419c5f8ebd003b70cf89b4996a6318e2dfe904646f2e7404c68df56e25098464

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 03:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_34b57de4d583a219698fc3eeeabdadaa_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Size 22.7MB
Sample260811-d2ewmavdmd
SHA256 419c5f8ebd003b70cf89b4996a6318e2dfe904646f2e7404c68df56e25098464
MD5 34b57de4d583a219698fc3eeeabdadaa
SHA1 4a11806b9d23879692377fb6c9bd38aca91502b5
SHA512 48791354bd349c9e789ec42b7407ac7cd92739c055c2300fc0374389451cb8c290fa231c53f7a54db9e98295ae00e21f7f5baf05d1757f04ba76fd82155bff37
SSDEEP 196608:kFlP7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouQmHpn6F44IAWv3:iZahvQHrc8u3xXJ/f4uUWH3mHN6+Jrv3
TLSH
T11E378E12729751E9D06ED1B88A578332D7757C420331A3CF12A8F65A2F73BA45F3A362
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Detects executables packed with Dotfuscator 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c506-18.dat	INDICATOR_EXE_Packed_Dotfuscator
behavioral2/files/0x00080000000182ad-392.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c506-18.dat	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/files/0x00080000000182ad-392.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c506-18.dat	INDICATOR_EXE_Packed_Yano
behavioral2/files/0x00080000000182ad-392.dat	INDICATOR_EXE_Packed_Yano

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c506-18.dat	UPX
behavioral2/files/0x00080000000182ad-392.dat	UPX

