63c80a5d599ae76d3143fb8da1a9e8bc1190a89b7960448bce82c0694408d5e0

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 10:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_c43342a7064887bc847973b5c7d83bba_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe
Size 52.4MB
Sample260910-mz8wcssaqb
SHA256 63c80a5d599ae76d3143fb8da1a9e8bc1190a89b7960448bce82c0694408d5e0
MD5 c43342a7064887bc847973b5c7d83bba
SHA1 569ce3a9d52f12e87c1b112076f97973da0c20dd
SHA512 cd4355d37adcce43b9bf4f7346d3bd7923d354f497a0a5338296ebe0cbb74bc091dd914b843fd830c113de98d212b476892141a9104afbe5ecee0d61a4e1f5f5
SSDEEP 196608:6m/mm/mm/mm/mmEFIF0wumm/mm/mm/mm/mmEFIF0wumm/mm/mm/mm/mmEFIF0wuo:O666Zv
TLSH
T1B5C77C05F98244F1D967417049DBD27ECA70BA2587228EEBF74C871BAF23B91AC39711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCCABBAACBCCAABABCAACACBABCBCBABACBAACCCCABABBACACCAABB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCCABBAACBCCAABABCAACACBABCBCBABACBAACCCCABABBACACCAABB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1460	svchost_CCCABBAACBCCAABABCAACACBABCBCBABACBAACCCCABABBACACCAABB.exe
4308	svchost_BACBBBAAABBBCBABBABBBABBABCAACBCCABCABBBCBCBAABACBAABCB.exe
1448	svchost_CCCABBAACBCCAABABCAACACBABCBCBABACBAACCCCABABBACACCAABB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BACCBBBABACBBBCACCBCAACBBBBBAACBABCBACCCCABABCABACCABABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCABBAACBCCAABABCAACACBABCBCBABACBAACCCCABABBACACCAABB.exe"	2026-09-10_c43342a7064887bc847973b5c7d83bba_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BCABBAAABBCAAAAACBCACCCBABBACCBCBBCABCAAAACAABACCABBBABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACBBBAAABBBCBABBABBBABBABCAACBCCABCABBBCBCBAABACBAABCB.exe"	svchost_CCCABBAACBCCAABABCAACACBABCBCBABACBAACCCCABABBACACCAABB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
792	sc.exe
2648	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
924	cmd.exe
3200	cmd.exe
4864	cmd.exe
2004	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCABBAACBCCAABABCAACACBABCBCBABACBAACCCCABABBACACCAABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_c43342a7064887bc847973b5c7d83bba_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACBBBAAABBBCBABBABBBABBABCAACBCCABCABBBCBCBAABACBAABCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3372	schtasks.exe
2944	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1472	2026-09-10_c43342a7064887bc847973b5c7d83bba_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe
1472	2026-09-10_c43342a7064887bc847973b5c7d83bba_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe
1472	2026-09-10_c43342a7064887bc847973b5c7d83bba_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe
1472	2026-09-10_c43342a7064887bc847973b5c7d83bba_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe
1460	svchost_CCCABBAACBCCAABABCAACACBABCBCBABACBAACCCCABABBACACCAABB.exe
1460	svchost_CCCABBAACBCCAABABCAACACBABCBCBABACBAACCCCABABBACACCAABB.exe
1460	svchost_CCCABBAACBCCAABABCAACACBABCBCBABACBAACCCCABABBACACCAABB.exe
1460	svchost_CCCABBAACBCCAABABCAACACBABCBCBABACBAACCCCABABBACACCAABB.exe
1448	svchost_CCCABBAACBCCAABABCAACACBABCBCBABACBAACCCCABABBACACCAABB.exe
1448	svchost_CCCABBAACBCCAABABCAACACBABCBCBABACBAACCCCABABBACACCAABB.exe
