6d668e1b21c4db1ae7c442b2f5ef95f5456f496f7e99d9c56d3d2892baa90e15

Analysis

max time kernel
149s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 01:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_d82c6ded1639afa525049fbfbfa7ed13_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Size 16.7MB
Sample260810-b94hvade29
SHA256 6d668e1b21c4db1ae7c442b2f5ef95f5456f496f7e99d9c56d3d2892baa90e15
MD5 d82c6ded1639afa525049fbfbfa7ed13
SHA1 c5b8cb0f71f72c65380e4e5465048a568ceb888d
SHA512 0c8d144b523f9ae5ea133a6c79a8e747e7daafb5a9888891afd640dc1a4830e85c55ad45e0c2612db357e94801ba2b58f8b78d8800dcf9654d66f8e71b624979
SSDEEP 196608:9qx7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouB:YxahvQHrc8u3xXJ/f4uUWHo
TLSH
T1A607AE17B34681E6C02AE2B88A474337D7B97C440330A7DB6695B76A2F37BE4573A350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Detects executables packed with Dotfuscator 2 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c4a1-18.dat	INDICATOR_EXE_Packed_Dotfuscator
behavioral2/files/0x00080000000182c5-394.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 2 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c4a1-18.dat	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/files/0x00080000000182c5-394.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 2 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c4a1-18.dat	INDICATOR_EXE_Packed_Yano
behavioral2/files/0x00080000000182c5-394.dat	INDICATOR_EXE_Packed_Yano