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CABACCCBCCBABCABCBCBCAAACAACBBACBBCBABACACACAAAACCCBBAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CABACCCBCCBABCABCBCBCAAACAACBBACBBCBABACACACAAAACCCBBAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CABACCCBCCBABCABCBCBCAAACAACBBACBBCBABACACACAAAACCCBBAA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CABACCCBCCBABCABCBCBCAAACAACBBACBBCBABACACACAAAACCCBBAA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3508	svchost_CABACCCBCCBABCABCBCBCAAACAACBBACBBCBABACACACAAAACCCBBAA.exe
2776	svchost_CACBACBCBACCBBBCABBBAAAAACACCAAAACBCAABCCACBCBBBBBCBBAC.exe
2120	svchost_CABACCCBCCBABCABCBCBCAAACAACBBACBBCBABACACACAAAACCCBBAA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACBCCAAAABABAABBBBCCCCACABBCACBACBCABAAACABCBCCBCBACCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABACCCBCCBABCABCBCBCAAACAACBBACBBCBABACACACAAAACCCBBAA.exe"	2026-08-11_34b57de4d583a219698fc3eeeabdadaa_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACAAACCCAAACBBBBCBCCCAACACCABACCBCCACABABCABBBACAACBABBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBACBCBACCBBBCABBBAAAAACACCAAAACBCAABCCACBCBBBBBCBBAC.exe"	svchost_CABACCCBCCBABCABCBCBCAAACAACBBACBBCBABACACACAAAACCCBBAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5892	sc.exe
2740	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5324	cmd.exe
3092	cmd.exe
2764	cmd.exe
5328	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACBACBCBACCBBBCABBBAAAAACACCAAAACBCAABCCACBCBBBBBCBBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_34b57de4d583a219698fc3eeeabdadaa_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABACCCBCCBABCABCBCBCAAACAACBBACBBCBABACACACAAAACCCBBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2172	schtasks.exe
1220	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5188	2026-08-11_34b57de4d583a219698fc3eeeabdadaa_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
5188	2026-08-11_34b57de4d583a219698fc3eeeabdadaa_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
5188	2026-08-11_34b57de4d583a219698fc3eeeabdadaa_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
5188	2026-08-11_34b57de4d583a219698fc3eeeabdadaa_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
3508	svchost_CABACCCBCCBABCABCBCBCAAACAACBBACBBCBABACACACAAAACCCBBAA.exe
3508	svchost_CABACCCBCCBABCABCBCBCAAACAACBBACBBCBABACACACAAAACCCBBAA.exe
3508	svchost_CABACCCBCCBABCABCBCBCAAACAACBBACBBCBABACACACAAAACCCBBAA.exe
3508	svchost_CABACCCBCCBABCABCBCBCAAACAACBBACBBCBABACACACAAAACCCBBAA.exe
2776	svchost_CACBACBCBACCBBBCABBBAAAAACACCAAAACBCAABCCACBCBBBBBCBBAC.exe
2776	svchost_CACBACBCBACCBBBCABBBAAAAACACCAAAACBCAABCCACBCBBBBBCBBAC.exe
2120	svchost_CABACCCBCCBABCABCBCBCAAACAACBBACBBCBABACACACAAAACCCBBAA.exe
2120	svchost_CABACCCBCCBABCABCBCBCAAACAACBBACBBCBABACACACAAAACCCBBAA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5188	2026-08-11_34b57de4d583a219698fc3eeeabdadaa_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Token: SeDebugPrivilege	3508	svchost_CABACCCBCCBABCABCBCBCAAACAACBBACBBCBABACACACAAAACCCBBAA.exe
Token: SeDebugPrivilege	2776	svchost_CACBACBCBACCBBBCABBBAAAAACACCAAAACBCAABCCACBCBBBBBCBBAC.exe
Token: SeDebugPrivilege	2120	svchost_CABACCCBCCBABCABCBCBCAAACAACBBACBBCBABACACACAAAACCCBBAA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5188 wrote to memory of 5324	5188	2026-08-11_34b57de4d583a219698fc3eeeabdadaa_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe	92
PID 5324 wrote to memory of 2172	5324	cmd.exe	94
PID 3508 wrote to memory of 5860	3508	svchost_CABACCCBCCBABCABCBCBCAAACAACBBACBBCBABACACACAAAACCCBBAA.exe	95
PID 5188 wrote to memory of 3092	5188	2026-08-11_34b57de4d583a219698fc3eeeabdadaa_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe	98
PID 3092 wrote to memory of 5892	3092	cmd.exe	100
PID 5188 wrote to memory of 2764	5188	2026-08-11_34b57de4d583a219698fc3eeeabdadaa_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe	101
PID 2764 wrote to memory of 2740	2764	cmd.exe	103
PID 3508 wrote to memory of 5328	3508	svchost_CABACCCBCCBABCABCBCBCAAACAACBBACBBCBABACACACAAAACCCBBAA.exe	106
PID 5328 wrote to memory of 1220	5328	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-11_34b57de4d583a219698fc3eeeabdadaa_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_34b57de4d583a219698fc3eeeabdadaa_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABBCBAAABACACCCAACCACCAAACCBBACCBBCABABABBBAAAAABCABACBACBCABABBCBBCBACBCAACBBAABACBBCAAAACBACCBCABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCCBCCBABCABCBCBCAAACAACBBACBBCBABACACACAAAACCCBBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5324
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABBCBAAABACACCCAACCACCAAACCBBACCBBCABABABBBAAAAABCABACBACBCABABBCBBCBACBCAACBBAABACBBCAAAACBACCBCABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCCBCCBABCABCBCBCAAACAACBBACBBCBABACACACAAAACCCBBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCCCBBCCCACCCABABACBBBCAAAACCCABBCBABBAACABBCABACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCCBCCBABCABCBCBCAAACAACBBACBBCBABACACACAAAACCCBBAA.exe" start= auto displayName= "UserDataSvc_BCCCCBBCCCACCCABABACBBBCAAAACCCABBCBABBAACABBCABACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCCCBBCCCACCCABABACBBBCAAAACCCABBCBABBAACABBCABACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCCBCCBABCABCBCBCAAACAACBBACBBCBABACACACAAAACCCBBAA.exe" start= auto displayName= "UserDataSvc_BCCCCBBCCCACCCABABACBBBCAAAACCCABBCBABBAACABBCABACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCCCBBCCCACCCABABACBBBCAAAACCCABBCBABBAACABBCABACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCCCBBCCCACCCABABACBBBCAAAACCCABBCBABBAACABBCABACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2740

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCCBCCBABCABCBCBCAAACAACBBACBBCBABACACACAAAACCCBBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCCBCCBABCABCBCBCAAACAACBBACBBCBABACACACAAAACCCBBAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBABACCBCCCCAAABCBCCACCABABBACCBCACBACBAACCAABCAABBBAACBACCBBCCBABCAABACBABCCAAACACBCACCACACBCBBAACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBACBCBACCBBBCABBBAAAAACACCAAAACBCAABCCACBCBBBBBCBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5328
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBABACCBCCCCAAABCBCCACCABABBACCBCACBACBAACCAABCAABBBAACBACCBBCCBABCAABACBABCCAAACACBCACCACACBCBBAACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBACBCBACCBBBCABBBAAAAACACCAAAACBCAABCCACBCBBBBBCBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1220

