6a298053c00c1245e1b9d03d8615f3b7b453b72296a1017628860ee8b7a9c5a1

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_5922c7b7175091ea7750b0122b20af0b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 16.3MB
Sample260810-2ffsssar7t
SHA256 6a298053c00c1245e1b9d03d8615f3b7b453b72296a1017628860ee8b7a9c5a1
MD5 5922c7b7175091ea7750b0122b20af0b
SHA1 c5d81d50dbead3d248e8ed506e95b1c227ec59cf
SHA512 6fa6241453ec43cb54aadeee844eebc4a1e576c03d3eae58937409ab0011cd0397cc84ecb1d17f23b2bb729f5f6ce79b4a96be0f33a04129e192f9423156d120
SSDEEP 393216:AO4q78UhasIO4q78UhasIO4q78Uhas5O4q78UhasIO4q78UhasIO4q78UhasrmHW:jhasrhasrhasghasrhasrhasabrW
TLSH
T1A7075B2CADA551F9D076C675C4A2E6B9EA317C1367100F8F11E9934A0E3BB926C34F36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4400	svchost_ACACABCCACAACCCACCBBABAACACCBBCAABCCCBBBCCBBCAABACBACBC.exe
1756	svchost_BCACCBCABCACCAACABBCBBBACABCBBCBCBCCCBABACBCCCCBBAABABA.exe
3980	svchost_ACACABCCACAACCCACCBBABAACACCBBCAABCCCBBBCCBBCAABACBACBC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BABCCABCBACAAAACCACBCBAABCCCABBBCCBAAACABBBBBAACBCBCBAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACACABCCACAACCCACCBBABAACACCBBCAABCCCBBBCCBBCAABACBACBC.exe"	2026-08-10_5922c7b7175091ea7750b0122b20af0b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BACAABCAACBABBCCBAABBACCBBCCACBACCABACBCCCBAABCCCABCCBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCACCBCABCACCAACABBCBBBACABCBBCBCBCCCBABACBCCCCBBAABABA.exe"	svchost_ACACABCCACAACCCACCBBABAACACCBBCAABCCCBBBCCBBCAABACBACBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3748	sc.exe
3764	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4908	cmd.exe
3916	cmd.exe
3552	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCACCBCABCACCAACABBCBBBACABCBBCBCBCCCBABACBCCCCBBAABABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACACABCCACAACCCACCBBABAACACCBBCAABCCCBBBCCBBCAABACBACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_5922c7b7175091ea7750b0122b20af0b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1808	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2024	2026-08-10_5922c7b7175091ea7750b0122b20af0b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
2024	2026-08-10_5922c7b7175091ea7750b0122b20af0b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
2024	2026-08-10_5922c7b7175091ea7750b0122b20af0b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
2024	2026-08-10_5922c7b7175091ea7750b0122b20af0b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4400	svchost_ACACABCCACAACCCACCBBABAACACCBBCAABCCCBBBCCBBCAABACBACBC.exe
4400	svchost_ACACABCCACAACCCACCBBABAACACCBBCAABCCCBBBCCBBCAABACBACBC.exe
4400	svchost_ACACABCCACAACCCACCBBABAACACCBBCAABCCCBBBCCBBCAABACBACBC.exe
4400	svchost_ACACABCCACAACCCACCBBABAACACCBBCAABCCCBBBCCBBCAABACBACBC.exe
3980	svchost_ACACABCCACAACCCACCBBABAACACCBBCAABCCCBBBCCBBCAABACBACBC.exe
3980	svchost_ACACABCCACAACCCACCBBABAACACCBBCAABCCCBBBCCBBCAABACBACBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2024	2026-08-10_5922c7b7175091ea7750b0122b20af0b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4400	svchost_ACACABCCACAACCCACCBBABAACACCBBCAABCCCBBBCCBBCAABACBACBC.exe
Token: SeDebugPrivilege	3980	svchost_ACACABCCACAACCCACCBBABAACACCBBCAABCCCBBBCCBBCAABACBACBC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1144	OpenWith.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 4908	2024	2026-08-10_5922c7b7175091ea7750b0122b20af0b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	97
PID 4908 wrote to memory of 1808	4908	cmd.exe	99
PID 4400 wrote to memory of 3636	4400	svchost_ACACABCCACAACCCACCBBABAACACCBBCAABCCCBBBCCBBCAABACBACBC.exe	100
PID 3636 wrote to memory of 4500	3636	notepad.exe	101
PID 2024 wrote to memory of 3916	2024	2026-08-10_5922c7b7175091ea7750b0122b20af0b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	105
PID 2024 wrote to memory of 3552	2024	2026-08-10_5922c7b7175091ea7750b0122b20af0b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	108
PID 3552 wrote to memory of 3764	3552	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-10_5922c7b7175091ea7750b0122b20af0b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_5922c7b7175091ea7750b0122b20af0b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABBCAABBABABACBBAABCCAABBBBBCCAACBACCBBCAACCCCBABAAABCABBCBCAABCBAACAAAACCACBCCAAAABAAABBCBBBCBACAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABCCACAACCCACCBBABAACACCBBCAABCCCBBBCCBBCAABACBACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABBCAABBABABACBBAABCCAABBBBBCCAACBACCBBCAACCCCBABAAABCABBCBCAABCBAACAAAACCACBCCAAAABAAABBCBBBCBACAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABCCACAACCCACCBBABAACACCBBCAABCCCBBBCCBBCAABACBACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1808
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABAAACAAACCCBBABBBCCCAAACCCABCBCCAACABBBACACBCAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABCCACAACCCACCBBABAACACCBBCAABCCCBBBCCBBCAABACBACBC.exe" start= auto displayName= "UserDataSvc_CABAAACAAACCCBBABBBCCCAAACCCABCBCCAACABBBACACBCAAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3916
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABAAACAAACCCBBABBBCCCAAACCCABCBCCAACABBBACACBCAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABCCACAACCCACCBBABAACACCBBCAABCCCBBBCCBBCAABACBACBC.exe" start= auto displayName= "UserDataSvc_CABAAACAAACCCBBABBBCCCAAACCCABCBCCAACABBBACACBCAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABAAACAAACCCBBABBBCCCAAACCCABCBCCAACABBBACACBCAAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABAAACAAACCCBBABBBCCCAAACCCABCBCCAACABBBACACBCAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3764