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCBBBAAABACBACBBCCCCCCABCACAABCCACBBCCCACBCCBACBCCBACAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCBBBAAABACBACBBCCCCCCABCACAABCCACBBCCCACBCCBACBCCBACAA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2424	svchost_BCBBBAAABACBACBBCCCCCCABCACAABCCACBBCCCACBCCBACBCCBACAA.exe
5924	svchost_CABCCBBACCBABACBCBCCBAACAAAACAABABCCBCCBCAAACACBABACACC.exe
2284	svchost_BCBBBAAABACBACBBCCCCCCABCACAABCCACBBCCCACBCCBACBCCBACAA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBBCCBCBCCCBBCACBCABABCACAACACCCBBCCACCBBCAABBBCBBBABBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABCCBBACCBABACBCBCCBAACAAAACAABABCCBCCBCAAACACBABACACC.exe"	svchost_BCBBBAAABACBACBBCCCCCCABCACAABCCACBBCCCACBCCBACBCCBACAA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACBAACCBCCBCAACACCBACACACACBAACCBABABBABABBAAABCCBCBAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBBBAAABACBACBBCCCCCCABCACAABCCACBBCCCACBCCBACBCCBACAA.exe"	2026-08-10_d82c6ded1639afa525049fbfbfa7ed13_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2664	sc.exe
624	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5332	cmd.exe
6060	cmd.exe
4780	cmd.exe
1416	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBBBAAABACBACBBCCCCCCABCACAABCCACBBCCCACBCCBACBCCBACAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_d82c6ded1639afa525049fbfbfa7ed13_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABCCBBACCBABACBCBCCBAACAAAACAABABCCBCCBCAAACACBABACACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3520	schtasks.exe
6136	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4584	2026-08-10_d82c6ded1639afa525049fbfbfa7ed13_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
4584	2026-08-10_d82c6ded1639afa525049fbfbfa7ed13_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
4584	2026-08-10_d82c6ded1639afa525049fbfbfa7ed13_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
4584	2026-08-10_d82c6ded1639afa525049fbfbfa7ed13_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
2424	svchost_BCBBBAAABACBACBBCCCCCCABCACAABCCACBBCCCACBCCBACBCCBACAA.exe
2424	svchost_BCBBBAAABACBACBBCCCCCCABCACAABCCACBBCCCACBCCBACBCCBACAA.exe
2424	svchost_BCBBBAAABACBACBBCCCCCCABCACAABCCACBBCCCACBCCBACBCCBACAA.exe
2424	svchost_BCBBBAAABACBACBBCCCCCCABCACAABCCACBBCCCACBCCBACBCCBACAA.exe
5924	svchost_CABCCBBACCBABACBCBCCBAACAAAACAABABCCBCCBCAAACACBABACACC.exe
5924	svchost_CABCCBBACCBABACBCBCCBAACAAAACAABABCCBCCBCAAACACBABACACC.exe
2284	svchost_BCBBBAAABACBACBBCCCCCCABCACAABCCACBBCCCACBCCBACBCCBACAA.exe
2284	svchost_BCBBBAAABACBACBBCCCCCCABCACAABCCACBBCCCACBCCBACBCCBACAA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4584	2026-08-10_d82c6ded1639afa525049fbfbfa7ed13_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Token: SeDebugPrivilege	2424	svchost_BCBBBAAABACBACBBCCCCCCABCACAABCCACBBCCCACBCCBACBCCBACAA.exe
Token: SeDebugPrivilege	5924	svchost_CABCCBBACCBABACBCBCCBAACAAAACAABABCCBCCBCAAACACBABACACC.exe
Token: SeDebugPrivilege	2284	svchost_BCBBBAAABACBACBBCCCCCCABCACAABCCACBBCCCACBCCBACBCCBACAA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 5332	4584	2026-08-10_d82c6ded1639afa525049fbfbfa7ed13_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe	92
PID 5332 wrote to memory of 6136	5332	cmd.exe	94
PID 2424 wrote to memory of 2776	2424	svchost_BCBBBAAABACBACBBCCCCCCABCACAABCCACBBCCCACBCCBACBCCBACAA.exe	95
PID 4584 wrote to memory of 6060	4584	2026-08-10_d82c6ded1639afa525049fbfbfa7ed13_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe	98
PID 6060 wrote to memory of 624	6060	cmd.exe	100
PID 4584 wrote to memory of 4780	4584	2026-08-10_d82c6ded1639afa525049fbfbfa7ed13_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe	101
PID 4780 wrote to memory of 2664	4780	cmd.exe	103
PID 2424 wrote to memory of 1416	2424	svchost_BCBBBAAABACBACBBCCCCCCABCACAABCCACBBCCCACBCCBACBCCBACAA.exe	106
PID 1416 wrote to memory of 3520	1416	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-10_d82c6ded1639afa525049fbfbfa7ed13_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_d82c6ded1639afa525049fbfbfa7ed13_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACCABABCCBBCBCACBBAACCBACCAAABBBCACBABCBAABAABABBCBCCBBAAAABBBCAAACACABBBBCACAACCACABBABAABABACABABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBAAABACBACBBCCCCCCABCACAABCCACBBCCCACBCCBACBCCBACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5332
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACCABABCCBBCBCACBBAACCBACCAAABBBCACBABCBAABAABABBCBCCBBAAAABBBCAAACACABBBBCACAACCACABBABAABABACABABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBAAABACBACBBCCCCCCABCACAABCCACBBCCCACBCCBACBCCBACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBCAAACCCCBCCBAACCBBCABCBCBCBABACBBAAACACCAAAAACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBAAABACBACBBCCCCCCABCACAABCCACBBCCCACBCCBACBCCBACAA.exe" start= auto displayName= "UserDataSvc_BCBCAAACCCCBCCBAACCBBCABCBCBCBABACBBAAACACCAAAAACBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6060
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBCAAACCCCBCCBAACCBBCABCBCBCBABACBBAAACACCAAAAACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBAAABACBACBBCCCCCCABCACAABCCACBBCCCACBCCBACBCCBACAA.exe" start= auto displayName= "UserDataSvc_BCBCAAACCCCBCCBAACCBBCABCBCBCBABACBBAAACACCAAAAACBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBCAAACCCCBCCBAACCBBCABCBCBCBABACBBAAACACCAAAAACBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBCAAACCCCBCCBAACCBBCABCBCBCBABACBBAAACACCAAAAACBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2664

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBAAABACBACBBCCCCCCABCACAABCCACBBCCCACBCCBACBCCBACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBAAABACBACBBCCCCCCABCACAABCCACBBCCCACBCCBACBCCBACAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABACABCBCCBABAAABCBBACBABACCCAABBBACACBABBAAACCACACACACACAACCBBCBCCACACBACBAACBACBCABCCCCAACABCCCBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCBBACCBABACBCBCCBAACAAAACAABABCCBCCBCAAACACBABACACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1416
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABACABCBCCBABAAABCBBACBABACCCAABBBACACBABBAAACCACACACACACAACCBBCBCCACACBACBAACBACBCABCCCCAACABCCCBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCBBACCBABACBCBCCBAACAAAACAABABCCBCCBCAAACACBABACACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3520

