93dfc9bef8fe29cdb628560da564210c6325eae24ab98c4f8da170d579fc2581

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_7a676d13d88420a7e9042c0b2ba50513_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Size 17.6MB
Sample260810-e9gwma1emb
SHA256 93dfc9bef8fe29cdb628560da564210c6325eae24ab98c4f8da170d579fc2581
MD5 7a676d13d88420a7e9042c0b2ba50513
SHA1 9ebd52a6b9c701f350b5c1960c093a19d6f0486b
SHA512 2986dacc3c723c5a177fadf6e9f0c29c6fab997982421407efcfc084707e62be01443fdef17cc77f037b3a7717eaf1298418cfe7a0e86687f2042747c3706b27
SSDEEP 196608:kFlP7APhNNECwHrc8u3x3AEcq/fByuKKU:iZahvQHrc8u3xXJ/f4uHU
TLSH
T19607AE17B35A81E5C02AD2B88A474213E7B67C480330B7DB16D5B76A2F77BE45B3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral1/files/0x000700000002441c-20.dat	UPX
behavioral1/files/0x0002000000000719-90.dat	UPX

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACBBCBBBAABACCBBABABCCCBAAACBBACBBCACBAAABBCAABABBBBAAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACBBCBBBAABACCBBABABCCCBAAACBBACBBCACBAAABBCAABABBBBAAA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4484	svchost_ACBBCBBBAABACCBBABABCCCBAAACBBACBBCACBAAABBCAABABBBBAAA.exe
4228	svchost_BCCCAABCCABACBACABAACBCCCCBCBACACBCAAAABCBAABBCCCAAABCC.exe
816	svchost_ACBBCBBBAABACCBBABABCCCBAAACBBACBBCACBAAABBCAABABBBBAAA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBAACACCCCCBCCCAABCBABBAACACABAAABCABBCABACBAABAACCACBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBBCBBBAABACCBBABABCCCBAAACBBACBBCACBAAABBCAABABBBBAAA.exe"	2026-08-10_7a676d13d88420a7e9042c0b2ba50513_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABBCBABAABCBCAAAABACBACCBCACBAABBCBCCCBCAACCBCCBCACBAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCCAABCCABACBACABAACBCCCCBCBACACBCAAAABCBAABBCCCAAABCC.exe"	svchost_ACBBCBBBAABACCBBABABCCCBAAACBBACBBCACBAAABBCAABABBBBAAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2404	sc.exe
4992	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1908	cmd.exe
1832	cmd.exe
4344	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCCAABCCABACBACABAACBCCCCBCBACACBCAAAABCBAABBCCCAAABCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_7a676d13d88420a7e9042c0b2ba50513_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBBCBBBAABACCBBABABCCCBAAACBBACBBCACBAAABBCAABABBBBAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2212	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4496	2026-08-10_7a676d13d88420a7e9042c0b2ba50513_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
4496	2026-08-10_7a676d13d88420a7e9042c0b2ba50513_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
4496	2026-08-10_7a676d13d88420a7e9042c0b2ba50513_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
4496	2026-08-10_7a676d13d88420a7e9042c0b2ba50513_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
4484	svchost_ACBBCBBBAABACCBBABABCCCBAAACBBACBBCACBAAABBCAABABBBBAAA.exe
4484	svchost_ACBBCBBBAABACCBBABABCCCBAAACBBACBBCACBAAABBCAABABBBBAAA.exe
4484	svchost_ACBBCBBBAABACCBBABABCCCBAAACBBACBBCACBAAABBCAABABBBBAAA.exe
4484	svchost_ACBBCBBBAABACCBBABABCCCBAAACBBACBBCACBAAABBCAABABBBBAAA.exe
816	svchost_ACBBCBBBAABACCBBABABCCCBAAACBBACBBCACBAAABBCAABABBBBAAA.exe
816	svchost_ACBBCBBBAABACCBBABABCCCBAAACBBACBBCACBAAABBCAABABBBBAAA.exe
4228	svchost_BCCCAABCCABACBACABAACBCCCCBCBACACBCAAAABCBAABBCCCAAABCC.exe
4228	svchost_BCCCAABCCABACBACABAACBCCCCBCBACACBCAAAABCBAABBCCCAAABCC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4496	2026-08-10_7a676d13d88420a7e9042c0b2ba50513_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	4484	svchost_ACBBCBBBAABACCBBABABCCCBAAACBBACBBCACBAAABBCAABABBBBAAA.exe
Token: SeDebugPrivilege	816	svchost_ACBBCBBBAABACCBBABABCCCBAAACBBACBBCACBAAABBCAABABBBBAAA.exe
Token: SeDebugPrivilege	4228	svchost_BCCCAABCCABACBACABAACBCCCCBCBACACBCAAAABCBAABBCCCAAABCC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4856	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 1908	4496	2026-08-10_7a676d13d88420a7e9042c0b2ba50513_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe	102
PID 1908 wrote to memory of 2212	1908	cmd.exe	104
PID 4484 wrote to memory of 1144	4484	svchost_ACBBCBBBAABACCBBABABCCCBAAACBBACBBCACBAAABBCAABABBBBAAA.exe	105
PID 1144 wrote to memory of 552	1144	notepad.exe	106
PID 4496 wrote to memory of 1832	4496	2026-08-10_7a676d13d88420a7e9042c0b2ba50513_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe	110
PID 1832 wrote to memory of 2404	1832	cmd.exe	112
PID 4496 wrote to memory of 4344	4496	2026-08-10_7a676d13d88420a7e9042c0b2ba50513_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe	113
PID 4344 wrote to memory of 4992	4344	cmd.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-08-10_7a676d13d88420a7e9042c0b2ba50513_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_7a676d13d88420a7e9042c0b2ba50513_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAACCBBBBCBCAABAACAACACBABAAAACCBACBCABABABABBABBACACBBCBCCCBAACABBBBCACBCCCCAAAACCBBABABCCBBCBCAABAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCBBBAABACCBBABABCCCBAAACBBACBBCACBAAABBCAABABBBBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAACCBBBBCBCAABAACAACACBABAAAACCBACBCABABABABBABBACACBBCBCCCBAACABBBBCACBCCCCAAAACCBBABABCCBBCBCAABAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCBBBAABACCBBABABCCCBAAACBBACBBCACBAAABBCAABABBBBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABCCCABBCBBAACBCAAACCABCBAABCAABCABCCCCCBABAAACBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCBBBAABACCBBABABCCCBAAACBBACBBCACBAAABBCAABABBBBAAA.exe" start= auto displayName= "UserDataSvc_AABCCCABBCBBAACBCAAACCABCBAABCAABCABCCCCCBABAAACBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABCCCABBCBBAACBCAAACCABCBAABCAABCABCCCCCBABAAACBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCBBBAABACCBBABABCCCBAAACBBACBBCACBAAABBCAABABBBBAAA.exe" start= auto displayName= "UserDataSvc_AABCCCABBCBBAACBCAAACCABCBAABCAABCABCCCCCBABAAACBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABCCCABBCBBAACBCAAACCABCBAABCAABCABCCCCCBABAAACBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABCCCABBCBBAACBCAAACCABCBAABCAABCABCCCCCBABAAACBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4992

