fc7454432741288b5832bdd60105f286c964b05bd5aefa0f45e2575d63b3913b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 15:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-31_be81226b2ba2f95c7b2cb95cd7c8f376_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Size 21.6MB
Sample260831-skshqaxtgs
SHA256 fc7454432741288b5832bdd60105f286c964b05bd5aefa0f45e2575d63b3913b
MD5 be81226b2ba2f95c7b2cb95cd7c8f376
SHA1 d5f439c1178dc16730f960fdab26e55bc61e5260
SHA512 293cc4059b19ae0b1f2737d76ddcdc670fdd2593d6f6db82252745aac2b3ee85e02f19352a1b1c18dc0ee2fe1c4b985b7cd3d435ae93c6403ebecf4450182ee7
SSDEEP 98304:i//t//fA91pH2WpjHrgBFFu416AWva//t//i//t//fA91pH2WpjHrgBFFu416AWL:MmHpn6F44IAWv1mHpn6F44IAWvPjH
TLSH
T1AE376B5A62AA10F9D4AFD176C6A58332D6707C23033157DB527CCA3E2F676906D3CB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBBCCBBAAACBACBCCBABCCABBACCAACBACCAABABBCCBBBAACCBAAAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBBCCBBAAACBACBCCBABCCABBACCAACBACCAABABBCCBBBAACCBAAAA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4304	svchost_CBBCCBBAAACBACBCCBABCCABBACCAACBACCAABABBCCBBBAACCBAAAA.exe
2456	svchost_AABBBCCACBBBCCCACCCCABCABCBBBCBCCCACAACBCBCBACBACCABBAC.exe
5104	svchost_CBBCCBBAAACBACBCCBABCCABBACCAACBACCAABABBCCBBBAACCBAAAA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CACBACCBBABBCCCAAABBBAAABBCBCAAABBBCBBCCCBBCCBBBCBBAAABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBCCBBAAACBACBCCBABCCABBACCAACBACCAABABBCCBBBAACCBAAAA.exe"	2026-08-31_be81226b2ba2f95c7b2cb95cd7c8f376_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_ACAAACBACBBABBBAAABCCAACBCABBABBCBCCABBAACBCCCBAABACCBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABBBCCACBBBCCCACCCCABCABCBBBCBCCCACAACBCBCBACBACCABBAC.exe"	svchost_CBBCCBBAAACBACBCCBABCCABBACCAACBACCAABABBCCBBBAACCBAAAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
448	sc.exe
2804	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4228	cmd.exe
5008	cmd.exe
1124	cmd.exe
3512	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-31_be81226b2ba2f95c7b2cb95cd7c8f376_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABBBCCACBBBCCCACCCCABCABCBBBCBCCCACAACBCBCBACBACCABBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBCCBBAAACBACBCCBABCCABBACCAACBACCAABABBCCBBBAACCBAAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2712	schtasks.exe
4644	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2920	2026-08-31_be81226b2ba2f95c7b2cb95cd7c8f376_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
2920	2026-08-31_be81226b2ba2f95c7b2cb95cd7c8f376_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
2920	2026-08-31_be81226b2ba2f95c7b2cb95cd7c8f376_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
2920	2026-08-31_be81226b2ba2f95c7b2cb95cd7c8f376_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
4304	svchost_CBBCCBBAAACBACBCCBABCCABBACCAACBACCAABABBCCBBBAACCBAAAA.exe
4304	svchost_CBBCCBBAAACBACBCCBABCCABBACCAACBACCAABABBCCBBBAACCBAAAA.exe
4304	svchost_CBBCCBBAAACBACBCCBABCCABBACCAACBACCAABABBCCBBBAACCBAAAA.exe
4304	svchost_CBBCCBBAAACBACBCCBABCCABBACCAACBACCAABABBCCBBBAACCBAAAA.exe
5104	svchost_CBBCCBBAAACBACBCCBABCCABBACCAACBACCAABABBCCBBBAACCBAAAA.exe
