cebe82b2c49af974fc2056f70c0e66b916c45d0440cbf7ae38fba868d6deb1ff

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_a6ae7cc7648f8920c766cff341828899_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 9.6MB
Sample260813-ejsv7saq4z
SHA256 cebe82b2c49af974fc2056f70c0e66b916c45d0440cbf7ae38fba868d6deb1ff
MD5 a6ae7cc7648f8920c766cff341828899
SHA1 d9136280fa0407a96d7deae1b7f3000ba9c5b6fc
SHA512 6b4aff8c9d01669c34dd15d2725278ece72126d260c3dc894c7e0ff13e382cd52d00e1c916cf1194f9035985f6986aff087aa717858a8a430c9ab3cd0742c609
SSDEEP 49152:U+ES+EW5+ES+ES+ES+EWLj+ES+EW5+ES+ES+ES+EWLIqatglg+ES+EW5+ES+ES+6:n+rA91pH2WpjHrgBFFu416AWvl
TLSH
T1DCA67B91B69760FDE06FD074896BC336E6717C130232878B66BCD65B2F236646D28723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCABCBBABCBBCBACABCBCBCBBABCBCBBCBACACAAAAAAAACCABBBCBC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCABCBBABCBBCBACABCBCBCBBABCBCBBCBACACAAAAAAAACCABBBCBC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4344	svchost_CCABCBBABCBBCBACABCBCBCBBABCBCBBCBACACAAAAAAAACCABBBCBC.exe
4072	svchost_AACACCABCCBBABCABABCCCCAACBCAABABABCBBACBCCCACAABCBBCBC.exe
4904	svchost_CCABCBBABCBBCBACABCBCBCBBABCBCBBCBACACAAAAAAAACCABBBCBC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABBABCBCACBCCACCCAAAABAACCBCBCBAACBCCABBAABCCBABAABCCABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACACCABCCBBABCABABCCCCAACBCAABABABCBBACBCCCACAABCBBCBC.exe"	svchost_CCABCBBABCBBCBACABCBCBCBBABCBCBBCBACACAAAAAAAACCABBBCBC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCCAAAAACCBBACCBBAABBCCABBABCABCACCCCCBCBAAACCCCCABACAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCABCBBABCBBCBACABCBCBCBBABCBCBBCBACACAAAAAAAACCABBBCBC.exe"	2026-08-13_a6ae7cc7648f8920c766cff341828899_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4000	sc.exe
1080	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5088	cmd.exe
456	cmd.exe
4376	cmd.exe
2616	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCABCBBABCBBCBACABCBCBCBBABCBCBBCBACACAAAAAAAACCABBBCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_a6ae7cc7648f8920c766cff341828899_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACACCABCCBBABCABABCCCCAACBCAABABABCBBACBCCCACAABCBBCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2128	schtasks.exe
920	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1588	2026-08-13_a6ae7cc7648f8920c766cff341828899_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
1588	2026-08-13_a6ae7cc7648f8920c766cff341828899_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
1588	2026-08-13_a6ae7cc7648f8920c766cff341828899_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
1588	2026-08-13_a6ae7cc7648f8920c766cff341828899_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4344	svchost_CCABCBBABCBBCBACABCBCBCBBABCBCBBCBACACAAAAAAAACCABBBCBC.exe
4344	svchost_CCABCBBABCBBCBACABCBCBCBBABCBCBBCBACACAAAAAAAACCABBBCBC.exe
4344	svchost_CCABCBBABCBBCBACABCBCBCBBABCBCBBCBACACAAAAAAAACCABBBCBC.exe
4344	svchost_CCABCBBABCBBCBACABCBCBCBBABCBCBBCBACACAAAAAAAACCABBBCBC.exe
4904	svchost_CCABCBBABCBBCBACABCBCBCBBABCBCBBCBACACAAAAAAAACCABBBCBC.exe
4904	svchost_CCABCBBABCBBCBACABCBCBCBBABCBCBBCBACACAAAAAAAACCABBBCBC.exe
4072	svchost_AACACCABCCBBABCABABCCCCAACBCAABABABCBBACBCCCACAABCBBCBC.exe
4072	svchost_AACACCABCCBBABCABABCCCCAACBCAABABABCBBACBCCCACAABCBBCBC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1588	2026-08-13_a6ae7cc7648f8920c766cff341828899_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4344	svchost_CCABCBBABCBBCBACABCBCBCBBABCBCBBCBACACAAAAAAAACCABBBCBC.exe
Token: SeDebugPrivilege	4904	svchost_CCABCBBABCBBCBACABCBCBCBBABCBCBBCBACACAAAAAAAACCABBBCBC.exe
Token: SeDebugPrivilege	4072	svchost_AACACCABCCBBABCABABCCCCAACBCAABABABCBBACBCCCACAABCBBCBC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2932	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 5088	1588	2026-08-13_a6ae7cc7648f8920c766cff341828899_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	98
PID 5088 wrote to memory of 2128	5088	cmd.exe	100
PID 4344 wrote to memory of 4852	4344	svchost_CCABCBBABCBBCBACABCBCBCBBABCBCBBCBACACAAAAAAAACCABBBCBC.exe	103
PID 4852 wrote to memory of 1792	4852	notepad.exe	104
PID 1588 wrote to memory of 456	1588	2026-08-13_a6ae7cc7648f8920c766cff341828899_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	108
PID 456 wrote to memory of 4000	456	cmd.exe	110
PID 1588 wrote to memory of 4376	1588	2026-08-13_a6ae7cc7648f8920c766cff341828899_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	111
PID 4376 wrote to memory of 1080	4376	cmd.exe	113
PID 4344 wrote to memory of 2616	4344	svchost_CCABCBBABCBBCBACABCBCBCBBABCBCBBCBACACAAAAAAAACCABBBCBC.exe	116
PID 2616 wrote to memory of 920	2616	cmd.exe	118

