c3a40d02a3c7ac4595cced591c55fe3eb07d37cb36ec0922f9d724a48acc2d83

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_6f3143dedc820a52352b8dfd79838b6c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 23.2MB
Sample260810-cxk2eahn2s
SHA256 c3a40d02a3c7ac4595cced591c55fe3eb07d37cb36ec0922f9d724a48acc2d83
MD5 6f3143dedc820a52352b8dfd79838b6c
SHA1 0fce1c885cb7b5e7e7cb8a395125204a25c8eef5
SHA512 ea273e8ae0f9ba61bf841b1f82938780354465770f1d83c0c089cedda3e27908f463299dfcf8277c87d47d6adbaaa4e3891a15aa36c57d9e92375d176296c69c
SSDEEP 196608:kFlP7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouu1tIDewjqkjiqMeF:iZahvQHrc8u3xXJ/f4uUWHn8Kwekym
TLSH
T110379E26B7A581E5D46AD1B89A578232E7767C40073263CB46D1F61A2F33BE14F3A331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with Dotfuscator 2 IoCs

resource	yara_rule
behavioral2/files/0x000d0000000118fa-11.dat	INDICATOR_EXE_Packed_Dotfuscator
behavioral2/files/0x000c00000001c5e2-34.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 2 IoCs

resource	yara_rule
behavioral2/files/0x000d0000000118fa-11.dat	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/files/0x000c00000001c5e2-34.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 2 IoCs

resource	yara_rule
behavioral2/files/0x000d0000000118fa-11.dat	INDICATOR_EXE_Packed_Yano
behavioral2/files/0x000c00000001c5e2-34.dat	INDICATOR_EXE_Packed_Yano

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/files/0x000d0000000118fa-11.dat	UPX
behavioral2/files/0x000c00000001c5e2-34.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4852	svchost_BAAABBCABABBBBCACBABACBABACBCBCACCBCCCCCAAABCAACBCBBCCA.exe
4908	svchost_BCCBBBCCAABCBACCACAACBACBCABACAACBCBAACCCABCACAABCCACBA.exe
5044	svchost_BAAABBCABABBBBCACBABACBABACBCBCACCBCCCCCAAABCAACBCBBCCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBABBBABAAABCAABBBBCAABCAACBBBBCBACACCACABCBBABCAAAAAABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAAABBCABABBBBCACBABACBABACBCBCACCBCCCCCAAABCAACBCBBCCA.exe"	2026-08-10_6f3143dedc820a52352b8dfd79838b6c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABCBCCAACCCABAAAACAACAACCAAAAACCABCCCCBCAAAAAAAAAACBBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBBBCCAABCBACCACAACBACBCABACAACBCBAACCCABCACAABCCACBA.exe"	svchost_BAAABBCABABBBBCACBABACBABACBCBCACCBCCCCCAAABCAACBCBBCCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2852	sc.exe
1912	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2940	cmd.exe
2920	cmd.exe
1164	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBBBCCAABCBACCACAACBACBCABACAACBCBAACCCABCACAABCCACBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_6f3143dedc820a52352b8dfd79838b6c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAAABBCABABBBBCACBABACBABACBCBCACCBCCCCCAAABCAACBCBBCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6136	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1820	2026-08-10_6f3143dedc820a52352b8dfd79838b6c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
1820	2026-08-10_6f3143dedc820a52352b8dfd79838b6c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
1820	2026-08-10_6f3143dedc820a52352b8dfd79838b6c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
1820	2026-08-10_6f3143dedc820a52352b8dfd79838b6c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
4852	svchost_BAAABBCABABBBBCACBABACBABACBCBCACCBCCCCCAAABCAACBCBBCCA.exe
4852	svchost_BAAABBCABABBBBCACBABACBABACBCBCACCBCCCCCAAABCAACBCBBCCA.exe
4852	svchost_BAAABBCABABBBBCACBABACBABACBCBCACCBCCCCCAAABCAACBCBBCCA.exe
4852	svchost_BAAABBCABABBBBCACBABACBABACBCBCACCBCCCCCAAABCAACBCBBCCA.exe
4908	svchost_BCCBBBCCAABCBACCACAACBACBCABACAACBCBAACCCABCACAABCCACBA.exe
4908	svchost_BCCBBBCCAABCBACCACAACBACBCABACAACBCBAACCCABCACAABCCACBA.exe
5044	svchost_BAAABBCABABBBBCACBABACBABACBCBCACCBCCCCCAAABCAACBCBBCCA.exe
5044	svchost_BAAABBCABABBBBCACBABACBABACBCBCACCBCCCCCAAABCAACBCBBCCA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1820	2026-08-10_6f3143dedc820a52352b8dfd79838b6c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	4852	svchost_BAAABBCABABBBBCACBABACBABACBCBCACCBCCCCCAAABCAACBCBBCCA.exe
Token: SeDebugPrivilege	4908	svchost_BCCBBBCCAABCBACCACAACBACBCABACAACBCBAACCCABCACAABCCACBA.exe
Token: SeDebugPrivilege	5044	svchost_BAAABBCABABBBBCACBABACBABACBCBCACCBCCCCCAAABCAACBCBBCCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2940	1820	2026-08-10_6f3143dedc820a52352b8dfd79838b6c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	94
PID 2940 wrote to memory of 6136	2940	cmd.exe	96
PID 4852 wrote to memory of 2768	4852	svchost_BAAABBCABABBBBCACBABACBABACBCBCACCBCCCCCAAABCAACBCBBCCA.exe	98
PID 1820 wrote to memory of 2920	1820	2026-08-10_6f3143dedc820a52352b8dfd79838b6c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	102
PID 2920 wrote to memory of 2852	2920	cmd.exe	104
PID 1820 wrote to memory of 1164	1820	2026-08-10_6f3143dedc820a52352b8dfd79838b6c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	105
PID 1164 wrote to memory of 1912	1164	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-10_6f3143dedc820a52352b8dfd79838b6c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_6f3143dedc820a52352b8dfd79838b6c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABABABBCCABCBBBCCACBBBCBABCBCABBBCCCBBCBBBCBAAAACCBAAAABACBCACAACBCABACCACBBAACBCCCACABBCAAABCCCBACBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABBCABABBBBCACBABACBABACBCBCACCBCCCCCAAABCAACBCBBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABABABBCCABCBBBCCACBBBCBABCBCABBBCCCBBCBBBCBAAAACCBAAAABACBCACAACBCABACCACBBAACBCCCACABBCAAABCCCBACBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABBCABABBBBCACBABACBABACBCBCACCBCCCCCAAABCAACBCBBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCBCBCBCACCCAABBCCCACACAABBAAAAABBABCCAACCCBCCCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABBCABABBBBCACBABACBABACBCBCACCBCCCCCAAABCAACBCBBCCA.exe" start= auto displayName= "UserDataSvc_ACCBCBCBCACCCAABBCCCACACAABBAAAAABBABCCAACCCBCCCACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCBCBCBCACCCAABBCCCACACAABBAAAAABBABCCAACCCBCCCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABBCABABBBBCACBABACBABACBCBCACCBCCCCCAAABCAACBCBBCCA.exe" start= auto displayName= "UserDataSvc_ACCBCBCBCACCCAABBCCCACACAABBAAAAABBABCCAACCCBCCCACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCBCBCBCACCCAABBCCCACACAABBAAAAABBABCCAACCCBCCCACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCBCBCBCACCCAABBCCCACACAABBAAAAABBABCCAACCCBCCCACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1912