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCBBACCBABACBCBCCBAACAAAACAABABCCBCCBCAAACACBABACACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCBBACCBABACBCBCCBAACAAAACAABABCCBCCBCAAACACBABACACC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5924

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBAAABACBACBBCCCCCCABCACAABCCACBBCCCACBCCBACBCCBACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBAAABACBACBBCCCCCCABCACAABCCACBBCCCACBCCBACBCCBACAA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 d6db051b945b16a5494f945b946355c154b8d417f6fbac0b1cf9b1443fad69ed
MD5 5caf2eee60aa4b81eaaea03688576b83
SHA1 994409746cba55996f6fd3444efcc472036a9b5e
SHA512 db1a078ec650160d1af2bb497791ae8efc5ff441963050519bf872029cf54fb0191f64992d90a0c1d68f1b269ea2fd782ab013fcc2898c4fac5687ef5cdf874b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\qap`g`v~dtlq
Size 10B
SHA256 87e7fb82690e677ceaed8a1d54dd4258637dd1184f8183df7a0da9a578bcba4a
MD5 65772a807d55b5cb131eeb191d430ed6
SHA1 442e1202c3834673ce489d40960f1537cd620c9c
SHA512 f7945db3649457dfffe5e2cf4bdfb6205a40027502c97c139b0464dac5f9658e096f0e9a30049b3e67478be4051564dccf826bdc8f10c1745aa77701922999af
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 8294d0a8e088d6587bb45a74351cfd816808aadd010f99d13025127b5892da3d
MD5 0030ec88532f98739ed47441d9659d72
SHA1 fc0975b26e17bb7eb78c931024992be089a3c933
SHA512 9b64c9f1a543055ec80e02c07b6dd082c213527c17c2f0f23ae7a57b103afa6a7aca6766d5a95ac85566dafd2d1ee834be950df916bc69be1f37efce63b853fd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 f1606b07caf9ac8720081763ec6a8f5ae7bce0ebdb0657ce64f05cbad3462bd9
MD5 fae98e7ea087715d75f2be02277bb7d5
SHA1 82c31442ec280ab3c4269f719d707ac5a2ada324
SHA512 badff14883ad051469e7c94d73e2d7345307ecd181363e06c7f20decfa7f161ea38c5b6197613d1b7d26c72691c21c5b625f5b249781d78977fd06148aa4886e
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 17.3MB
SHA256 40d4c0b131685786a64fa4f578683a96d9cd1de6ca27e93a3ee7ff29f36a2d69
MD5 c321a301775a3839425f5bf5634545d1
SHA1 13875f92f83a79bff34ac804c0e59604a4867839
SHA512 635c394cbdffd97a3af3675aeb63ab43e7f29ab5bbf47f5b5729a5395e62ee9062bf062dac7911163616a40081a63e80479c165fb47c7739cdbbc728da6393c2
SSDEEP 196608:9qx7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouggZ2jp:YxahvQHrc8u3xXJ/f4uUWHm29
TLSH
T1E907AE13B24681E6C02AE2B88A478337D7B97C440330A7DB56D5B76A2F37BE4573A351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 50a4d5632822de33f1aaf91383810b921915ee7a66a11f953861fa75945c475c
MD5 5f9c7a627cfd1e76675319c1fcd733f4
SHA1 e527774eb1b1bb9631e4c780398699ebb28116a8
SHA512 3604168226f91909dff7fc377eb3d3a0a8c1cb95a58b4d1d3b7794c14b528890c4f7713a3d1be5bfd986b8af9aee07c5e8020c1c42e26a17a3a865e79bc69696
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 f1af9e476a8fc26002a62bef7b45b8ced102ec31f6fd54791d98f4e3cab11a71
MD5 c9981a547ff8a33c19f97fd052c79ae4
SHA1 e67e5b89b7263b079cb80396f57fa8504175630c
SHA512 b574d0a52fea145253f0544d5de71f2200661264b5dcc3d902e048925aab5a911177b524b0db484b8b450b2f989b70c09beda0e84645e3e5f6223f456f4de31c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\qap`g`v~dtlq
Size 10B
SHA256 fa98281abedeafe8e0b62feafa17c49117093b5d21b73e42d52f5b6261b87b0d
MD5 7d85243a9c3638d0735a23ab1dcd32c7
SHA1 8ce3ded269ab2336b4b936a453b795b3b5d81c4f
SHA512 d72d3f4545e32dc8c396dc4a3b73b576454450fa32968f89d383a71d902430c2b5b9aae1d142278e57545ff4e7148da80011a4e1ad9893d8d22a5d63cbce3386