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCBBBAABACCBBABABCCCBAAACBBACBBCACBAAABBCAABABBBBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCBBBAABACCBBABABCCCBAAACBBACBBCACBAAABBCAABABBBBAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:552

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4856

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAABCCABACBACABAACBCCCCBCBACACBCAAAABCBAABBCCCAAABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAABCCABACBACABAACBCCCCBCBACACBCAAAABCBAABBCCCAAABCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4228

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCBBBAABACCBBABABCCCBAAACBBACBBCACBAAABBCAABABBBBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCBBBAABACCBBABABCCCBAAACBBACBBCACBAAABBCAABABBBBAAA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 e9efd024174cf1e20bc7954053f4820c457aa7dc69c40d80e10083a56282d46b
MD5 e5b529e5a85b24164cc116859531eaf6
SHA1 031abc7a349e5744f39a39619a7a6cb2cd405bed
SHA512 f5276243289da175627d4af82b596b52f1408561d7ef0cc435cf315210258ae01d1c9d7a5d3e79ffcc7e088f099a0fe5f9fbcf8e8473058a9e5e54b1905e82b1
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 18.0MB
SHA256 e376b5205c485e76e1ddf05a8b91f6cec7378bd65ef1455592d256fa7043d0e0
MD5 d2bebb9f74f881594799d9676aed8435
SHA1 3d76330d3423f0a9c94cc4c4dee0b6ccfa2b1bd7
SHA512 39a023cf75b6a336c0706bd9d47e6d952ed96c6ba8bccb4e906cda66d3982042395ba9ccaef5c1ca60298e12d2875afb0f38b9d01a718cac17da0f6bc92ab295
SSDEEP 196608:kFlP7APhNNECwHrc8u3x3AEcq/fByuKK2:iZahvQHrc8u3xXJ/f4uH2
TLSH
T19F17AE13B35A81E5C06AD2B88A574213E7B67C484330B7DB16D5B72A2F77BE05B3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\DSS\qap`g`v~dtlq
Size 10B
SHA256 97810f3428f68184a6aef68844a2c418a8be89b32636e37a3e431ee74ad5ddcb
MD5 3d9321454c45e6621a91866eb42a7c73
SHA1 3efb7958efad0e1d5e1f404b603794f841b6e1bb
SHA512 220aa05c85bd1b3dd7cc03424e3773bb2325399838db98fc0bf514d923f7789f26e1c79581a264872c8aa379c93a8bff6c4b4f1ee26c5043a8ae3d6c2a81bdf2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 48c60ffe9f97830eda5d52e60b28941a57b986fe56d807e1ddbb91a9433783fc
MD5 97ec56d689e4172225722a0804380351
SHA1 ef16a44fa1ab0895e6975cb08783c2aa1648c639
SHA512 d181ef607b4d280f0dd2abee5195e7c9973ddec0e10117432951817be9570d85d036939bb202d055330ed596bef0ff6c25f4f16d710a9224925d55bb437b1cf5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Diagnosis\CustomTraceProfiles\qap`g`v~dtlq
Size 10B
SHA256 7156026e8c4503b5273654cb083f808eec465a505f59c9e1c119a5028d271bb9
MD5 086721329eefa8e9ad69d9b4d50398ec
SHA1 acbf290cbbccc2afb2a5b58c0a6e58332404facd
SHA512 f5cd56d65681971f2fcd711d41d80d3a7c2c69e457f0bd77b86827eeab091dda5a77802c37b01ba47f5570b92036aa91645003f3f6789d9080484d40efc63b76
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 33c3d74b538be3f58011329022ac92f68e1a20ac27c769907d68d13ca52d8c36
MD5 cc96512d0a7c6d9c54ed8c60416dabc3
SHA1 25771e9588ae5a2a251a8d9d942108a45c839c77
