a3397c0a3097f57818ac47eb518c7a0b7d73c0a86fd3b96651642250a97ac030

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_0d691251c4a3ffda2b879bc19b958215_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 15.4MB
Sample260810-dkk2baaj5t
SHA256 a3397c0a3097f57818ac47eb518c7a0b7d73c0a86fd3b96651642250a97ac030
MD5 0d691251c4a3ffda2b879bc19b958215
SHA1 078962526a0e4234ce6fa2c39ab69b920e7aa027
SHA512 f1aa034f9def2928dcc06baf435d8a425e894b4f761f127d11d229c1c19cb7e64e721f42a28f057bc3c16593e0b3d916e6a9627a0ce1c807604be54d23e9426f
SSDEEP 196608:z7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouV:zahvQHrc8u3xXJ/f4uUWH8
TLSH
T100F69E13B35685E6C02AE2B88A474222D7B97C440334B7DB16E5B7692F37BE4573B390
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4b2-25.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4b2-25.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4b2-25.dat	INDICATOR_EXE_Packed_Yano

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4836	svchost_CACCCCAAABAAACACACAACACCBBBCABAABCCCBCAACBBABAACCBBBCAB.exe
3392	svchost_ACAACBBBCCAAACBBCCACBCBAACABBCCBBBBCACBBCCBAAACAACCBCBC.exe
4112	svchost_CACCCCAAABAAACACACAACACCBBBCABAABCCCBCAACBBABAACCBBBCAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCCCBABABBABACCBCCAAABAABCACBACAAACBABBBBBBCAABACCBBCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACCCCAAABAAACACACAACACCBBBCABAABCCCBCAACBBABAACCBBBCAB.exe"	2026-08-10_0d691251c4a3ffda2b879bc19b958215_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBCBBAACBCBCBCCBABAABAABCABABABCCABCCBACCBCCCBABBCBBCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACAACBBBCCAAACBBCCACBCBAACABBCCBBBBCACBBCCBAAACAACCBCBC.exe"	svchost_CACCCCAAABAAACACACAACACCBBBCABAABCCCBCAACBBABAACCBBBCAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1192	sc.exe
952	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3652	cmd.exe
5984	cmd.exe
4348	cmd.exe
3716	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_0d691251c4a3ffda2b879bc19b958215_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACAACBBBCCAAACBBCCACBCBAACABBCCBBBBCACBBCCBAAACAACCBCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACCCCAAABAAACACACAACACCBBBCABAABCCCBCAACBBABAACCBBBCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3408	schtasks.exe
3276	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
6036	2026-08-10_0d691251c4a3ffda2b879bc19b958215_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
6036	2026-08-10_0d691251c4a3ffda2b879bc19b958215_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
6036	2026-08-10_0d691251c4a3ffda2b879bc19b958215_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
6036	2026-08-10_0d691251c4a3ffda2b879bc19b958215_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
4836	svchost_CACCCCAAABAAACACACAACACCBBBCABAABCCCBCAACBBABAACCBBBCAB.exe
4836	svchost_CACCCCAAABAAACACACAACACCBBBCABAABCCCBCAACBBABAACCBBBCAB.exe
4836	svchost_CACCCCAAABAAACACACAACACCBBBCABAABCCCBCAACBBABAACCBBBCAB.exe
4836	svchost_CACCCCAAABAAACACACAACACCBBBCABAABCCCBCAACBBABAACCBBBCAB.exe
3392	svchost_ACAACBBBCCAAACBBCCACBCBAACABBCCBBBBCACBBCCBAAACAACCBCBC.exe
3392	svchost_ACAACBBBCCAAACBBCCACBCBAACABBCCBBBBCACBBCCBAAACAACCBCBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	6036	2026-08-10_0d691251c4a3ffda2b879bc19b958215_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	4836	svchost_CACCCCAAABAAACACACAACACCBBBCABAABCCCBCAACBBABAACCBBBCAB.exe
Token: SeDebugPrivilege	3392	svchost_ACAACBBBCCAAACBBCCACBCBAACABBCCBBBBCACBBCCBAAACAACCBCBC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 6036 wrote to memory of 3652	6036	2026-08-10_0d691251c4a3ffda2b879bc19b958215_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	95
PID 3652 wrote to memory of 3408	3652	cmd.exe	97
PID 4836 wrote to memory of 3596	4836	svchost_CACCCCAAABAAACACACAACACCBBBCABAABCCCBCAACBBABAACCBBBCAB.exe	99
PID 6036 wrote to memory of 5984	6036	2026-08-10_0d691251c4a3ffda2b879bc19b958215_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	103
PID 5984 wrote to memory of 1192	5984	cmd.exe	105
PID 6036 wrote to memory of 4348	6036	2026-08-10_0d691251c4a3ffda2b879bc19b958215_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	106
PID 4348 wrote to memory of 952	4348	cmd.exe	108
PID 4836 wrote to memory of 3716	4836	svchost_CACCCCAAABAAACACACAACACCBBBCABAABCCCBCAACBBABAACCBBBCAB.exe	111
PID 3716 wrote to memory of 3276	3716	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-10_0d691251c4a3ffda2b879bc19b958215_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_0d691251c4a3ffda2b879bc19b958215_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABBACBABACABCAACACCBBCBCCBABABCCAAACBBBCBACCABACCABBBBBBCCBAACABCAAABCAAACABAAABCAAABACAACCCCBACAABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCAAABAAACACACAACACCBBBCABAABCCCBCAACBBABAACCBBBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABBACBABACABCAACACCBBCBCCBABABCCAAACBBBCBACCABACCABBBBBBCCBAACABCAAABCAAACABAAABCAAABACAACCCCBACAABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCAAABAAACACACAACACCBBBCABAABCCCBCAACBBABAACCBBBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABACCABAACBACAABBBCCBABAACCBAACCBCBACCBBAAABBCCAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCAAABAAACACACAACACCBBBCABAABCCCBCAACBBABAACCBBBCAB.exe" start= auto displayName= "UserDataSvc_ABACCABAACBACAABBBCCBABAACCBAACCBCBACCBBAAABBCCAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5984
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABACCABAACBACAABBBCCBABAACCBAACCBCBACCBBAAABBCCAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCAAABAAACACACAACACCBBBCABAABCCCBCAACBBABAACCBBBCAB.exe" start= auto displayName= "UserDataSvc_ABACCABAACBACAABBBCCBABAACCBAACCBCBACCBBAAABBCCAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABACCABAACBACAABBBCCBABAACCBAACCBCBACCBBAAABBCCAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABACCABAACBACAABBBCCBABAACCBAACCBCBACCBBAAABBCCAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:952