C:\Users\Admin\AppData\Local\Temp\2026-08-13_a6ae7cc7648f8920c766cff341828899_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_a6ae7cc7648f8920c766cff341828899_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAABCCBCAAABCCBCCBBCBCBABCCCABCBCAABACAAACBAABABBCBCBBCCCCBACACABAABCBCCAAACAAAABABCCCCABACBAACCABBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBBABCBBCBACABCBCBCBBABCBCBBCBACACAAAAAAAACCABBBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAABCCBCAAABCCBCCBBCBCBABCCCABCBCAABACAAACBAABABBCBCBBCCCCBACACABAABCBCCAAACAAAABABCCCCABACBAACCABBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBBABCBBCBACABCBCBCBBABCBCBBCBACACAAAAAAAACCABBBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBABCCABBBACBCAABCACCABCACAAABBACBCBCBCCCAABABBBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBBABCBBCBACABCBCBCBBABCBCBBCBACACAAAAAAAACCABBBCBC.exe" start= auto displayName= "UserDataSvc_BCBABCCABBBACBCAABCACCABCACAAABBACBCBCBCCCAABABBBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:456
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBABCCABBBACBCAABCACCABCACAAABBACBCBCBCCCAABABBBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBBABCBBCBACABCBCBCBBABCBCBBCBACACAAAAAAAACCABBBCBC.exe" start= auto displayName= "UserDataSvc_BCBABCCABBBACBCAABCACCABCACAAABBACBCBCBCCCAABABBBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBABCCABBBACBCAABCACCABCACAAABBACBCBCBCCCAABABBBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBABCCABBBACBCAABCACCABCACAAABBACBCBCBCCCAABABBBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1080

