8fd19dc311b08d56af9bce898d0bc1d65eea904a582af8ac713a6b0622f7a5a1

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_a55cb085d8d7ea9c13e215fb4525d820_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 15.4MB
Sample260811-2ck84sek2x
SHA256 8fd19dc311b08d56af9bce898d0bc1d65eea904a582af8ac713a6b0622f7a5a1
MD5 a55cb085d8d7ea9c13e215fb4525d820
SHA1 93541ef73f91c01ed72ff52662362f52909efcc0
SHA512 a416695432829ff7f4ff891934fd3ce75c1d1fd6b321b39a03ff78c773ed3692258491a9aabfb8a1b0bd4b04cd70e7665b539e1ed4693c0571b7fdd45df1beac
SSDEEP 196608:J7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouW:JahvQHrc8u3xXJ/f4uUWHf
TLSH
T111F69E13B35681E6C06AE2B88A474212D7BA7C440330B7DB16E5B7692F77BE45B3B350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Detects executables packed with Dotfuscator 2 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c681-18.dat	INDICATOR_EXE_Packed_Dotfuscator
behavioral2/files/0x00080000000182ad-385.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 2 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c681-18.dat	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/files/0x00080000000182ad-385.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 2 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c681-18.dat	INDICATOR_EXE_Packed_Yano
behavioral2/files/0x00080000000182ad-385.dat	INDICATOR_EXE_Packed_Yano

