928bb3f0cb9a52bf5d6e2aff104abc99fc547adc065d2b204bbb9ec8c7666572

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_371bca2d1246ae31197e87db073c38f0_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Size 10.5MB
Sample260808-tsrrtszgra
SHA256 928bb3f0cb9a52bf5d6e2aff104abc99fc547adc065d2b204bbb9ec8c7666572
MD5 371bca2d1246ae31197e87db073c38f0
SHA1 e859d8a9ba4e8662cfa8366b6e3cb39d75237c0d
SHA512 60f307a1b098a4a4024334eff7531484dfdfbee9dd9ad8f18507778b885271a1f0cdd793426f67296246113b7fb796d24f658dde683a0988aab4d04a771db6d1
SSDEEP 98304:kFPdLz7Upmya6iSNNEuy4v/YtfKoNewC8rc8u3xP33zkEsi:kFlP7APhNNECwHrc8u3x3AEv
TLSH
T155B69D27F29900E5C42ED178C65B8623DA7A7C554724AADF06A077252F33BF01B3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024375-21.dat	UPX
behavioral1/files/0x0002000000000721-92.dat	UPX

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBABBCACBABCAAAACCCACABAABABCBACBCAACCCCAABBBCBACCCABAC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBABBCACBABCAAAACCCACABAABABCBACBCAACCCCAABBBCBACCCABAC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3808	svchost_BBABBCACBABCAAAACCCACABAABABCBACBCAACCCCAABBBCBACCCABAC.exe
3060	svchost_ABCBACCAAABACABBABBBBABCBCBABCCBCCABBCBABBCACBAACCABCCC.exe
2992	svchost_BBABBCACBABCAAAACCCACABAABABCBACBCAACCCCAABBBCBACCCABAC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBCACABCBCBBABCABCCACABABAAACBABCCBCACCBCCBCCABBBCCAACCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBABBCACBABCAAAACCCACABAABABCBACBCAACCCCAABBBCBACCCABAC.exe"	2026-08-08_371bca2d1246ae31197e87db073c38f0_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCAABBBCCACAAABCAAACBCCBCCACACCCAABCBCACCBCCAAABABBAAABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCBACCAAABACABBABBBBABCBCBABCCBCCABBCBABBCACBAACCABCCC.exe"	svchost_BBABBCACBABCAAAACCCACABAABABCBACBCAACCCCAABBBCBACCCABAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5084	sc.exe
1236	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1976	cmd.exe
1392	cmd.exe
3056	cmd.exe
2904	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCBACCAAABACABBABBBBABCBCBABCCBCCABBCBABBCACBAACCABCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_371bca2d1246ae31197e87db073c38f0_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBABBCACBABCAAAACCCACABAABABCBACBCAACCCCAABBBCBACCCABAC.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1128	schtasks.exe
4560	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4420	2026-08-08_371bca2d1246ae31197e87db073c38f0_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
4420	2026-08-08_371bca2d1246ae31197e87db073c38f0_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
4420	2026-08-08_371bca2d1246ae31197e87db073c38f0_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
4420	2026-08-08_371bca2d1246ae31197e87db073c38f0_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
3808	svchost_BBABBCACBABCAAAACCCACABAABABCBACBCAACCCCAABBBCBACCCABAC.exe
3808	svchost_BBABBCACBABCAAAACCCACABAABABCBACBCAACCCCAABBBCBACCCABAC.exe
3808	svchost_BBABBCACBABCAAAACCCACABAABABCBACBCAACCCCAABBBCBACCCABAC.exe
3808	svchost_BBABBCACBABCAAAACCCACABAABABCBACBCAACCCCAABBBCBACCCABAC.exe
2992	svchost_BBABBCACBABCAAAACCCACABAABABCBACBCAACCCCAABBBCBACCCABAC.exe
2992	svchost_BBABBCACBABCAAAACCCACABAABABCBACBCAACCCCAABBBCBACCCABAC.exe
3060	svchost_ABCBACCAAABACABBABBBBABCBCBABCCBCCABBCBABBCACBAACCABCCC.exe
3060	svchost_ABCBACCAAABACABBABBBBABCBCBABCCBCCABBCBABBCACBAACCABCCC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4420	2026-08-08_371bca2d1246ae31197e87db073c38f0_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	3808	svchost_BBABBCACBABCAAAACCCACABAABABCBACBCAACCCCAABBBCBACCCABAC.exe
