3cda933134dd9ef9e8cd0a569f84965406ff7621c6069fbfabb78e89f9eb71b1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/08/2026, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_0c0bd4154420793ccecc7d8df627d138_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 9.1MB
Sample260812-akd18avdpc
SHA256 3cda933134dd9ef9e8cd0a569f84965406ff7621c6069fbfabb78e89f9eb71b1
MD5 0c0bd4154420793ccecc7d8df627d138
SHA1 ae3b6c041f2cc4045c07e8abee37054e43052952
SHA512 c633072a6c82b487493a80496e144ca1237ae784709ca3a20c874d9fcf322bf2dab5fc9451b9f5524334c37d7fac0306244f3618f22aec612bb3d28c63a6e566
SSDEEP 49152:U+ES+ES+ES+EpqatglxhO0+ES+Epqatglk+ES+ES+ES+ES+ES+ES+ES+ES+ES+EA:vUIsUVA91pH2WpjHrgBFFu416AWvu
TLSH
T1EFA66B95B2A720FDE06FD175896B8332D6717C130632938F12BCD66A2F237946D29723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBCAABCACAAABABCCCACBCCCAABBAABACABCCACCACAAACBCBAABBCA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBCAABCACAAABABCCCACBCCCAABBAABACABCCACCACAAACBCBAABBCA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3704	svchost_BBCAABCACAAABABCCCACBCCCAABBAABACABCCACCACAAACBCBAABBCA.exe
5056	svchost_CCBBAAACBBCBABBBAAABBBBABBCACAABBCCCCCCBBACAAABACAACBCB.exe
4064	svchost_BBCAABCACAAABABCCCACBCCCAABBAABACABCCACCACAAACBCBAABBCA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_AACAAABBAABBCCCACAACCAABAACCABAABCBCBBCBCACBCCCCAACABABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCAABCACAAABABCCCACBCCCAABBAABACABCCACCACAAACBCBAABBCA.exe"	2026-08-11_0c0bd4154420793ccecc7d8df627d138_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_AAACCCBACBAAACCAABAAABCCBCBBAAACBACCACACBCBBACBBCABBCAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBBAAACBBCBABBBAAABBBBABBCACAABBCCCCCCBBACAAABACAACBCB.exe"	svchost_BBCAABCACAAABABCCCACBCCCAABBAABACABCCACCACAAACBCBAABBCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1476	sc.exe
4792	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1012	cmd.exe
2652	cmd.exe
1684	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCAABCACAAABABCCCACBCCCAABBAABACABCCACCACAAACBCBAABBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_0c0bd4154420793ccecc7d8df627d138_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBBAAACBBCBABBBAAABBBBABBCACAABBCCCCCCBBACAAABACAACBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5052	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4980	2026-08-11_0c0bd4154420793ccecc7d8df627d138_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4980	2026-08-11_0c0bd4154420793ccecc7d8df627d138_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4980	2026-08-11_0c0bd4154420793ccecc7d8df627d138_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4980	2026-08-11_0c0bd4154420793ccecc7d8df627d138_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
3704	svchost_BBCAABCACAAABABCCCACBCCCAABBAABACABCCACCACAAACBCBAABBCA.exe
3704	svchost_BBCAABCACAAABABCCCACBCCCAABBAABACABCCACCACAAACBCBAABBCA.exe
3704	svchost_BBCAABCACAAABABCCCACBCCCAABBAABACABCCACCACAAACBCBAABBCA.exe
3704	svchost_BBCAABCACAAABABCCCACBCCCAABBAABACABCCACCACAAACBCBAABBCA.exe
5056	svchost_CCBBAAACBBCBABBBAAABBBBABBCACAABBCCCCCCBBACAAABACAACBCB.exe
