2d120d2a85b358f0e7b15cbb9a9f6699ce900d3db80f7dcfafdfd051f03d6625

Analysis

max time kernel
149s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 06:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_3188b871b0473b4531b537a41b0374cf_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Size 15.8MB
Sample260910-hd5vcszcma
SHA256 2d120d2a85b358f0e7b15cbb9a9f6699ce900d3db80f7dcfafdfd051f03d6625
MD5 3188b871b0473b4531b537a41b0374cf
SHA1 c0675f064d703f3b5d7ba9fe9a7143aa6e431134
SHA512 ee0ed9132a5cd96ef29ece044e131d1bd3d2723e4dd2cf4f11990c3df2396bbccd0886c9df27384c19f94175bdbd550177c18df81564a3eab1301ab1ec92e294
SSDEEP 196608:uxsk7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouH:eahvQHrc8u3xXJ/f4uUWHi
TLSH
T1B6F69E13B35681E6C02AE2B88A574222D7BABC440334A7DF12D5B7692F77BE4573B350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Custom signature

Detects executables packed with Dotfuscator 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024762-20.dat	INDICATOR_EXE_Packed_Dotfuscator
behavioral1/files/0x000200000000071b-92.dat	INDICATOR_EXE_Packed_Dotfuscator

Custom signature

Detects executables packed with SmartAssembly 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024762-20.dat	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/files/0x000200000000071b-92.dat	INDICATOR_EXE_Packed_SmartAssembly

Custom signature

Detects executables packed with Yano Obfuscator 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024762-20.dat	INDICATOR_EXE_Packed_Yano
behavioral1/files/0x000200000000071b-92.dat	INDICATOR_EXE_Packed_Yano