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABCCACAACCCACCBBABAACACCBBCAABCCCBBBCCBBCAABACBACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABCCACAACCCACCBBABAACACCBBCAABCCCBBBCCBBCAABACBACBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3636
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4500

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1144

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCBCABCACCAACABBCBBBACABCBBCBCBCCCBABACBCCCCBBAABABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCBCABCACCAACABBCBBBACABCBBCBCBCCCBABACBCCCCBBAABABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1756

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABCCACAACCCACCBBABAACACCBBCAABCCCBBBCCBBCAABACBACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABCCACAACCCACCBBABAACACCBBCAABCCCBBBCCBBCAABACBACBC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 4e7f43329b11ccc0e85d3a3af30d4e87ac51c24292e204da8d7657e40f65b8bd
MD5 ffa4fc8c82386faf5d059a7c3b2d1f5c
SHA1 d628c8da9780975261715ac527fd8237cc5b0437
SHA512 6971ff1da5b2604ae9d676576438bf819d2016cd8cc6dd8f521da63fa0c09f2552ee9f0ddb3dbe5d9b80bfa6e0d635d3f7b4635cff8ba023a87cda0792a7323c
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 16.7MB
SHA256 61e2af664a02c7e4e2fd15bc7c3dc1a5e4cff062d9a19de08598794a220a2510
MD5 ec106ec9831ba1a4fb04ebeca42fd39c
SHA1 f77e5ad0e519101b31ed004376af6767d2555faa
SHA512 accac48974c29907916f29f0ed06e4d87ea477d0a47759b88971f312ee8cfb5803e53cafb189d7a7ccf8d7e33b494c4e9f279b371d7f40d7f2b53893451f0f37
SSDEEP 393216:AO4q78UhasIO4q78UhasIO4q78Uhas5O4q78UhasIO4q78UhasIO4q78UhasrmH/:jhasrhasrhasghasrhasrhasabr/
TLSH
T196075B2CADE551F9D076C675C4A2A6B9EA317C1367204F8F11E5934A0E3BB926C30F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\WDF\qap`g`v~dtlq
Size 10B
SHA256 df1db9ba08c7a305612c3043dce00ed8eb54f17fa0a306dca11956029f5e0808
MD5 aac9d88abb100f0b5def45a65e08c72c
SHA1 de7259b0f6873c133a76b46dcbd952caaffb99c1
SHA512 de32bb88a526e38e6303a68d2698d472675f6cf03c6075984ff3c225d09b512e55b0988df3927215cf2886101425d6038add1b6909f13e3fa8be33a1c2b7eda0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 3b6e636900a4b3ee28378b4d1eb6832831283f03b287033f1cf1eff87029998e
MD5 e09647d4ef911edb2a5040dde1540ae1
SHA1 b40b6a95786db05a42eb812d45495d79dd2b7922
SHA512 df4f64831e448a4791ad45f771e1cbf1cd010e9cb10c154ab08839fb871f980b19b534a7735e7489526a07a3357a7e77dbc68c2c82eb41eb55bf363fa0da930b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Adobe\qap`g`v~dtlq
Size 10B
SHA256 cc9064e0d5e84a138ec5c458c4dc95471c95cb90f226d68d5d5ddc52f34ddddf
