4d686026c8202786df89a6214d9fa4f8cc3d637541a723a732aaf4077ca91815

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 03:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_d9672f90e664ddf8bfcf0f24c9cc620e_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 25.2MB
Sample260810-egva9a1alg
SHA256 4d686026c8202786df89a6214d9fa4f8cc3d637541a723a732aaf4077ca91815
MD5 d9672f90e664ddf8bfcf0f24c9cc620e
SHA1 a5d82df77c45eab231a039c438e091bcd45035c0
SHA512 7753ccaaf7beacd54c147bd08231df39a1521d985456d0835f9ece7bd9b0d6d018ed201115dd52918692911d9731ddda420c82b075e647f978baa50461010c89
SSDEEP 49152:U+ES+ES+ES+EWLcR+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+EZ:YA91pH2WpjHrgBFFu416AWvE
TLSH
T154476B05F94750F5D92B50B04DDBD3BBCA707E2282224BEBE65DDB1B2E337A06C28651
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBABCABCAABABCBCAACCCBCBACBBCCBBACCBBABCBCBBCCCBBCCACBC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBABCABCAABABCBCAACCCBCBACBBCCBBACCBBABCBCBBCCCBBCCACBC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3728	svchost_BBABCABCAABABCBCAACCCBCBACBBCCBBACCBBABCBCBBCCCBBCCACBC.exe
5168	svchost_BCBACABAAAAACAAABCCCBCBBCCAAAABBABABCCABAAACABAABAAABBA.exe
732	svchost_BBABCABCAABABCBCAACCCBCBACBBCCBBACCBBABCBCBBCCCBBCCACBC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CACCABCACABACCABBBAAAABCACCCABABACBCBBCAACCBABBACCAABCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBABCABCAABABCBCAACCCBCBACBBCCBBACCBBABCBCBBCCCBBCCACBC.exe"	2026-08-10_d9672f90e664ddf8bfcf0f24c9cc620e_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABBCBCABBBBAABBABCCBCBBCBBCCBCBACACBBBBAABCABACBACCABACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBACABAAAAACAAABCCCBCBBCCAAAABBABABCCABAAACABAABAAABBA.exe"	svchost_BBABCABCAABABCBCAACCCBCBACBBCCBBACCBBABCBCBBCCCBBCCACBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6084	sc.exe
5872	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5356	cmd.exe
216	cmd.exe
2588	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_d9672f90e664ddf8bfcf0f24c9cc620e_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBABCABCAABABCBCAACCCBCBACBBCCBBACCBBABCBCBBCCCBBCCACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBACABAAAAACAAABCCCBCBBCCAAAABBABABCCABAAACABAABAAABBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5348	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3756	2026-08-10_d9672f90e664ddf8bfcf0f24c9cc620e_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
3756	2026-08-10_d9672f90e664ddf8bfcf0f24c9cc620e_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
3756	2026-08-10_d9672f90e664ddf8bfcf0f24c9cc620e_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
3756	2026-08-10_d9672f90e664ddf8bfcf0f24c9cc620e_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
3728	svchost_BBABCABCAABABCBCAACCCBCBACBBCCBBACCBBABCBCBBCCCBBCCACBC.exe
3728	svchost_BBABCABCAABABCBCAACCCBCBACBBCCBBACCBBABCBCBBCCCBBCCACBC.exe
3728	svchost_BBABCABCAABABCBCAACCCBCBACBBCCBBACCBBABCBCBBCCCBBCCACBC.exe
3728	svchost_BBABCABCAABABCBCAACCCBCBACBBCCBBACCBBABCBCBBCCCBBCCACBC.exe
5168	svchost_BCBACABAAAAACAAABCCCBCBBCCAAAABBABABCCABAAACABAABAAABBA.exe
5168	svchost_BCBACABAAAAACAAABCCCBCBBCCAAAABBABABCCABAAACABAABAAABBA.exe
732	svchost_BBABCABCAABABCBCAACCCBCBACBBCCBBACCBBABCBCBBCCCBBCCACBC.exe
732	svchost_BBABCABCAABABCBCAACCCBCBACBBCCBBACCBBABCBCBBCCCBBCCACBC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3756	2026-08-10_d9672f90e664ddf8bfcf0f24c9cc620e_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3728	svchost_BBABCABCAABABCBCAACCCBCBACBBCCBBACCBBABCBCBBCCCBBCCACBC.exe
Token: SeDebugPrivilege	5168	svchost_BCBACABAAAAACAAABCCCBCBBCCAAAABBABABCCABAAACABAABAAABBA.exe
Token: SeDebugPrivilege	732	svchost_BBABCABCAABABCBCAACCCBCBACBBCCBBACCBBABCBCBBCCCBBCCACBC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2180	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 5356	3756	2026-08-10_d9672f90e664ddf8bfcf0f24c9cc620e_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	99
PID 5356 wrote to memory of 5348	5356	cmd.exe	101
PID 3728 wrote to memory of 5480	3728	svchost_BBABCABCAABABCBCAACCCBCBACBBCCBBACCBBABCBCBBCCCBBCCACBC.exe	102
PID 5480 wrote to memory of 1808	5480	notepad.exe	103
PID 3756 wrote to memory of 216	3756	2026-08-10_d9672f90e664ddf8bfcf0f24c9cc620e_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	107
PID 216 wrote to memory of 6084	216	cmd.exe	109
PID 3756 wrote to memory of 2588	3756	2026-08-10_d9672f90e664ddf8bfcf0f24c9cc620e_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	110
PID 2588 wrote to memory of 5872	2588	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-10_d9672f90e664ddf8bfcf0f24c9cc620e_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_d9672f90e664ddf8bfcf0f24c9cc620e_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBABBCBACABBCABACAAAACCAAAABCCCBCCABBABBACAABBABCCCACCCAACCACBBBACBCAACCBAABBACABABBABBBABACBBAACACCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCABCAABABCBCAACCCBCBACBBCCBBACCBBABCBCBBCCCBBCCACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5356
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBABBCBACABBCABACAAAACCAAAABCCCBCCABBABBACAABBABCCCACCCAACCACBBBACBCAACCBAABBACABABBABBBABACBBAACACCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCABCAABABCBCAACCCBCBACBBCCBBACCBBABCBCBBCCCBBCCACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAACCCABCBCBACBBCABCAACACCBCACBAAAACCBCCCBACBACCCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCABCAABABCBCAACCCBCBACBBCCBBACCBBABCBCBBCCCBBCCACBC.exe" start= auto displayName= "UserDataSvc_BAACCCABCBCBACBBCABCAACACCBCACBAAAACCBCCCBACBACCCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:216
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAACCCABCBCBACBBCABCAACACCBCACBAAAACCBCCCBACBACCCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCABCAABABCBCAACCCBCBACBBCCBBACCBBABCBCBBCCCBBCCACBC.exe" start= auto displayName= "UserDataSvc_BAACCCABCBCBACBBCABCAACACCBCACBAAAACCBCCCBACBACCCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAACCCABCBCBACBBCABCAACACCBCACBAAAACCBCCCBACBACCCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAACCCABCBCBACBBCABCAACACCBCACBAAAACCBCCCBACBACCCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5872