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\as\qap`g`v~dtlq
Size 10B
SHA256 1cd8fa171ae6f9405f691d20de3509d7775ee6be0d023f40ab6954c9de34e936
MD5 543739245a81e454813bad24b788e694
SHA1 c87a5a46346ecf29a5d3baccf98b9fd3e2a0aa73
SHA512 37cdf272de761b108a420b975bf815aed25de8d83e8e78e86ffff85e1a8489825811f2e281bcbf566b38b8eb517a277efda1f5dd45bc98bfdb9a15e37871aeaa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 6825bfebb57177f2f4bf6ddb20f6a7c7bed7e7c1c0d2a0805506183646a2f92c
MD5 f50fd448d3a412fe9670c2a8fda86cd6
SHA1 ff8d2cc2b666663181235d6e18c1fb455a956261
SHA512 6d913e868fcc3f007f688c590e61ad5471e0a31ddf0735764f54b5bacfd17fe02d6f75c2f2341135599b2c6310240d554ecd11b9b2cadc7aaafe1225fdc6ec99
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 d9baa654737530fb8658ef3a448dc636c410472d26f154c3c90409c28d551645
MD5 33225a0990bb97906343eb670fe1b9ed
SHA1 cd711a7f33a16e6bce6e991164c72ac6dd980481
SHA512 93897b791d8efcb08e863565888c841c138d4ad3a64ae6ac86d8b6c4009247cc10c431927909b4186242d48a9c68150d049ea09f3f923b7c4add1b257ee9ea20
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\qap`g`v~dtlq
Size 10B
SHA256 c3524ce71442c2a020d770feb70a16728639759ffac35e0057bb4bda274311b2
MD5 ab6e03b0e5c6a9adf60246eb5dc6f538
SHA1 5b04996dea03034e61b7f239972f37e54719ff0e
SHA512 fedec726d4c278f359badb59185c7d262121d3f4eb6305cb8141ea9c454a282581c4fd44df533936600d7c1457b3df873c7ea0d73fc58e583d02cbf823efdc39
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 518d6074660da0f0cea1b1c8655eeb46c8d4a09cb19febbe1ae2e302d4a63e23
MD5 4e733199792169f5307c8462b9e58646
SHA1 2cd613114573a2edcce30d76ba19582d23b9440a
SHA512 543fa875eb5174c59c95fcd2622d93302a53938da012ab5761897a28742a7223ef6e8e76940f50cd775c0eb2dfd3539310e090aef9cdd93a92476a67a928ea82
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7b03bf4a13d2f78e8ddcc2d48ba4360d8f2df1e4b33a30049bda49834e8aac86
MD5 0e18aafe578f0a36d9fd4392cf7400fb
SHA1 a6d7eb1bdef7a2199d21902c71305b3ee213b280
SHA512 638528bf4c7dbbb22f3061cf18f9550026f0510cf0d0543c8b0ea4b85c30e1f74b3deb214521e8688b09394dc3064d7ab45a07b26c239dfbd0ef099aacc72e40
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 00cb8004464418832ebac811506cec620e6f1f0a9c213a4fcf8ca8971579524a
MD5 eb98e67cdcc5f8c69f4a702a6d17e6f4
SHA1 899ead226654fa75ec10cd68f7429b287edc641e
SHA512 9932206721c87a5bde87cf962766af7dd34329dd4fa581bf5be394c40b83e75d2cf63982287aa313adbf6a656a1afe6854c0f8c054015a7a446fb0b3c3a57756
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b1fad671614533597891bf6af4124464720092c11224379ef566d955f7b60050
MD5 67f395a6da379a53e0fbbb01cc2253eb
SHA1 0da2d26afc48ca41d49b6bd926f0678872bc4287
SHA512 829a4a3f2da22738f091377af078ebf50a93963f755faeb7fc87be90b4251b03394a763fb04fdd72bc2e20349f7abb4b10ccdf53358e7c143637eae4ea44608d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b52961379e2c9ce984f5d60b957383de7a32bbb64de9632d5a32ff3c0e6674e5
MD5 90b1afd1a645232e6d60ed36c1278b27
SHA1 2242a5d6e5b66d43da208b193a7feb2b2a0e4dc7
SHA512 f120f2d86522422efa8b4627687fba4457c007a1bca399c57baa373075e0981e330310dc44d6311efa7d4696ca45a4dc0966d6c5b58a9a2dd8fe35717576f435
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1ae94848fdcb39d69715c987d3c5fc8ce6a6b5ab61f0e4710cb1c7e806338383
MD5 95a00321608e9566b503472efdbfbdef
SHA1 2a38a1aeb6d5b19a6181df81caca57bfefe094f2
SHA512 267e43153b5447752cf40e179be16f1b2df7ade0040a1d57f714ea63ccdb4f9ba251f4acdce971144b6d207ac12e582c842d2424a2bb2fa51f5ec75ef06864a5
MD5 SHA1 SHA512