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBACBCBACCBBBCABBBAAAAACACCAAAACBCAABCCACBCBBBBBCBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBACBCBACCBBBCABBBAAAAACACCAAAACBCAABCCACBCBBBBBCBBAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2776

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCCBCCBABCABCBCBCAAACAACBBACBBCBABACACACAAAACCCBBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCCBCCBABCABCBCBCAAACAACBBACBBCBABACACACAAAACCCBBAA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 8d39e690961a653f8d0e5f1b138824098d75c2221f7fdd5b4a0008287a7d7cf2
MD5 ebde0366df96df025a9d0a6edf2dad33
SHA1 1fa942e7528d75f35f98dc037eafd391207cf462
SHA512 1c8f0bb6d4ce80d487e3329ea6d2ca4857207d91c6dd193770b2d0a0ac912dd58dc54c8aed031884b3df595325be1884df914cf1bb47b256411888cd45213ce9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 b8a3b9dd8e75890bffa29f162114ba7656630c9bde21eca80908a08bb88e1069
MD5 59d2ddb5bcb1567ef4c4cc4f928072dc
SHA1 febb6b78c76334e42bcd8fedce04b55adf35f928
SHA512 7b50a1449a34759d2f41f73bcf20ded3a64a6e9189261391e5f85450925dd519b47de5500af0736a1cc9a2a0c599e10dac901d78ee819949364c5b1aaf76095d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 bb19e024ba59a8023730539c45a91a474b4b032a1cad67f279c2531992cc57ee
MD5 c2ce64efd7589d073440fe72ea7c665c
SHA1 c2ebe050f716b2c173a34667048b8a88880b5330
SHA512 72884b367265fd765106a85b176536d8acad2c550e2b0f692d8e271558b50d25f93f483d1144da9fff9b904a900d49dc9bef455f23d2cdb8643406e5640aa378
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 3f621a6bdf230e9d29a0dea9549a9ee420290360caddf87809a58992067e4eaf
MD5 6044ed4bb3bcc2ca3610bb63122cea47
SHA1 4d1391eff689275ceed16bf024d85f37d163783f
SHA512 629643929d6eddfcdfbeab9ca6d89ff5f31eb631f2ac8df54491cd319c9a91f5a33b42585db2cb498dc55694c9ab036b849070898dbc09f3298a657b9c6cad5e
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 23.3MB
SHA256 4a0cc77291ff4d5203a98166b86d7e78ca2d0434fa745fe4f3b0b8b36e111bf3
MD5 16b50ccbed8ecb2d8770fba32d5baee7
SHA1 3fb7e2621c17e60cb30486ea911e026e35d65a92
SHA512 e9095345bf688545c982780de49dd26589bc734866bb78acafff4fa9662a326fcff98766410f927c18d00b5bd62ee859b8639e5ded0965317b7062402434dd9c
SSDEEP 393216:iZahvQHrc8u3xXJ/f4uUWH3mHN6+JrvT2s:iSvQHrK5/f4uULbr7t
TLSH
T13F379E12729751E9D06ED1B88A578332E7757C420331A3CB12A8F6592F73BE45F3A362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 d819d14b1af23545a4e0f22726ee59b2bb8c48070503cb6905f58edd9ab198b9
MD5 04fdc804a9c85c3c55c1b2b800c93605
SHA1 1fb5480c98df34efdd82983c6373885a01e9479c
SHA512 1c8113fd6af1319f19f4f095bf421a286d81a6982922c5359ec644ed11a4f8bfd96f678b4efcec478a3dff59a68f7a0d0a62a167fd9a376d6f1bda9ec4395b04
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 46c592b319bdcb91785e428cd3f74d78a38006eaf136ad89b3ebe8f5f45d15dc
MD5 4f04c9e87cc813e25b53a1b411620ad4
SHA1 d0022f5e6cbc04e8966e05f6a76178901c5766fc
SHA512 b2f2313dd91bc9a4ef18ab7637ac281b3540575565f5ca29d417d6736badace039bbc5efd6407c767db13f195d0be55dba5f41183d343176396eea719d256993
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 df5c1501c410a945e2a9f0db22b3f277e58ca0b8dbb091d235dc7ad8cfd289fc
MD5 e7d3aa5e9e944f9559c7c12ec4735f89
SHA1 b13f543cf9b550e33f94134815d60fec29f22f95
SHA512 1d14fb2618a1a0b24def8e706cc9f88a9d796172dc2ad52890bd914b6db89cbabc2bb59eb84b8dbfa2419ef524134b1c7ed1e7dee3bce27d8b7da11f90b1616c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\qap`g`v~dtlq
Size 10B
SHA256 48b527614f826ada318fcbd1c0291e5de50f91775f34163398c9b5601b68d119
MD5 ddc72cb5fbfd976b8c5970207a884997
SHA1 40b7644312d0abf3c70814aa0c557f3b88dedf6e