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCCACCACCAACBAACBCACCCAAAABBBABAABAACCBBBCBACACABACCABB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCCACCACCAACBAACBCACCCAAAABBBABAABAACCBBBCBACACABACCABB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1124	svchost_CCCACCACCAACBAACBCACCCAAAABBBABAABAACCBBBCBACACABACCABB.exe
448	svchost_BBBBCABCCABBAACBCAABACACABACBBCAACBBCAABABBACBACBABCBCC.exe
2700	svchost_CCCACCACCAACBAACBCACCCAAAABBBABAABAACCBBBCBACACABACCABB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CACBACCBBCBBBBCBBACBACABCBAACBBACBABABBCACCCCBCCAAABCABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCACCACCAACBAACBCACCCAAAABBBABAABAACCBBBCBACACABACCABB.exe"	2026-09-08_3188b871b0473b4531b537a41b0374cf_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CCBAACACBCCBABAAACABAAABAACACCCAAABCCABAAAAAAACBAAABCBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBBCABCCABBAACBCAABACACABACBBCAACBBCAABABBACBACBABCBCC.exe"	svchost_CCCACCACCAACBAACBCACCCAAAABBBABAABAACCBBBCBACACABACCABB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4524	sc.exe
2132	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3512	cmd.exe
4224	cmd.exe
4392	cmd.exe
2720	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_3188b871b0473b4531b537a41b0374cf_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCACCACCAACBAACBCACCCAAAABBBABAABAACCBBBCBACACABACCABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBBCABCCABBAACBCAABACACABACBBCAACBBCAABABBACBACBABCBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2412	schtasks.exe
2412	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3828	2026-09-08_3188b871b0473b4531b537a41b0374cf_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
3828	2026-09-08_3188b871b0473b4531b537a41b0374cf_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
3828	2026-09-08_3188b871b0473b4531b537a41b0374cf_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
3828	2026-09-08_3188b871b0473b4531b537a41b0374cf_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
1124	svchost_CCCACCACCAACBAACBCACCCAAAABBBABAABAACCBBBCBACACABACCABB.exe
1124	svchost_CCCACCACCAACBAACBCACCCAAAABBBABAABAACCBBBCBACACABACCABB.exe
1124	svchost_CCCACCACCAACBAACBCACCCAAAABBBABAABAACCBBBCBACACABACCABB.exe
1124	svchost_CCCACCACCAACBAACBCACCCAAAABBBABAABAACCBBBCBACACABACCABB.exe
2700	svchost_CCCACCACCAACBAACBCACCCAAAABBBABAABAACCBBBCBACACABACCABB.exe
2700	svchost_CCCACCACCAACBAACBCACCCAAAABBBABAABAACCBBBCBACACABACCABB.exe
448	svchost_BBBBCABCCABBAACBCAABACACABACBBCAACBBCAABABBACBACBABCBCC.exe
448	svchost_BBBBCABCCABBAACBCAABACACABACBBCAACBBCAABABBACBACBABCBCC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3828	2026-09-08_3188b871b0473b4531b537a41b0374cf_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Token: SeDebugPrivilege	1124	svchost_CCCACCACCAACBAACBCACCCAAAABBBABAABAACCBBBCBACACABACCABB.exe
Token: SeDebugPrivilege	2700	svchost_CCCACCACCAACBAACBCACCCAAAABBBABAABAACCBBBCBACACABACCABB.exe
Token: SeDebugPrivilege	448	svchost_BBBBCABCCABBAACBCAABACACABACBBCAACBBCAABABBACBACBABCBCC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3768	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 3512	3828	2026-09-08_3188b871b0473b4531b537a41b0374cf_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe	98
PID 3512 wrote to memory of 2412	3512	cmd.exe	100
PID 1124 wrote to memory of 4668	1124	svchost_CCCACCACCAACBAACBCACCCAAAABBBABAABAACCBBBCBACACABACCABB.exe	101
PID 4668 wrote to memory of 4800	4668	notepad.exe	102
PID 3828 wrote to memory of 4224	3828	2026-09-08_3188b871b0473b4531b537a41b0374cf_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe	106
PID 4224 wrote to memory of 4524	4224	cmd.exe	108
PID 3828 wrote to memory of 4392	3828	2026-09-08_3188b871b0473b4531b537a41b0374cf_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe	109
PID 4392 wrote to memory of 2132	4392	cmd.exe	111
PID 1124 wrote to memory of 2720	1124	svchost_CCCACCACCAACBAACBCACCCAAAABBBABAABAACCBBBCBACACABACCABB.exe	114
PID 2720 wrote to memory of 2412	2720	cmd.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-09-08_3188b871b0473b4531b537a41b0374cf_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_3188b871b0473b4531b537a41b0374cf_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCBABBBBBAAACBAABBBABBBBABABBACBACBBCCACBBAABCCCBCCCACACCACAABAABAABCBBCAACABCBCACBAAACCCBACABBBCAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACCACCAACBAACBCACCCAAAABBBABAABAACCBBBCBACACABACCABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCBABBBBBAAACBAABBBABBBBABABBACBACBBCCACBBAABCCCBCCCACACCACAABAABAABCBBCAACABCBCACBAAACCCBACABBBCAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACCACCAACBAACBCACCCAAAABBBABAABAACCBBBCBACACABACCABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCBABCAAACAACBCBCABBCAAAACABAACCBBCCBAACAACAABCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACCACCAACBAACBCACCCAAAABBBABAABAACCBBBCBACACABACCABB.exe" start= auto displayName= "UserDataSvc_ABCBABCAAACAACBCBCABBCAAAACABAACCBBCCBAACAACAABCBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCBABCAAACAACBCBCABBCAAAACABAACCBBCCBAACAACAABCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACCACCAACBAACBCACCCAAAABBBABAABAACCBBBCBACACABACCABB.exe" start= auto displayName= "UserDataSvc_ABCBABCAAACAACBCBCABBCAAAACABAACCBBCCBAACAACAABCBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCBABCAAACAACBCBCABBCAAAACABAACCBBCCBAACAACAABCBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCBABCAAACAACBCBCABBCAAAACABAACCBBCCBAACAACAABCBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2132