MD5 d1364490ff9a3ec77d3da46dfd5c8ad0
SHA1 9a3b020f87c192f3bf21a6a030cabcd708cc92bb
SHA512 fe9b5684bed0910d64f9783dd33788b73319dde41a6487cd17a95d2ce04c9614472ea1f7c16258df196bf4007344996d5641b15e37268ae9d6424ab830df7e52
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 3d3035a7142c60d569b0fc2e89cf09d68bb907803536e7e65492eee86a82c13c
MD5 67f1788fa8e6ac1f99f9605cdeb47bdc
SHA1 0db4014597daf40b2bfa3c417cd81d8f0b7b4bd9
SHA512 24df845b9e6d90a6d436d6b9f34d549d00a04525935e30f2d3d7979c9f7191e5dc4973c08a3be7c04e315cdf4171240ac34c28837e5e610e160b461ce2adf52c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ea9bf964da4bf64415a5852948d863c8e3ab1693fcbd3968c25669cd27fe4842
MD5 fe565ef860d2e44a63a8920366986e9d
SHA1 040319225ac99ddcebe61f9040fee9b04bf46b22
SHA512 e29cecea034fa6aac63341954db48096a6fc4a294622febb64c4e323005154222f00518519766ba7c67c63ccfa4b83ce2ce2a0c43ef368b9200479c80d39ff2a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d2650bd99112b43299e78c633aac8395e8b946d28d196ada919a9f6d9d56b7f2
MD5 8a0b194cc1dbe4af5fe8a6845f284474
SHA1 43185b5ded5b2a24118681d5987105cae2562409
SHA512 27acc2fcbe93fd1b225e2003b7b800095bc6e7ce84ebf29a2816bde5d9f4228c932ffe7de6b661d2e67ff8f90649c36c1378f28d3c8df4634de70df8d1c089f5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f87b8b010738080cb9ed5aa04314a5b2ee6583aa51c5113b26a30b8ea513c546
MD5 911cdd63831e6e407b12c39e902995ea
SHA1 703e35bb6e3f917acc3b478a8f3979ce092b2ca9
SHA512 2517c0000ffd5755bcfae52327cdec08742a99c52f7b5ee601bc3cc8bb04bca6e3ff7f879fb042dcf30dc62096105182e049bd12372874c121e88b62436315e9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5ca679c93b9e329294c2185eeb4969cb9f8e17bb8b755e4b87768ff14da98fe3
MD5 c4444e20288917d63b270bd3d4c3cbef
SHA1 a51409c9c2a630d190aee4db11d897658fb2a65b
SHA512 c2b8efc8483e81689c9a029b03d58a04e390ebb96adfd5457c90b3e122414f3438470d14677a2489b206857a102816fb2eee659dd7ad30442c6ab338433bbca8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 030c41b0fe496a563ba293ad4e4e2a10e2467d8a1ef0d46fa6b6b3f75ff585b0
MD5 51f2c32e9cc75531b94da67cb66f1f3d
SHA1 ac2b7a4ba0d4d11783e807346336c1477eed745e
SHA512 bc9095e0af3aef37fc9a12fa62ae9196c5b68de787432e84e4bd3496958514a29072bf382a05a3ffc7b2a80c70699bc2119dcc80ac3a62539e965a12221e377d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ba3428e5afbec56abd0a2e073ac2d9dc6aa070da6f82fc46737b4916e261a491
MD5 aba2cb72abc27c0400fd59d5e15193be
SHA1 6a61464a81a4b55f6a198ee7d0bff1a88798513f
SHA512 6e561c2f57d2a0f70ea178ae99ff99f1a3431e220643d8bf05af206944bf52f3fe0baf78c48b014a947f7f93ff65e0a237234db08da0b8e5953024482ca197b8
MD5 SHA1 SHA512