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCAABBBACCCBBACACCAAAAAABBCAAAACBBBBCCBAABAAAABAAACCABA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCAABBBACCCBBACACCAAAAAABBCAAAACBBBBCCBAABAAAABAAACCABA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCAABBBACCCBBACACCAAAAAABBCAAAACBBBBCCBAABAAAABAAACCABA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCAABBBACCCBBACACCAAAAAABBCAAAACBBBBCCBAABAAAABAAACCABA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2364	svchost_BCAABBBACCCBBACACCAAAAAABBCAAAACBBBBCCBAABAAAABAAACCABA.exe
4228	svchost_CCBABCACBCBCCBCABAACCCABABACBBBABABCBABBAABCBABBCBACAAB.exe
4248	svchost_BCAABBBACCCBBACACCAAAAAABBCAAAACBBBBCCBAABAAAABAAACCABA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABACCCBCBABAACCACCBCCAABABBACBCBBBCABABBBBCBCCCAACCBBCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAABBBACCCBBACACCAAAAAABBCAAAACBBBBCCBAABAAAABAAACCABA.exe"	2026-08-11_a55cb085d8d7ea9c13e215fb4525d820_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAAABCACCAACCCBCACBBCBBBABCBAACCAACABCCABBAABACBBBCCCBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBABCACBCBCCBCABAACCCABABACBBBABABCBABBAABCBABBCBACAAB.exe"	svchost_BCAABBBACCCBBACACCAAAAAABBCAAAACBBBBCCBAABAAAABAAACCABA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1096	sc.exe
1284	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4604	cmd.exe
5696	cmd.exe
4864	cmd.exe
904	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_a55cb085d8d7ea9c13e215fb4525d820_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCAABBBACCCBBACACCAAAAAABBCAAAACBBBBCCBAABAAAABAAACCABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBABCACBCBCCBCABAACCCABABACBBBABABCBABBAABCBABBCBACAAB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4820	schtasks.exe
3968	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2992	2026-08-11_a55cb085d8d7ea9c13e215fb4525d820_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
2992	2026-08-11_a55cb085d8d7ea9c13e215fb4525d820_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
2992	2026-08-11_a55cb085d8d7ea9c13e215fb4525d820_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
2992	2026-08-11_a55cb085d8d7ea9c13e215fb4525d820_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
2364	svchost_BCAABBBACCCBBACACCAAAAAABBCAAAACBBBBCCBAABAAAABAAACCABA.exe
2364	svchost_BCAABBBACCCBBACACCAAAAAABBCAAAACBBBBCCBAABAAAABAAACCABA.exe
2364	svchost_BCAABBBACCCBBACACCAAAAAABBCAAAACBBBBCCBAABAAAABAAACCABA.exe
2364	svchost_BCAABBBACCCBBACACCAAAAAABBCAAAACBBBBCCBAABAAAABAAACCABA.exe
4248	svchost_BCAABBBACCCBBACACCAAAAAABBCAAAACBBBBCCBAABAAAABAAACCABA.exe
4248	svchost_BCAABBBACCCBBACACCAAAAAABBCAAAACBBBBCCBAABAAAABAAACCABA.exe
4228	svchost_CCBABCACBCBCCBCABAACCCABABACBBBABABCBABBAABCBABBCBACAAB.exe
4228	svchost_CCBABCACBCBCCBCABAACCCABABACBBBABABCBABBAABCBABBCBACAAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2992	2026-08-11_a55cb085d8d7ea9c13e215fb4525d820_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	2364	svchost_BCAABBBACCCBBACACCAAAAAABBCAAAACBBBBCCBAABAAAABAAACCABA.exe
Token: SeDebugPrivilege	4248	svchost_BCAABBBACCCBBACACCAAAAAABBCAAAACBBBBCCBAABAAAABAAACCABA.exe
Token: SeDebugPrivilege	4228	svchost_CCBABCACBCBCCBCABAACCCABABACBBBABABCBABBAABCBABBCBACAAB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 5696	2992	2026-08-11_a55cb085d8d7ea9c13e215fb4525d820_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	91
PID 5696 wrote to memory of 4820	5696	cmd.exe	93
PID 2364 wrote to memory of 3672	2364	svchost_BCAABBBACCCBBACACCAAAAAABBCAAAACBBBBCCBAABAAAABAAACCABA.exe	94
PID 2992 wrote to memory of 4864	2992	2026-08-11_a55cb085d8d7ea9c13e215fb4525d820_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	97
PID 4864 wrote to memory of 1096	4864	cmd.exe	99
PID 2992 wrote to memory of 904	2992	2026-08-11_a55cb085d8d7ea9c13e215fb4525d820_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	100
PID 904 wrote to memory of 1284	904	cmd.exe	102
PID 2364 wrote to memory of 4604	2364	svchost_BCAABBBACCCBBACACCAAAAAABBCAAAACBBBBCCBAABAAAABAAACCABA.exe	106
PID 4604 wrote to memory of 3968	4604	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-11_a55cb085d8d7ea9c13e215fb4525d820_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_a55cb085d8d7ea9c13e215fb4525d820_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABCBABAACCABBCBCCBABCCCBCBABBAABBCAACBCBCCCBCBCCABAABAABBBCBBCACCCBACBCBBABBBACBCCBBACBACACCACBCBCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBBACCCBBACACCAAAAAABBCAAAACBBBBCCBAABAAAABAAACCABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5696
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABCBABAACCABBCBCCBABCCCBCBABBAABBCAACBCBCCCBCBCCABAABAABBBCBBCACCCBACBCBBABBBACBCCBBACBACACCACBCBCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBBACCCBBACACCAAAAAABBCAAAACBBBBCCBAABAAAABAAACCABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABBABAACACCACABBACBAABAACCBCCBBCCCABCBCBCABBACBCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBBACCCBBACACCAAAAAABBCAAAACBBBBCCBAABAAAABAAACCABA.exe" start= auto displayName= "UserDataSvc_CABBABAACACCACABBACBAABAACCBCCBBCCCABCBCBCABBACBCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABBABAACACCACABBACBAABAACCBCCBBCCCABCBCBCABBACBCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBBACCCBBACACCAAAAAABBCAAAACBBBBCCBAABAAAABAAACCABA.exe" start= auto displayName= "UserDataSvc_CABBABAACACCACABBACBAABAACCBCCBBCCCABCBCBCABBACBCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABBABAACACCACABBACBAABAACCBCCBBCCCABCBCBCABBACBCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABBABAACACCACABBACBAABAACCBCCBBCCCABCBCBCABBACBCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1284