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCAAABAAACACACAACACCBBBCABAABCCCBCAACBBABAACCBBBCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCAAABAAACACACAACACCBBBCABAABCCCBCAACBBABAACCBBBCAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABABCCABCABBCCBCCBBACCCBABCCABAAABBBBCBBCBCAABABAABABACCABCCCCBAABCBBCCCCCABCCBBCBABAAABCBAABACBABABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACBBBCCAAACBBCCACBCBAACABBCCBBBBCACBBCCBAAACAACCBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3716
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABABCCABCABBCCBCCBBACCCBABCCABAAABBBBCBBCBCAABABAABABACCABCCCCBAABCBBCCCCCABCCBBCBABAAABCBAABACBABABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACBBBCCAAACBBCCACBCBAACABBCCBBBBCACBBCCBAAACAACCBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3276

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACBBBCCAAACBBCCACBCBAACABBCCBBBBCACBBCCBAAACAACCBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACBBBCCAAACBBCCACBCBAACABBCCBBBBCACBBCCBAAACAACCBCBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3392

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCAAABAAACACACAACACCBBBCABAABCCCBCAACBBABAACCBBBCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCAAABAAACACACAACACCBBBCABAABCCCBCAACBBABAACCBBBCAB.exe
1⤵
- Executes dropped EXE
PID:4112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SwitchReset.exe

Path C:\Users\Admin\Desktop\SwitchReset.exe
Size 6.3MB
SHA256 619f5b21a9bc351f954791edd3d1497608cda83fbb79c58ad3a53d069d0a1fb7
MD5 dd0f99ec06f9887bdf8ded3c81ec88e5
SHA1 e4862662fff2febd09616d3a824e9185b6dd843d
SHA512 e9be355c3ce012635022afb2ed0c599ef9e4e627511da2175b91a2333de7538ba94ce444fe248dd9c944e57a4530aab046d9173c509ac86fec19fb4e12cee832
SSDEEP 49152:U+EF+Ei+EF+Ei+EF+E6wquMlPhwc7Ue8j2f+K3ZCQgzIhNFjGcVuknKHzhTKKN6t:z7Upmya6iSNNEuy4v/YtfKoh
TLSH
T1F7669C03F29A04E9D06ED1788B679623EA727C450735A6DF1694B7262F33BE01B3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchReset.exe