SHA512 674a6f7af9a4daaaa3f9bdff09de2ef55f4481ca7fb539b28e5aaccdbe99cc84c00bb02cb12fa9f8770dcbd6689ac807ade7e4c9dc2209a3487a79a17de8cf93
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\qap`g`v~dtlq
Size 10B
SHA256 2b7c72c847cc7b5ba1cc68929652c6d231f47bb9e59adce995b5add5b2b40f31
MD5 65816372d5627658e715ef508c3e0465
SHA1 4fcd3487d1b2f5abe22427b60083b9f19de2ee98
SHA512 fa595f0ae5f5195088bc66fad28ce9e2c223681bca9f2c3d1a9eae7b3f8706c19e7573ee92ad40705a807ea66171d276fcdc52b4fc362a0821950e0ac3122d91
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 a44bfacca14fb5b817715d437272625cabb2001baec45e02a5e62f6302aa77e7
MD5 58d3669f86be6b3fe5750e2da5b3d0b6
SHA1 2670eb50953c7f4bbb4153723189b0474b5421b6
SHA512 cdfce2b37acac34fa279d20e4cee50707c938895d51962922079df6868c86a8da214ff2cf53f7b72f1fdc8817d85e771bf9a467332330005bbc2512312d3f733
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 84894dd84d813179ab7d0300fc7f232ac57e8db74c189f17e34d5b2123b0b2f6
MD5 598f47fea93c98eac8cf7d766327269b
SHA1 1ac83adaa01d5d50158867899df99db43a708fbc
SHA512 690c80ee80e989c12666acb6f37496e3ed268bd2bc8c3a7c5b8a902571be72beb0125d8439d25007ba92d2c6dc3376b8f9c1eb64abc1c5c5f17780e7940072bb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\qap`g`v~dtlq
Size 10B
SHA256 c0dcd41c8755c8a9c41a599182b703f5ba50a46950243956feb8c10ba42069d5
MD5 59c910901e727dd075b367f2bd22f177
SHA1 f50903385950eca0b83f55195d4996e1299e007c
SHA512 b09b11367c2e249b60a61f3a58fd373239ac7126de7eb8aac20bb8a012a2c1d63798042b939d3d6fd12eb8236705147bb975919e0edd89301ae39c8ce6d9cb65
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qap`g`v~dtlq
Size 10B
SHA256 f286da0527ef6e42ea6b0414662c2debaf488165fe25f33b6078e416d3b0be46
MD5 54e0d479e9319a056780e0d3efae5bb8
SHA1 2bc24ca7a2cba2167ef6a3c24a974f9885b04575
SHA512 0be476a82edaeeb113a5f188ba05c9e40fd01996114c5bb5cd32bfc38c7983593bef08fbf42925e88bebdd643ecfa25a5eb1b1b060651055131364f0fa7b4eee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Sun\Java\qap`g`v~dtlq
Size 10B
SHA256 5c26e667466e548ab4d996d490272c93ec593b6ef48190d905cc1b55f7072076
MD5 eeafe6a2757b4eb9724763e1662541f5
SHA1 a3c004c8bc7192de72fc41c59f55fb8b39a2a8aa
SHA512 6924dc91f1b48636dfa5b90231e19d46205cbcbf0d1ff87d82925401bc7ff84663e11aee3aa6d208834b9d09eb5d41a0b606d18a8c2e8f481ed880ff9c3ee9b5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fdfec7a881c0a3060a443f1a26e1ff80daa8035ccb8818cef298b836e555a404
MD5 91ba5a7bf756ca75e8870543c64e97e7
SHA1 693cd0e134b326a06c0ddb46cec2ed88feb785d1
SHA512 8012cf0618b44382d5b4996da66fc23e3adf5c07e3d8ad54898d585072d3e4f477838a4aaa9c743b38850c3196ad1773b513d27683d557bfb455c1bad7623837
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d1d7389ba815436b7f19e4e6672f63212f72c0bca51433b1f9227064d414a46b
MD5 b6ad3531022bd0146f9b42f120c942e0
SHA1 351efe281d37274d3f5d0e3a9af4146a2dc4e049
SHA512 480339a8e0dbfe699e3d31bdb075ebc6251dc5aaecdcc0214b379fc8a5418297cbe818627e92a75a9d90e0278a19a11f44f7cc2f175a2fbd44f782ed0be7b36c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7ae1284cf3fe2f67dc49b7c2a0faa472d8bcad4bdeba6dec55bf6e408ba2bedb
MD5 605e7db09af2c84fbebc530136c8cfec
SHA1 ef204e7e46f77254d28afd2936c02e1f056dfb8f
SHA512 9a3fe96298e64806154cf8900efcb966cd1c3b7bdf524602cb82c455d3e72a3fc29d081ee2340f60d58cd537033e8fe15342a931ea43efe3df321bb1f4b14582
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c477591c2c1654c142c4a716151d7ad4cee8cd8e189badb8f75194d1fae10a3f
MD5 8a4490faa51f8a758c57a34de432ac06
SHA1 3c571e8188bf91dfe9218d257a2ccf801e32e046
SHA512 d116c988ab03dbbb9163b966e1e7617def5ea4f77f834bd2ba4ebd0fe59c6b4808d8dd0974e802c53f66aa1e86aa7ca21bbd8428eb7ddda5acebe4424863cad4
MD5 SHA1 SHA512