Token: SeDebugPrivilege	2992	svchost_BBABBCACBABCAAAACCCACABAABABCBACBCAACCCCAABBBCBACCCABAC.exe
Token: SeDebugPrivilege	3060	svchost_ABCBACCAAABACABBABBBBABCBCBABCCBCCABBCBABBCACBAACCABCCC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1084	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 2904	4420	2026-08-08_371bca2d1246ae31197e87db073c38f0_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe	103
PID 2904 wrote to memory of 1128	2904	cmd.exe	105
PID 3808 wrote to memory of 440	3808	svchost_BBABBCACBABCAAAACCCACABAABABCBACBCAACCCCAABBBCBACCCABAC.exe	106
PID 440 wrote to memory of 4896	440	notepad.exe	107
PID 4420 wrote to memory of 1976	4420	2026-08-08_371bca2d1246ae31197e87db073c38f0_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe	111
PID 1976 wrote to memory of 5084	1976	cmd.exe	113
PID 4420 wrote to memory of 1392	4420	2026-08-08_371bca2d1246ae31197e87db073c38f0_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe	114
PID 1392 wrote to memory of 1236	1392	cmd.exe	116
PID 3808 wrote to memory of 3056	3808	svchost_BBABBCACBABCAAAACCCACABAABABCBACBCAACCCCAABBBCBACCCABAC.exe	119
PID 3056 wrote to memory of 4560	3056	cmd.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-08-08_371bca2d1246ae31197e87db073c38f0_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_371bca2d1246ae31197e87db073c38f0_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBCCBCBACACCABCABBACCCACCCABBBCCCAABCCCABBCABBCCCCCBABCCACACACCAAABCCCCAABBBCCCBBCCABBBBBBBBACBCAABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCACBABCAAAACCCACABAABABCBACBCAACCCCAABBBCBACCCABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBCCBCBACACCABCABBACCCACCCABBBCCCAABCCCABBCABBCCCCCBABCCACACACCAAABCCCCAABBBCCCBBCCABBBBBBBBACBCAABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCACBABCAAAACCCACABAABABCBACBCAACCCCAABBBCBACCCABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBAABACCBACABABAAABACACAAACCAACBBBCABBACCBAACCBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCACBABCAAAACCCACABAABABCBACBCAACCCCAABBBCBACCCABAC.exe" start= auto displayName= "UserDataSvc_ABBAABACCBACABABAAABACACAAACCAACBBBCABBACCBAACCBCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBAABACCBACABABAAABACACAAACCAACBBBCABBACCBAACCBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCACBABCAAAACCCACABAABABCBACBCAACCCCAABBBCBACCCABAC.exe" start= auto displayName= "UserDataSvc_ABBAABACCBACABABAAABACACAAACCAACBBBCABBACCBAACCBCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBAABACCBACABABAAABACACAAACCAACBBBCABBACCBAACCBCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1392
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBAABACCBACABABAAABACACAAACCAACBBBCABBACCBAACCBCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1236

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCACBABCAAAACCCACABAABABCBACBCAACCCCAABBBCBACCCABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCACBABCAAAACCCACABAABABCBACBCAACCCCAABBBCBACCCABAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:440
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABAAACABABCBBACBAABBAACCBABABCBCABCCCCAACBAAACAAABBBCBACBABACCCAACBCCCACACCACBCACBACCCCCAACBCBAABBBBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBACCAAABACABBABBBBABCBCBABCCBCCABBCBABBCACBAACCABCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABAAACABABCBBACBAABBAACCBABABCBCABCCCCAACBAAACAAABBBCBACBABACCCAACBCCCACACCACBCACBACCCCCAACBCBAABBBBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBACCAAABACABBABBBBABCBCBABCCBCCABBCBABBCACBAACCABCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4560

