27007ddc81a8f178b868df3e43a3d73e25ec82cea9d17a12828beb7dadbaa2eb

Analysis

max time kernel
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 17:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-05_71f0bda6c70d8826978be4ea1eec93de_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Size 15.1MB
Sample260907-wec3mascpf
SHA256 27007ddc81a8f178b868df3e43a3d73e25ec82cea9d17a12828beb7dadbaa2eb
MD5 71f0bda6c70d8826978be4ea1eec93de
SHA1 049d6b83254b1a6941cedb2f0c1d6655f06ddddb
SHA512 1bfc0b8dbf1c1b789e506f3458e85f5752d4a2d898da7229fbeee98b68668a2ac98e62d080ab2519bc39a6fded7c0a984291519ad5c172e6848ccf770fb0faff
SSDEEP 196608:27APhNNECwHrc8u3x3AEcq/fByuKlWH3CTou5b:2ahvQHrc8u3xXJ/f4uUWHs
TLSH
T114F69E13B35681E6C02AE2B88A474322D7B9BC440334A7DB16D5B7692F77BE45B3B350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Detects executables packed with Dotfuscator 2 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c58b-19.dat	INDICATOR_EXE_Packed_Dotfuscator
behavioral2/files/0x0008000000018297-386.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 2 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c58b-19.dat	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/files/0x0008000000018297-386.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 2 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c58b-19.dat	INDICATOR_EXE_Packed_Yano
behavioral2/files/0x0008000000018297-386.dat	INDICATOR_EXE_Packed_Yano

