e6d89449a0737f1bc971f096c4addd67260184f1208df76e97b4a5ce012f82a8

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_7d3c71c818d13eff5dffd02c53db5933_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stop_vidar.exe
Size 23.4MB
Sample260810-e8kwwseb26
SHA256 e6d89449a0737f1bc971f096c4addd67260184f1208df76e97b4a5ce012f82a8
MD5 7d3c71c818d13eff5dffd02c53db5933
SHA1 481936da5bfe41508942b6415911b2b4351ea203
SHA512 57f576ef348f1e5cafec870e98ae40d8f9b8b47740bf6494ccbedf293d65149791dbc6aa73706ecf79a8733b1c8376715c8201178626191f5cb5989f29b25271
SSDEEP 196608:kFlfFlfFlfFlfFlfFlfFlfFlfFlCnSsmHpn6F44IAWvB/:i33333333sLmHN6+Jrvp
TLSH
T19437CF86B99750F8EC7EA07549ABD332C5317C378031874B66EDF6062F73A646C1A623
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral1/files/0x000700000002448b-20.dat	UPX
behavioral1/files/0x000200000000071f-93.dat	UPX

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCCCCCAABABABCABABCABCBABABCBBCCACBBBACBCAACACCAAACAABA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCCCCCAABABABCABABCABCBABABCBBCCACBBBACBCAACACCAAACAABA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4748	svchost_BCCCCCAABABABCABABCABCBABABCBBCCACBBBACBCAACACCAAACAABA.exe
3272	svchost_BCCCCCAABABABCABABCABCBABABCBBCCACBBBACBCAACACCAAACAABA.exe
456	svchost_BCCBBAACBBACBBABBCAABCACCBAABCCCACBAABBACABBBBBABCBCBAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CAAACABBCBCBBABABAABBBBCACCBCABACBABCBBBBABBCABBACCBBCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCCCCAABABABCABABCABCBABABCBBCCACBBBACBCAACACCAAACAABA.exe"	2026-08-10_7d3c71c818d13eff5dffd02c53db5933_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABABCABABBCCABCBCBBABBAABBBBAABCCBBCAABCBAABACBABBABCCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBBAACBBACBBABBCAABCACCBAABCCCACBAABBACABBBBBABCBCBAB.exe"	svchost_BCCCCCAABABABCABABCABCBABABCBBCCACBBBACBCAACACCAAACAABA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
408	sc.exe
4336	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
776	cmd.exe
2300	cmd.exe
3684	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBBAACBBACBBABBCAABCACCBAABCCCACBAABBACABBBBBABCBCBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_7d3c71c818d13eff5dffd02c53db5933_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCCCCAABABABCABABCABCBABABCBBCCACBBBACBCAACACCAAACAABA.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5092	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4108	2026-08-10_7d3c71c818d13eff5dffd02c53db5933_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stop_vidar.exe
4108	2026-08-10_7d3c71c818d13eff5dffd02c53db5933_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stop_vidar.exe
4108	2026-08-10_7d3c71c818d13eff5dffd02c53db5933_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stop_vidar.exe
4108	2026-08-10_7d3c71c818d13eff5dffd02c53db5933_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stop_vidar.exe
4748	svchost_BCCCCCAABABABCABABCABCBABABCBBCCACBBBACBCAACACCAAACAABA.exe
4748	svchost_BCCCCCAABABABCABABCABCBABABCBBCCACBBBACBCAACACCAAACAABA.exe
4748	svchost_BCCCCCAABABABCABABCABCBABABCBBCCACBBBACBCAACACCAAACAABA.exe
4748	svchost_BCCCCCAABABABCABABCABCBABABCBBCCACBBBACBCAACACCAAACAABA.exe
3272	svchost_BCCCCCAABABABCABABCABCBABABCBBCCACBBBACBCAACACCAAACAABA.exe
3272	svchost_BCCCCCAABABABCABABCABCBABABCBBCCACBBBACBCAACACCAAACAABA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4108	2026-08-10_7d3c71c818d13eff5dffd02c53db5933_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stop_vidar.exe
Token: SeDebugPrivilege	4748	svchost_BCCCCCAABABABCABABCABCBABABCBBCCACBBBACBCAACACCAAACAABA.exe
Token: SeDebugPrivilege	3272	svchost_BCCCCCAABABABCABABCABCBABABCBBCCACBBBACBCAACACCAAACAABA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2684	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 776	4108	2026-08-10_7d3c71c818d13eff5dffd02c53db5933_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stop_vidar.exe	90
PID 776 wrote to memory of 5092	776	cmd.exe	92
PID 4748 wrote to memory of 3516	4748	svchost_BCCCCCAABABABCABABCABCBABABCBBCCACBBBACBCAACACCAAACAABA.exe	99
PID 3516 wrote to memory of 4980	3516	notepad.exe	100
PID 4108 wrote to memory of 2300	4108	2026-08-10_7d3c71c818d13eff5dffd02c53db5933_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stop_vidar.exe	102
PID 2300 wrote to memory of 408	2300	cmd.exe	104
PID 4108 wrote to memory of 3684	4108	2026-08-10_7d3c71c818d13eff5dffd02c53db5933_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stop_vidar.exe	105
PID 3684 wrote to memory of 4336	3684	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-10_7d3c71c818d13eff5dffd02c53db5933_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_7d3c71c818d13eff5dffd02c53db5933_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCCAABCCACACCCBBAAACBBBBACBABCCBBBACCCACCCAACBACCABCAAABBBAAABBCBBACCCABACCACBACBBACCCCCAAAACABCACCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCCAABABABCABABCABCBABABCBBCCACBBBACBCAACACCAAACAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCCAABCCACACCCBBAAACBBBBACBABCCBBBACCCACCCAACBACCABCAAABBBAAABBCBBACCCABACCACBACBBACCCCCAAAACABCACCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCCAABABABCABABCABCBABABCBBCCACBBBACBCAACACCAAACAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACCCABAABACAAABBCBAACABCCBBCCBACCBABACCCACBBBABBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCCAABABABCABABCABCBABABCBBCCACBBBACBCAACACCAAACAABA.exe" start= auto displayName= "UserDataSvc_AACCCABAABACAAABBCBAACABCCBBCCBACCBABACCCACBBBABBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACCCABAABACAAABBCBAACABCCBBCCBACCBABACCCACBBBABBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCCAABABABCABABCABCBABABCBBCCACBBBACBCAACACCAAACAABA.exe" start= auto displayName= "UserDataSvc_AACCCABAABACAAABBCBAACABCCBBCCBACCBABACCCACBBBABBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACCCABAABACAAABBCBAACABCCBBCCBACCBABACCCACBBBABBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACCCABAABACAAABBCBAACABCCBBCCBACCBABACCCACBBBABBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4336

