945169438d3080
SHA512 8cb92a63fd527eaec7cc92db47e2c6e0fcea00ae2ad4306fe20b06cb69c1a81802d5572df0d357b98ebfa477e0e1edd05d0d2b57e0bfcb161f340d317af821ef
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 5ad97161e4e2719ae38ef6d1815eb69c6849494d5179b908f132b1d88e5b65d6
MD5 4d80e88c5b01636b8f222712115595c3
SHA1 e9fd39a20889fed874d4a036c95e0c0fdb6893e2
SHA512 15caa4c02e87807611da629ced5e008ae763c0573842753f61fd83ca32cb81c200dcef76a28bff32e66c2b6aca159bfca4ce061b781ce53d75ec911c8c7f6926
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 afa979982c8f79ee515bce6ef0eb59cb7f9eb9a869705b0d7d509be4f4b45a7f
MD5 addef24d84b4af6b608d1e33ef34fca2
SHA1 6f813b75d230e85af5a6a44cf26a81025bb2870e
SHA512 a96248c3b25dc2073c5f3072ded30b47c13d4e78d326908ba4a925b14ece9352ec85c0715064f766f9b8d6c4094f9eda287c61200fb68f47d5a53023dff2eab1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 9545c16fcbe9d19914da95ec8379af8672d9e9848b1fb5eb1bfaddea39a0771a
MD5 d991d145db5142ffb3ba246e03a92b51
SHA1 75c35e026eff48b253e57db692e8df3f5e479228
SHA512 fdc0f363b4585e9d7b43e677830e805ed0d65785cb548425bfd7c45a2c1b854b25e129cea3e597d152d0e70a2d910ecfc8526f38736cf020b1fbbe8ec2c4c3f1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 b3fc24ff1877d7341570042adfd6c3831d30cbbf4c00937e7bb5ed5e41e5b6af
MD5 9743e4a39d833d2d75bc7f12bfe22a48
SHA1 22447e78d1184b05a5d320cccc05d8899e91c038
SHA512 8ca8b1576768fefed477a119f16fe995398f32e0fb60cfa8c8f696346496be40a92bbb5521d4044e38f0924842a4abf864c241b965cdaf0454b878297f6a4505
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 13917abd2e763a564411a353b8dead87c72842b35c59523ae5724a162c88b83a
MD5 2caafc941593d1793b4132e7ed2e0cd0
SHA1 7d3df75d82d3d6257d25b393ce74b7991e0ba48c
SHA512 caa75451232ed8d1e9b1dc3554f1c1cc8901cf88ecaca9ecae87626f48b3bb2215ca14a111c74a434c5638280680776b35e0957a150aeedeb87e2bb4307ca310
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Recovery\qap`g`v~dtlq
Size 10B
SHA256 a118751df4ac74c5176fff5093d46caab31ace9dcf4dbf0d588e2aa8b5e88ee9
MD5 e980990dbe883574952aa2ea52afae8a
SHA1 db589a24920ec93c7fdc632697b0a464fd87426c
SHA512 5d46e312ecbb533072bfdc00109689d132d408834440b70459816fc8ba4fec2bd67c6111ac757ac11bd3bbf9e94982121dc534b6f0beb7b195c7e36adf3b9433
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 048d78f2527f31573fc0c39023f26a78208aa5ca6df6259146feb7a63924982d
MD5 76529360e95772e121045bcb9354cdba
SHA1 2897c89a1741796f99a69931cd2a9ea5e118d504
SHA512 39b912af76afbf875eb6297e6c8000966d9f658f6e8624284b912acf6714f2c3676ead18310d68da5424bce6f8ffa3f79c57f51dedb4bb63b8fb0c46ee56082d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 78f49e26998c180bd28367a785a286dd92b4032fe85e867e6b3f1e9aed286752
MD5 bc24b471a49d4da5e642648da99ccda7
SHA1 651a12f14d5b8b38e9b03222b58a185c1afe5960
SHA512 b89a758c7a61023f69d2d0a34d2ee0c0b1374e0781437603a5f5afe42881222a52ea45b898e527f70d81f85ae0f08421f13f0c7430c335773a8f4a59c5d89d40
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\qap`g`v~dtlq
Size 10B
SHA256 643b7a24acdc80b37aaff2e689865baeb47b089a386eae66ef30d3f6264b89ff
MD5 b921fa98b1542aebd9eafc471d518040
SHA1 5e74caf7db6a34e86c32a5dc4cb8e413fa19988e
SHA512 6189e5a722aa4035403a06e28124c639e2f081cdbf4994b6943e9a8ec55857d03055da48afd3dd8e409634dd9063da8bd3f9e14b249b4e175dc553ff8b9ce30a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 39d246b949eea0e2a6037aeeb3bc2a44074a521992f28dc5984eb98d87fa4b32