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1084

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBACCAAABACABBABBBBABCBCBABCCBCCABBCBABBCACBAACCABCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBACCAAABACABBABBBBABCBCBABCCBCCABBCBABBCACBAACCABCCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3060

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCACBABCAAAACCCACABAABABCBACBCAACCCCAABBBCBACCCABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCACBABCAAAACCCACABAABABCBACBCAACCCCAABBBCBACCCABAC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 7d730efecc4ad596d85bd0ffcd3375ba1bee0032398a9097bcffd9d87211da50
MD5 36067d8a9769c5e2cd5c9830536fab54
SHA1 b0defa8ad68f686a5e9d3a5b5d67bdf840122504
SHA512 2f3094d79a571793ba4fefa31893325d01bd5aeeca0143c354782d3e89957c7afb38d4a7b6d879da86073be7f33fdc35599547c2ff79ba19a11006e62c58c17a
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 10.9MB
SHA256 09dc3cb156d1f6aa190014c6eb4d0013e152ae617cac71194e0b86bede05c614
MD5 02a35aeab3ede1179e6d4a19003729d4
SHA1 918f16419ec68802de9db085c02c3bf82b942ed4
SHA512 4af7adb1b02a2854b7c8963f87854a79d83d3d158d5803d380842dd39077c6145c317d9a61a70e0e98fdd7f039d84870d03e3ab67913d7ecd3ef9d05610fba2d
SSDEEP 98304:kFPdLz7Upmya6iSNNEuy4v/YtfKoNewC8rc8u3xP33zkEsdpiI:kFlP7APhNNECwHrc8u3x3AEW
TLSH
T178C69D27F29900F5C46AD238CB5B4623DA7A7C554734AADF069076252F33BE01B3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 a46116bf8da31e2031cb109544ac39c60bf91edc562493916abd358c6cc30471
MD5 d3f4218b5ebd717a7c18796f0b47669e
SHA1 1d8c7573581ea39f57ba75598f21764039c5542d
SHA512 8d99135fc24b665952238c84bd12bdcfbee636fefdf3d1a8fcb757704cbcdb6baa1ee3f47965a5ab031d43b3cbeeee1b592fc4321a3c329d1e854bfc287821a0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\GameExplorer\qap`g`v~dtlq
Size 10B
SHA256 407a57eec57e440a3e221de461d900a8d69ba44d7ca58275a180d25da3d7bac8
MD5 ea03bc6937553d699bbb5d7040f99a5d
SHA1 109c705b8ae70e910c99b12916643e8acde62fcc
SHA512 962558fde8770c7e432b5dc0646e79183d48aafc2a182d81d658d3c1fc2d4b1c295818d8ff813f61278793383fabd14de49586897c07ce5909f4b4a8c7591abf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 6e71551a8e515249745f4aed50b36a8a892fde579dd85bbb4a591f0fe5b3fe79
MD5 a5c74f2dc236377399ce95eb43763b36
SHA1 1bf9799e2e62e487c6094044cc6adad67c44c759
SHA512 a3d1f0ebc7d67faeedb6f1f2fe0077b74afe04ce5d86452a8b92e7bf72b2a5f2c0e8cec2b543e2d93f56a561f71c519b8b037e1628c5afd3605a6ab28e9167e0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 d960fdfc72c2d316397ebcb74e2cfbc6b70ad785e3aec7bb0199d63d214ecd06
MD5 c867f7587e9a332274bcc74ee3e6c6ab
SHA1 5b4f4a38cc28cfb6b1bd864026f145614443984c
SHA512 ecfd719bfe43a26264d42b9f01764dcbb1976dec311348e30713c66602db351963c028c9b81084568cad76d3f315dff3bfe189cd10ccaae90e1b4242effb293e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\SystemAppData\qap`g`v~dtlq
Size 10B
SHA256 9f2947842f65664df00506743aab7d135326956949cc4d5e8a3d9b8b47f65d7c
MD5 dfa877cda3255baf562132dcf05790fb