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABBCBABAACBBBCABABCCAAACBABBACBCBABBBACBACCCAAACBABBAAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABBCBABAACBBBCABABCCAAACBABBACBCBABBBACBACCCAAACBABBAAA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3184	svchost_ABBCBABAACBBBCABABCCAAACBABBACBCBABBBACBACCCAAACBABBAAA.exe
2980	svchost_CCACCACCCBBAAAABBAAACABCBBABACBBACCBBBCBBACCABCCAAACAAC.exe
2952	svchost_ABBCBABAACBBBCABABCCAAACBABBACBCBABBBACBACCCAAACBABBAAA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABABACBBBACACBBCCAAACBBCACAABAAAACBCBBCBACCBCCAAAABBCBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBCBABAACBBBCABABCCAAACBABBACBCBABBBACBACCCAAACBABBAAA.exe"	2026-09-05_71f0bda6c70d8826978be4ea1eec93de_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAAAAAABABABBBBABABCCBBBBBBBBBCBBAABABBCCCACBCBACBAABCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCACCACCCBBAAAABBAAACABCBBABACBBACCBBBCBBACCABCCAAACAAC.exe"	svchost_ABBCBABAACBBBCABABCCAAACBABBACBCBABBBACBACCCAAACBABBAAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4288	sc.exe
2840	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1320	cmd.exe
4396	cmd.exe
5588	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBCBABAACBBBCABABCCAAACBABBACBCBABBBACBACCCAAACBABBAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCACCACCCBBAAAABBAAACABCBBABACBBACCBBBCBBACCABCCAAACAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-05_71f0bda6c70d8826978be4ea1eec93de_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2636	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5020	2026-09-05_71f0bda6c70d8826978be4ea1eec93de_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
5020	2026-09-05_71f0bda6c70d8826978be4ea1eec93de_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
5020	2026-09-05_71f0bda6c70d8826978be4ea1eec93de_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
5020	2026-09-05_71f0bda6c70d8826978be4ea1eec93de_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
3184	svchost_ABBCBABAACBBBCABABCCAAACBABBACBCBABBBACBACCCAAACBABBAAA.exe
3184	svchost_ABBCBABAACBBBCABABCCAAACBABBACBCBABBBACBACCCAAACBABBAAA.exe
3184	svchost_ABBCBABAACBBBCABABCCAAACBABBACBCBABBBACBACCCAAACBABBAAA.exe
3184	svchost_ABBCBABAACBBBCABABCCAAACBABBACBCBABBBACBACCCAAACBABBAAA.exe
2952	svchost_ABBCBABAACBBBCABABCCAAACBABBACBCBABBBACBACCCAAACBABBAAA.exe
2952	svchost_ABBCBABAACBBBCABABCCAAACBABBACBCBABBBACBACCCAAACBABBAAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5020	2026-09-05_71f0bda6c70d8826978be4ea1eec93de_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Token: SeDebugPrivilege	3184	svchost_ABBCBABAACBBBCABABCCAAACBABBACBCBABBBACBACCCAAACBABBAAA.exe
Token: SeDebugPrivilege	2952	svchost_ABBCBABAACBBBCABABCCAAACBABBACBCBABBBACBACCCAAACBABBAAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 1320	5020	2026-09-05_71f0bda6c70d8826978be4ea1eec93de_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe	91
PID 1320 wrote to memory of 2636	1320	cmd.exe	93
PID 3184 wrote to memory of 4452	3184	svchost_ABBCBABAACBBBCABABCCAAACBABBACBCBABBBACBACCCAAACBABBAAA.exe	94
PID 5020 wrote to memory of 4396	5020	2026-09-05_71f0bda6c70d8826978be4ea1eec93de_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe	97
PID 4396 wrote to memory of 4288	4396	cmd.exe	99
PID 5020 wrote to memory of 5588	5020	2026-09-05_71f0bda6c70d8826978be4ea1eec93de_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe	100
PID 5588 wrote to memory of 2840	5588	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-05_71f0bda6c70d8826978be4ea1eec93de_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_71f0bda6c70d8826978be4ea1eec93de_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACABBBBBCCBCCAAABCABACACCCBCBCCAABBABCBBBBACCCCAACCCBACCCCBCABCAAACACCACABBACBCCBCACABAAAACAACBAACBACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBABAACBBBCABABCCAAACBABBACBCBABBBACBACCCAAACBABBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACABBBBBCCBCCAAABCABACACCCBCBCCAABBABCBBBBACCCCAACCCBACCCCBCABCAAACACCACABBACBCCBCACABAAAACAACBAACBACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBABAACBBBCABABCCAAACBABBACBCBABBBACBACCCAAACBABBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABCACAABBCAABACCBBCABCACBBBBBBABBBBACBAABACABCCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBABAACBBBCABABCCAAACBABBACBCBABBBACBACCCAAACBABBAAA.exe" start= auto displayName= "UserDataSvc_AABCACAABBCAABACCBBCABCACBBBBBBABBBBACBAABACABCCBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABCACAABBCAABACCBBCABCACBBBBBBABBBBACBAABACABCCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBABAACBBBCABABCCAAACBABBACBCBABBBACBACCCAAACBABBAAA.exe" start= auto displayName= "UserDataSvc_AABCACAABBCAABACCBBCABCACBBBBBBABBBBACBAABACABCCBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABCACAABBCAABACCBBCABCACBBBBBBABBBBACBAABACABCCBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5588
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABCACAABBCAABACCBBCABCACBBBBBBABBBBACBAABACABCCBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2840

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBABAACBBBCABABCCAAACBABBACBCBABBBACBACCCAAACBABBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBABAACBBBCABABCCAAACBABBACBCBABBBACBACCCAAACBABBAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4452

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCACCCBBAAAABBAAACABCBBABACBBACCBBBCBBACCABCCAAACAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCACCCBBAAAABBAAACABCBBABACBBACCBBBCBBACCABCCAAACAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2980