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABBCABABBBBCACBABACBABACBCBCACCBCCCCCAAABCAACBCBBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABBCABABBBBCACBABACBABACBCBCACCBCCCCCAAABCAACBCBBCCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2768

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBCCAABCBACCACAACBACBCABACAACBCBAACCCABCACAABCCACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBCCAABCBACCACAACBACBCABACAACBCBAACCCABCACAABCCACBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4908

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABBCABABBBBCACBABACBABACBCBCACCBCCCCCAAABCAACBCBBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABBCABABBBBCACBABACBABACBCBCACCBCCCCCAAABCAACBCBBCCA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 980332b1e3229cf0b10bb510d28c5124fd5aecf0f39093c081a642ed0845bdcd
MD5 964e6e6ed2b8204b3f8911195b49b465
SHA1 ea3011984b4aee56fc1268b632a917b7eec3da88
SHA512 0c88c30319b62cbe60a17c20c58e8f52b1e5f65d6ef3b6d0d9864846d7f07eb4702b36e6145fdd0c3d3b76c16b5344114d0679cd669229b562ec3b5407680d0f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\UUS\Packages\qap`g`v~dtlq
Size 10B
SHA256 1104c48191e4a739bbe34f21e445640fb35ed4dc5f8e4ad86a5b8452ef64c82f
MD5 0a17da5c25edae5368e40fd313fd1153
SHA1 db00b3b95e9769b8b682031b3771d15f309c191e
SHA512 eb9c69369151eb77dd9b98151907c82811a1dd5996bbac2d96de490f790ce86cc85078e7bae5f2cbc359a578023b8ac1b0e01438802f86d7c4970d03e1ffb7c6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 311a2ce012fd81e3cb31d411d1a110b3315b74244709ef25fbf0cf4299ebe8fe
MD5 6b86d966616ea2e85be0e73d7967d412
SHA1 a9af88e40d00791ee505ba23919e38598867d41a
SHA512 2c41ad1f72efb19444426592c316a8fcc818d7a45e02de2a0a67c94107f2d826cc20c8671dce5bd13958c611d15e10fb5755ff14d5a4d5fbbf9475bdd4f74eeb
MD5 SHA1 SHA512