5104	svchost_CBBCCBBAAACBACBCCBABCCABBACCAACBACCAABABBCCBBBAACCBAAAA.exe
2456	svchost_AABBBCCACBBBCCCACCCCABCABCBBBCBCCCACAACBCBCBACBACCABBAC.exe
2456	svchost_AABBBCCACBBBCCCACCCCABCABCBBBCBCCCACAACBCBCBACBACCABBAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2920	2026-08-31_be81226b2ba2f95c7b2cb95cd7c8f376_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Token: SeDebugPrivilege	4304	svchost_CBBCCBBAAACBACBCCBABCCABBACCAACBACCAABABBCCBBBAACCBAAAA.exe
Token: SeDebugPrivilege	5104	svchost_CBBCCBBAAACBACBCCBABCCABBACCAACBACCAABABBCCBBBAACCBAAAA.exe
Token: SeDebugPrivilege	2456	svchost_AABBBCCACBBBCCCACCCCABCABCBBBCBCCCACAACBCBCBACBACCABBAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1600	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 3512	2920	2026-08-31_be81226b2ba2f95c7b2cb95cd7c8f376_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe	98
PID 3512 wrote to memory of 2712	3512	cmd.exe	100
PID 4304 wrote to memory of 3396	4304	svchost_CBBCCBBAAACBACBCCBABCCABBACCAACBACCAABABBCCBBBAACCBAAAA.exe	101
PID 3396 wrote to memory of 3448	3396	notepad.exe	102
PID 2920 wrote to memory of 4228	2920	2026-08-31_be81226b2ba2f95c7b2cb95cd7c8f376_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe	106
PID 4228 wrote to memory of 448	4228	cmd.exe	108
PID 2920 wrote to memory of 5008	2920	2026-08-31_be81226b2ba2f95c7b2cb95cd7c8f376_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe	109
PID 5008 wrote to memory of 2804	5008	cmd.exe	111
PID 4304 wrote to memory of 1124	4304	svchost_CBBCCBBAAACBACBCCBABCCABBACCAACBACCAABABBCCBBBAACCBAAAA.exe	114
PID 1124 wrote to memory of 4644	1124	cmd.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-08-31_be81226b2ba2f95c7b2cb95cd7c8f376_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-31_be81226b2ba2f95c7b2cb95cd7c8f376_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBACBAABABCBBACACABACABBBBCBABBCABAAABCABBCCABBACAABCAABCBBABCBBBBAAABAACAACAABCCBCABBABAABCACACBAAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCBBAAACBACBCCBABCCABBACCAACBACCAABABBCCBBBAACCBAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBACBAABABCBBACACABACABBBBCBABBCABAAABCABBCCABBACAABCAABCBBABCBBBBAAABAACAACAABCCBCABBABAABCACACBAAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCBBAAACBACBCCBABCCABBACCAACBACCAABABBCCBBBAACCBAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBCAACABBBBCCCACACCCBAABBBCACCCBBABBAACBBCBBCCBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCBBAAACBACBCCBABCCABBACCAACBACCAABABBCCBBBAACCBAAAA.exe" start= auto displayName= "UserDataSvc_CCBCAACABBBBCCCACACCCBAABBBCACCCBBABBAACBBCBBCCBACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBCAACABBBBCCCACACCCBAABBBCACCCBBABBAACBBCBBCCBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCBBAAACBACBCCBABCCABBACCAACBACCAABABBCCBBBAACCBAAAA.exe" start= auto displayName= "UserDataSvc_CCBCAACABBBBCCCACACCCBAABBBCACCCBBABBAACBBCBBCCBACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBCAACABBBBCCCACACCCBAABBBCACCCBBABBAACBBCBBCCBACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBCAACABBBBCCCACACCCBAABBBCACCCBBABBAACBBCBBCCBACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2804