MD5 42fd603dff7f6c7eb52b30ae725a2093
SHA1 7f4a6ad84df39f0774c84704db52afb5e2edc263
SHA512 791705e97031cc14503473da209291d6f5cb8454521548649cdea1558ead9fdda441a41ad69813a953c6207483ba22725b20e94bec2a6bd7cac08266c9390bbf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 14cf69b9e4baa04290637ca6f8feedbe6a9f5398b9130224ec08784f3df5c3fb
MD5 fc63c49567fc3ef6eae4b11b3194fb34
SHA1 d43503833e0166ba8b6597cd168d672e17cf76cc
SHA512 c9453cb79a78b88e8ee95e6d8385c9f4b08023e6a7f838ff101b2e347ea4f187a07d63dccef6e68544baee131229f27f457d9b04b701b06f95811bbb1584f87b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fec95223076f2600dcf75b4a5bf9958287642fa812499f647c92b0e65af577d6
MD5 02f75b506862f01003e609222273a665
SHA1 dfbcb27ac4b2f0660c1916c8669812397c8bf33e
SHA512 e4761dc3f82a03800d08cf57c83056141612e0cc155dd011393a871bf2f828b0b64809e9af0478cbafe320d2b83eb1faaed385d4e2eaaf9799d737b5acd70c8c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4ee6b37119001823ed7be5aa49049f0304e1deed82f4c317ba3623c931e3e393
MD5 2ba7f79b2cfa2974dacf49392ae20ac5
SHA1 6dbd044f20196551c020f71d99ffda37c03b904d
SHA512 d265f4a480a93998fd133a3cd3a3b98db8c75afa4592a49bab00092e9179ed9c9a9a7a705ce8d9ef1dd36d7ae7e484688cc7366f4bff39f84c5ee44ab6820ad3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6ad0f664ad5d75132a24945eb33e0e9625f122732af143f6bb02ccb0a0656958
MD5 19fd652cacbdc8772736e78c07cc491f
SHA1 40da825063e18cc06a5be49445774729a69dad51
SHA512 894901b64e74deda37c2c3baa08b520a489ee8f9216aca59643fa856110daa1dfc8b5674405068537fe759926c9685e9648c34828bf30992f184a2386d62de8d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 98936e7640d0424329052617e137c9837a0107fc33030a406d6d8db66d879d1a
MD5 58dfc18c28bede6f8ff270ba5341b11a
SHA1 809e2060a46205a83168b870512ff37e2e9813f1
SHA512 67a1588b55ccf634af5061af6f7f99ad88e9d6b52d48337b261eb8e3ce51167b008245504907f2ac7761d296aa9794d13e0344a4733fc139437770e792c6869d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Documents\OneNote Notebooks\qap`g`v~dtlq
Size 10B
SHA256 f0555ceaf566e23dbfe5dbcf7d38d1f83d0c643bfdd8285c00e29606fc928655
MD5 92bca811e66db78ced58ce0070b60a6d
SHA1 ea7da965d8ec8be4acc70f5d89ca3b9c4c8a5f1d
SHA512 40b0f7e318167f6ecb9fcdc1ab27b2ba9fa920870dabac4f43bbca62582f2942945648b3ceb4b1e3f6f1aea2181df43221e91e67a7850f91a8d986dd4f50e0af
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 47649040b3e32ee104d1028092ae60ce70f8ecb8c1fbcfd44da91ada65ec1480
MD5 3e60e8f8f235bf2b3501ebe8e78ead1a
SHA1 d6192f0162b5cf0d9f7b8524bed107514d5b068a
SHA512 f6bd9290af4971f43751ebf6b1d0c5ba7a0df5d44a78fc384c5c83db65c03f16d2527630501d350e328b138d4a7dae0b878925513e7020de33014cc179c13c6e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3141fc3e48fba1c3057b4568efbb34c3433bfa008607087da12ea179f35c3b87
MD5 4929d17a3aeb3427c66b518aa50b0016
SHA1 1d6c4e0b3a1699f7e4100d76558fe539bb27af95
SHA512 7cb9d2e05f4e04f400c35c17d754f71df2dbec41bfe3c66ebd0b2913bc3e9ca3ffdf9e9b94d83386eeb66f9f3547b9c6c48ea0adf8db8e0720584f3a6317d3ea
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 fa55cb07fad7de12ca3b06594b04f71bc24131be9064c04f5419078a6f8bbf28
MD5 3aa2c5367952b430173878d0a3193deb
SHA1 af2b2742d306c358bb3ac81dc5b20ae8385334da
SHA512 c7c2065eaddf7874b5d627847c16a02ab59665da168108aadbf08c8d66c6ec2d962de460d945c4a755291d3f44710fa7c304768dfa0b4a3cf19f4b75df43b5de
MD5 SHA1 SHA512