Submit Download

JoinStep.exe

Path C:\Users\Admin\Desktop\JoinStep.exe
Size 47.0MB
SHA256 fea73496152b1c95d4ea72ee3118bd4784e91fdd561f7d4518bd012539e869c8
MD5 02f151a37a01611e10b0485d9ff5361a
SHA1 c4df4e72c4090cf14bd42f3df225f8d5dfd126ae
SHA512 f9f83be604ced00b3c273877c739891e36a4faf16467bfcaca7354a81a1f06303050987ad961a44c8e7b5af17db1d213d66679e46e7d72e2947955d999814648
SSDEEP 393216:iZahvQHrc8u3xXJ/f4uUWHn8KwekyFZahvQHrc8u3xXJ/f4uUWHn8Kweky+W:iSvQHrK5/f4uUebSvQHrK5/f4uUej
TLSH
T117B7AE26B7A581E5D46AD1B89A578232E7767C40073263CB46D1F61A2F33BE14F3A331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ba152784af628ebd05088cf568ce982678ee92d4127dc293f71ef805054daffc
MD5 5537377b906b40b92ec36b986ad413b9
SHA1 2f747b5d5833d9c6e348b57e161921becf10800a
SHA512 b3427d50f66a1175798ba27c1920fdebf7ac7b2122e1ab06d310dd80ee59696f99e886ed6425a12c7d18390975f3c4e07f09637dfdc53c331508870116929144
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5bd5f2e86cfdc777e1dbc6cef69220ac6698e7bf5dd8d1e20bd425246c6fe140
MD5 efd94453285d9366efb9c5c6edd28dfc
SHA1 59b239ff086b01801b1122db397f6486bcc19f74
SHA512 e21764652b5268bdc6b040f1fe2f3ce6182d8247c8f5fd0a37d11c5efcf339029c261569996c0056eb160466dcbdb8f7d6775a064b0f9a705305a3b9d0ba2aab
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d6671ae3a8a91d6ba0cc493cdacc05504e2bfa1b25f46440dc5f4943dffb8b26
MD5 bd10b7f2c6dd1b184bd921c690324a3c
SHA1 038e8323e1967fbfa3b19025089cf1d05fcbee13
SHA512 caa4cd96bf72f86546a04079b09bc9368eec6b8175d8c7917da184a08b4d025d0b4ba7baedc53fb925f94856dfbff02a8ee940799ff95cfea1c2d9c601898a44
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 beb293889e02168c0856c9dfa9aa1a2347e6caa90afa28fc2f202e975e6163c8
MD5 cce2a9857e74d889aa75bc9d73206e40
SHA1 32e58b74e5dc8ef9d60311fcc4cdb23765c9e293
SHA512 6940c6ddb560b9141620d0111b7a695bac5bb2ac42c7a3ae4f7076c5576c948a94bb80b3ee2bbb9281e28229585acbbd06aaafc31754350475434cbbd57e27c3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7c09423f9fb449593d82b9f234191679f145b7305816d712da51158b1e2ce00b
MD5 acec03904f23c4b0a6fb38006cd8451f
SHA1 51913655b6ff0ca1e3fbbf0cb07929d4a9ce956b
SHA512 0203a2be1571b984b3cb82e4ee1e91d8a9290d3cbbaf68d6914324bfdbc0d2b210936f92aaf1e8882604919ecdcca95fead7167146f65ff34fd2e69748d3b181
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f10a049128001e8977260fbc942d41433ff5f4418d159fed555333802d8b82dc
MD5 abff4ed117ff420ce038831d38065a78
SHA1 72849006451b6a2533f513bc2c6cbccbeb1403f3
SHA512 20f52699da212fa0b1b1bc69d88c4835895f3e8926d2a57009ae5b9b500649e6b2ca21b772360a34f7a698174bcb96509639807a9d22f1b0406dc6a853c3c0e2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 df2c76177b731524ad358b5b07a8cf5c941cd0c85a2147e507fbfd202e3492a6
MD5 7cdd6230b76d12907349270357931284
SHA1 f91f4170419be435fb1af7441bca955145055231
SHA512 ace772ee6612eed8d77b03ce1fc0f63d1340ad6cc7a1327cbf25684ddf050ffae6464857ec85a73eda4bc20ba3740fc672d813d55ce6fea233eb811c51215528
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3fd7355c4044ce91f198e93ea4c800b061d118c84172bd49a1d97b70ffc7b9ca
MD5 49d824dfb4d723b5750ba9ee1ecb0fc4
SHA1 c2a6607eacee1693bbeb382d8e3a10fd8e9467e5
SHA512 827f590b38754eaff03e5a2b6087c494834125f76aad22dc1942b7a4210ea63b95e9a646138cc106d9c7a26791406385b31f927e484ac723f321f6750d6c3875
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 82d5412e589adb57100e780bb8eba212163d74d31b77baad94726d06b7928edb
MD5 a09a4164ced08cba4858f1cfed5b95e2
SHA1 4d9560e529392abfc0509da0b21ee7106b57a3f8
SHA512 4ea3c4549998327269f8cf0ce4ff665225edc1283251e45476261fbd72201225c028f4588fc628e874acc0274a06d086dc34ebc1cd6397677745a1d4b5dd8fd2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 bdcfffac092db82c8cc9ecf1486f55535a37ccc85135c149b9cb8a5c227cac1b
MD5 1d833725b40c72dc397a4648914aaec9
SHA1 e084c21dd78938d9acc3e19f7667b6ac5ca0584d
SHA512 382a26e74def58a69e80b6392196a0b1094724e398b2a11cafc58889626f8521a39d117b3cadbcbca31047ee794c7d18b57faa29c396113413fd77764c4d3c29
MD5 SHA1 SHA512