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCABCAABABCBCAACCCBCBACBBCCBBACCBBABCBCBBCCCBBCCACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCABCAABABCBCAACCCBCBACBBCCBBACCBBABCBCBBCCCBBCCACBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5480
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1808

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2180

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACABAAAAACAAABCCCBCBBCCAAAABBABABCCABAAACABAABAAABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACABAAAAACAAABCCCBCBBCCAAAABBABABCCABAAACABAABAAABBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5168

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCABCAABABCBCAACCCBCBACBBCCBBACCBBABCBCBBCCCBBCCACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCABCAABABCBCAACCCBCBACBBCCBBACCBBABCBCBBCCCBBCCACBC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 9025b01e0e81c4db4610f97d1ee249bdfa7ce7db2dfac4df6d48650eb7f0cb46
MD5 2956d012d574a375c370bd13a922a804
SHA1 4a2e37ce780a3477b14a581a666752e4548ae8cd
SHA512 58b0469706eddf16ca28616015c4f181f804937e57b37cdf6c2baf8b096ffd97ccb61f915b914f24572c9c7758819a634edb61308fb8dacb2817286aff034135
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 25.7MB
SHA256 d6746c6e99860d64aa955c3926c5c62f869b38a064a98edb2d9b34369af07529
MD5 e7173a732b0aafab736b781395c93edc
SHA1 d5e52df3ed1cddd7118783a786db54cf46c98ca0
SHA512 ae9049327597775c7b05e8d0f149e551af4b0ab3715f1df27ae44626ef11c1bc338f404003803c14b799a5bf8acdf6f2a6633ed28c49d10c4febbcd40746fd30
SSDEEP 49152:U+ES+ES+ES+EWLcR+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ER:YA91pH2WpjHrgBFFu416AWvHpi5
TLSH
T1EF476C05F98750F5D92B50B04DDBD3BACA707E2282324BEBE65DD71B2E337A06C28651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\qap`g`v~dtlq
Size 10B
SHA256 b47b28478e3abbe209ffcae03deff56202e8437e5ed0491dc15be7742bc45fce
MD5 ca44b71283de85f1ef0d2056716efa9a
SHA1 33e16b76cfa2eed3863bf5a95698b09c3d987757
SHA512 118575cd7fbee7a1956fb446b528ae882838aaa627be62dc4c1228c5412aa6850d00c5da412082b37668b5f2d9ff531442cd2a753a7bca4f24903dfae6b7e8cf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 cd77cc1237a2f8f6d6ca9e526fa16b33a741a357f0445c695e97be68675425a9
MD5 c92e3a8a8918df3a13f73f7496e97e46
SHA1 49542b2edbb8dcbae3015f6231517676b540fb13
SHA512 d83a255f1f7f3d20d31bacc8f13dacf354426e538fa8f559370d475e163a64b66e3e416b2a07e8ad22281895835d4b8e74f39f4d8bd1e1e5bdeeeafd7a6265b3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 c0c10aa36cc9cae2da0bc2399361a57bfce7b99f28524542be5c6249a0b4a222
MD5 5ccd4194d954908e955d383de503d7b1
SHA1 afca8b24bf2be9ca3bd420df4432c352ed14a60e
SHA512 bb458809d5ca34bb511bc40723577af0a9a66efcb8e79bbd1ae0c44d9137b0f502c4bd61491528d7e6b06e31aab839d1b50efcb65914a9a02f4e0f50b37a7f25
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tracking Protection\qap`g`v~dtlq
Size 10B
SHA256 11a3c4d078a47e51abd5550080477c105bc5a0096b1753e6bc3253a55cce934f
MD5 765028eadbbdc256d4b7d7d6f87de9a4
SHA1 b188eefbd9f3337c7f131607dc4da10178b2db33
SHA512 84dedb408c201f82b74a6199de14c428c20780e9b4d501ec1a294b43f534a9de98615befb9d976ae7870d016e042e33e4ed701e0cc39ffbada27382b73e6ad68