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCBBAAACBACBCCBABCCABBACCAACBACCAABABBCCBBBAACCBAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCBBAAACBACBCCBABCCABBACCAACBACCAABABBCCBBBAACCBAAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCCCCCBBCCABCACABBBABCBACACCABABCCCBBBCABAAABBACABBCCBCBAABCCCAABAABCBACCABBCBCBACBAAAABAACAACCACBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBCCACBBBCCCACCCCABCABCBBBCBCCCACAACBCBCBACBACCABBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCCCCCBBCCABCACABBBABCBACACCABABCCCBBBCABAAABBACABBCCBCBAABCCCAABAABCBACCABBCBCBACBAAAABAACAACCACBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBCCACBBBCCCACCCCABCABCBBBCBCCCACAACBCBCBACBACCABBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4644

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1600

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBCCACBBBCCCACCCCABCABCBBBCBCCCACAACBCBCBACBACCABBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBCCACBBBCCCACCCCABCABCBBBCBCCCACAACBCBCBACBACCABBAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2456

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCBBAAACBACBCCBABCCABBACCAACBACCAABABBCCBBBAACCBAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCBBAAACBACBCCBABCCABBACCAACBACCAABABBCCBBBAACCBAAAA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 1ee88606ac7078aeba9ab65ab937dbdbf8ac8fc4aea0346e12c7c82bde667c0f
MD5 0b9e6934a992df07a66fa705894e48ed
SHA1 eb1deaa60bbd3e593daf9ce8ab2e7b19302c95bd
SHA512 d7ec09fd484f0fff14238498e2aeecda6163060cf495f7aadf04a894dfd6caf29fc43460f270b983fa18d306e351e5f64494d3ba05b93e2ee2c7d763b360d0fc
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 22.0MB
SHA256 29f2198d1437a746756a626c1396fb6fbdc59d86002cf2bf1ed3f1b45ba1e2e2
MD5 7c47d4f461c19833b3a9617f51cc45fa
SHA1 1de0d6dd25e4e94c234690b57bc97cc1dd0c59b6
SHA512 14ef6ee5a88156c20d30d5e8d1848eaa54a4fa8c1bcdc7d8b17a4dd5383885bcc49b4872500357951bca2f2362a8bb7d3b6ddb6283041e5c5fd40edc59cb547a
SSDEEP 98304:i//t//fA91pH2WpjHrgBFFu416AWva//t//i//t//fA91pH2WpjHrgBFFu416AWM:MmHpn6F44IAWv1mHpn6F44IAWvPjQ
TLSH
T14E376A5A62EA10F9D4AFD176C6A58332D6707C23033157DB527CCA3E2F676906D38B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 db69c2c21d033001e660478134653f65b1a90f81d2edf5e37abbffa3a2254b13
MD5 1a1578f0d9b5aba0f6ac6b71799c878c
SHA1 d79566243a6ca45bda3267780a3f8df64d1009ca
SHA512 e77b70b4e6adcb7da8a3cc515be144899cf3b545ac230e8c4a5def182a338aec0fc65d74bb5e2d31aa608b9ab9a9e951cef422dab23489c76643603d03ed9ab0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Provisioning\AssetCache\qap`g`v~dtlq
Size 10B
SHA256 38648c44f8d961bd3e18834c5fe3f8ecd174c21dc64fc6341ab87baac643bf82
MD5 472d4cd54b89a4d80d60f0baba48483c
SHA1 bce6477b3d7d58f6796f19eb6bf5dcd6b6cc7037
SHA512 b551668c590afc462a8ef8fc634af047c57db766c46274d708f3ea2c7922df114faff06512e3875b75e2ccf50187544e35ac6deba7a8dc2e620a3653068afad0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 a4561152952aa8ea613c9370306c4a15b59dec3e924a64140f097c1871d352ba
MD5 d5fbb0e22acd41a0ff7792c92c6901f5
SHA1 ae75354acfa36e8427b458b2e1ddde0cddf6718a
SHA512 992ad171afa18690e520626fb85e2e430a67a38d076396319b7de356054dfc826c8e5dc3a3ad276bf8056b9be96735ba147f0fb4c83c66bc5325f2836b69ec5b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 2c5c404741314618cc62ce2c5b2c07b9831edf98e627661d4c85acef3abc3943
MD5 c6ccbadcca2250b73f220bb2780a9f4f
SHA1 b7897c7746dafd03d16cb648111dc816cc433b57
SHA512 0074881e13af454f7874fa7a5cb27790efc2de1384f321b964f0bccc87026cc31e29e5f61910e8d36b639e5012a6ac4e7e5242367e55ce4201b4fc4e52056e0a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\AvailabilityDB\qap`g`v~dtlq
Size 10B
SHA256 b42e5c731288c11393d617c10b391eb12157cc485064fad7e41b62fd677f06d3
