7674a819da57a3cbf003677dfe213a346f2b903b50b0116579143edb9ab0bbfc

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_a3bc5146b473f10644f55ffe2a203ee8_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Size 13.0MB
Sample260812-e36w6syeka
SHA256 7674a819da57a3cbf003677dfe213a346f2b903b50b0116579143edb9ab0bbfc
MD5 a3bc5146b473f10644f55ffe2a203ee8
SHA1 832e359eddded9c9e7bffb3959bde8ad52b29791
SHA512 4d997d757403f50822209ffda09911c5ebcb241c2bb0404df7e476e4ab43f6fdea88cfaa06abd104ee35335ca12854a3e187065984a517b12c4c69a3d239db50
SSDEEP 98304:kFPdLz7Upmya6iSNNEuy4v/YtfKoNewC8rc8u3xP33zkEszWiC/f35DKJU15xc:kFlP7APhNNECwHrc8u3x3AEcq/fBy7
TLSH
T1FBD6AE17B29A40E5C42ED1B8C61B4227D6BA7C540334ABDF16A07B652F33BE05B3E365
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c557-19.dat	UPX
behavioral2/files/0x00080000000182af-392.dat	UPX

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCACBBCBCBCCABACABBBAACAAAACBACABACCBACABCBACBCBCCAABCA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCACBBCBCBCCABACABBBAACAAAACBACABACCBACABCBACBCBCCAABCA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCACBBCBCBCCABACABBBAACAAAACBACABACCBACABCBACBCBCCAABCA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCACBBCBCBCCABACABBBAACAAAACBACABACCBACABCBACBCBCCAABCA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
6048	svchost_CCACBBCBCBCCABACABBBAACAAAACBACABACCBACABCBACBCBCCAABCA.exe
4412	svchost_BBABBBBCABBCACBBAABABBABCAACAABACBCACABACBBBCAABCBCACCB.exe
2500	svchost_CCACBBCBCBCCABACABBBAACAAAACBACABACCBACABCBACBCBCCAABCA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBABCACAAABCCBBCBCBACCCABBBBCCCBCCBCBBCACCBBBBACBCAABBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCACBBCBCBCCABACABBBAACAAAACBACABACCBACABCBACBCBCCAABCA.exe"	2026-08-12_a3bc5146b473f10644f55ffe2a203ee8_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBABAABBCCACBABCCBAAACBAACCABACCCBABBACBCBCACCABCCBABCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBABBBBCABBCACBBAABABBABCAACAABACBCACABACBBBCAABCBCACCB.exe"	svchost_CCACBBCBCBCCABACABBBAACAAAACBACABACCBACABCBACBCBCCAABCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
448	sc.exe
1824	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3232	cmd.exe
5816	cmd.exe
4524	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBABBBBCABBCACBBAABABBABCAACAABACBCACABACBBBCAABCBCACCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCACBBCBCBCCABACABBBAACAAAACBACABACCBACABCBACBCBCCAABCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_a3bc5146b473f10644f55ffe2a203ee8_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5508	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3288	2026-08-12_a3bc5146b473f10644f55ffe2a203ee8_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
3288	2026-08-12_a3bc5146b473f10644f55ffe2a203ee8_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
3288	2026-08-12_a3bc5146b473f10644f55ffe2a203ee8_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
3288	2026-08-12_a3bc5146b473f10644f55ffe2a203ee8_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
6048	svchost_CCACBBCBCBCCABACABBBAACAAAACBACABACCBACABCBACBCBCCAABCA.exe
6048	svchost_CCACBBCBCBCCABACABBBAACAAAACBACABACCBACABCBACBCBCCAABCA.exe
6048	svchost_CCACBBCBCBCCABACABBBAACAAAACBACABACCBACABCBACBCBCCAABCA.exe
6048	svchost_CCACBBCBCBCCABACABBBAACAAAACBACABACCBACABCBACBCBCCAABCA.exe
4412	svchost_BBABBBBCABBCACBBAABABBABCAACAABACBCACABACBBBCAABCBCACCB.exe
4412	svchost_BBABBBBCABBCACBBAABABBABCAACAABACBCACABACBBBCAABCBCACCB.exe
2500	svchost_CCACBBCBCBCCABACABBBAACAAAACBACABACCBACABCBACBCBCCAABCA.exe
2500	svchost_CCACBBCBCBCCABACABBBAACAAAACBACABACCBACABCBACBCBCCAABCA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3288	2026-08-12_a3bc5146b473f10644f55ffe2a203ee8_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	6048	svchost_CCACBBCBCBCCABACABBBAACAAAACBACABACCBACABCBACBCBCCAABCA.exe
Token: SeDebugPrivilege	4412	svchost_BBABBBBCABBCACBBAABABBABCAACAABACBCACABACBBBCAABCBCACCB.exe
Token: SeDebugPrivilege	2500	svchost_CCACBBCBCBCCABACABBBAACAAAACBACABACCBACABCBACBCBCCAABCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 3232	3288	2026-08-12_a3bc5146b473f10644f55ffe2a203ee8_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe	92
PID 3232 wrote to memory of 5508	3232	cmd.exe	94
PID 6048 wrote to memory of 1280	6048	svchost_CCACBBCBCBCCABACABBBAACAAAACBACABACCBACABCBACBCBCCAABCA.exe	95
PID 3288 wrote to memory of 5816	3288	2026-08-12_a3bc5146b473f10644f55ffe2a203ee8_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe	98
PID 5816 wrote to memory of 448	5816	cmd.exe	100
PID 3288 wrote to memory of 4524	3288	2026-08-12_a3bc5146b473f10644f55ffe2a203ee8_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe	101
PID 4524 wrote to memory of 1824	4524	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-12_a3bc5146b473f10644f55ffe2a203ee8_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_a3bc5146b473f10644f55ffe2a203ee8_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCBBBCAAACCCCBBACCABCCCCCBACCBCBABBCBBABBBBACACABCBCAACBAAAABBBACCCABAABBCBCBCBAABBBACABBCCAABBAAAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACBBCBCBCCABACABBBAACAAAACBACABACCBACABCBACBCBCCAABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCBBBCAAACCCCBBACCABCCCCCBACCBCBABBCBBABBBBACACABCBCAACBAAAABBBACCCABAABBCBCBCBAABBBACABBCCAABBAAAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACBBCBCBCCABACABBBAACAAAACBACABACCBACABCBACBCBCCAABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAAACACBCCBBAACABAACABCACACCCAAABABABBCACAAAACACBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACBBCBCBCCABACABBBAACAAAACBACABACCBACABCBACBCBCCAABCA.exe" start= auto displayName= "UserDataSvc_AAAACACBCCBBAACABAACABCACACCCAAABABABBCACAAAACACBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5816
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAAACACBCCBBAACABAACABCACACCCAAABABABBCACAAAACACBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACBBCBCBCCABACABBBAACAAAACBACABACCBACABCBACBCBCCAABCA.exe" start= auto displayName= "UserDataSvc_AAAACACBCCBBAACABAACABCACACCCAAABABABBCACAAAACACBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAAACACBCCBBAACABAACABCACACCCAAABABABBCACAAAACACBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAAACACBCCBBAACABAACABCACACCCAAABABABBCACAAAACACBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1824