4308	svchost_BACBBBAAABBBCBABBABBBABBABCAACBCCABCABBBCBCBAABACBAABCB.exe
4308	svchost_BACBBBAAABBBCBABBABBBABBABCAACBCCABCABBBCBCBAABACBAABCB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1472	2026-09-10_c43342a7064887bc847973b5c7d83bba_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe
Token: SeDebugPrivilege	1460	svchost_CCCABBAACBCCAABABCAACACBABCBCBABACBAACCCCABABBACACCAABB.exe
Token: SeDebugPrivilege	1448	svchost_CCCABBAACBCCAABABCAACACBABCBCBABACBAACCCCABABBACACCAABB.exe
Token: SeDebugPrivilege	4308	svchost_BACBBBAAABBBCBABBABBBABBABCAACBCCABCABBBCBCBAABACBAABCB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4240	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 924	1472	2026-09-10_c43342a7064887bc847973b5c7d83bba_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe	96
PID 924 wrote to memory of 3372	924	cmd.exe	98
PID 1460 wrote to memory of 552	1460	svchost_CCCABBAACBCCAABABCAACACBABCBCBABACBAACCCCABABBACACCAABB.exe	100
PID 552 wrote to memory of 4560	552	notepad.exe	101
PID 1472 wrote to memory of 3200	1472	2026-09-10_c43342a7064887bc847973b5c7d83bba_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe	105
PID 3200 wrote to memory of 792	3200	cmd.exe	107
PID 1472 wrote to memory of 4864	1472	2026-09-10_c43342a7064887bc847973b5c7d83bba_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe	108
PID 4864 wrote to memory of 2648	4864	cmd.exe	110
PID 1460 wrote to memory of 2004	1460	svchost_CCCABBAACBCCAABABCAACACBABCBCBABACBAACCCCABABBACACCAABB.exe	113
PID 2004 wrote to memory of 2944	2004	cmd.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-09-10_c43342a7064887bc847973b5c7d83bba_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_c43342a7064887bc847973b5c7d83bba_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCBABAABBCCCCCBCACAACBBBCCABCACBCACAABCCBABCBCAACCCBAAABBCAAABBCAACBAAACACBACACCABCCCBAACCACBAACBBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABBAACBCCAABABCAACACBABCBCBABACBAACCCCABABBACACCAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:924
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCBABAABBCCCCCBCACAACBBBCCABCACBCACAABCCBABCBCAACCCBAAABBCAAABBCAACBAAACACBACACCABCCCBAACCACBAACBBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABBAACBCCAABABCAACACBABCBCBABACBAACCCCABABBACACCAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBACACCBCABBCBABBBCCBACACAACCCAABCCCACCBACBBAACBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABBAACBCCAABABCAACACBABCBCBABACBAACCCCABABBACACCAABB.exe" start= auto displayName= "UserDataSvc_BBACACCBCABBCBABBBCCBACACAACCCAABCCCACCBACBBAACBAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3200
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBACACCBCABBCBABBBCCBACACAACCCAABCCCACCBACBBAACBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABBAACBCCAABABCAACACBABCBCBABACBAACCCCABABBACACCAABB.exe" start= auto displayName= "UserDataSvc_BBACACCBCABBCBABBBCCBACACAACCCAABCCCACCBACBBAACBAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBACACCBCABBCBABBBCCBACACAACCCAABCCCACCBACBBAACBAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBACACCBCABBCBABBBCCBACACAACCCAABCCCACCBACBBAACBAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2648