MD5 1cf99f90327931a2845912d76e16ec3d
SHA1 d2f4aed04fa4ffc3458642aad73cd07fc56db58c
SHA512 bd845d408024f703e59e46f0b0f331b2fd4462f17c97d659f8802129acb13355aac55b4e48157aefe04b20bd584fdf75bd11f0f460607037a039ebc8bf0795ea
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\sw\qap`g`v~dtlq
Size 10B
SHA256 a951c7829a5a161de7bef38ed78b5dbd0aafbe7feb7a4ababccfe2663cfd3219
MD5 02af0fccb2f5bacded8a07b20f8bd7eb
SHA1 e9e1b81ce37fa2490c3aa8840913fbd4d2a80aad
SHA512 54d424e05c353e03409d3457b7ea4e3138d71ec2aa2d32ff387dbc950d964a60e93a3b1ca43426a9a62a994243daa65219f3b3df1e1f3a67e8423e50c0326409
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 02d326ab3c56ff0cc909118c1362a01179915f4f71e341b0a3346525d3fe2cb8
MD5 e4e12789ff6cc37d436b68e0bf5ba2f1
SHA1 8935291c0cc8bffc96ba0e1d2dd8cd6e7deb68c9
SHA512 4ab96b83bbaff826dad3ca00e000d04eb0edceb8ee6a36a260ff102d491811cb84d0e987050e1b8da530769303dcc3275359d13cad563bf2899d1d5329f9ce52
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\SwitchStep\qap`g`v~dtlq
Size 10B
SHA256 14230a59be19bde1b3a7ef20c506d4713ad95352597dacb88a482a8341a5d174
MD5 98f5cc1062c9bcd15ae1aeac1763b106
SHA1 4ba52595f985e1ad9085a0f805a79061714b537b
SHA512 ece9d2310538cb5cb0d9a7c4f65b5391f1eed2a768a2d1ecab9e9b18cab3875cd5a9cd654fdf5f03c715d6211055a95f153d1959480b89bda8e25360f6c1084d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 61309c05830b3b14d9533c4836a48a9a84d50e95b1f27cb5b517ba418eeca95a
MD5 8cccc7394ffb6e9ea8056fc1f9fe004c
SHA1 46e0ef0c23eb034b92d95073a35d36d78b665a23
SHA512 979b03fe98c121ab7e519ca1a4977f0852879e72c01b7405e4f9059d5e6d555436bf53fddb384d50a2b3e64252787e01bd7df41939c8a0003f2689f95f101716
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8bb75367b8ff92ee2ffbbd8a1a68216f80296bfc5c373a3aa3144d58000facae
MD5 ed240f194eeb1fc6caf1c0caa66a0213
SHA1 e9a3ac0cf9d56fb8131ec544110dee2036e38ce7
SHA512 1f9883d85927f759a5b96fd7d05e6524f3eb45b6f1d7844ac333a7296f91ecc8b9dfd82888d606b021f62a5d324a44840a7085cbc4261aa3769466e949c2639e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4feed8403ade23768364fa712e2908a3dfeecd10d232719f9f55b133114b6719
MD5 33b0e655dc81d6fe98858c37ab1e4489
SHA1 627d3a7c85f5da60d478a02e3d61c3ff5d567585
SHA512 6f207120bc64eb421535006d955e024df0f1a44660b746eab121d285c4c016a0ed3873bde498a4ccc943d8f6d9e90ad6807f22f116330f5dbed113512f944a59
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 942f5a44febde05e7cbc9aae951c8e132a8b0b3b3b53c0674ab2259b27391ed5
MD5 3e7206151a3c0995179463b0478660d5
SHA1 aa0c2f645288a4eeb3fc5276700e17d5ca26410e
SHA512 ce563154e0c1ce60f6e5bcbdc854a9362398cf92d532d9019245de457800f28bfa8bcd0ff623c40c658564bc0044e4a7ebe69100f4d6ec03040ceadd3d58d179
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d0fd1a89e46753778567ea98267967f0c4e70bbc560c07b216cd8fef88f3a337
MD5 4a6be35930b8ba962f89482b0d2a22be
SHA1 96645cb8842ce31c00a79c722d19d46349f25c33
SHA512 a1cc9e37c4fa228df1ccbb5054f7e68f376bb997ab0a310706603d846c02c6a8baa19eca0a70f28f1cef89a487ca7627a1e57edeadde219cb05826f7e95ac76f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 84511fe9aa1772475b3aaa8220b5ed33924a3081a6a12a5ac74e6d45a6d5b827
MD5 b08e3cb810d4e86e8447f928ba138d4e
SHA1 e1fe27b7951f0cfdc42a1e20a3de41763e7db1e0
SHA512 f0afcc3895e4c94f42219cd30055df7628b2153936865dfad82e49d627c75a839a6ef4fba85e23ce24edaa7df44a7e2668405d0e89a826d6d8e821775e3fe233
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts\qap`g`v~dtlq
Size 10B
SHA256 a84ff6a37d77d986f3be31a58defbd880d1491c04c9be118c04feb7a86e8653c
MD5 18cf9196f625267d3bac7d088ed6fede
SHA1 a7401f68168fb08d8a580cb37482cc32432029fa
SHA512 5ad147835882788837557323dbc149751015717a409fddd4b08e102ce3b2558e7da6be0514b2e1854c7ee0237f5fd2f3321d1a22ba39b6dc4e679d031fb2f92b
MD5 SHA1 SHA512