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCCAABABABCABABCABCBABABCBBCCACBBBACBCAACACCAAACAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCCAABABABCABABCABCBABABCBBCCACBBBACBCAACACCAAACAABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4980

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2684

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCCAABABABCABABCABCBABABCBBCCACBBBACBCAACACCAAACAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCCAABABABCABABCABCBABABCBBCCACBBBACBCAACACCAAACAABA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3272

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBAACBBACBBABBCAABCACCBAABCCCACBAABBACABBBBBABCBCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBAACBBACBBABBCAABCACCBAABCCCACBAABBACABBBBBABCBCBAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 5c64ab85082c9d85bb7be592e0cdb8fa08fb150f1f772e7dd2d78cc526c25738
MD5 3c68afc51da63864c9606e620bc3b4b0
SHA1 a91b7d2fc3221da63070360c08739a3247b28bbc
SHA512 80412cfa982b429e066128e0675d006c560430a5c7e7bbedd8c356280be8005a94e01fdc76a1dfb8293a1bac32ea058e66982b68bc7b77863ce90629c113fb61
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 23.8MB
SHA256 c19b9f40c9a2837579fcfd06bcbeb56095f6edbd8a4012b004cc4c079410722a
MD5 c43abb3d0fb021e96b2064a5be2cf3c3
SHA1 13c63068e4413c24aad7a5e204191a76ccd79005
SHA512 e9541e56ab4aa2fe2e4d05939fab00f2e7c2badb8f01dab0bba0d17e854fe6acf6d15569f21b397f30367730232a8651f27d0d418f81bebde2cd0388e185e483
SSDEEP 196608:kFlfFlfFlfFlfFlfFlfFlfFlfFlCnSsmHpn6F44IAWvBQ:i33333333sLmHN6+JrvK
TLSH
T15D47BF46B99750F8EC7EA17589ABD332C5317C278031874B66EDF6062F73A606C1A723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\uk-UA\qap`g`v~dtlq
Size 10B
SHA256 42e32f1c306f342cf1be042eecb8f91cba65bbfac4df4b9f7c3e64913d933ee8
MD5 d3cec5d8115048b41789dc8122f19fae
SHA1 5fd35bab9dfb043c3fda1eb91cd284fd69ab26b2
SHA512 3203b4f8cdddd02d634e0e555344ccec3f853898f15535e02fccc8e9f8ff9f59b6be13d4556504bb675b0ebce8bafcfad9fad49bd7d07e558ee7731580a77a79
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.CapturePicker_10.0.19041.1023_neutral__cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 14a5a832b3560ed9d7fa0f383b0122d707dbdd736ae1fee82a8fe1ba2dc531b2
MD5 eba646aa48ada5d6bbe90b5d175cd60c
SHA1 6bc2a9b965d3dd7d6f64995821f51130613be49a
SHA512 5198e8a85a43b7d493e6963ec51fbb2278792607cf043c1a270c593268e0a67de12441ac7bff82c6d99783e31be4eefefcbb770591aa820f1ab5d8a8be9568c2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\qap`g`v~dtlq
Size 10B
SHA256 81d75776fc36300f38cfd9c58ac292c01a8e55fce9545379192a7fca4880cc9d
MD5 808ba1de71970244202cf1aa3f537c07
SHA1 5fa721f5eb40231c794e31ddb6cbe840ebf985a1
SHA512 5bb541ce100c565bfca2bcab92ba27f32bcc364f3287dfdce6820b9266fc7dac831b05924a9c78e7fca33cfd995d5e372ecdc3319dc4756ad76576eafb8b5cc4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 005d6028cafb75a3e6d9f8a9211dd35d66958938cb579812445fad096ea39af7