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBBABCBBCBACABCBCBCBBABCBCBBCBACACAAAAAAAACCABBBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBBABCBBCBACABCBCBCBBABCBCBBCBACACAAAAAAAACCABBBCBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBCCAACACAABBBBCBCAABCABBACABCABCBCAAAABCCACAAABAABBCBBBBACAACACACABCACBBBCBAABBACBCCABCCAACCCCBACBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCABCCBBABCABABCCCCAACBCAABABABCBBACBCCCACAABCBBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBCCAACACAABBBBCBCAABCABBACABCABCBCAAAABCCACAAABAABBCBBBBACAACACACABCACBBBCBAABBACBCCABCCAACCCCBACBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCABCCBBABCABABCCCCAACBCAABABABCBBACBCCCACAABCBBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:920

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2932

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCABCCBBABCABABCCCCAACBCAABABABCBBACBCCCACAABCBBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCABCCBBABCABABCCCCAACBCAABABABCBBACBCCCACAABCBBCBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4072

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBBABCBBCBACABCBCBCBBABCBCBBCBACACAAAAAAAACCABBBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBBABCBBCBACABCBCBCBBABCBCBBCBACACAAAAAAAACCABBBCBC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 7ef5fcaafdd48d1961c49f73c500b84f11192ddadc31195cc60423c641da2ccc
MD5 9ca90d1cca7d7a9ae0269a56e95d76b2
SHA1 7059f129f3ef27fdf7430ab0a0976fc6edd301aa
SHA512 a033c72b6fe4a0cdce5a2cf6a55c285b281a8a656b69dc561ecfa624523d518eaaeaef70c8719ce38c360c1127b53f561d0d831f2853864c91d5c23f47e4647a
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 10.0MB
SHA256 5b0083c97415dfd79b6446a21f2cc409ee93bce59dc3fccc64a487ad2f5eaf1b
MD5 c4a9963aaeca1427e1ae8e20c2583e58
SHA1 5efc7f4983d2c2ca168181bb035402a8c78fe6f4
SHA512 37d43dbae1f215b0ec65bb4c735927196cee5b56e7c821d867f26156de60d095de6a214ad4e7efa86ddd5c5c4cde33a28ee82b6d0baf84ccb1e04755450d2577
SSDEEP 49152:U+ES+EW5+ES+ES+ES+EWLj+ES+EW5+ES+ES+ES+EWLIqatglg+ES+EW5+ES+ES+6:n+rA91pH2WpjHrgBFFu416AWvipiz
TLSH
T117B67B51B69760F9E0AFD174896BC336E6717C130632878B63BCD65A2F336606D28723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.LockApp_10.0.19041.1023_neutral__cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 d3094298b6557534d0cb2d86b5abead86a81aede4b7bd7e9c7e7c00253a80ba1
MD5 2f563fd45d722247864352cc77085e7c
SHA1 cc45d338f3481840ab9a8d947de3697d9f723f52
SHA512 51eafa2681b5861d392609084c662d677f437ebd1c0eb66c2cb115407abfc9e1a565d12249708c2cbaf6a90e43a6b8ac7beaae0f373c1c3d778ef918d8460e1f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Workspaces\Logs\qap`g`v~dtlq
Size 10B
SHA256 38f7e43923a97b9df95e4b19109e503dbd6e3ec19ce6541f952bcb4890ff4026
MD5 53f1f8d7c26de7893169ecd4a5324187
SHA1 373a627dbe052770e3586274e897d679f5ba4745
SHA512 dc5923bc3567377834e880b8cc06cf0d2a739eb2714a7ad5f894026f6393f20c3ea0e228b480d409f68a49b78c35d8d19d59b6cf349804764479017fc212b72c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\TempState\qap`g`v~dtlq
Size 10B
