7674a819da57a3cbf003677dfe213a346f2b903b50b0116579143edb9ab0bbfc

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/08/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_a3bc5146b473f10644f55ffe2a203ee8_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Size 13.0MB
Sample260812-e36w6syeka
SHA256 7674a819da57a3cbf003677dfe213a346f2b903b50b0116579143edb9ab0bbfc
MD5 a3bc5146b473f10644f55ffe2a203ee8
SHA1 832e359eddded9c9e7bffb3959bde8ad52b29791
SHA512 4d997d757403f50822209ffda09911c5ebcb241c2bb0404df7e476e4ab43f6fdea88cfaa06abd104ee35335ca12854a3e187065984a517b12c4c69a3d239db50
SSDEEP 98304:kFPdLz7Upmya6iSNNEuy4v/YtfKoNewC8rc8u3xP33zkEszWiC/f35DKJU15xc:kFlP7APhNNECwHrc8u3x3AEcq/fBy7
TLSH
T1FBD6AE17B29A40E5C42ED1B8C61B4227D6BA7C540334ABDF16A07B652F33BE05B3E365
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral1/files/0x00070000000244d1-21.dat	UPX
behavioral1/files/0x000200000000071d-103.dat	UPX

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBBCBCAABACAABAACACBABBBBACCACABBCAAABBBCCBBBCAABCBCCBB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBBCBCAABACAABAACACBABBBBACCACABBCAAABBBCCBBBCAABCBCCBB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
988	svchost_BBBCBCAABACAABAACACBABBBBACCACABBCAAABBBCCBBBCAABCBCCBB.exe
3956	svchost_AACABABCCCBCBAAABCAAABAABAAACCBBABCBABBCBCAACCCBAABCAAA.exe
2700	svchost_BBBCBCAABACAABAACACBABBBBACCACABBCAAABBBCCBBBCAABCBCCBB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABBBCCBCCCAACAABACCCAAABCBBBAAABACCACCAABCABABBCCBCCABAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBCBCAABACAABAACACBABBBBACCACABBCAAABBBCCBBBCAABCBCCBB.exe"	2026-08-12_a3bc5146b473f10644f55ffe2a203ee8_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CACCAABCABACBBACCCBABCCBBBCCBCBCAACBCABBCAABBBABBBCBAAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACABABCCCBCBAAABCAAABAABAAACCBBABCBABBCBCAACCCBAABCAAA.exe"	svchost_BBBCBCAABACAABAACACBABBBBACCACABBCAAABBBCCBBBCAABCBCCBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4168	sc.exe
4320	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4748	cmd.exe
1436	cmd.exe
4100	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACABABCCCBCBAAABCAAABAABAAACCBBABCBABBCBCAACCCBAABCAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_a3bc5146b473f10644f55ffe2a203ee8_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBCBCAABACAABAACACBABBBBACCACABBCAAABBBCCBBBCAABCBCCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2268	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2920	2026-08-12_a3bc5146b473f10644f55ffe2a203ee8_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
2920	2026-08-12_a3bc5146b473f10644f55ffe2a203ee8_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
2920	2026-08-12_a3bc5146b473f10644f55ffe2a203ee8_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
2920	2026-08-12_a3bc5146b473f10644f55ffe2a203ee8_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
988	svchost_BBBCBCAABACAABAACACBABBBBACCACABBCAAABBBCCBBBCAABCBCCBB.exe
988	svchost_BBBCBCAABACAABAACACBABBBBACCACABBCAAABBBCCBBBCAABCBCCBB.exe
988	svchost_BBBCBCAABACAABAACACBABBBBACCACABBCAAABBBCCBBBCAABCBCCBB.exe
988	svchost_BBBCBCAABACAABAACACBABBBBACCACABBCAAABBBCCBBBCAABCBCCBB.exe
3956	svchost_AACABABCCCBCBAAABCAAABAABAAACCBBABCBABBCBCAACCCBAABCAAA.exe
3956	svchost_AACABABCCCBCBAAABCAAABAABAAACCBBABCBABBCBCAACCCBAABCAAA.exe
2700	svchost_BBBCBCAABACAABAACACBABBBBACCACABBCAAABBBCCBBBCAABCBCCBB.exe