Submit Download

svchost_BBACACBBACCACBBBABBAAAACBBCACBABBABBAAABABABCBBCBCCCCAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACACBBACCACBBBABBAAAACBBCACBABBABBAAABABABCBBCBCCCCAB.exe
Size 28.3MB
SHA256 5f0e96bd37d27a52218cd4418183553ceb12085b9c6c229391716ee156d62f6d
MD5 d64a949905dfd3c97cd9ab4afd5ddc32
SHA1 951d2e4582a6fd042946a86b6de980ea2f9618cc
SHA512 46d98da1227b8acbdfd46040cb9a666fe56730c9a8c2803b491dae1878a72fc6407f762121e88b767b731517a0e4abb78152222679d3560b9de51727cb04cd1e
SSDEEP 196608:dG7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTou75g:dGahvQHrc8u3xXJ/f4uUWHK5g
TLSH
T1E6579E12B25584E5C02AD3B889578222D679BC500731A7FF96A4B7296F37BF05B3E370
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 88f15c011f934db55c073ab12f61dec93694ac2811605ff425042e229e85a1c1
MD5 9a4489c09b1e4fcb4c7b0a6240281108
SHA1 aa0627bc38a6af7f7882c7ae6eb5c3ff51b9cd27
SHA512 f453b624968276d024f543528ac0de8ebe6c54e7416d470f55f56bd7ab7fadd9ced39be7db00859aa99f27d92d8115f0114a1d26c498cd9cce98248d656d499a
TLSH
T12021C641B4AAC8D3AC3268CB9E31C9D31CE836CB945C6A66920D5518ABD9C319F198F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 028fb7183833069155211e47b53e7501be3a7a1b09845fe5fe5ceea4a38c5428
MD5 052457dd1684ede7d1106aadebb18d83
SHA1 5d4d2e00019e36523759c3b1418a6b8a6c2fb2b2
SHA512 d508ba17a64b6db8ef6ee718fd50cf7a990028e4d9af1a0fcfdb21ef51b726c2ed647306a367a06d549246bc5809779aee78cf801415f4157a9cbf1324d1892f
TLSH
T13921E751F4AACCD3ED3368CB9E35D9D31CA836CB989C5A26930D4518A7D9C31DE098E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 776B
SHA256 3698c0cc191c083fc52ffe087857fe1ebaedc56c0b7c984b66670f8a44f77c53
MD5 77e25c705de9908865f7d12197e1a788
SHA1 994e58c7526851993921fd999db6aab5a477b615
SHA512 43114a1e66f16792e2eadb8b85a19af44896b8740cc88aa2b90eb85b418db7b6708bfb872254cd1a8e78d699b3b0df30ac697afaa66161252d8ce4bdded7bc41
TLSH
T13B01F941B4AAD8D7EC32688B5E318DD31CE836CF549C6A27930D521CA7D5C319F198F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4116-3770-0x0000000000170000-0x0000000000191000-memory.dmp

Download

memory/4116-1262-0x0000000000170000-0x0000000000191000-memory.dmp

Download

memory/4696-68-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/4696-10-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/4696-46-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/4696-103-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/4696-21-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/4784-104-0x0000000000F60000-0x0000000000F81000-memory.dmp

Download

memory/5812-69-0x0000000000170000-0x0000000000191000-memory.dmp

Download

memory/5812-47-0x0000000000170000-0x0000000000191000-memory.dmp

Download

memory/5812-43-0x0000000000170000-0x0000000000191000-memory.dmp

Download