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACCACCAACBAACBCACCCAAAABBBABAABAACCBBBCBACACABACCABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACCACCAACBAACBCACCCAAAABBBABAABAACCBBBCBACACABACCABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAACAACACACACAACABCBCBBABAACBACACBABABBCCCCCCABCBCBBCBBBAAACCBABABABBCBABBBCBBCABAABAABCACAACBACBBACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCABCCABBAACBCAABACACABACBBCAACBBCAABABBACBACBABCBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAACAACACACACAACABCBCBBABAACBACACBABABBCCCCCCABCBCBBCBBBAAACCBABABABBCBABBBCBBCABAABAABCACAACBACBBACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCABCCABBAACBCAABACACABACBBCAACBBCAABABBACBACBABCBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2412

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3768

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCABCCABBAACBCAABACACABACBBCAACBBCAABABBACBACBABCBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCABCCABBAACBCAABACACABACBBCAACBBCAABABBACBACBABCBCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:448

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACCACCAACBAACBCACCCAAAABBBABAABAACCBBBCBACACABACCABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACCACCAACBAACBCACCCAAAABBBABAABAACCBBBCBACACABACCABB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 89a4c999a5e6cbd52174984f75610ad980f58089cdb6d69489249b5a0d6052ff
MD5 5d3ef2250c81ff175500a9abcde3b11f
SHA1 02ab8b22777a79de916dabcbaa7fb546e8ea08e3
SHA512 210d6fa7359b63b18bd5e5ea7733e3e830aea9ffcd190187b44b9ff6316dd29901661bb4e0e9943cd5d6598ebceeeb151db922a5dc45b3f0c811cd297fd8ed4e
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 16.2MB
SHA256 45659847c2a8413726fc14796e0ee641b6530949256b47fbaf8a2e4d21cfac8d
MD5 feaf2cb3e891aa3aa49e9a2f9fa1bb5d
SHA1 0edd3f10e04535578aa9f0c0691aadbdaa4ef828
SHA512 8ab73defea5d58b17d2833a7eee4030c3c1bba4d776d2c861864a7f6ef72431c63477295901dd21d85b784eca0bbf000da0525508b6847caf9f3aef7bdbe3107
SSDEEP 196608:uxsk7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTour:eahvQHrc8u3xXJ/f4uUWHU
TLSH
T1DD07AE13B35681E6C06AE2B88A574222D7BABC440730A7DF12D4B7692F73BE4573B351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 3bc6761990ac8db629f7d23c80399b63277b8c16301e04bf96a13e7c981cb6c4
MD5 cdb4a1558b78bcc139869afaa4f9773b
SHA1 78be785b99787b4a7d1cde84579228578f8dc2c1
SHA512 5933c19c38e2722b5aed3a8ccd9309a7f7d91cbf8bffd51f0e0fa5a4d0e2d3372666dc11efd6ce657e0e27a21b02dc5597aa3c9b42825284f369f062030a2d18
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\qap`g`v~dtlq
Size 10B
SHA256 60a5a75c222e67b53110c22131aa42e998a67afc08bec94fe7c4adaf0c5d7ebd
MD5 91d2c098f1031f4ffc1e33e427141936
SHA1 c67abb5fd9f8dce7a2771e1f231f6e77dc75a3b3
SHA512 9f849ba32caa8cf9587d4a628396208ada1ed2c69297d2fef05fa528d00393b3f8fc8a286b13370ea5834edbf1a508926a6443214a25a4dec8f91aad17f92641
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\component_crx_cache\qap`g`v~dtlq
Size 10B
SHA256 819f301e1df84531dd6c4770d237e8c13e7b7167d782fbef42fc75fac6bd0572
MD5 0c639d279a67a29e8a60339fa6c5964f
SHA1 19a51a7175e7caaa1113e5b8d8459b5cbe86f135
SHA512 a222ae8db160b1cc5034ee6e6e94be45e914ddee33944353f65694b4b3cea3df44d8c748386c484433561fd6637d987ccdbdc42b6630f694787efa4475ed4357