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBBACCCBBACACCAAAAAABBCAAAACBBBBCCBAABAAAABAAACCABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBBACCCBBACACCAAAAAABBCAAAACBBBBCCBAABAAAABAAACCABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCCACBCCCAACACBBABACBACCBBCACBABBBBAABCBABBAAACACCCAABCACBBACCACCAABCBBAAABABAACCBBCBCCAACBBAAACACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCACBCBCCBCABAACCCABABACBBBABABCBABBAABCBABBCBACAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCCACBCCCAACACBBABACBACCBBCACBABBBBAABCBABBAAACACCCAABCACBBACCACCAABCBBAAABABAACCBBCBCCAACBBAAACACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCACBCBCCBCABAACCCABABACBBBABABCBABBAABCBABBCBACAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3968

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCACBCBCCBCABAACCCABABACBBBABABCBABBAABCBABBCBACAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCACBCBCCBCABAACCCABABACBBBABABCBABBAABCBABBCBACAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4228

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBBACCCBBACACCAAAAAABBCAAAACBBBBCCBAABAAAABAAACCABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBBACCCBBACACCAAAAAABBCAAAACBBBBCCBAABAAAABAAACCABA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 3cbe5e3b6ebdf2ce0bebb8ce675e86d752ad8035704e7ecc61402345dc1e4ddf
MD5 c063b7061fb461d69194c2b7127766b8
SHA1 f7ec41110659b41ebdf4cfcb34e11980e06ec64a
SHA512 40faa7f9ea88c463ffd94439319f73c85c36b81b78986100d7f3a41ec4d35f06cc19387a373d02e6be0cdd07e6e35cbbb3112b46473a39fe1edd570bead72c4f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 1a24b97f7ce61969f2482f3e22a250993c3af7dc3c92aa37a13e11b637a5feb8
MD5 a653fe3f999ee56f4832e2017326786e
SHA1 de32815c644d4dd81a68e44e637df47fd2789bca
SHA512 944a55f7f978f14c7e02433951bd795e3793373ee1402e3460eb918301ec3b1224e0924ad71feefcb5cc7ea931d034a2bea79960f36e40bbf56ed5a2c8a074b5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 0752e7845274ea2c677aedfad1d0db2a745436aa541ffe59e09d09876f6d29fe
MD5 7211fbde0783b176e6bd11982c52642a
SHA1 e1291d269dced9c8be1a286d52aceda3bbb16571
SHA512 453818e0e401f8b50350bf1b6bba1bfde886d0b3f3ed33d8ba3151ade87be42db9c0bc1e1066633619bc4734e9749137a5ff11e8b4811f865470d31ca65e72f2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DataCollection\qap`g`v~dtlq
Size 10B
SHA256 4f383e6eb5e7a07b9eabc493ca8b2368ea7c7931e4e7ef370ea78d3b0aa14926
MD5 f5e4c5193ff9eeafa05c719225b193d1
SHA1 ae9d6f980c5172b3d7aeda97ac7e9db1db6d7881
SHA512 8d9036b2f0f317b2b20877e938d4c9dc0587250a8a13c9e897c55c818fbdb1363036cdb7078c7caa626cf859a127c24f18934b92902d0f17fb2a7c95ddfb7296
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsAppRuntime.CBS_5001.184.1607.0_x64__8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 12053cae4262f36de5ba60359db2441f029b9a26002bd17bb8d97670439f3cd0