SHA1 36075022e45496a3f03fe4e99286b36f8408622d
SHA512 54c0a62dff0acdf1e1e919fd4df70a2c6e1a070c9f7315237718b7dee72c4771a53d53b1285cffba4babf37697375dbd191595e8b93966b676f865fc4a4ea8d0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2700_1248924655\qap`g`v~dtlq
Size 10B
SHA256 be06d303f57f0d20b9441e1f7a088fbec3b22e0d0d0b9d70dcd35c4629848f68
MD5 cf0779cba8f70ed3a609099ab56e08c1
SHA1 8134f924e0de302c98ed6a4f3659b31a7b71495c
SHA512 30129b967c4f97fd202ae9b553f5d2f96ce2b6aa291cd68ef97deb8f751d9ac25fb6077fecc81345d3a4d07b358658757c335564ef708c8509a625158afe49a7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5e8142e32a44da5848d4b50f4b4d48c903b7de625f24fc0bcf6c718338324edf
MD5 19ab720645a89c344131460802f32372
SHA1 b822b57b1095103cde48e9fdce6a248b6254a12d
SHA512 c412c94507fb9235667ae83ad837d8ab30fdd72620128404d93b62f5c7787e0cf0eba753159af552b6e15ae38de5aea647490fc71407004eb940f2ed081ee334
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a4db726641527746ee8480f396b2a686511bee1b765d248564838e68d95de761
MD5 19a1c4b9afcbc1dd6492ae7dac200392
SHA1 1f8713dacc09b04851787cc0b3a92c3e16fa5caa
SHA512 df994822a36b7c60b00b8896c4c0ccd21b6285f633d10f9908c4471ad61bff37180f908a4b74523c91246bacfda5190fe449ab6cc6b1bb3ad023e4d2f6bb669b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c8446d5b086054387357e8c0d2f073eb347dc0d496f7e0e178de70ae8a25b7a9
MD5 87fa571a28201725629c9a3271e58a5f
SHA1 54b462e7e36d92650a85e89b50d29a6633915d75
SHA512 f01bf2894959fa6ea5d76bccc78950dec1fb5e08b5c7ba65777d37ca0bb77383ddff3239f4cdd91bd37ae84a168757d2422cb3d4d48ef88b2098be2afce70327
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 394b8e4670f0d8d4025949ced8b4a4b1e5dc50eaed48e95492fa5cf11164164c
MD5 943f7d01c1294f6a1864c7f359fef0c2
SHA1 36c58ca2f0efc3fed6d95d58090b2cf08b0be890
SHA512 f6df5d42963e861e5c5cb537f0b8a87763b22bcb1741c10fdd5ffe9fcb89defc9366b362e1ca7652fa9e2cdc2448969940247738a878753d41fb3e0ec8cf3a00
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b76ad85f57fb3daddc5810c9475911153aa256480f857390c1b2ca044b817f1d
MD5 89b65f8ee35a3ca18d22adf0acfdaddc
SHA1 7b4ad0ce0f2915bba9cfb18631129415f0e5bddb
SHA512 b51afd181526b4bc3dc68be3cef887cde5b38d2df20ac4f40ca623467c77a434a82fe664aa9e299a6cf91b0400543b42b7b9e581505077e09427d03ee75d6000
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 dc8396286a065967d28a79079192ac5fffabe49a38e3b2787feb21282fe547b2
MD5 8952c4847dc3edfc6f8c881329d982bd
SHA1 034ccfb009929c7939597b91ea3e8d7e222648c6
SHA512 01996b4089c1f16bc7ca680184d3387bf6dea48906990a801061279ddcd4f8fb0b11b583c338f3ae05bc9aab39cbc43bb19e175cf0d2e338295e092eaebeacf5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 83bab2e6123499ac50a752f07492a44b0e744d88e896ad4c6014a8622c3d849d
MD5 620ef1808d1f1f4d7d9028d069ef846c
SHA1 ccd489b6621bfd399b5cbdf85b1438d29aed5064
SHA512 54d1325aae0d4ec354f507d92e8d5211060bb8be89517f7faf31cb4bbd3a21fc730fe8a2bda92e1c8e1763ce8757adbe903885b9a8d108bbc41e2c7adf8a9868
MD5 SHA1 SHA512