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\sv\qap`g`v~dtlq
Size 10B
SHA256 50d467deadc4b1c93b2fceed97edd95ea0d01598371cf94f65cc074311193df6
MD5 1629332e3968724e34493f58c40ac779
SHA1 db6717e550c23b9a5e04a6228e0dee9e892a1d71
SHA512 3416c80f0f0e724e79655a8564d51d5a88cda6ddfd4c70b40334ed18ab08b2cf2b104c8baca1cecbeb4ec509b556c53c16f7c4fa0652089bcd394d06a7957428
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\AC\INetHistory\qap`g`v~dtlq
Size 10B
SHA256 bd5f150a2cf5533399a10f2156f7fcc01d86b92e9fc15ea75c0fe5a723ae55d1
MD5 783961262f2bd05ca690fc6669a33044
SHA1 b8e496cea34d0f97f2e0c265554df63bf0b2f596
SHA512 f4f750b32185ac1772f1fce44b5cbb29c7140aa938d6a53793f950c2e73cc34553683e7dfd0dc67fefe7fc5d8c863080bdd42c568cfbf5e311982a091e362a7b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\SwitchStep\qap`g`v~dtlq
Size 10B
SHA256 e37d3f6033644aeb8c35d3f0f6e6812eaecfae4fa6a27d0f5ba5ac4e3b9df4b4
MD5 e68825c0a3737bba1ef6b09af078e9a5
SHA1 e34f13325c4f22b734e89543d358d5a1df554d6b
SHA512 a6c5ed6e9fc4b2412beec686ab33405b56a4d3e5d397bdff8e3f666777b13f223367b6516e5d52334466efd79b08b13f8ebf25cd23ef46f78111685b17c5cdf2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 361aeea6f4f77cb39d6ad82befa27fcaa2d8839349a36f29ff47b8e6218c40a7
MD5 cc24e0d987e0c9df62ef74dbc0fa2f31
SHA1 5e85f1841007ca6a2ae3cac5fbcc59cd8bcc3078
SHA512 68971f5308f7ebde344dac9ac08b1ae790c5e2dccb630c1cebcc4d2a6663e466e75085e917ab94560ae9dc286b708ab33da7ec50a3bb7e1cfc590fadbeb5da1c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7a1b3f4734fe19c7af7eaddca2a673304e5de153cb3b4dcc1492ad41688545ab
MD5 6ed7de8d3c0c1a7faee45e245617d779
SHA1 ec9a6bf4c7cb5e3ad04b83bfea534ce157d1d2b8
SHA512 ddac46bb82000775538ae79c5233c348a6c22143235565c348dbea299d1289a02b7548ddb77a78739f895a8f4c41aaa2fc2dafd93d21cc0a81505a109a5c8012
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2dbe800a81fe7ff1a3c18bc7d2e7441db197b89c9abfee82b0493520f1502b8e
MD5 f2d92ca99a20bd1c6ed1f44ab2cd6360
SHA1 a5c7988c94f774fa35a9eacb89e2d35815d059c3
SHA512 61ffa3db9b928fb91ef2b038de473a7e7fe4946cbd04aada6553694ec56a76097821af1db1095a2e4d4aee39a003813d60635fc48b027240f01edc7836bb06e2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d4c8843dd737678045d6dc33b7007b287278b893f142ea9b5a2c86ece55e106c
MD5 5e65e685c3010c97d420194dcb147534
SHA1 9ccad8123fe8fdcc207be76f98cdc607180f53a2
SHA512 137f4ac15ca9e17160403668a377b30927b48e709718fa62a8d987a08875fef20f47cd6e4ed52c4a3a98a1bca9b5de08f9265d57d9b8e24e8361d8129793ac18
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d17f5dab60f0042f603230e287d022b743c9d4d5e9e2c13b70949bedda716b1d
MD5 e118544deda65f02b1ba0b386a13b767
SHA1 4b3cc8012ae99e521a40b3108fb1354d429e33a7
SHA512 a986355cc0d8720288d05497b5703058806104dec1b92592443f97a64de402ca03f841ed2d3fcd5a433b2de4fa2fdf641ee0b4aee188647ef506f9f633395582
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e0f7070f6666705b9b7a450fc583528d51c33e03f1b3fccc52ba5e16b2ae2876
MD5 ebc92bdc23856403ca98ae68651b09ba
SHA1 95bb77dfef09a29b57c346c723359724b8634785
SHA512 90e7b1f84fe3ef47b900e41f5f367675c96442ab639d0e610559ae7b9abe769e088e295c34c307a6f6b36425f494376e264ecf4503db14719bec928bba4d60c9
MD5 SHA1 SHA512