Submit Download

svchost_CBBCCBBAAACBACBCCBABCCABBACCAACBACCAABABBCCBBBAACCBAAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCBBAAACBACBCCBABCCABBACCAACBACCAABABBCCBBBAACCBAAAA.exe
Size 21.6MB
SHA256 fc7454432741288b5832bdd60105f286c964b05bd5aefa0f45e2575d63b3913b
MD5 be81226b2ba2f95c7b2cb95cd7c8f376
SHA1 d5f439c1178dc16730f960fdab26e55bc61e5260
SHA512 293cc4059b19ae0b1f2737d76ddcdc670fdd2593d6f6db82252745aac2b3ee85e02f19352a1b1c18dc0ee2fe1c4b985b7cd3d435ae93c6403ebecf4450182ee7
SSDEEP 98304:i//t//fA91pH2WpjHrgBFFu416AWva//t//i//t//fA91pH2WpjHrgBFFu416AWL:MmHpn6F44IAWv1mHpn6F44IAWvPjH
TLSH
T1AE376B5A62AA10F9D4AFD176C6A58332D6707C23033157DB527CCA3E2F676906D3CB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 c8906dfda31f5202f69907eb271a26c1eeac6d20631c4ade47610b81079548dc
MD5 56d4f0902c245085578f4f6999894c41
SHA1 cf8b4ae9c4afa36e4187ad7c4833b05bff208bd9
SHA512 4b7da8a0268a037009224724a0de86ed12e68b481e2b765acaaa9e0af6554c3a496ad7e67316d8cf3cd7489cb465a48d54ae9b668d60bcd7846d8b09f2dbdc41
TLSH
T1D6210860F0E6CCA3E92268CFA63DD9EB0CA437CEAC9C5A01531CC21D3795C318E5A4D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 6c8a4f076ccd5dc127f7aa7d932b86e58b57098cf4609906e0b9b4f964e9c8dd
MD5 6b758c9a3872ec800bb3dbfc4ac277a0
SHA1 24f015ef31bd3c345c8c814b8dca80070f65f51a
SHA512 4e2d94cf7cd17e3c3fde4e1b6671576d10d7a72359a8fce076e585ac84bde4d3d19ba842004ea230112ff6279a69c4d32d7e653fbf1beed61c9f242575f00eed
TLSH
T13621F6A0F0E6CCA3E82268CF5239D99B0CE437CEAC986A11630CC11D2795C314F564D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 780B
SHA256 b84afdd7475a57b4ec09679faab431175e902b1141b6c314e5ae4d694fbf4107
MD5 7c99cd594e905a6e7046b65c5663dfb9
SHA1 7692d1894968a1b5fb4090adebbccdfe6cf17a31
SHA512 632e446b2460da3f839c99a5a4d3dcd03ff77cabc3c651c6d76e1bf80a728dc9d93cbdb0c26f9228f77772cee4aa5e85e0842f4a8144035c9d0413a448455176
TLSH
T12401F590F0E6DCA7E83268CF922DAD9B0CE437CAAC986A056358821D6755C314F564D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2456-2967-0x0000000000FE0000-0x0000000001001000-memory.dmp

Download

memory/2456-71-0x0000000000FE0000-0x0000000001001000-memory.dmp

Download

memory/2920-6-0x00000000003F0000-0x0000000000411000-memory.dmp

Download

memory/3396-59-0x00000000052E0000-0x00000000052E1000-memory.dmp

Download

memory/4304-35-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download

memory/5104-115-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download

memory/5104-3164-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download