MD5 8bab5b6c35e741465ec9eb5af0675965
SHA1 99347723ea762526276b80c4dbb0502ee710973d
SHA512 ebb7aff06709f24c3643f44002c25787b74f79b417f1b52042c8d7d45e48db735fcea8cb53cb62feb74206537f37046e8f1f608cac54b4d024180216e8fd697b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.HEIFImageExtension_8wekyb3d8bbwe\AC\INetHistory\qap`g`v~dtlq
Size 10B
SHA256 33a38735755443c40411ef28cf4040d33146216a9874049d0161fda3a7835840
MD5 6633584bc6ba1307e2d01a9e576ebcaf
SHA1 1ac2ceac98ed6b5f5b6f89d1b1660f78d4e7c170
SHA512 1dec324707b438bff3695e07ee5f173110c00b49d377709e6c886cacaefa10c017521d35b3fb65153b1ccebb83624ea943e34b81a6bf344b8f5e7836491cba24
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\qap`g`v~dtlq
Size 10B
SHA256 aa7dd4c86700b613ad85782511af4f15ba51427ec42c915886860b43b2df5000
MD5 c92ae44e875a0ff2e99bc91907817992
SHA1 242169d73eb1f5bde70e11927fcfc080b1d29d7d
SHA512 baf6f413a814f9a1492ebd58dc4c2aa044b998f8f2b7d134032dbe510fda82faa8775c9b3a0139722e77326f6ec8256a54e3380a696ac5ddf58e9cef10488ef2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8827b2131711a8ae0721274e9bf94e72cab9df6eab709cd3638ae71f276b3807
MD5 05ff5ac24c24cd3e65e31ee08c7d4ae1
SHA1 75ddf8aa3891f2972acdaaadf364f972eaa645b4
SHA512 3f6df40a74cb4924cec10d98abd205161ba82d9e7b476659e3ff89ce24189be33fcaf3331a3c3deeb4bcdedf495f8c75e3516adda1b655bb07bbfc95a96efa27
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5c693f5109dae2cae33245bd3d99db6754b96def3554d36d8b05f7a883ed85fe
MD5 31b214eb538396ab1502597485b319ed
SHA1 7269aa2370f928647abd2ea51b094826635c3b66
SHA512 fe94fda4ddd23d4f5471ab99555645e70aa54bd06caaffc060609b3b320cb92be810f9582e3d82f436603fb6a2b8d64b1b5cc42d453b653b1afe26c03f2baca8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ed8b484e87a74e5dec49efb92a94d4829037d054c622384e020bbd2a4031b4f8
MD5 ab0d26690315a93770176f4460d62389
SHA1 27db96951625796be1599491a155b4343115a0c6
SHA512 a883ad8e293c33d69f5503e408b3a65435a51230769d2e42f164780e5f716f0552f8dbc221b0df5f4a890ab5e5ebeb0a527214532eb70264da72141c3c547cea
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 754aca0f0df517f7b1e55cda5a5cd37c92c628fce7c8424f7de140ec48cbe58e
MD5 7f4b17333f0a39e3dcce45d7999e3aa2
SHA1 349208afbc324cf7519bbc39f901c3034f87d2cd
SHA512 a46ce5dc1f402e6691991d0147460175bd4cf1e478136ea233772f4f6808828fab7bd26e4ff5a82a8d9e155e41ab3591848ba8913fe3a51ed1e8bfbcb9100fb0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6482fba318795bdc2b34c2dde2d935d268cbaf3a5d35975bc8d7f2db6a2da412
MD5 73476d7bafb58bb3e666b197e3e42f11
SHA1 511aaffade8184855d56c582cead2e955a46a0f8
SHA512 941ae73e2f65c39b6861c066276c137f72b9b8db25dccc60d2d20b1622937f95c3ef4d1204b9ee0e6798b188388837e86b1fbf6b6193c73e914a0921fb3cba23
MD5 SHA1 SHA512