Path C:\Users\Admin\Desktop\SwitchReset.exe
Size 1.9MB
SHA256 50efb99f94bb48b24d5b36fa84f9720241610146ccfd28b9dd05ad6d51aa112f
MD5 57872e07fac0b164fe773c6cf1275526
SHA1 5683966292f00445801b50364ac61f96d6794fdf
SHA512 15703009a331e20889870cc5341adc36b3509159809246a3d33281b358e24a6cf65f924a19e77593c0555ae298270c68e40b57c65626afc27b124722668ab163
SSDEEP 49152:U+EF+Ei+EF+Ei+EF+E6wquMlPhwc7Ue8j2f+K3ZCQO:z7Upm0
TLSH
T1F7958D03F6E608A5E07ED1B84BA6D23A8D71B5590334F4DFA699874A2E33FD0073A751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 73445b147aa3376d3cbccd68c7cc12c4d12aaa29b1f62466e43dc88ad98e674d
MD5 f390744c533dbfdae867b8e76175b003
SHA1 c3dfc83cd859230ae7e8a6b2d2e3e38b770c2338
SHA512 1a39259b58fb393b63fc9becb670be7a43a5532601af2a5d6c24c4eed61f0928c8ade8daadd0df9f056d9ac38581fe21b39242ce8ab4abd3e94d36a82d393236
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4f99e2a7bd09f6497681b0faf6911dc7b8bf87a332ea08ece7cca1dfddbe207b
MD5 bb7ea7ef6123816bbc342bb9a8431de6
SHA1 773f203c10c11f41d72eb252c24a713f30a92852
SHA512 7fb2cab47944f56f1f5b77b7cb95cd5cf4e89823643b04f5eb6fe473f86c652a025e494792f816f084dd03fe6cb02ee838711cc97d34ac6f4d30754098506e54
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 48ad2a0528bd3e659f2fcca4b7b9c42081a54b30d06f3c0ff975553a62e866c9
MD5 4e749c4b46a52923497a350bf6eb67bb
SHA1 f4e0f901b274f420ad3b1756e18b2380aab5c334
SHA512 741a46bb2a4da4be2a63f8dc27f0c86af2db89efb857966b17747798d3a4730aae4b217e84a6042129ad9de43024769e04d67f2ae17ee0fe21dbb2d7a162b5e8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 88cad3a5366c6f950443757dbe8e97dc0d6e5e4179277917102e4c4709b694a0
MD5 ce4e2d58825a0b34411d8101dc63d47c
SHA1 d1677cc5d474ae9c795472e7a13c3858418e4895
SHA512 268f3d945bd1d9a953d825feca0560ff59c8f3e378dd2249b5bb5dd0a9930c306f3da107a0db84878a003011ae43e10f9c3a07592b22cca19ac86f4452a244d2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c198b152fa5145fcade2ad60ce8d7c0ef2052db757fe9b2a1cc76976d6cf7b36
MD5 989f8e1a11111d878a94e786669288a1
SHA1 af7c0247ca3fc607ec4ea7b42c9001f20958210e
SHA512 5ac224af1cc6516513bae3543519b8b4242c86691be762495e0b95b4fcf4f7fb6613f676c76ea00611d276bc189eb78b4e48eedc97a14847e307e8fe424ff88a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fbaf54e4aca311a31fd638b149aedb0bd6d9027bcbf6f1b151cb5ba8ff2a0ced
MD5 68bc7dd86b2b9989102d0e4e771e987d
SHA1 f5b9dfb067290b82c01ba809c65a4c2554c5b023
SHA512 aae51b7f5dffbe6377ade6f9bdbd9f7ca9e02c21fdc933bf3953ae918e638871829dfea09a9139bbe1514e19f665158b2d94bf4272e8b8f535f08f0bfcca40cb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 def0533a2c173b61251ac2128272df959ea3d74deac03eb5ed216703cf08943c
MD5 664332ebc85c79b4ec4b752c88fcdf12
SHA1 bcd65a07abaec5d7abc4d1c2637b5e3817f25f4a
SHA512 404ba8ac8afd790d6eb673f7d0bb93391a38f0a8a9005e2456c7dec190090968638a989a49fb7bf28bca1fbf3cdd60efae32d2349c1c4f869a78b93239812d32
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ccad1546847d3a83ef56e398d7f9a7064a5b84fb34d884545d55714015f9981a
MD5 b7236f6171e4cd979ad275ed048cd782
SHA1 681c8d386f0bae1428542404b77d8f6c90945eb7
SHA512 8ca25f6f9e5f9e5370f6c8f2846152054b344255547b9b3ea49863ae79646dcf4882d74ed8f78fe6cb60dfd3c6181901ba118fbfc43714ba96051b62405c6dfb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2aeda18a73d52a1a91dbdfe7de7818b4cd736820846e3a0c19259499660cacba
MD5 65fa36d8957ab798f897240d15e88163
SHA1 639e9af4a7761286f5e85c43be1d75ba4c05189d
SHA512 2634752b769ffe4e879a20e15ef96129daacf7fea775f1fec7f97c1e0cb47f71b9615500b573dcccf77409618e5c2338c2de634300e38e08ea0b5e8a2d49dc2e
MD5 SHA1 SHA512