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBABAACBBBCABABCCAAACBABBACBCBABBBACBACCCAAACBABBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBABAACBBBCABABCCAAACBABBACBCBABBBACBACCCAAACBABBAAA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 a8c98077afe9e752afc34a2c60b77edbea8b79fdec2adffbda33268ffd1a36a6
MD5 7153ac43e7600ba5752e800823cdfbe9
SHA1 a3c8a6d7c837d7328de7cf186213c1f6595b0b7c
SHA512 403f98a11192d1a0536c5b1f82e47c6cc158ae7093dd71a4102c01c7c7b7d6231ddf5e4aa96330961b15dfc70a691db1b674eb48790c5af96990f2a4d66b8f9d
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 15.7MB
SHA256 e82a8622c8adac93cdaab4ba65b75b7e7381cae39d8e5d8466ea6e5395fba826
MD5 99f2769b717f8a8be1459da0b0af1e6d
SHA1 019891fff4f97da50deec8ba0017b3429b77540b
SHA512 ea8e901707ba4447d44579460bc143e64e81517b918ee7106810425ede7e4dce5d360076d3e39e12631d4bc855e09d355072b9e85adbd5a6513fa692e23e99ba
SSDEEP 196608:27APhNNECwHrc8u3x3AEcq/fByuKlWH3CTou5+gZ2jl:2ahvQHrc8u3xXJ/f4uUWHi2R
TLSH
T18DF6AE13B35681E6C06AE2B88A474322E7B9BC440334A7DB12D5B7692F77BE4573B350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 f142d43004938fb80eef05c3b063f7451e3d8804c1da7f853c0fc6c84055bfe0
MD5 a28527ba24282024c6b46838538a52f2
SHA1 c2df85ab9cd4f9078d3f787e7bada43a36577706
SHA512 c2b4cf07df1391f4849d4b381fc9171fee5c499b1d7fd13486cd1bc68bf6c044311457d23c0d0730b9235324d8ef5337af8d437253144259aa75cbada92ed7e3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\sw\qap`g`v~dtlq
Size 10B
SHA256 6f24d20adee5588e72d8a1ddb0d32e4200fe8cfb88a1c26f9b18f143fb3df987
MD5 370661456034a5252406d285b2fe75fa
SHA1 9f009c21daa04870a5087b5bc6e85106ea73e9f7
SHA512 c75f632ed77dce27f79b7b2ad2f8b57dd90a8c9892b4c566ce60625e63d936cb6aa45c717060fd148597a62a1a5c41ec7049c69d0dc043947174f2ff7d4d040d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ta\qap`g`v~dtlq
Size 10B
SHA256 1bb8f7c154c93cc6a16fae6790f63cb5afd25fd61d34d53bf125978a682b6703
MD5 c0b6a6165013fea242e163ce78a4943f
SHA1 e9c37931a9d1905e6c57835bdbfce955f35a3b68
SHA512 99a93ff7339b86c93e5a116a263c84848c8904fc72272e26c521646fe9a7cd112d4df2fe47b45f9e07d8319e4d6d5d49db8fd6779427f7c3b89d92ee2471ce43
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 99d32a715de05b811112e5e9d5ea49338ba50d1318881fa4be8b900823e6234e
MD5 f59fd9fbac845a5738b8b91c1fc23f2c
SHA1 69343c49e88478f22da3a11c308062e91f59cfac
SHA512 84d4435a9f0a3f026cac152f216f3d63135f1d0d0bc5bd2039d980161d6baa577e3c32ee9944e251fc84c0ccc20f0cd25f3819260bb2d28e4054edb4fc83888a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 573a03574d191f240449a0a2962d6af3568ba15e97d88c0661cff4b358237aa6
MD5 f2e1b1df37fb9f3da188a85d55d22c29
SHA1 8c998e39ffc0a55e15c60b75de5b5de7d2e29920
SHA512 420b1e6b1ab1e38977f33cefd4e7f6f0fc2e186353c3f464885d3e33969da09094426209a1317ac2485212548fcbf649f682bec88b2c1436a31fc4777ac3c756
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5bdee94c3a0bd791098fd4821cd27a34e94c9d987498908bd3142e86bee45035
MD5 76be302aeed1b3f3875fedf28f3b5b93
SHA1 72dbf886f4aa803ea65b48e43b207d783b2446ea
SHA512 d5ef64c1301ebb55d7601cbeb6acdb55a7e28867433bc0650ce4c9cbaafc9dd4f4154b7b0dff97e63b2480eeede9ca9eaf7a199970a3b6bef1ed257d462fc088
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 240299a879d5e9c7bbf9e2734f009832a1eaf19555c635f1abdfdf9ddeddbc03
MD5 6fdc352030c0664f538a21f013ecb3f9
SHA1 2992dbd06f0c15a386b0b0e7af6ea86b06a6d634
SHA512 fd6b8b08238c7f16b4fa055cf3490d2b9a5ee1c89b90d991c41f96451a31b3d805c6cf972b49de20c3a88ecf6da604da6b30ff5484be26ce7d784ad7cff9987f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 54deecdf90f5765d1b8e8ed3b9ecd30b41c9cbc88e3a52e70f355e86e3ed16d0
MD5 5c444691308e8d6a085bd2e782a8d48b
SHA1 dca6cf69f55230fce2bc03fc01bab844e6637bbb
SHA512 20c5b35a9f2fb9a8d6861818b689ef6f45e02cbc7c6a24bddae53721e6d68651aff602d6c851ba202106cbe211c546c4f33e9a377d420b8ea2b5195f7a62a916
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d68094c247543dbb566b7e94c707c7cc0c97c17e390f0e8ca78500fea6765e93
MD5 ef42a64090d4b0488e38930e86ab4960
SHA1 b5258fc95c80dac0fb4604172fb87fd0b8d64df5
SHA512 80985fc2d6ee1afc42e44f98848c042a8d50fe0c921f8d33737ca3749cc70ada3e3275777978e51acb56f936751d7cef2c9c0d15b7b06e2b2e144b5a27901a6f
MD5 SHA1 SHA512