SHA256 fc7269e77b3aa3cfe434f1f5d6c7f66271a0a79c91bc5f07b654e7b7beee3169
MD5 ecfe642bb063a5fc51e8c1815481c354
SHA1 ec9679db7d3538a4c6836de844a05115fee71a89
SHA512 5a3afb30267da4fb1026a98c430173169af2582f33792a8a3f4f18e8aa9ade3ac110da89f4bef18be283c12fb3a8dd89f7b94516d2afba0755928316ad355880
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\77wftcd8.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\cache2\entries\qap`g`v~dtlq
Size 10B
SHA256 bf5bcbbdd23213d037529c7811709a0d329db3ee8a4dff974037f3edb54d3708
MD5 dda00e403d0dfceb2bc428ca3a202cdf
SHA1 c99729129bd9ba13ec9eae4d3e3782ee8361ab0a
SHA512 0fe0c7cd7b0d19cb8877186408be2ec0d19374bd6f99140b83812c50cd93e3b03083a8408ba95ce1fb44d6e9e8f99d7a64158c53e10f9be7bf320cde3fa4de26
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c75cbd7decc28117e4e1395c530bb47d7dab4a33bf4a8e7c7f131a0956d373ff
MD5 38dedf594ade38fc257b7a1034a563b2
SHA1 71f1e003d4c4b8a0189bbde29b3b5de97202f263
SHA512 33b8bc8c5c0e22c733016897382050f87f5874922c52ef852c4544ded4b444aaa3144864836d7a1f7e017407a66a37de992a6debb3db2d3c868670eedcb5a19e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 94834c2a8306ebd47c381ee6d8c0e047c23b1454ad349663e2f14ffa5d6184a1
MD5 6ebd958eed68d7323d46c3647ae78dc9
SHA1 ac26d9ebff4af8a9300404e0b32d06ca2a4913d9
SHA512 04a2420c617916595e364a2dcf3b44a527f1eb694e8b90c1a5b8308a9f975d5a447381dc2d1604ba0375cb13659ffffbb9d0b8f84069c3cb9c497c5de54795e5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ecbff1947653dabfd78f53eb11d420a0cf025127f8d2cb8ae35a1b37bb13c9e6
MD5 1b99f19d49f2ee683ce0ae302b1cf0f3
SHA1 63d648425a151fb8cce93128a54339c23cf3c0ef
SHA512 273322f8989232929d9715e8c38fcccf857b9868ff1f5ca5bd8d02303740a54036d6cf314f97ae8c8f87d1e8b34f9c77581e534a474103d83223cdec975e714d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 50b097bb556abf0dbe6bee3257952537a99961c852e5a56235c5681cdb98c3b8
MD5 7f1783ddedd8830eaeea8713bc2b906f
SHA1 f848c2b31e98c584f1d22830226d9c72ff60c6e2
SHA512 8a397a548794b9302587bbfd719b530647f84200c33b8c6d708e3ad9c59010e1716f7e6f917840ff7ccd938055a6877746806b735d2bc1f32d4371e4ff539020
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 bd20a9107cfa01c324a1c86122cd14432b2541e9cb6ba678e0cb96f31e4b478a
MD5 8e4f60e432a6671967e9a655236440ec
SHA1 d46df6cb3e22c8b868a201512b16abbd86987655
SHA512 83b03947d0338cc28da9459cd9aff770f8b7e8c290d60d9c935c0e3769901683696a6830ff659ff99cae94252d2a2cf723bd0fe5b216fa21e301d9ff88f7b00e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 305b9fd2a184040ac19fe0997dcefd60c1cd61eca303e67c64fa9360b2ba517d
MD5 0976f61d7e276dbf85b4e26cdf0a3296
SHA1 901792690b29fed6c828a559d85e13ac233b7400
SHA512 296bb44d70d7ee5bb9a2856e009569e9b0510697da1c6cebbfcee08c7b6a54327ed3c77f9932105ea36db6d29ac35f195550ca6067abc509e4eea03ede33e1df
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 bc86c7ef82edb25862117fbcc100ff2825ab12dc3f581c27a52b7eeadc736051
MD5 3f10b2674cb95c4dc02bfc36dc4be6e9
SHA1 f26a673d243c349ac00d993630cdc198ed84ad4e
SHA512 5a891661e88051dc29c1bdc850e4af95ebaf944e3c4002c8a6c8887027be70462afba752a33518c13f9c7f4b3531cc0a771b7fa762b002addd8ea2176b95c1a6
MD5 SHA1 SHA512