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACBBCBCBCCABACABBBAACAAAACBACABACCBACABCBACBCBCCAABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACBBCBCBCCABACABBBAACAAAACBACABACCBACABCBACBCBCCAABCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6048
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1280

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBBBCABBCACBBAABABBABCAACAABACBCACABACBBBCAABCBCACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBBBCABBCACBBAABABBABCAACAABACBCACABACBBBCAABCBCACCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4412

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACBBCBCBCCABACABBBAACAAAACBACABACCBACABCBACBCBCCAABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACBBCBCBCCABACABBBAACAAAACBACABACCBACABCBACBCBCCAABCA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 5412f35dbaba64aac416b1dc630b6f1f4713166ccad4ee26eff45dbb22de586b
MD5 4f690b006dcdef7dd4c071111c661e43
SHA1 7b2f49bb26380adbe35397100775cf86c2441277
SHA512 5b310acc702f0939abaa3040492950130d1f18236f87c2fb250252266739dd324254a61a35a36dd131962748f965ac6b437939509d549c39b2e4f661dd98d64b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 17e05d24b1c0b3c54cda7d9d9151e458158e4be61437073638e08a53d57905ee
MD5 bca3eaf74aa8c4697d3100b26d7ea903
SHA1 4c47ed1f69178b1f02f4afcc831671fbc2b266b1
SHA512 fc18c7e796cb2b19faf293b3c54659e0459e71c7a3c7adfc5a52d53891f809f54fcdfa4cb746c599f52c20af47214481880147523268172fd261f926186c86ac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.FileExp_1000.26100.3.0_x64__cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 3fc00ff2102f943b481a39440db1ace6aa6ba14a4ad5637472b3dcd3d62ca7d2
MD5 f41f0e58d4bfd3c12b1c41a40083fa6b
SHA1 4780260e9dc4040aed73ccf0807322f1517b9543
SHA512 99ea94b8a690db7275de7e1d11fc5af5682e00b6d2b6fc02253ce879100f2e4bf8cac50ebd67414ce7b05b99c1329fcb96b794d8477debdfd04e598221b6a7db
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 a1ef4de011f7728660a9b898c3e07ce08d78f05932d4c4d4a94f78d5c49ed0e2
MD5 33141ba1d25c0ac09d204a92dfb654af
SHA1 2ed2e24ff57a616161330a30b0cd127fbce51d9c
SHA512 7361d0eecb6d1e43583a7e1d092bcec68e0bf159d6c7478c8c856687d318379ee82411c11636d0f7c9228e73eb86604cf3842525e2aa0c2eae064d68f17b4d7a
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 13.6MB
SHA256 d8adb8641a6b9c90b86916289696a7b763b555b21850f8fa15931edd72faaf32
MD5 caf3a2aac75219233d101c8b2b1d4d14
SHA1 eceefa7231f7f45840e69aebfd142300eeb3f3ef
SHA512 7984ca4a8ed11cdabcf1d2579350ea457b09a4a97a1a9ef086b2d4b413695e2e7678811b4ff0defc133c0034c3a9864060f926f494868c9c387db6e29579c9df
SSDEEP 196608:kFlP7APhNNECwHrc8u3x3AEcq/fByegZ2jU:iZahvQHrc8u3xXJ/f4P2A
TLSH
T19CE6BE17B29940E5C42AD1B8C65B8223DB7A7C540334ABDF16A07B692F33BE05B3E355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 4a2cbb4701b5aa1f07951f0e5b600325682e2472006d2380386dcf4311eeb792
MD5 1e46c71ba829bc7e106072f58eadd730
SHA1 b4bcded9415aa3132e00e1d2bd30863ca94ffb6a
SHA512 a821174554344001b3796de60dd94ee4ecf33b658a647ab5955e4811a37973c513b96cc5dc2545754c971b80f06a58b4f4b75855c5013320c80880de33d695b3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}v48.108.8828\qap`g`v~dtlq
Size 10B