Submit Download

svchost_ACACABCCACAACCCACCBBABAACACCBBCAABCCCBBBCCBBCAABACBACBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABCCACAACCCACCBBABAACACCBBCAABCCCBBBCCBBCAABACBACBC.exe
Size 16.3MB
SHA256 6a298053c00c1245e1b9d03d8615f3b7b453b72296a1017628860ee8b7a9c5a1
MD5 5922c7b7175091ea7750b0122b20af0b
SHA1 c5d81d50dbead3d248e8ed506e95b1c227ec59cf
SHA512 6fa6241453ec43cb54aadeee844eebc4a1e576c03d3eae58937409ab0011cd0397cc84ecb1d17f23b2bb729f5f6ce79b4a96be0f33a04129e192f9423156d120
SSDEEP 393216:AO4q78UhasIO4q78UhasIO4q78Uhas5O4q78UhasIO4q78UhasIO4q78UhasrmHW:jhasrhasrhasghasrhasrhasabrW
TLSH
T1A7075B2CADA551F9D076C675C4A2E6B9EA317C1367100F8F11E9934A0E3BB926C34F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 0b07db13f5f8fb2662f586df284aee88ddc33a1f22dfc9636de7bed47832596a
MD5 e7cdaaa471d1bc3b6a64f43c962fb26c
SHA1 e87050f672134eaccfb246d2f553d7af015a7a0d
SHA512 1d62a063f017c900840537dd88c3d13785713070f43f3783b163d86c9b5bd9cdca6824e19f939f9e21b7c75ff99313c52580c6b3a2884e101a159b14dd546b86
TLSH
T11311CD60E4F9DC23FD3365CF963ADBA218E83BB7AC589E18230D45187745C358D594E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1756-72-0x0000000000010000-0x0000000000031000-memory.dmp

Download

memory/2024-0-0x00000000002E0000-0x0000000000301000-memory.dmp

Download

memory/2024-7-0x00000000002E0000-0x0000000000301000-memory.dmp

Download

memory/3636-60-0x0000000005380000-0x0000000005381000-memory.dmp

Download

memory/3980-420-0x00000000004C0000-0x00000000004E1000-memory.dmp

Download

memory/4400-36-0x00000000004C0000-0x00000000004E1000-memory.dmp

Download