Submit Download

svchost_CCABCBBABCBBCBACABCBCBCBBABCBCBBCBACACAAAAAAAACCABBBCBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBBABCBBCBACABCBCBCBBABCBCBBCBACACAAAAAAAACCABBBCBC.exe
Size 9.6MB
SHA256 cebe82b2c49af974fc2056f70c0e66b916c45d0440cbf7ae38fba868d6deb1ff
MD5 a6ae7cc7648f8920c766cff341828899
SHA1 d9136280fa0407a96d7deae1b7f3000ba9c5b6fc
SHA512 6b4aff8c9d01669c34dd15d2725278ece72126d260c3dc894c7e0ff13e382cd52d00e1c916cf1194f9035985f6986aff087aa717858a8a430c9ab3cd0742c609
SSDEEP 49152:U+ES+EW5+ES+ES+ES+EWLj+ES+EW5+ES+ES+ES+EWLIqatglg+ES+EW5+ES+ES+6:n+rA91pH2WpjHrgBFFu416AWvl
TLSH
T1DCA67B91B69760FDE06FD074896BC336E6717C130232878B66BCD65B2F236646D28723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 69e91897a7c402517f99a276b14b77fd83219a62bbc81bd9f0d0b8ff518a903a
MD5 bed63ba6d238a41f959ee9ba54eb5525
SHA1 c6ebe698667164139e6941ec9adb0183e92b7c4b
SHA512 13ff8fdaaff642564b1f9c40d3764ec0326b40133be302d490cecc4e01902692a46e429d166e538a173a1aa3bc59faf0108479d7dd0c3121bcbfa5bb46cb019d
TLSH
T1D0210A71F8E58C53ED3374CA722EEBD30CA4B68BAC1D7B18130A9109A795D728D150C3
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 81be2f6aae819fe8cdaef2f82be3539eca58e59bd3aed60b5739fd434777febd
MD5 ae4a3b2b28d92f2063a67d852fd5c145
SHA1 5d363080b7513aeae7d493fd1adf66fa2c3355f1
SHA512 190158aa47d92f7cb36335190600a61ab8cb256faa3eca06f1ce6c06451507e43b70f146f1a70d3dd03e9286ec30132ded15bcefb69bc3f5cfb33ce78a49879c
TLSH
T15721F871F8E5CC63EA3368CA722EEBD30CA8728BEC5D6A14130D9209E795D72CD154C2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 5356b74bc8f8d8db9210ac3a9cf3f533152760e6e391af30da24a964a2318fd0
MD5 b4fbc4b4855688baae78d84c27fdf432
SHA1 380cb67774375fa40d227d9ad19c6ba93e5f40d1
SHA512 a338659da6f6b79db10ff01daf3ee7ca1b8d5ae67aac2f2ffee2541293114a86ab1b60d9a5a6e349ee3e7ba91d1af57790b1ebe793022374b519a2580c898be8
TLSH
T142110B71F8E59C53ED3374CA612EEBD30CA5B28BAC1D6B18130D9209A795D728D150C3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1588-6-0x0000000000620000-0x0000000000641000-memory.dmp

Download

memory/4072-71-0x0000000000A00000-0x0000000000A21000-memory.dmp

Download

memory/4072-2746-0x0000000000A00000-0x0000000000A21000-memory.dmp

Download

memory/4344-36-0x0000000000F40000-0x0000000000F61000-memory.dmp

Download

memory/4852-59-0x0000000005780000-0x0000000005781000-memory.dmp

Download

memory/4904-1138-0x0000000000F40000-0x0000000000F61000-memory.dmp

Download