MD5 054fbb2e2043c8195e40a25b6a213cdb
SHA1 e44332b1395e6cf55f1f54a4e5157fd2584da8f6
SHA512 c8e3eab4536cffc9ad905ef959487cdd19815cd0e3ce374671e6286baac46615e7baa93c0d5ab44085fa99836516aa52eac546296f881f73eacf6ec4c4109315
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 16.0MB
SHA256 69f061da26966f096e50ed7dd999275bb1c3bec5df7d5a3975eba8950d9ffa78
MD5 267c2fe083dad3c3c7a9f4f617f76cba
SHA1 bd4c0cec28e4d992bfd3a44759728c6cf1052a66
SHA512 d3fc435206eff1578130b9ef2eed0075b58d6618ba57afb21eb0769e1c3a00f763c8ef47a90600f5850bc9319ad5d089acc78d992a2b129801d1fd38e3c97451
SSDEEP 196608:J7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouZgZ2jn:JahvQHrc8u3xXJ/f4uUWHL27
TLSH
T17907AE13B35681E6C06AD2B88A474322D7BABC440330A7DB16D5B7692F77BE45B3B350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 83e30e7a69f98151c83130d4b6bd80acf28e7602f14441dd228e6c1fb9435ed7
MD5 3292363d8e63ee0435bbc4b4628fed42
SHA1 c0be9f5937dd52dbc5c38fcacf5bbd692a549cd4
SHA512 5a35b9f4ce42813f0ca5bda919bdc7afa64bf25adf7d174358b21e05d86f73ea3dd19e92a798083ed8ce49fe240977c3dcc0b751276a3838a26385e1bedd36f8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 b2e72e832977b142f12595ac6f0936559d62cafe0d7e757ab8a3cd7a3d3206df
MD5 56dc398dfc694a4d84cfdd11dbfd31a9
SHA1 0bdd2f6f682a327f17571138532793be3ec3170d
SHA512 93a66190ea7a2ce8d79a6c0661eb50290f1b465fa5f3653d2975a7158fc4c9cc12a5b61c90a055fe554e95e506bcf85653783a7a803c35edc49edaed994fa0e4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 ea51a7e3041b3acc050920c266a22a994e1be4ae16264b85c557f534fe8cd24d
MD5 3254cbcaef888ba393b0c4ff975fb3a2
SHA1 874b557c630d4c7162d1533ce13752dc8fc15358
SHA512 1e43d692f6e1b1cf05c09e9d02275d7dcf41455d8ccdff90ae1aa53efd0d9de7ed2f2f56c6b47d411f02b183fcdd3804247e317a5f726c60749ef4923611a801
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\qap`g`v~dtlq
Size 10B
SHA256 1f793e2fba3132ff2bf078c82e891472cddf199b7a9baf0fb2f65269c3df6f7d
MD5 8b058bb5106aea78bb983036e8a330e3
SHA1 593a396f7b9d1c4190b597ef7557a3d756aa1822
SHA512 f3ec1ed9f989a9b46aeaad3f958baacdba185da5b6c8c603a86069549efbb31ea0c1668ac9e05fd200dcd04427cb64362f8d7e977e4cd86a95158bf765d52a03
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\D3DSCache\qap`g`v~dtlq
Size 10B
SHA256 d1665f04f0597661c48e5cb447c2035e43fc2fcd2ce3aa5e4c860118bb5fa35a
MD5 8899a573f46f4b7f5698858df6807960
SHA1 5019657b89fee54181b271515572a13722e315fd
SHA512 51356dd842505e3fefcba6e1182a13c8cfedc122bf595922a34dc68855e3682253ee6f8736ab30b543a17f3239b611e35ed35828f4b8c232f4b14befbaf1b9ce
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ko\qap`g`v~dtlq
Size 10B
SHA256 569dc749451904e5ea6939deb9e1cad619f748a7e255050e3db5a8294ac758b1
MD5 6702802b136a46072b225926a42b4d97
SHA1 5df5a308695981f2b3ca1b895a855bebc5283740