Submit Download

svchost_BBABBCACBABCAAAACCCACABAABABCBACBCAACCCCAABBBCBACCCABAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCACBABCAAAACCCACABAABABCBACBCAACCCCAABBBCBACCCABAC.exe
Size 10.5MB
SHA256 928bb3f0cb9a52bf5d6e2aff104abc99fc547adc065d2b204bbb9ec8c7666572
MD5 371bca2d1246ae31197e87db073c38f0
SHA1 e859d8a9ba4e8662cfa8366b6e3cb39d75237c0d
SHA512 60f307a1b098a4a4024334eff7531484dfdfbee9dd9ad8f18507778b885271a1f0cdd793426f67296246113b7fb796d24f658dde683a0988aab4d04a771db6d1
SSDEEP 98304:kFPdLz7Upmya6iSNNEuy4v/YtfKoNewC8rc8u3xP33zkEsi:kFlP7APhNNECwHrc8u3x3AEv
TLSH
T155B69D27F29900E5C42ED178C65B8623DA7A7C554724AADF06A077252F33BF01B3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 7a0922fee0609bf612211482b8523937119c7858e896da32bb572a672627c067
MD5 2ded3c0eae6752ed57fb5b555e4c8e54
SHA1 72cba806d97f8c82525060ced521dcce7d953c51
SHA512 9fdec062557d7a7bff6cec8f470539ec54027131b5098ef2a97f144f9ffe6b3ad3bbdf291447d7534990de270325ca6c3849f86911f0c0e59d4db3338084e33d
TLSH
T17D21DDA0D4DACCE3E8322C8F6A29DDD318E4369F585C5EA5530E42197F998318D16CD2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 69e9a04ffc368537503edf1afc4696f880275b5492d2b7d3544e61825888c304
MD5 bbb32c92fbab491b183a6b366bcbe52d
SHA1 74d506952409292d0d3a5973b262c034cf96d24a
SHA512 f31d6fd71a6b3de0711b6d43922aca635a945d507c62e68a589572dac022fcc4b864124151e8c38ed4a6696e7847449ff98cea5a39b4423eb3eb14854923e380
TLSH
T1E121DD64E4DACCE3E9326C8F5A29DDD318A4369F985C5D91530E42087BD9831CD16CE2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 1aa449d17728fe3a787ccee60776de0be611adb28a259f8ed812352ec62ab19c
MD5 95b6703757070bb882cfdc9242077c91
SHA1 4e435f17384d631087aa6b44bb17f46ef3258768
SHA512 ac16d97065997bd567f6c0b72d3bf8abaeda1b7849c0450527e8ad026b9fc5679b0c654325a6437e2d784741833e28396bf90079787a63b10585979b80fdbd7a
TLSH
T12C11EEA094DAD8E3E8333C8F6A25DDD31CE4369F685C5EA6530E421D7B99831CD16CD2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/440-59-0x0000000005450000-0x0000000005451000-memory.dmp

Download

memory/2992-2601-0x0000000000B60000-0x0000000000B81000-memory.dmp

Download

memory/3060-71-0x00000000000D0000-0x00000000000F1000-memory.dmp

Download

memory/3060-2760-0x00000000000D0000-0x00000000000F1000-memory.dmp

Download

memory/3808-36-0x0000000000B60000-0x0000000000B81000-memory.dmp

Download

memory/4420-6-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download