Submit Download

svchost_CABACCCBCCBABCABCBCBCAAACAACBBACBBCBABACACACAAAACCCBBAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCCBCCBABCABCBCBCAAACAACBBACBBCBABACACACAAAACCCBBAA.exe
Size 22.7MB
SHA256 419c5f8ebd003b70cf89b4996a6318e2dfe904646f2e7404c68df56e25098464
MD5 34b57de4d583a219698fc3eeeabdadaa
SHA1 4a11806b9d23879692377fb6c9bd38aca91502b5
SHA512 48791354bd349c9e789ec42b7407ac7cd92739c055c2300fc0374389451cb8c290fa231c53f7a54db9e98295ae00e21f7f5baf05d1757f04ba76fd82155bff37
SSDEEP 196608:kFlP7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouQmHpn6F44IAWv3:iZahvQHrc8u3xXJ/f4uUWH3mHN6+Jrv3
TLSH
T11E378E12729751E9D06ED1B88A578332D7757C420331A3CF12A8F65A2F73BA45F3A362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 41fa6283138d69c33f036532fef89d008edc45dda1c0dc4e4664cfaa7f886041
MD5 0a894aa867752f46cae71b5283e4ce56
SHA1 a04f7ad34d70978fde458a2a8001fe53244f3893
SHA512 4cd20e05454eec29ede0b0d00f5c994e18eda21c9c9a05a1cb99f361bb697950d0bbd494dd4360a217175b49df1159633cd6dd965d388b486a3679e1872dfe03
TLSH
T15121A6A4E4E5DC73F93328CBA72ADBC30CA4379F9C58AB2817184218A799C339D194D1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 2a40e567d66c4ee43a611236d3de5f3bd1f8ad8b90554618e3ab4f05930363d2
MD5 c9a2b62247005961d3893028e04d43c2
SHA1 65ab2e332d4a570b4f0c4e5ed47f51e21531150c
SHA512 beb985dd4388f4c19dae63fdc69dd40b4e830873f82345c4ddbed2a7141ee92a6b81d07822fafd345b4e5a1d512381f1d4d71c75575bdfbc294dd4d03d39752b
TLSH
T1681198A4E4E9D823F93328CB932ADBC34CA8378F5C58AB2817180219A789C335D194D6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 e0df2d13b1529af98a0a764c048cac89913c5d796ceb668ca6bd8ff725c4dc0b
MD5 13bfd0dcacd7858d341a79f39901db85
SHA1 86f971e30f73437464a6ba8ceff6adc15bf561d4
SHA512 98376a9a2411593671af2f6573dc73b9bce42af5dff749f59d9a3e73af5a2b9e94e1fba302abf79b791e3428466a62a7e48c53d2787cc38026d34da380e18481
TLSH
T19021A4A4E4E9DC33F93328CB933ADBC34CA4378F5C58AB2817184218A789C339D194D6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2120-738-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download

memory/2120-2950-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download

memory/2776-78-0x00000000004A0000-0x00000000004C1000-memory.dmp

Download

memory/3508-30-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download

memory/5188-6-0x0000000000B90000-0x0000000000BB1000-memory.dmp

Download