Submit Download

svchost_CCCACCACCAACBAACBCACCCAAAABBBABAABAACCBBBCBACACABACCABB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACCACCAACBAACBCACCCAAAABBBABAABAACCBBBCBACACABACCABB.exe
Size 15.8MB
SHA256 2d120d2a85b358f0e7b15cbb9a9f6699ce900d3db80f7dcfafdfd051f03d6625
MD5 3188b871b0473b4531b537a41b0374cf
SHA1 c0675f064d703f3b5d7ba9fe9a7143aa6e431134
SHA512 ee0ed9132a5cd96ef29ece044e131d1bd3d2723e4dd2cf4f11990c3df2396bbccd0886c9df27384c19f94175bdbd550177c18df81564a3eab1301ab1ec92e294
SSDEEP 196608:uxsk7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouH:eahvQHrc8u3xXJ/f4uUWHi
TLSH
T1B6F69E13B35681E6C02AE2B88A574222D7BABC440334A7DF12D5B7692F77BE4573B350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 af52bdb839a9d4bdd07ce86f9e897d8263399027ac30525681601e06a255f388
MD5 4d360a3b41dbc2ccee0153a15e80a552
SHA1 40d5dc1ccaff3b2964e91022d612792bd0af49c1
SHA512 5274a8e66425bd488f72e4d646ff58a20a38c68d44adfbe93e84e736437c74c2d54060953b7d0e073da08c47dbeb59fa3839ac72173194270a35c07f13bf7e27
TLSH
T1ED2126A0E1A4CC23F031649765559B8608E7779FBC5CAB38330D8308FF95C3ADE094A2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 3d84aade3aba795d8d287661d591b4ea0be039e91e24a7280d06bfc9215f472e
MD5 100bdb5f20170180fb9df89c98a15813
SHA1 0bfb335f4c39b3ed4798eff4fbf4e3ec04b4aed3
SHA512 baac9278946b08efb72ce163db490a280e194a5c668301948e9d74f4b24eee03777efffed750288e98b217be39fc83135e58dba3d3dd4d810ddf1d0bb6a4bcbe
TLSH
T1A421F3B1E1A4CC63F13164D6A6559BC608A7779FAC5C9B28230D8308FF99C39DD094A2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 cb624ef46b521d9f86e885193922c6b12cb27ed97f543dac9ec94b876f420c4b
MD5 02794ba8fa2c25421f58df5037f15502
SHA1 718393c07854817bfae7febc3f54a0752c6ca57e
SHA512 d2d86e9ebeee5e05be4290efff2a1e3f288cdc1471c95b563a9215988d474e1496742eb81b29d2a2dd15cb25740f953dc8c48f561a2a64630ec6987404f30741
TLSH
T16D1104A1E1A5DC23F031649665599B8608E3778FBC5CAB38330D8308FF95C3ADD054A2
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Public\Videos\qap`g`v~dtlq
Size 10B
SHA256 d9e9bd303cc2d6004841e2eb134a3420508eea11c60102e0826301c263a50176
MD5 55da52f30abf44852c8ecc3b0dbd7aa8
SHA1 38447555ade3c8c3940a98369bd4f4cd8d0a8434
SHA512 7c0264a1ac1c40762b313761309afb76ba1aa8e973963e2c92d50d61cfd31f438606b6d9fe228f1e7bba36a1811e1e292283957f263173c9aa57747a9b625edf
MD5 SHA1 SHA512

Submit Download

memory/448-71-0x0000000000520000-0x0000000000541000-memory.dmp

Download

memory/448-3163-0x0000000000520000-0x0000000000541000-memory.dmp

Download

memory/1124-35-0x0000000000100000-0x0000000000121000-memory.dmp

Download

memory/2700-1275-0x0000000000100000-0x0000000000121000-memory.dmp

Download

memory/2700-3165-0x0000000000100000-0x0000000000121000-memory.dmp

Download

memory/3828-6-0x0000000000160000-0x0000000000181000-memory.dmp

Download

memory/4668-59-0x00000000020C0000-0x00000000020C1000-memory.dmp

Download