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABBAACBCCAABABCAACACBABCBCBABACBAACCCCABABBACACCAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABBAACBCCAABABCAACACBABCBCBABACBAACCCCABABBACACCAABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:552
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACBABBBCCACCCAACCACACBBBACBBABBAAABCAAACCCAACCCBCCBBCCBAACBACCCCBAACAABBCAABBBACCBABABBCAABACBCBBCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBBAAABBBCBABBABBBABBABCAACBCCABCABBBCBCBAABACBAABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACBABBBCCACCCAACCACACBBBACBBABBAAABCAAACCCAACCCBCCBBCCBAACBACCCCBAACAABBCAABBBACCBABABBCAABACBCBBCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBBAAABBBCBABBABBBABBABCAACBCCABCABBBCBCBAABACBAABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2944

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4240

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBBAAABBBCBABBABBBABBABCAACBCCABCABBBCBCBAABACBAABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBBAAABBBCBABBABBBABBABCAACBCCABCABBBCBCBAABACBAABCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4308

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABBAACBCCAABABCAACACBABCBCBABACBAACCCCABABBACACCAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABBAACBCCAABABCAACACBABCBCBABACBAACCCCABABBACACCAABB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 9a392604c551e10bfa80c74c1a7bfd99286123fbbc1aa7fa00513817c6af0fdb
MD5 2708e6128fc9ef9befe93796cc6b2de6
SHA1 d865b3d65150cfcbf5e09a454e360d8ce596644e
SHA512 c49f575c76ef92ea521e8ff6e185093ed9395261888c09de679ae8dad6410ab64a7e758c8a0ae5e83949e9d1c1ef333e0177f81546e2b772d43066dacd4bfe0f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\windows.immersivecontrolpanel_10.0.2.1000_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 1f5c847d5ff769808df6c3482cf72e9a96f3651d90703aadf08e4181472cea82
MD5 79473b5e75171cb34f095aae04093354
SHA1 418eeb147e50e6b0c272e4f2c2301a4ef72ff777
SHA512 6fb274d189c6ec021d96c5519a01d4f81ad102267ce48a9e06679a28cc200883cd9dbf7659f16cec2c9e59f13df6363ae4c804a70472959770ced48adf2e6ed3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 7002951e9a092421f7f27c5e6d5a2162b406bed15bbf4d589cc6542e1022f18f
MD5 b83a2c8ec91a612d2048b501eaef8fed
SHA1 2a1e32640fa727442cd30fcafa211293daf7717a
SHA512 72a273a39c2a1ad32b204edbdb5ed1a6484f3b2bd247e8885d9818ad2957b5785d6180913fb14572cf3fa2c79a087744e896726d9a8fadc658ed604a90a542b1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 afe102ec4427b842323dbe1f602d68816255cd464b2fbc35a7f774c4a40b052b
MD5 ed8a2e93f4d70701f215ad7d77fc6d20
SHA1 f42ac0614b741f39ca666935bcb94a57ca192f8c
SHA512 c400f2c8f32f3f65357e1ffc22d1ae6fd508ee5e9e79ed763790a7b163e63d320483343963d58650a9fb643cff69edc8f0c444b0054715169d943bc630e80099
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 13a53ef4d14e54f84bc2367f90ec4b62c81198b695e72d4ec3a9f7511ac7a5e1
MD5 293a2f68aa9d921fa54fc84193552ce5
SHA1 c7aa1998f9287bed2d79f7adf3b6ca4854eb046b
SHA512 344ec452a9d7d09340ada406f8bc8421b20acd103789359ad77e8a633c37d780f3a352e09a75a79b5c7124e5dc20e030939ce6fc557b7410350dcb94c3ba6636
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\qap`g`v~dtlq
Size 10B
SHA256 fc2c06b8a6632d6c07629dbad95ac67513f1b3006207a1a835be0d4a96fe055c
MD5 a2d790328c97bf6d157f1a409f2f6d26
SHA1 2c63dd0b85d309a27e820467ed066e7bc981aef8
SHA512 4b02276e29e2608e0165d4ff3944570e02c4f83ca09be8fce40b2c0f2903122851f529f6510b243d7e54428650deb3c8961cfec22d80f8ec41023c4d236aa7d8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 c2b273fd1cdc8e89e48589fbb6524e6e298f333f036e6bf983759bfb0a3a7af7
MD5 2a1bec951ac9f9ded1c7ed4e63a9582e
SHA1 4599462b5af0c0cf93e2c9451d25f15ad750c637
SHA512 dddedfdf9e89d05d388a0b44d8c2d1c13383d241ae2cd8a2a6f6e54c0ffa64668589858d0210d851391603e0302691ea6cfcec909b2d43f7838289aad26329f9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\AppData\qap`g`v~dtlq
Size 10B
SHA256 b49033ece6beb19d2bec2b900fedef1469f4e232e280d5c6831ee644988dd33a
MD5 ce5beda4e07bf5d5c4c69d4d71e2efec
SHA1 a0b345e5a1a888db072572659426af2792709e7e
SHA512 b9202302da7d49dd203fc6dde7bbc07075cd0f102c27fbda0ed962c753a855ed01d1e744e4cc0c7607f96c4fb3cb0771b86424ec0679eef219099d06d5783885
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\SmartArt Graphics\1033\qap`g`v~dtlq
Size 10B
SHA256 bfe76af061637a17e3b1c3088fefb6a460099a70cd8a7d48b3d70bfff0afd0be