SHA512 60d0e2d7f36007dccbe26f592a0f37e3b2319497ea7697e31f778760d6f3f38e248a6969b89477ad7077ccead54b57f7821942a6b3f9e8e88fee842b09ebeeb3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\AppData\qap`g`v~dtlq
Size 10B
SHA256 f7d1b7244a32f1d201406098ca6f54ddc90e82ea4af2599d2f36caae5d7a1c78
MD5 ae33cf3d59122db918de106ad5e4e995
SHA1 67e16b52f9ad630811781ea66370512c05e4b92a
SHA512 1bf125d80ae227b8c63afe24e796b58b2c081a1a6fe7bd9e1dfa3d768f76d5f2360e8223efa2ae54adf632343dfee18ee8749b518f759848909550ecd4f469be
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Credentials\qap`g`v~dtlq
Size 10B
SHA256 79a71e4a4d93657c7e1bea5a1de8269e37b7422b10edd762c6e0bfaba4e7d573
MD5 1ae8ceb16786f3fe81159cfd041ab18b
SHA1 7bafeddd37c23245d28645cd9803f03e8653ac23
SHA512 fdfe4d660d444f312fbad4a3eee73df2bea55aa8777f46375d6fde07e85a67d084c8d5a83791485dafe2de4ddd2f8d1a89837046746c77811298d9a06dbc8ec7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7f160e411221dd3df69615bd3c481dbce287df120f6c4598231bdcd50b5377c2
MD5 755d3786143a43490f38aaf46ce035d7
SHA1 5974122b36d12bc1cb74859b8a4b6ffb2b547e91
SHA512 89e600b037d5c533195e9dbd37d87d0fa5e1dfd3ad6e9b3a5cf4b6ce8909d4321f74ca0cd73d7f7c8a55cb632f2867ab7b1bceb694a444744059b37cd764d6a7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bbd6b0f31047faa421e53ee1763ef7ae3ba1960eb63005ef127b2046d092fd06
MD5 feac0b4d3ce1ac90ac014dbc1d1fb721
SHA1 45d566aff5565b8921edaf059fcccc07bf6cbd32
SHA512 eadcb4f26d2bf3bb257a8a71a9a35b35945bff2ee4505b708bbbe03320c70ec3edfedb33681a36ec195de21dd9e59893b9a8cf4c7f31eb73cc285c77d4623e24
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b65e9801c9a9ab6f8d3369923e9e25bd71da07a193d852b2fc0c27077484c3c3
MD5 c49cc966322b1787023e7ec5bda089e9
SHA1 b3cfdc259d493c44954aae4ab3d56e361813639a
SHA512 9fd1d8bbefcbd4095f8063e3ff8b056c29ff8c3ecff980cc9996a0a0ec17f2644ce358b6782e31864dfad78c8438d2a7083f746e3a8e722cce1827b6bb2b156d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c8a6f9c563293c79d411431d6a4d5fb775c1b6314b72ff3c193ebd3d34d44d04
MD5 a40af2d320ecb688bf2c838eeb737c5f
SHA1 a74c7d5c62d58052c5341048a44e1c3b7c43abe8
SHA512 25d2657449032232f04948ff110c7ffc8b052d93c4819ea8f4aadaa37ae2f9151876c574a9db54ed07dce6b04cb720bc5fd006a0838fa0161eb9e3446b258d14
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e3191b0ff26d97b57d2266384785c1e4a3e0a03e4079860a4728126552287188
MD5 b14a7f8d95f8a4c2c082eee8fac9076f
SHA1 bcf2ef621d51f33721775717d8f3c103978439ba
SHA512 2d065d78c5635e4e785cb0d17924dba9b1b8ebd9d8a650bede52edb941cea46ac2db9b115e7028997023063cde3a195aa378d7969d1215cf927c27fb0cfab73d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0ea00c1a5aeeba47c7e8838e907ba8230e684859da466cc204e32b9184b043a6
MD5 32a97f951a901c28d5f4a335e05ad651
SHA1 e492f6603d4dcebf4f673555c9007e58936bb311
SHA512 15bc9c31adaa2793c102de3d9f4f22644c9de99642960a8dcdc69a083cd8009ddb32f13de6eb1393fe5ba1f4de5b346a21adcdc20ed58b439765ba17f73eadfd
MD5 SHA1 SHA512