5056	svchost_CCBBAAACBBCBABBBAAABBBBABBCACAABBCCCCCCBBACAAABACAACBCB.exe
4064	svchost_BBCAABCACAAABABCCCACBCCCAABBAABACABCCACCACAAACBCBAABBCA.exe
4064	svchost_BBCAABCACAAABABCCCACBCCCAABBAABACABCCACCACAAACBCBAABBCA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4980	2026-08-11_0c0bd4154420793ccecc7d8df627d138_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3704	svchost_BBCAABCACAAABABCCCACBCCCAABBAABACABCCACCACAAACBCBAABBCA.exe
Token: SeDebugPrivilege	5056	svchost_CCBBAAACBBCBABBBAAABBBBABBCACAABBCCCCCCBBACAAABACAACBCB.exe
Token: SeDebugPrivilege	4064	svchost_BBCAABCACAAABABCCCACBCCCAABBAABACABCCACCACAAACBCBAABBCA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2776	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 1012	4980	2026-08-11_0c0bd4154420793ccecc7d8df627d138_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	99
PID 1012 wrote to memory of 5052	1012	cmd.exe	101
PID 3704 wrote to memory of 3760	3704	svchost_BBCAABCACAAABABCCCACBCCCAABBAABACABCCACCACAAACBCBAABBCA.exe	102
PID 3760 wrote to memory of 3644	3760	notepad.exe	103
PID 4980 wrote to memory of 2652	4980	2026-08-11_0c0bd4154420793ccecc7d8df627d138_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	107
PID 2652 wrote to memory of 1476	2652	cmd.exe	109
PID 4980 wrote to memory of 1684	4980	2026-08-11_0c0bd4154420793ccecc7d8df627d138_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	110
PID 1684 wrote to memory of 4792	1684	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-11_0c0bd4154420793ccecc7d8df627d138_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_0c0bd4154420793ccecc7d8df627d138_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAAACCBBCAABAAABABAACACAACCCBBCBACAABBAAACBABAAAABABBACBBBCBAAAABCABACCACAAAAABBABACCBAACCBABCBCCBCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAABCACAAABABCCCACBCCCAABBAABACABCCACCACAAACBCBAABBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1012
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAAACCBBCAABAAABABAACACAACCCBBCBACAABBAAACBABAAAABABBACBBBCBAAAABCABACCACAAAAABBABACCBAACCBABCBCCBCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAABCACAAABABCCCACBCCCAABBAABACABCCACCACAAACBCBAABBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABCABAABBCCCBCBABAACCCCCBBABCBBBACBABAABCCCBBACCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAABCACAAABABCCCACBCCCAABBAABACABCCACCACAAACBCBAABBCA.exe" start= auto displayName= "UserDataSvc_BABCABAABBCCCBCBABAACCCCCBBABCBBBACBABAABCCCBBACCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABCABAABBCCCBCBABAACCCCCBBABCBBBACBABAABCCCBBACCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAABCACAAABABCCCACBCCCAABBAABACABCCACCACAAACBCBAABBCA.exe" start= auto displayName= "UserDataSvc_BABCABAABBCCCBCBABAACCCCCBBABCBBBACBABAABCCCBBACCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1476
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABCABAABBCCCBCBABAACCCCCBBABCBBBACBABAABCCCBBACCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABCABAABBCCCBCBABAACCCCCBBABCBBBACBABAABCCCBBACCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4792