2700	svchost_BBBCBCAABACAABAACACBABBBBACCACABBCAAABBBCCBBBCAABCBCCBB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2920	2026-08-12_a3bc5146b473f10644f55ffe2a203ee8_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	988	svchost_BBBCBCAABACAABAACACBABBBBACCACABBCAAABBBCCBBBCAABCBCCBB.exe
Token: SeDebugPrivilege	3956	svchost_AACABABCCCBCBAAABCAAABAABAAACCBBABCBABBCBCAACCCBAABCAAA.exe
Token: SeDebugPrivilege	2700	svchost_BBBCBCAABACAABAACACBABBBBACCACABBCAAABBBCCBBBCAABCBCCBB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4408	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 4748	2920	2026-08-12_a3bc5146b473f10644f55ffe2a203ee8_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe	100
PID 4748 wrote to memory of 2268	4748	cmd.exe	102
PID 988 wrote to memory of 1036	988	svchost_BBBCBCAABACAABAACACBABBBBACCACABBCAAABBBCCBBBCAABCBCCBB.exe	103
PID 1036 wrote to memory of 4868	1036	notepad.exe	104
PID 2920 wrote to memory of 1436	2920	2026-08-12_a3bc5146b473f10644f55ffe2a203ee8_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe	108
PID 1436 wrote to memory of 4168	1436	cmd.exe	110
PID 2920 wrote to memory of 4100	2920	2026-08-12_a3bc5146b473f10644f55ffe2a203ee8_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe	111
PID 4100 wrote to memory of 4320	4100	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-12_a3bc5146b473f10644f55ffe2a203ee8_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_a3bc5146b473f10644f55ffe2a203ee8_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCCABBCBBACACABCCBBACAABABBCBCBACCCBBBCCABBBCABCBCBABCABAABBACACCABBCABCACAABBBAABCBABABABBBBACCBABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBCAABACAABAACACBABBBBACCACABBCAAABBBCCBBBCAABCBCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCCABBCBBACACABCCBBACAABABBCBCBACCCBBBCCABBBCABCBCBABCABAABBACACCABBCABCACAABBBAABCBABABABBBBACCBABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBCAABACAABAACACBABBBBACCACABBCAAABBBCCBBBCAABCBCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABAACBABCCCABABCACCBABCCCCBBBACCAABBAAABCABCABCABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBCAABACAABAACACBABBBBACCACABBCAAABBBCCBBBCAABCBCCBB.exe" start= auto displayName= "UserDataSvc_BABAACBABCCCABABCACCBABCCCCBBBACCAABBAAABCABCABCABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABAACBABCCCABABCACCBABCCCCBBBACCAABBAAABCABCABCABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBCAABACAABAACACBABBBBACCACABBCAAABBBCCBBBCAABCBCCBB.exe" start= auto displayName= "UserDataSvc_BABAACBABCCCABABCACCBABCCCCBBBACCAABBAAABCABCABCABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4168
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABAACBABCCCABABCACCBABCCCCBBBACCAABBAAABCABCABCABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABAACBABCCCABABCACCBABCCCCBBBACCAABBAAABCABCABCABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4320

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBCAABACAABAACACBABBBBACCACABBCAAABBBCCBBBCAABCBCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBCAABACAABAACACBABBBBACCACABBCAAABBBCCBBBCAABCBCCBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:988
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1036
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4868

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4408

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABABCCCBCBAAABCAAABAABAAACCBBABCBABBCBCAACCCBAABCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABABCCCBCBAAABCAAABAABAAACCBBABCBABBCBCAACCCBAABCAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3956