SHA256 d126e6a5d3f174a37e7bc54540a9771d8f74aaebca48c50fa374e77c24f6b067
MD5 ebd1af9a5c420fb5d09341c8f7d7e078
SHA1 29c78969d79c5f52f7c418df23ac943b5bb415ea
SHA512 f33bdf409c427871fb51943d0a8258ee1a194a6801239a24a9c3ba3059e94c835341ff74854aa75af898296b034b9beca33f4e9cd3242f77cbf0892f8feb35bb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 03cf932aa2842c2968218b8274be8446b803c1455290c2d9f3bb8dc0be298461
MD5 cdd6ba70368c775036f995f6572a3cce
SHA1 dc7f739d29dd3e70388acffad3b0e6167c89e733
SHA512 29415fd5c32d37ba281dc8fbbee97887a54f17357841f27e2a73bfabd57e066ff5a1f284479425200d81cf04aaa2b3d55ec57ac4a8302d8c34e5d2e86ba157ab
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44\qap`g`v~dtlq
Size 10B
SHA256 f4eec9d9aa47a769344984167ad920b6c4b04090e9e7621147de74cadc379815
MD5 b4c6738d31f1aa74800ccc0edd98d731
SHA1 051e3bacbaedd67ee12786b045b0efa3c8e1f886
SHA512 761e16317b3603d8814211ba6983ac60ba34685392aba8f1a366d71f229f259a34134cf7b9d6ecb5cf754f0d8572accb1e43940b45a53f7bf51ee82d80c8f536
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OpenCookieDatabase\qap`g`v~dtlq
Size 10B
SHA256 39e55df2477f2b5ea6819c6a7ccc8df0c36d7fb96df3de2c9cf9d2591a6fe167
MD5 f00e8a24f4846e65ed7b4d10284bcce2
SHA1 51e76bed4c3469f7fae03dba663df1dd30b8e2f1
SHA512 8914f54dcd847f02ebecb8b55138b5de4a5622cebee882a94335fa4250d7e06a457ef7ed3b451736fc1ada4b518da43def33bb529c26c2d423ec75499a890813
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\qap`g`v~dtlq
Size 10B
SHA256 af4749ad8cf9d3af7ec214729eb96711b6ec0a88cabaf172628e771a7d208ed9
MD5 1c77586d26e7ed726ba51d8ca6e789b6
SHA1 056f3be883359a50fc4fa854994aeefbe05b4403
SHA512 3434d5ff31786180a1d8c3161fea4aa14c785b3f574aaf96ee239ba7ed43734819362703073f4f881ec5554dc7bb199a51f3904164bda133be393c4776f4e507
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6316_1044072609\qap`g`v~dtlq
Size 10B
SHA256 0ca77a9361f2d148ee36c7364da5d7a0eebf4a6277279b28d48552d7ea6d77e2
MD5 b5b0ae7036e1dc8f3bf91fd13a69d041
SHA1 5b56240282d90c2ab3f8ab41afc4ce9e14c36fe8
SHA512 ec1fa452509a6962de64cbeea8b091fbf289ae80eb6d110a81a3b7500a0d3cbeae8b2479e6a303add0a9bbd1d856db97d9561ec633dc9bc500982464df428a6d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2601fd146cf712b79cde497b0063d55440cf814231dbfe7f73247c80383e8cc5
MD5 ea62cafb691ad82fc2c0acc3447bffc8
SHA1 44bf362027f8758e6f0e6b5b5258a15e5e628478
SHA512 cc577d39eec11f7d8de7e9e37c5ec539f036c4411bd862f1bf2bea8756efa4946add356125b47664a88fc077b624dd350b6174cad4e3ea7f7fd239d409c41185
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e9bfd189b9af36d4691477239a8c6cb4bcb62bcbc615813ccebe2da8227fa605
MD5 13e6121f14a79c51465ca5982c63b808
SHA1 e239d778193f618964cf362e1e21c9007562e43f
SHA512 773ce390641cf52b8e8f101f180f2b3594951938310b84460a5deff06833e245509663fa644a1484e6378cb8fa5b46b948ceb0a6721918d7d8ad6851542e2575
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6c2c247af8fb529f2bd6dfd612d0a9bc34c761ff120081c72edbcef3476ec1e9
MD5 dd363390b0fac88de3c79dc350ff51a5
SHA1 0656cea8f58f1a67486f8935e41317e4e4e487ba
SHA512 8c40a4d403e47cf0a473f657d64e9b3127cce30a024adcfaefb4132f34423509aa2243dc4959126a968533d2eadbd7757097efc87506fadaa71d34187804caed
MD5 SHA1 SHA512