MD5 fb667973d3c641997f3babef4ebffd0a
SHA1 600e8c3184a854dfb20f711fa64b754ca02a5740
SHA512 dfcec1c26b6ff66082fa5296b8eb2b50ab29142bf506eb7d7943cc9504dfb80b3a899eed2c8061f0ee5cc82d87da6b15d38215472950c132960f4b5a86e93c83
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2c246ef787b16641a2545176cce04f471d05b6101c20cf52feaeef8994236460
MD5 f8f2c871f0d5355f71dae7fade295ce1
SHA1 3e76a05973431945c2f7f27129906cd7a0e5228f
SHA512 8b9c5da64aa9a0e593e197884fa20b35d9cb7f317e8f3e79abac0d07d53461fc61861240656839be897011b461f711005b8be286faf01a2ea7f27fc1ccaf7de6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9a89819eb99e0f0914070b664e2b2cab3f4345340c93d389f5e1c8d3535a0826
MD5 431f0620f5bca5cdbeac29451347a657
SHA1 140343bbf31d08a42554c4ed449e69b6ac069179
SHA512 9d497a37d6f2f46a7867d114fd7807cb518cbb997ac17afa06db96a45ae33e455e2587e9c67e4bdfc0ef1afba555916644b90c555d8804c15f3989ef2db924fc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 396920cfd2c77b92a2a19ee832215657db6bde4353037b01580a3d0a258e8179
MD5 9023457ac22749ef9d3d9bd6404fb29b
SHA1 6be91317baa87b3179b590c69ac9c7f84058eddd
SHA512 528f45e30b64e8201ff43ca556c6a9fbc777836e1fd34f3ce42ce53b084e9aa4f85d1ddb0addb88658bbf221de694542346f6421d2f68a8bcb6c87c8e8fa92b0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 87364d38144a9e0e72d01264c4d2da772bf8af5603d274ac5233c478622a59c6
MD5 874aeca5fb719ba02ea9e86061efbbeb
SHA1 d2e5f4c2791b0b1c054139d7ea412ce71dc59665
SHA512 7128486989033bbbde6c0bbd979a92e0c3b80b775763bc7b73f4863153b6f742acac63a09f3e192b9857c738d98935e037d7d3ce03db740e57c2a67ed0fa3e1c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 15d0b8855093275afa37aab32f2bcac14b2c44fceb76f14469e5755a65f7f175
MD5 e1a37da523fbe60e0b9165f6688b8d80
SHA1 652ee9427776652f3962891a393ae97693014728
SHA512 b2c4c45b98598423638bb566eff5246ffb4bc640203ad47f8320457d73b3657468b817d8e9582a59495bcf7a2c58447dd9298e2d11702cefc7ed3802b525ec42
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7a52bc5820a87ccb6cfdab506ac6046ee4c4e7641f92cdfe02243af578423566
MD5 a6c485945ed070c1326c4976c3a85b88
SHA1 3e6d338ac19dc03c4f992addf0205a4b06f87376
SHA512 f6aa533bab6e706dc9b8f7833119418b093f6960e6921197bf4cdf96396d335f543440103a21848073196fce71654e9a6cb4aa3feae204545b26c59ea3a90c2c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates\qap`g`v~dtlq
Size 10B
SHA256 e6f0e4b0f1da73c118cc9488dc18c3e6f9873a6e7432f2062a3260f55d668deb
MD5 38b9a713319a0a10865fd3eb089eaa79
SHA1 e580e1711fe8f02254aac18a17f0f368f60dd013
SHA512 8de1f17ba4111c424854e7f86003a09ce1ca673a1752414145f5acd1e37c3abe03c769b1c172cfa29c60bc5daaed371a8c00ed94be5bda32dc6c38ebc6d51832
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 93b22fcd3f120708cbfece78660cc0e2f3ce6981b9eff2852c8069dab7fe4154
MD5 fcaa884609241515499f915da4815096
SHA1 b1e9263987e8b832957b4e8e0afe3ae910e9f850
SHA512 7db79f2a539c2df728dfdfa655f95f5f4f9d8d17f8c7f064bd54ac3660c5ae2c0c626b1c677fc885ec0ff7c975ab9e5ad6fe6dc8c582f66d1a07d0f81336ed40
TLSH
T18721EB71E0A9DC93F0F224937715CBC60DE437A7AC5CAB28630A9128F69DD354E158B2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 8be3a3413f71bfa3927aafd42cc4aa1d29bfb6d1543b49ec2dd100a3853d31b2
MD5 20531b827c33136a7c30a95de3f3e258
SHA1 bb1850fa658e8c1091f594add31c594c18486c5a
SHA512 bc87529c9bb8eaa968e7fa550c46153ebd8c2096e8754682b37e6e89026ad7bddebab4a8937346cd91641145413ba8c95a6c27d2cb64f9b1d910753c85888cd1
TLSH
T19621FC31E0A8CCA3F0F268C37715DBC609E437ABAC5CAB18530E9128E69DD354D058B1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 94d4e456aee7668a79ea1fdbf391a169b4fd60c9f987f54c16ded5a85cbaf2ae
MD5 a0ddbb1050006b6cff398952f0e34508
SHA1 740767c8c8b302e55134832bde838b343509c3c2
SHA512 badc0e0859a861b71b55ee4a5a91d386b9fcc3ed9df47f385d42ef20517b97d56115b1e72a7a57d9c55c3cea1533362a3532f5df2c9a6c8610ed517fec49340d
TLSH
T1EE110A71A0A9DC93F0F224937715DBC60DE43797AC5CAB28630A9228F69DD394E158B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/552-59-0x0000000005630000-0x0000000005631000-memory.dmp

Download

memory/1448-414-0x0000000000C40000-0x0000000000C61000-memory.dmp

Download

memory/1460-36-0x0000000000C40000-0x0000000000C61000-memory.dmp

Download

memory/1472-6-0x0000000000EB0000-0x0000000000ED1000-memory.dmp

Download

memory/4308-75-0x0000000000550000-0x0000000000571000-memory.dmp

Download

memory/4308-3071-0x0000000000550000-0x0000000000571000-memory.dmp

Download