Submit Download

svchost_BCAABBBACCCBBACACCAAAAAABBCAAAACBBBBCCBAABAAAABAAACCABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBBACCCBBACACCAAAAAABBCAAAACBBBBCCBAABAAAABAAACCABA.exe
Size 15.4MB
SHA256 8fd19dc311b08d56af9bce898d0bc1d65eea904a582af8ac713a6b0622f7a5a1
MD5 a55cb085d8d7ea9c13e215fb4525d820
SHA1 93541ef73f91c01ed72ff52662362f52909efcc0
SHA512 a416695432829ff7f4ff891934fd3ce75c1d1fd6b321b39a03ff78c773ed3692258491a9aabfb8a1b0bd4b04cd70e7665b539e1ed4693c0571b7fdd45df1beac
SSDEEP 196608:J7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouW:JahvQHrc8u3xXJ/f4uUWHf
TLSH
T111F69E13B35681E6C06AE2B88A474212D7BA7C440330B7DB16E5B7692F77BE45B3B350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 586109c86851b6f58f3f37f4245b27d58d442748a842bbe442b6afe870a10869
MD5 b33ca6f11dd2152f973bf6345760ab88
SHA1 a8c9d3b6312788182e4d111cef1fde1c1a2faa3c
SHA512 f67adec17c9d759ea32246236e5a89d93d5708f11dd9e9d804e92cae9c3be35f5c9c5ad8790620092ffefef854d322acb3acb1b6b8e41fefef150e809f7370a2
TLSH
T1E721D77294F9CC57F93228C79139DAC34CA436CB987C6B98630A5118B7D9C21DE198E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 30d6ddf215e73a32005285196beeaddab903c530c76552a7aa06e6199dd10469
MD5 f503bebacd69f3b48be73b4514ff3ae9
SHA1 eca26cf14548c8b8249c01feee8e27ec8cab2fe9
SHA512 5b57ce0d0451aea291c885afb3a57bcabdc0c6a2f13f20329b22a5fa1564511e95a067807f235ef1fd4e377e80fb6368bdac21400e9d5aa39c0918ba1e311a3a
TLSH
T18821F832D4F9CC97F9322CC7A539DAC34CA436CB98BC6B44631A9118B7D9C318D098E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 94afbbba45270f7f92ca2abf0a8a644db5af2f805253771a14349d3acbcecad0
MD5 3c8e4c2ee950601fe856947df37ddaee
SHA1 f7118c69eceb16d563100015c0d36da01b079142
SHA512 24fa77fda617c655e57386f5a592e605e74fec4f2a11a16e097b0c3a0c773b27b5acee3906636d4226bf7bcfced6d50f6ee8bb05c52c153516e7a6886ce83b6a
TLSH
T1B111C47294F9DC57F9322CC7A139DAC34CA436CB58BC6B586319511CB7C9C21DD198E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2364-33-0x00000000001C0000-0x00000000001E1000-memory.dmp

Download

memory/2992-6-0x0000000000AF0000-0x0000000000B11000-memory.dmp

Download

memory/4228-63-0x00000000008C0000-0x00000000008E1000-memory.dmp

Download

memory/4228-4092-0x00000000008C0000-0x00000000008E1000-memory.dmp

Download

memory/4248-1936-0x00000000001C0000-0x00000000001E1000-memory.dmp

Download

memory/4248-4094-0x00000000001C0000-0x00000000001E1000-memory.dmp

Download