Submit Download

svchost_BCBBBAAABACBACBBCCCCCCABCACAABCCACBBCCCACBCCBACBCCBACAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBAAABACBACBBCCCCCCABCACAABCCACBBCCCACBCCBACBCCBACAA.exe
Size 16.7MB
SHA256 6d668e1b21c4db1ae7c442b2f5ef95f5456f496f7e99d9c56d3d2892baa90e15
MD5 d82c6ded1639afa525049fbfbfa7ed13
SHA1 c5b8cb0f71f72c65380e4e5465048a568ceb888d
SHA512 0c8d144b523f9ae5ea133a6c79a8e747e7daafb5a9888891afd640dc1a4830e85c55ad45e0c2612db357e94801ba2b58f8b78d8800dcf9654d66f8e71b624979
SSDEEP 196608:9qx7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouB:YxahvQHrc8u3xXJ/f4uUWHo
TLSH
T1A607AE17B34681E6C02AE2B88A474337D7B97C440330A7DB6695B76A2F37BE4573A350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 78f62b5bdf502e8a6206ba534bd5f346a21619816aafebf994a3d07d1c102b16
MD5 633ce476c86d5532b8110bf05e75142b
SHA1 da2cc40d5543e952a788b51d114be84787a5f6b3
SHA512 b9e6a4b4fdc4c442653fcf35abcf0be52fbadb7ca36fc09c4f6ddd6b8c796a17e5eba00b0eb549a6ec886ba420abe2ea19ee49fb8efe2f159a0050ac33ff146a
TLSH
T14B212771F4E8ECA3E92328CFD619AB624CA033AFFC5C5A14138D82197B54C32CD454D1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 f14a5806644102e4ffbfbc1d86a07352f392a281d03c5de63fe743fa01dd8d7e
MD5 50afe720c81b68153db4c7b868d2e720
SHA1 42f7726920a7a885a2d3bdead8194b65b4456c4c
SHA512 37c58b7fcc9deac6007903470d7e820ccaacaf9d3a7d3b962b402a97f4cc2e2549d9e4fba11977418963dfd07590d5329360c75a217a595417645b578afc0685
TLSH
T112110471B4E9AC53FC2328DF961AAB528CA033AFBC586A08138D811D7B54C32CE514D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 9173d56138ede73a632f2c7c78acba9281534647e9dd187301de7b1470105099
MD5 5f6bf1cc75bbb82422f6295b2a37ec95
SHA1 9b55d0a745380636f9d2bff98f0935133a8b6691
SHA512 5f6c1e7fb93560e04c8de86fb454a5b9a847e984f64811161dc9ccfe849f31ce7b00b06d46b79a41e19e3c95648654c449056910d52341811073edcf78c50ea0
TLSH
T1A321F671B4E9EC63EC2328DF961AAB628CA037AFBC5C6A14138D811D7B55C32CE554D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2284-542-0x0000000000210000-0x0000000000231000-memory.dmp

Download

memory/2424-33-0x0000000000210000-0x0000000000231000-memory.dmp

Download

memory/4584-6-0x0000000000630000-0x0000000000651000-memory.dmp

Download

memory/5924-80-0x0000000000D00000-0x0000000000D21000-memory.dmp

Download