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Notifications\qap`g`v~dtlq
Size 10B
SHA256 feba8b9e6730fa9a94e9533f85a7ac24152fe9722eae5082a07a17c1531c0edb
MD5 97f2c71fe0f5ffed4c7ea13bf36b2340
SHA1 d34fce1ed586ec675b09b15da2254693d3130715
SHA512 a1afe12031838b1a7f409b0874c9ed845218a89d0d7021c0429a71ade26a7406b9660e94f639bd8844432bf86d24ce689092c96cf6efcbcfde1807a4c2c22998
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.NET.Native.Framework.2.2_8wekyb3d8bbwe\AC\Temp\qap`g`v~dtlq
Size 10B
SHA256 3cc5eb647761ce1e30d6c688f6da865328fe55dbe1440f0fc003a79904dba09e
MD5 314627b35b6ab9207e06a3a1f520fcc0
SHA1 5f1f2e2970f828ec618c7754c25fc0aa2c7eaf40
SHA512 b68542e4601f89cb1cf35eb280115aa8cac0aa19baf056fe4e8d6ed08913df6b25deb468e28cdd2f7150261131e22338d4242c66d6112670f12b4968e7fb627d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Word\qap`g`v~dtlq
Size 10B
SHA256 959e7ce3381f8daa4a69ceb8d27b62ba1d1c7c42abb672df981cd41faa630418
MD5 05449b41e36ca38833b3d45851a43eaa
SHA1 09c10e2c3336e28b797c062addfe8e59fcce4de8
SHA512 3383b134a0e1b476181433ecf985eba8c53c9e52907b6cb025ef4ccc0da9c97f29b85e20e614e23dc6f60c84975724431eb8ce93d8c3ba942ee94d7e575a7c60
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 49da120cbfa008ef85459e532e0fa414ec281d3a884d72f72d4e45ce9ce2175e
MD5 1e631c7e3e6a35107c6cb0c6b3596145
SHA1 a8ce1642c101cb26a93afe84d611a40d75342cd1
SHA512 8eefa04bbba4a6a8da19a0395d8428cba33d20903a657abd8186fd2f24eda41ed835cc17c7fd692448b8c73f9d19c09a5317441723440848d0dfa07ed80786db
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6e102715d14fe3ffced5f8d03612646c68c0ddc4ade7d0c6edfe0a2e2baa84b6
MD5 062e88db9c672766dad35c996fca590c
SHA1 2a143da47e88361091ddcf14195099c561d06d38
SHA512 0a44ab64744ac901cd6bfc1c4c6ba8e72d9ed01246e7653d4137d6bf0c20754556f16583ee6fe8931078d689dd0a8859c5a06f8ed949eb47ca1db231f8e3c531
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 fd747c9ea7d2656dad58ecd4bc69b643f6994cea3c52a33f0f3ad5d26ae9953e
MD5 b9f03bc0e3cf297724fc37235c4bd118
SHA1 2ac98fa5e6990c746bb3050f09c9e233f31c0c7e
SHA512 5c0da06b1e2cc7152e1879dbe3bedf7a1e2dc2550d09a78072b14ae9d1d7d1c0200836514929e120015110c4138b0dec1680f46a3a53b7d87c7e3bf0d82785b6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 69ad6e5a0c6409b723336be2eab5879943b2ae8fbd9e684a88f37e91a2cbdb0d
MD5 88b710056b874976f1aeae4e8669dec6
SHA1 fba8cd03f0c2ab1aa5870c56ba37a05db90c0e35
SHA512 784892678a5a73109c53be7ab4409ee9b42fa9a99263f9679ba81395fd85c44a88ea409241b1621cbc19077241c355ea7d3f60104c2280b44db0882cfbecf8f9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e3925ad71f7840f5c11504dabab01b3e96908e09179633aa1a0e7d4dcc28eb45
MD5 dbcf7397d02e374fe71fe254863fb796
SHA1 76891119d4c91a96f36ab13899e9c496a94f67aa
SHA512 a980445b4eff8f505fd0711cf86e496de2f206670beb95d72e922d6d28ec9e91966b1dee3568ea025c68058d0684742b852f45af15c895a4c827262c867ba50d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 57336051bae82b2846ccc19b24c3eb4d618e8795d5ab9b729ec6d8fa98d00c86
MD5 eaab88d6de85cee0cb527d326c3150ae
SHA1 03a9a47f6e9503f4ab3fb0b6048d5dca74532c1e
SHA512 ccab01b1a962e97b74009d4196768f0e378cae1ef44bc62f5f129fe54edd8b407f552478543f5c24f158803bfa73ba92cd1b31a48b178d8853ce5ca3b770610e
MD5 SHA1 SHA512