SHA512 53e8c9f75580f1952f3ad4b92f54bffaedff6363e7a7b1c7b5877eab76edb382715a136049056665a60fb055f3bf9e265c23a2d5e0a4a44d065982e1359f72ec
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 6b914adc058a5efa6bfd12812bf9cd5dc965000dc03265fbecd002fc283f054f
MD5 fd9793df59378becf60341db2b7beb9e
SHA1 6768ca5a22bcefc61525e8ed06c946d0f740383e
SHA512 54d17a9327851462f5b13d862e649268bba79e7f1a998dce6d041e40c4b02f08b8b1a20a8f06b053f590f5241639f1f89e929a45e56823154279d7938fa812d3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\lv\qap`g`v~dtlq
Size 10B
SHA256 1acc27ded3237423dec9637dfa35e0bfbe54dbb20b21bf669887571a50d64f80
MD5 9f5a061c471c1f58561415984aa95f0c
SHA1 37c01f81b69ebefcd11d1058c828f7e3e6873f42
SHA512 72ed0afcaa1afc7595daa12d0ea457a2160eb6290c79b5c97e29ed38570d0a4164a2fabea841bbf592986fdbe99b046c366c2e5586c9160d3315036d20eeb85a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\SystemAppData\qap`g`v~dtlq
Size 10B
SHA256 3c74c53f782aef6d419fef720e59b32fdd61372b99e184de2b8a422eb3190fd9
MD5 1f6947359c8726bcb3000b593a13fb94
SHA1 3664eb381ef3ba57307b08715be3105e4558ce57
SHA512 17ade99573a8f0c6927040936a3b970a5ff122427ddac0ffe2aa324f7df1f91e2f7d113e7fa48fb090b8d11c1824983d0877eb06ecd88c27dd49150a939a2e78
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bab5d79ce9f8f4d2def1b229aaf8b765fd5bb5d31a7072983825664068f84e6b
MD5 2e0f44f8b1dd1b30b02a3935b806bbd8
SHA1 d110bbd346585c10b3eb41d9c3e97811f4090f98
SHA512 a8e0a2324ef41249e13fbd6cd65cdfe21e7b6f53dd21f6ecb8634e70d9bd8125f9ef21409c8176813d993f8eb62fe353a319d946875096eb01756fec265a8ec5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8e62fea89841e7f9db788b3ae8e40180854fe2590419da2b69b2cd360cca1faf
MD5 97af9620370d21d97b0c3aada9181c78
SHA1 14a18d56bda92008641dac7cc24125333ad488c1
SHA512 bd33016dc8db77692b656757b966896aad7dca3f9983eda67dc88841938fad0f27e0b02a90595251c053a1d0082e1a8417a8780fa0163ebba79b58f7c13b8463
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d558ce4d919036e567e4414708c034d5ced7231843599c44219b97950ef16e7e
MD5 0a87d0f6f6b668af7846a4d0b50d265c
SHA1 41423578efa2012fd02b19a7e728a01de6277ae0
SHA512 f950743166142e9ae54dacff00098bd5ee25a1aa699a93f6b3390df3acf7e13e9f93cd44bca913084ad2a1116fd1b399ead2db91153017842c8325c38423d3af
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 44bc6ace04a52e143f0c7f0835233d0d3411f008d1549fb5fcc407bf8cae14bf
MD5 396ca404e96c4820ad221999757e5bba
SHA1 1af0ff360cdd1770b91d6c2c1d2159f3dbe1b665
SHA512 9259a6bb9129bb60b2f9b216e0ebc7fe84ce1c3d3c77925fc0308711616300a693c85523c7e38d43830c8e6e8d764540580f517e7e544cc3470cd4263e310bfe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3c6aefcca1dc5bee8b3c153bf985f9996174934debd2b1871bfe4f8cdcb20371
MD5 33868bd6331ec608e4ecb07c75a1faa5
SHA1 0e56da0379454ffe83e216ede2e4322341787eb6
SHA512 72b300fa7eb0631ad4509f846df87d577a914ebfbcaf93118d80b4af29818295a4bac779b3a682ad1ddc9b237c94868a1dbfd1b2bdf52be009b30eaf9e37eee5
MD5 SHA1 SHA512