Submit Download

svchost_BCCCCCAABABABCABABCABCBABABCBBCCACBBBACBCAACACCAAACAABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCCAABABABCABABCABCBABABCBBCCACBBBACBCAACACCAAACAABA.exe
Size 23.4MB
SHA256 e6d89449a0737f1bc971f096c4addd67260184f1208df76e97b4a5ce012f82a8
MD5 7d3c71c818d13eff5dffd02c53db5933
SHA1 481936da5bfe41508942b6415911b2b4351ea203
SHA512 57f576ef348f1e5cafec870e98ae40d8f9b8b47740bf6494ccbedf293d65149791dbc6aa73706ecf79a8733b1c8376715c8201178626191f5cb5989f29b25271
SSDEEP 196608:kFlfFlfFlfFlfFlfFlfFlfFlfFlCnSsmHpn6F44IAWvB/:i33333333sLmHN6+Jrvp
TLSH
T19437CF86B99750F8EC7EA07549ABD332C5317C378031874B66EDF6062F73A646C1A623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 ba70281ca843e3052d679bb19cbc5ebe37c68b2492a213041611a0f5939dc2e0
MD5 2ef7e78fbb6bc8eb4bf2bbc10d2bda91
SHA1 4e2dace62c0320bb17818660caea2bb6f61abb99
SHA512 62f9fdec6882a5e111235940dc28460ad402c7d257f12a5a1dadacbae217f181e143b349086d580e53ca6965ade4aaecf7f05e92c3795f82658fe19feecc6e29
TLSH
T1CB112E60D8B9DC63EA322856A70ADBF31CE4379B7D5CBA04230E4608AB89D30CD954D1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/456-79-0x00000000001D0000-0x00000000001F1000-memory.dmp

Download

memory/3272-628-0x0000000000310000-0x0000000000331000-memory.dmp

Download

memory/3272-73-0x0000000000310000-0x0000000000331000-memory.dmp

Download

memory/3516-59-0x00000000050F0000-0x00000000050F1000-memory.dmp

Download

memory/4108-6-0x0000000000140000-0x0000000000161000-memory.dmp

Download

memory/4748-35-0x0000000000310000-0x0000000000331000-memory.dmp

Download

memory/4748-25-0x0000000000310000-0x0000000000331000-memory.dmp

Download