Submit Download

svchost_BBABCABCAABABCBCAACCCBCBACBBCCBBACCBBABCBCBBCCCBBCCACBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCABCAABABCBCAACCCBCBACBBCCBBACCBBABCBCBBCCCBBCCACBC.exe
Size 25.2MB
SHA256 4d686026c8202786df89a6214d9fa4f8cc3d637541a723a732aaf4077ca91815
MD5 d9672f90e664ddf8bfcf0f24c9cc620e
SHA1 a5d82df77c45eab231a039c438e091bcd45035c0
SHA512 7753ccaaf7beacd54c147bd08231df39a1521d985456d0835f9ece7bd9b0d6d018ed201115dd52918692911d9731ddda420c82b075e647f978baa50461010c89
SSDEEP 49152:U+ES+ES+ES+EWLcR+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+EZ:YA91pH2WpjHrgBFFu416AWvE
TLSH
T154476B05F94750F5D92B50B04DDBD3BBCA707E2282224BEBE65DDB1B2E337A06C28651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 081fa55af5c3f86a37977bc198891fc042937e4a45ddb9a4a320cb10f9ac8b73
MD5 47ad26b38f9419d31c52f51c15d98feb
SHA1 ab2b9d90209644f9efbf47f24c3ca2440b201555
SHA512 2cdd3930d18742f73d35532717e19d78dfc7ccce636728c56c39615caaa9f9296b61f0321a165d35d1a5d65622056192e5a9a943433949adf5997fc3a0f9f85b
TLSH
T19A110AB194A9DC47E93369CBC12ADB920CE82747749C6A24A3498A187FCDC33CD554F6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 40052e15998432c6104ceb21ba0db503ad1c2341beb9eddfeec8efebaf187c83
MD5 d4f2c15180da7e43f082b1777c86e2fb
SHA1 fb9648e23e719ddf5fa371c7ecc6588d34f30c48
SHA512 9c33846d877807f776e29f6a069ac1af35780b4930407def7499e6779faa41cac5b3440b2dfb49034c01dd315970bbe10d925483773020d74a363d4a12fc66a9
TLSH
T18F21F9A094A9DC47E93369CFC12ADBA20CA82747749C6A20A34989187FD9C33CD554E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/732-88-0x00000000009C0000-0x00000000009E1000-memory.dmp

Download

memory/732-2872-0x00000000009C0000-0x00000000009E1000-memory.dmp

Download

memory/3728-35-0x00000000009C0000-0x00000000009E1000-memory.dmp

Download

memory/3728-25-0x00000000009C0000-0x00000000009E1000-memory.dmp

Download

memory/3756-6-0x0000000000B10000-0x0000000000B31000-memory.dmp

Download

memory/5168-77-0x0000000000120000-0x0000000000141000-memory.dmp

Download

memory/5168-93-0x0000000000120000-0x0000000000141000-memory.dmp

Download

memory/5480-57-0x0000000005310000-0x0000000005311000-memory.dmp

Download