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBCAABACAABAACACBABBBBACCACABBCAAABBBCCBBBCAABCBCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBCAABACAABAACACBABBBBACCACABBCAAABBBCCBBBCAABCBCCBB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 0ca77a9361f2d148ee36c7364da5d7a0eebf4a6277279b28d48552d7ea6d77e2
MD5 b5b0ae7036e1dc8f3bf91fd13a69d041
SHA1 5b56240282d90c2ab3f8ab41afc4ce9e14c36fe8
SHA512 ec1fa452509a6962de64cbeea8b091fbf289ae80eb6d110a81a3b7500a0d3cbeae8b2479e6a303add0a9bbd1d856db97d9561ec633dc9bc500982464df428a6d
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 13.4MB
SHA256 04ee080b0abd20c9d7258f84be6b6c9cf9504569adc3b40b994cb4e23da19395
MD5 623faddec9646a595b0d2458e003876e
SHA1 f304819b4022c8611cc630bd349ddd4f222e748c
SHA512 1d053baa3464cae9d595b4f822d272ca3f1f87ef09769fe0dda82681e32059ca0d6e1b52c05ab16b951d4b2395f37d7895f2712488de3b2bfda82c3f3e6d2c35
SSDEEP 98304:kFPdLz7Upmya6iSNNEuy4v/YtfKoNewC8rc8u3xP33zkEszWiC/f35DKJU15x/pb:kFlP7APhNNECwHrc8u3x3AEcq/fByO
TLSH
T1BFE6BE17B29940E5C02AD1B8CA5B4223D7BA7C544334A7DF16A07B692F33BE05B3E365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\MF\qap`g`v~dtlq
Size 10B
SHA256 3fc00ff2102f943b481a39440db1ace6aa6ba14a4ad5637472b3dcd3d62ca7d2
MD5 f41f0e58d4bfd3c12b1c41a40083fa6b
SHA1 4780260e9dc4040aed73ccf0807322f1517b9543
SHA512 99ea94b8a690db7275de7e1d11fc5af5682e00b6d2b6fc02253ce879100f2e4bf8cac50ebd67414ce7b05b99c1329fcb96b794d8477debdfd04e598221b6a7db
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\070fc69b-28b6-45cc-8a56-75c8dc728b82\index-dir\qap`g`v~dtlq
Size 10B
SHA256 5412f35dbaba64aac416b1dc630b6f1f4713166ccad4ee26eff45dbb22de586b
MD5 4f690b006dcdef7dd4c071111c661e43
SHA1 7b2f49bb26380adbe35397100775cf86c2441277
SHA512 5b310acc702f0939abaa3040492950130d1f18236f87c2fb250252266739dd324254a61a35a36dd131962748f965ac6b437939509d549c39b2e4f661dd98d64b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IECompatCache\qap`g`v~dtlq
Size 10B
SHA256 4a2cbb4701b5aa1f07951f0e5b600325682e2472006d2380386dcf4311eeb792
MD5 1e46c71ba829bc7e106072f58eadd730
SHA1 b4bcded9415aa3132e00e1d2bd30863ca94ffb6a
SHA512 a821174554344001b3796de60dd94ee4ecf33b658a647ab5955e4811a37973c513b96cc5dc2545754c971b80f06a58b4f4b75855c5013320c80880de33d695b3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 190f3c92187d6ebe9efe9946199077e988978044f1e9234e93c064be0a574e5b
MD5 e04dd0ab0794c05bf420daa066150915
SHA1 d170eb748abce1476387b1f5caf1496553dee736
SHA512 bfbb7fed88e305cff8931f000b49c3f883436f40186c47203e106d9c5abe290785ae04c9adf7af973b5b4425eb010c8ac243341b4c6571d10b8a53e33468ade1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 34435c99ae99cefe70e7f1b73bfa659810061622b1ba64d3868cc08ea66e71df
MD5 e619a993d0352ee8e2ac80d36337413b
SHA1 cbf827f6a15d6ff7ac35e96d1360e4bd6cf30e53
SHA512 9c8950e77e074d64545ff72858500ba163eaaccc64075783fb5e9a018bd9760675656747813a69e15360329c5384a656bb39d91208fd6743568acde948451dd7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 af4749ad8cf9d3af7ec214729eb96711b6ec0a88cabaf172628e771a7d208ed9
MD5 1c77586d26e7ed726ba51d8ca6e789b6
SHA1 056f3be883359a50fc4fa854994aeefbe05b4403
SHA512 3434d5ff31786180a1d8c3161fea4aa14c785b3f574aaf96ee239ba7ed43734819362703073f4f881ec5554dc7bb199a51f3904164bda133be393c4776f4e507
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e0bf7ea3b796d531821df30cb1e3545773049fd6120911dff4f78cfe35ebe129
MD5 634dfcb2aa56f5b2434a14e5be5c3299
SHA1 d54a6fdf5e974295d120de3b31fa19093d5bb289
SHA512 c3ca995c5c59149948f7b800e0c3114eb648105a61de9d4b7e4cc617ab992f076579deec574128105034330876c3995c7d238987d48107bb214e23f987d08a70
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 974c4275983a89a89fc86c25be432852bfe44854928f2c2874c154be8f615903
MD5 f9329807966ff1be7048792ad7c8f66c
SHA1 40786b1a7971659f32a967a37f74612b6287b2a1
SHA512 175080de7ba76bee3aa22664f4ce25387710976f2e44cde534eeda48bcb51a2280b0dc17be41bbc11f5a9b07863411673c854a8eabab1bdbfb35be627f6b5f40
MD5 SHA1 SHA512