Submit Download

svchost_CCACBBCBCBCCABACABBBAACAAAACBACABACCBACABCBACBCBCCAABCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACBBCBCBCCABACABBBAACAAAACBACABACCBACABCBACBCBCCAABCA.exe
Size 13.0MB
SHA256 7674a819da57a3cbf003677dfe213a346f2b903b50b0116579143edb9ab0bbfc
MD5 a3bc5146b473f10644f55ffe2a203ee8
SHA1 832e359eddded9c9e7bffb3959bde8ad52b29791
SHA512 4d997d757403f50822209ffda09911c5ebcb241c2bb0404df7e476e4ab43f6fdea88cfaa06abd104ee35335ca12854a3e187065984a517b12c4c69a3d239db50
SSDEEP 98304:kFPdLz7Upmya6iSNNEuy4v/YtfKoNewC8rc8u3xP33zkEszWiC/f35DKJU15xc:kFlP7APhNNECwHrc8u3x3AEcq/fBy7
TLSH
T1FBD6AE17B29A40E5C42ED1B8C61B4227D6BA7C540334ABDF16A07B652F33BE05B3E365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 13b8a7a77f9b1394beaac09c80dd4c9a15b2aa24c05432c2def1a6eafd4205ad
MD5 354be1a8d02e86676c9595a7392d15f1
SHA1 25109fbff9059b099383c182822eb38ed7f8edac
SHA512 187bf30b961354eb3116deaa0c1e96fef4119f91aacdcc851ad0a3e1c8f11613db33ca31cb1759814fc63531cf6eee6334dd4ea7f74637525dc3e282c639c9cf
TLSH
T1DC112E319CD5C8A3E932A487771BABD608E6339F5CBCAA4413491218FA80D31CD590E9
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 d07112ad46915a87f0d0f06e7a9d1b6c8e8a7cd5d0994f07a2238d3d7b79462d
MD5 7f4c0be75eea02768fcf49666be1a8af
SHA1 e1c5641273478a118d8878160d40b385f9303937
SHA512 3f5bfc58169e402ee389c3f882ce2ba9400d39e3e8aa40665db8b8a011764ed02538308a049c315cd61e7b9ef3471e9709b6210812746296521df448885bc3c8
TLSH
T18A212C719CD4C863E932A487731BEBD60CE6379F98BCAA44134D1218BA84D31CD690E9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2500-1683-0x0000000000FD0000-0x0000000000FF1000-memory.dmp

Download

memory/3288-0-0x0000000000EC0000-0x0000000000EE1000-memory.dmp

Download

memory/3288-7-0x0000000000EC0000-0x0000000000EE1000-memory.dmp

Download

memory/4412-78-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/6048-31-0x0000000000FD0000-0x0000000000FF1000-memory.dmp

Download