Submit Download

svchost_BAAABBCABABBBBCACBABACBABACBCBCACCBCCCCCAAABCAACBCBBCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABBCABABBBBCACBABACBABACBCBCACCBCCCCCAAABCAACBCBBCCA.exe
Size 23.2MB
SHA256 c3a40d02a3c7ac4595cced591c55fe3eb07d37cb36ec0922f9d724a48acc2d83
MD5 6f3143dedc820a52352b8dfd79838b6c
SHA1 0fce1c885cb7b5e7e7cb8a395125204a25c8eef5
SHA512 ea273e8ae0f9ba61bf841b1f82938780354465770f1d83c0c089cedda3e27908f463299dfcf8277c87d47d6adbaaa4e3891a15aa36c57d9e92375d176296c69c
SSDEEP 196608:kFlP7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouu1tIDewjqkjiqMeF:iZahvQHrc8u3xXJ/f4uUWHn8Kwekym
TLSH
T110379E26B7A581E5D46AD1B89A578232E7767C40073263CB46D1F61A2F33BE14F3A331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 207f0bf851e9d542a112b273e971ca831c88c27a41cd38e654917177a99ffeb1
MD5 6bac54ba3cadce201d52697444fa068d
SHA1 7603853b991c1580283bc832e312386903d73169
SHA512 34450b99882227424cce936056157a3396909cc045ecb8c18d68b1b6d0121ee09544dfd7a027ea62a6b4b4b94cec7349d0a001f69e166233454ba39dee087151
TLSH
T1E511E21274F9EC67F92368CB962D8B620CE037DFBC986E44230C82186E95C31CE554E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 1511d5c93cdfe62e2eef9b421516ee2379f68e45f4f2139e5755d4930f4454e8
MD5 be7481217011e2f79adf2d586e7bd0e0
SHA1 ca6411167c8281ef1efad169290a83779255fbd4
SHA512 b6c44c84795d15e999bd5aba9545d381f2a9e57e016c3ff45c7e60e083c81134112f761083fbb1f8ac1dc45128fd4672e5b831e7e8ea67d96a2cbb62ffc063a2
TLSH
T15521B35264F9DCA7F923A8CB962D8BB20CE437EBBC986E54230C91187E95C31CE554D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1820-0-0x0000000000750000-0x0000000000771000-memory.dmp

Download

memory/1820-63-0x0000000000750000-0x0000000000771000-memory.dmp

Download

memory/1820-89-0x0000000000750000-0x0000000000771000-memory.dmp

Download

memory/1820-30-0x0000000000750000-0x0000000000771000-memory.dmp

Download

memory/1820-16-0x0000000000750000-0x0000000000771000-memory.dmp

Download

memory/4852-108-0x00000000008E0000-0x0000000000901000-memory.dmp

Download

memory/4852-61-0x00000000008E0000-0x0000000000901000-memory.dmp

Download

memory/4852-80-0x00000000008E0000-0x0000000000901000-memory.dmp

Download

memory/4908-96-0x0000000000840000-0x0000000000861000-memory.dmp

Download

memory/4908-455-0x0000000000840000-0x0000000000861000-memory.dmp

Download