Submit Download

svchost_BBBCBCAABACAABAACACBABBBBACCACABBCAAABBBCCBBBCAABCBCCBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBCAABACAABAACACBABBBBACCACABBCAAABBBCCBBBCAABCBCCBB.exe
Size 13.0MB
SHA256 7674a819da57a3cbf003677dfe213a346f2b903b50b0116579143edb9ab0bbfc
MD5 a3bc5146b473f10644f55ffe2a203ee8
SHA1 832e359eddded9c9e7bffb3959bde8ad52b29791
SHA512 4d997d757403f50822209ffda09911c5ebcb241c2bb0404df7e476e4ab43f6fdea88cfaa06abd104ee35335ca12854a3e187065984a517b12c4c69a3d239db50
SSDEEP 98304:kFPdLz7Upmya6iSNNEuy4v/YtfKoNewC8rc8u3xP33zkEszWiC/f35DKJU15xc:kFlP7APhNNECwHrc8u3x3AEcq/fBy7
TLSH
T1FBD6AE17B29A40E5C42ED1B8C61B4227D6BA7C540334ABDF16A07B652F33BE05B3E365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 7c5073a1a9bb086870a1d94d04a98aa9a6e23d896e54bd6d90783f6b25738c88
MD5 91b082c88e3a6a434ba09aae691070ff
SHA1 cee1cfbb10ce01f9853d0dad07e90b9f491441d5
SHA512 6891e14dad25a2e3c0b3b2f471e3c49c77c65112fc663d4eb0ea97bec01333ce4cd986862cd62783630ac4fdd4e45e04b9ffa1d16ea3d02b15f9fa84bdb28bda
TLSH
T167112B70A8E5D463EA336CCB622AEBC70CF573CB746C9A04134941086394D64CE654EA
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 e63135b68ec73c970aad4f3b7c3cfb76047037494866984080033e80f5e1cec8
MD5 1019e216fb02c09c54b6d929bd74252d
SHA1 1160028a37aedbfaaf4706054ea49dac571fa447
SHA512 8c0388282246fb358318b09d5cf633c73fc4ca94a44f0af23c0f4e9509775b1f089279ba0a25768572f8f29eb01d0c6e8de996522c117e9c1e04d757655aa4e6
TLSH
T105213E7098E5C863EA33ACCB722AEBC70CF537CB746C9A04134941086795D60CE594EA
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Public\Videos\qap`g`v~dtlq
Size 10B
SHA256 f4eec9d9aa47a769344984167ad920b6c4b04090e9e7621147de74cadc379815
MD5 b4c6738d31f1aa74800ccc0edd98d731
SHA1 051e3bacbaedd67ee12786b045b0efa3c8e1f886
SHA512 761e16317b3603d8814211ba6983ac60ba34685392aba8f1a366d71f229f259a34134cf7b9d6ecb5cf754f0d8572accb1e43940b45a53f7bf51ee82d80c8f536
MD5 SHA1 SHA512

Submit Download

memory/988-34-0x0000000000560000-0x0000000000581000-memory.dmp

Download

memory/1036-57-0x0000000004F10000-0x0000000004F11000-memory.dmp

Download

memory/2700-90-0x0000000000560000-0x0000000000581000-memory.dmp

Download

memory/2920-0-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/2920-7-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/3956-89-0x0000000000EB0000-0x0000000000ED1000-memory.dmp

Download

memory/3956-77-0x0000000000EB0000-0x0000000000ED1000-memory.dmp

Download