Submit Download

svchost_CACCCCAAABAAACACACAACACCBBBCABAABCCCBCAACBBABAACCBBBCAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCAAABAAACACACAACACCBBBCABAABCCCBCAACBBABAACCBBBCAB.exe
Size 15.4MB
SHA256 a3397c0a3097f57818ac47eb518c7a0b7d73c0a86fd3b96651642250a97ac030
MD5 0d691251c4a3ffda2b879bc19b958215
SHA1 078962526a0e4234ce6fa2c39ab69b920e7aa027
SHA512 f1aa034f9def2928dcc06baf435d8a425e894b4f761f127d11d229c1c19cb7e64e721f42a28f057bc3c16593e0b3d916e6a9627a0ce1c807604be54d23e9426f
SSDEEP 196608:z7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouV:zahvQHrc8u3xXJ/f4uUWH8
TLSH
T100F69E13B35685E6C02AE2B88A474222D7B97C440334B7DB16E5B7692F37BE4573B390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 1c2da8a093b0dc9e0108c1b609340b2f1d9f619af9c8963a9d2fde839ea49b0d
MD5 4d03a7ec2b37a8dc3a79a637775771ad
SHA1 e6443147bdc9eb1066d9a800d1f4df11ed610946
SHA512 1c15f374d2776e256f8debc1808bd7d92307d051d2c49962f3a30006925e845b5d8e79da195c471b0ade7d6fdc8443238ab06d4ac84cb59f7e832bf6662b4f96
TLSH
T1E911C96174A9D863F932E8CF552EDBD318A8B39B6C985E14230D8518EFC9C33CD598E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 4c084321573d3e7484cfa26be1caae70a0c4aef6474c36f580049b54a3f0be20
MD5 fa13f3850946a77554c749526f0cee6e
SHA1 47609e824d01d2c16e809d251d3d5c56419ab608
SHA512 702130863558bf228b793510a41dc9ff0da1761b92db3fc514ce5750672a9e3cdae31239968a68c6f9496481895643350f34edac0a191ebb5bef8f777fe8cf4e
TLSH
T1D311B99064A9D423F932E8CF551EDBD318A4B7876C946E2423084518BF89C73CD598E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3392-114-0x0000000000A00000-0x0000000000A21000-memory.dmp

Download

memory/3392-83-0x0000000000A00000-0x0000000000A21000-memory.dmp

Download

memory/4112-110-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download

memory/4836-46-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download

memory/4836-89-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download

memory/4836-68-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download

memory/6036-10-0x0000000000A60000-0x0000000000A81000-memory.dmp

Download

memory/6036-93-0x0000000000A60000-0x0000000000A81000-memory.dmp

Download

memory/6036-21-0x0000000000A60000-0x0000000000A81000-memory.dmp

Download

memory/6036-47-0x0000000000A60000-0x0000000000A81000-memory.dmp

Download

memory/6036-69-0x0000000000A60000-0x0000000000A81000-memory.dmp

Download