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAABCACAAABABCCCACBCCCAABBAABACABCCACCACAAACBCBAABBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAABCACAAABABCCCACBCCCAABBAABACABCCACCACAAACBCBAABBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3760
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3644

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2776

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBAAACBBCBABBBAAABBBBABBCACAABBCCCCCCBBACAAABACAACBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBAAACBBCBABBBAAABBBBABBCACAABBCCCCCCBBACAAABACAACBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5056

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAABCACAAABABCCCACBCCCAABBAABACABCCACCACAAACBCBAABBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAABCACAAABABCCCACBCCCAABBAABACABCCACCACAAACBCBAABBCA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 ef9395a0691e1c6846bf7ce154d84d5c2b7d12b47fe1ba67af81633aa79607b2
MD5 0a8ee7b6d7deb10713a959fb6fdac441
SHA1 af6c4977c0c788333369cf92d082aa82f6a64d4a
SHA512 ca25b0c4ce92cbf0f21c992963036f8926a83bfd89a8ae657e118aa2df8e90e3050a7b80c767e6173411759d2d09f0e53cb0227ac7947fa63258594465449497
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 9.5MB
SHA256 a959271f2d2f9b3b5fcff25d043856285b8129aa062224e16d1a16535bd66459
MD5 44602e940dd9a6bb87876b75b9e2f3d0
SHA1 2d3c06d51adad534539173518019457242d5bf03
SHA512 2e0678ffb91823d26c3371770f3e631cb51be74cb575469f900d655dfa1954036ab8c213122b5c37bca6c940da31405064c8b4820625870ba859027e2a7c4067
SSDEEP 49152:U+ES+ES+ES+EpqatglxhO0+ES+Epqatglk+ES+ES+ES+ES+ES+ES+ES+ES+ES+EC:vUIsUVA91pH2WpjHrgBFFu416AWvZpix
TLSH
T182A67B55B2A720F9E0AFD175896B8332D6717C130632938F13BCD66A2F736946D28723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\de-DE\qap`g`v~dtlq
Size 10B
SHA256 45430841bfb1e2caa57a364740348a4aa81f6d09bf87df1cefd2cb601ba24c05
MD5 48215cfc9642e81da4638bd93db4d23b
SHA1 cf23d62d802a6ecc0bdfe426271100439924c863
SHA512 6df49da6b170f20b029b3a463355b2c5dd29a52fa7cdd6f1423c5b998e23682a98fa147b29387736c63e9e412b227fb5431ab3744e61f5fbf0ca83624be99d3d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 ffc78d516204672804777b30b12b0951f97071a6f50889dd073c67cc037e957b
MD5 e7cc7afa284c09d8619df38b0ea7669b
SHA1 ec6a524ef86c94d4099752d0e9057d28ad704d6f
SHA512 7c3e8d5ce157c9e6fc61d840f3abe8201d4f6109bde7731d10d52afa7da7507278f036c6685e1e2127523a79a5ab7b0c036f904ba3e4e7202d19a7213d319904
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\nl\qap`g`v~dtlq
Size 10B
SHA256 3af4dcd568425b241c379b3d823186bc1a30f443220667a92380a83384ac6f41
MD5 2b2ad44cb704869793167095448c6f9e
SHA1 6f191ad9ff6b025c60349b661788f14fa20903db
SHA512 a135143d57f4a0a3088d49951654d34df98b94ed800107fa58f4b33c4c4622118bbba96470e99ab413656a8f3514f267dd41407be96e2b94b2b2f79f7a3580af
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PPBCompatUaCache\qap`g`v~dtlq
Size 10B
SHA256 789ed0c27b608a1c0ae556f269ed232a54db515050e294e162a4accbbee5e0fa
MD5 37cdea0b301b3dd95eb22c33597d9302
SHA1 3b4477fdd0273f477c198c88cfcd0492993e2271
SHA512 450d9b30564977e593b61e2c71bca1bf3a75ee767bfd5d06c014247d9dece99c34dd8269ca83f03fe43b85f53a30163c8a1b3bd356f2e578c9e4b4ea1b453fc7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.UI.Xaml.2.0_8wekyb3d8bbwe\AC\Temp\qap`g`v~dtlq
Size 10B
SHA256 e36bb53d9f1c2fdf6ac3c311b56a411a20459043e4e1a33402c00136f6c9fa96
MD5 de52b286d88e958593bd870b5878b5d0
SHA1 53a4d68de093561070a2c8435f3e79502334a46b
SHA512 e4329bf1c43e40507322909d502957e44e3ffb43c85ef37abf644c3ce00bfb8ef5815a99b10e69c64992b5e3f7d6fefe7dcf92664fba2c9f765507afd9dce585
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0e4cc8f3df76194657cb6e19300470b0ed13087b4b08a07b73f982009c14017b
MD5 69c036721da65f0a23a2dd99357ef1ce
SHA1 b3f219ab60ebf186c31cfc6be8e7dd2af69a3deb
SHA512 d600b12706857c5387f76d97d3abac14092e447d92b8b26ee750cd51ecf2187b837ebb0e516e61c327c998eaa0877f93cea4f6689aa8856ca24e02480da418e0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bdf02e463e8d77e86f656a0f8eb5b1a62ec4b210b82dbb06b4b83d7fb2b739c7
MD5 02db284777026e847518470a3c968cee
SHA1 d5d2baa381531132b2a6d83317cd89f265fdf1e9
SHA512 57de57b9b7884080d432565ef5fd45bd738b6692a3d14dc44d0a6cdba4b8a2728dd6209c554cea22361b9272bff18ccf0e3e15ef13f0ef2e99e322658a83860c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0d0e7fd81c2a5f5fee64d41df35b69a37addfff88e0fa9fba67f07957a4d0bbf
MD5 a13ce24828fd4fc2d38acc8675f016cd
SHA1 14f59869c6686348f5e24a228371883891c4fedc
SHA512 73b34cc7a8808390c08b609acfccb448b78f70275e743f8a8e887c536542e77fc39b0fe4cfac0ed2990df465b312b5fb0c92de301cd9e399c8c6b0c093b1b5ff
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f5feb9f413abfbb099cd4cb034a5ea682e218f2f25c50cd3649586454d4e5272
MD5 d73831b191e7d0d82ffa310626ca54eb
SHA1 2792c9dabaa866dc79db5381f954e4526388f3a3
SHA512 dcd27d39f2d481086eeb64d8fe0753cea5ca66e6953300aa0dedb3eb166ff79c79d93c1230b5f276943b92b703e90b26104bcfed1102b6f8dece3a0c582a5430
MD5 SHA1 SHA512