Submit Download

svchost_ABBCBABAACBBBCABABCCAAACBABBACBCBABBBACBACCCAAACBABBAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBABAACBBBCABABCCAAACBABBACBCBABBBACBACCCAAACBABBAAA.exe
Size 15.1MB
SHA256 27007ddc81a8f178b868df3e43a3d73e25ec82cea9d17a12828beb7dadbaa2eb
MD5 71f0bda6c70d8826978be4ea1eec93de
SHA1 049d6b83254b1a6941cedb2f0c1d6655f06ddddb
SHA512 1bfc0b8dbf1c1b789e506f3458e85f5752d4a2d898da7229fbeee98b68668a2ac98e62d080ab2519bc39a6fded7c0a984291519ad5c172e6848ccf770fb0faff
SSDEEP 196608:27APhNNECwHrc8u3x3AEcq/fByuKlWH3CTou5b:2ahvQHrc8u3xXJ/f4uUWHs
TLSH
T114F69E13B35681E6C02AE2B88A474322D7B9BC440334A7DB16D5B7692F77BE45B3B350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 f31b4e3fadf3c2953b4612d35dd44e8f290d57579f6dd8c56c3dce9832a13168
MD5 016773a95a7345fdda54a5ef316581dc
SHA1 79fe1f48a1ec4302de94afe0a13d25d0a207af1d
SHA512 c9519da808f7a28d7df5397232e6894cc4a29ea861feb2de31d33bd090a81c5dc530bf9c603da7fd86f4f03bbf18ec5abd9946383ad4ed993b5387febb6401ef
TLSH
T16B11AB62F065D8A3F93028DB892DDAC71CE83A5E7D5CAB1C6305811C675AC3BDD1D8E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2952-72-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/2980-69-0x00000000008E0000-0x0000000000901000-memory.dmp

Download

memory/3184-33-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/3184-23-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/5020-0-0x0000000000120000-0x0000000000141000-memory.dmp

Download

memory/5020-7-0x0000000000120000-0x0000000000141000-memory.dmp

Download