Submit Download

svchost_ACBBCBBBAABACCBBABABCCCBAAACBBACBBCACBAAABBCAABABBBBAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCBBBAABACCBBABABCCCBAAACBBACBBCACBAAABBCAABABBBBAAA.exe
Size 17.6MB
SHA256 93dfc9bef8fe29cdb628560da564210c6325eae24ab98c4f8da170d579fc2581
MD5 7a676d13d88420a7e9042c0b2ba50513
SHA1 9ebd52a6b9c701f350b5c1960c093a19d6f0486b
SHA512 2986dacc3c723c5a177fadf6e9f0c29c6fab997982421407efcfc084707e62be01443fdef17cc77f037b3a7717eaf1298418cfe7a0e86687f2042747c3706b27
SSDEEP 196608:kFlP7APhNNECwHrc8u3x3AEcq/fByuKKU:iZahvQHrc8u3xXJ/f4uHU
TLSH
T19607AE17B35A81E5C02AD2B88A474213E7B67C480330B7DB16D5B76A2F77BE45B3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 a98a2614c50412780aeac95e8642fa53db3b50612b7d58d23720b83b9331be15
MD5 bcbce1457a4100171ae166fa370e4bc8
SHA1 acc632caca586320e2ed584f481ff31a3b6aa026
SHA512 b9199cfa120fd3fc92c47f86f0971022c33be61a6e7f0894d5e36d01347a2bdc898b17c42d7643336a7668479bd5bc17963d4c3e7630b9a6587d0bd05acab724
TLSH
T13D21FC51A8D9C813E933288B922DAAB30CA577DB74586A5423088518BFD9D34CE95CE2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 d697dfaff0ef3af625e4563857a124e07a1631965d0140b67170567a1913a81c
MD5 bded97c77c4f3fd5950a3cbfc5469f45
SHA1 8370dfb6ae4138ebe2c30bd44dd63fc543abafeb
SHA512 4947dcdbeb8dcd1a73c355f6edf044f8d376f5832eb921578d5325ec654230705ce2aaa42b7c38365ac8543124674979e29aab252fd430dea549b3c1125c1036
TLSH
T1F0112B11A8E9D803E93328CB932DAAB30CE573D774586A5423088608FFD9D34CD99CE2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/816-371-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download

memory/1144-57-0x0000000004D70000-0x0000000004D71000-memory.dmp

Download

memory/4228-77-0x0000000000040000-0x0000000000061000-memory.dmp

Download

memory/4228-2207-0x0000000000040000-0x0000000000061000-memory.dmp

Download

memory/4484-25-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download

memory/4484-36-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download

memory/4496-6-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download