Submit Download

svchost_BBCAABCACAAABABCCCACBCCCAABBAABACABCCACCACAAACBCBAABBCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAABCACAAABABCCCACBCCCAABBAABACABCCACCACAAACBCBAABBCA.exe
Size 9.1MB
SHA256 3cda933134dd9ef9e8cd0a569f84965406ff7621c6069fbfabb78e89f9eb71b1
MD5 0c0bd4154420793ccecc7d8df627d138
SHA1 ae3b6c041f2cc4045c07e8abee37054e43052952
SHA512 c633072a6c82b487493a80496e144ca1237ae784709ca3a20c874d9fcf322bf2dab5fc9451b9f5524334c37d7fac0306244f3618f22aec612bb3d28c63a6e566
SSDEEP 49152:U+ES+ES+ES+EpqatglxhO0+ES+Epqatglk+ES+ES+ES+ES+ES+ES+ES+ES+ES+EA:vUIsUVA91pH2WpjHrgBFFu416AWvu
TLSH
T1EFA66B95B2A720FDE06FD175896B8332D6717C130632938F12BCD66A2F237946D29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 780B
SHA256 03ea7ecd012442ff5f8604a6c53cc204af3034510e8cdd17bc34f72d69db3f14
MD5 c9d9cade8ddbded7179389314c7146e0
SHA1 4f5e84def99593cdcb67cdbbe61ba17927d3d5f9
SHA512 d9a3ee77717d6f437895fc3b2dcc9ad54fc2b8a9676cbab480428079c93b62edb4096885153a7f40bf6bb8f2cc097ff4fd22c3d863cac974da6d4c6ab9dd1585
TLSH
T10001FE61E4AAD453EC33F4CBA6299BC70DD436E768786A4523459118AFC4C30CF298F9
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 414c3a38789e36744bfc251a551fcb9f9f00eb6f95314423deb0598693008aff
MD5 f26979081774260deb2db3a36ce1466d
SHA1 9f3beace0a580a7ae11f0e51182f2dddb56c683e
SHA512 64d884ed1cbe379dfe72025dbf03b1bb68ac880ea68deea6b01c821aa33dfb5e457e0b7cbe4ee37e7b382f97576a46eb2efe692528542222055e90e226b7923f
TLSH
T13321DA60E4AAC453EC33B4CBA6299BD70D9436E768786A5423459118AFC8C30CF198F9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3704-34-0x0000000000DB0000-0x0000000000DD1000-memory.dmp

Download

memory/3760-58-0x0000000005130000-0x0000000005131000-memory.dmp

Download

memory/4064-1236-0x0000000000DB0000-0x0000000000DD1000-memory.dmp

Download

memory/4980-0-0x0000000000180000-0x00000000001A1000-memory.dmp

Download

memory/4980-7-0x0000000000180000-0x00000000001A1000-memory.dmp

Download

memory/5056-86-0x0000000000EB0000-0x0000000000ED1000-memory.dmp

Download