cff188d270cd7fcbec5bca70599e2cad6da1bc54823df9c4094c3986383012e0

Analysis

max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_48636e651be9270fe745740383a4a263_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 14.9MB
Sample260814-e7n7xsvcqa
SHA256 cff188d270cd7fcbec5bca70599e2cad6da1bc54823df9c4094c3986383012e0
MD5 48636e651be9270fe745740383a4a263
SHA1 022f9bdf5ca081cf1f2ea65b753b927a7fddf874
SHA512 23e29b540626bbd4b35910ab6a009988a3cfa7003962487015a34ca3eb586e349f98c1f7d7372b39869f7f6ad271dfe0dbd96aa65bbb83d40d817bcc99b89be2
SSDEEP 196608:i7APhNNECwHrc8u3x3AEcq/fByuKlWH3CToup:iahvQHrc8u3xXJ/f4uUWHs
TLSH
T151F69D17B35A81E6C02AD2B88A474212E7B97C440330B7DF16E5B7692F77BE45B3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Detects executables packed with Dotfuscator 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c540-19.dat	INDICATOR_EXE_Packed_Dotfuscator
behavioral2/files/0x00080000000182b1-387.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c540-19.dat	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/files/0x00080000000182b1-387.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c540-19.dat	INDICATOR_EXE_Packed_Yano
behavioral2/files/0x00080000000182b1-387.dat	INDICATOR_EXE_Packed_Yano

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CAABCAACCABACAACBCAAAABBCAAACBAACBABCABBABCBCAACCBBBAAC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CAABCAACCABACAACBCAAAABBCAAACBAACBABCABBABCBCAACCBBBAAC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2384	svchost_CAABCAACCABACAACBCAAAABBCAAACBAACBABCABBABCBCAACCBBBAAC.exe
5560	svchost_CBCAAACBBABAABAACCABABCAAABCCBBACACCACABACBACCAABBACBBC.exe
3260	svchost_CAABCAACCABACAACBCAAAABBCAAACBAACBABCABBABCBCAACCBBBAAC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBCBABBABBCCCACBACCAAAAABCAAAABCAAABACCBCCABCABCACCBACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAABCAACCABACAACBCAAAABBCAAACBAACBABCABBABCBCAACCBBBAAC.exe"	2026-08-14_48636e651be9270fe745740383a4a263_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACAACCABAACCACABCBBABBABCACCABBABCABBAACBCAAAABABACACBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCAAACBBABAABAACCABABCAAABCCBBACACCACABACBACCAABBACBBC.exe"	svchost_CAABCAACCABACAACBCAAAABBCAAACBAACBABCABBABCBCAACCBBBAAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5736	sc.exe
2412	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4276	cmd.exe
712	cmd.exe
3136	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_48636e651be9270fe745740383a4a263_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAABCAACCABACAACBCAAAABBCAAACBAACBABCABBABCBCAACCBBBAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCAAACBBABAABAACCABABCAAABCCBBACACCACABACBACCAABBACBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
928	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1032	2026-08-14_48636e651be9270fe745740383a4a263_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
1032	2026-08-14_48636e651be9270fe745740383a4a263_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
1032	2026-08-14_48636e651be9270fe745740383a4a263_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
1032	2026-08-14_48636e651be9270fe745740383a4a263_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
2384	svchost_CAABCAACCABACAACBCAAAABBCAAACBAACBABCABBABCBCAACCBBBAAC.exe
2384	svchost_CAABCAACCABACAACBCAAAABBCAAACBAACBABCABBABCBCAACCBBBAAC.exe
2384	svchost_CAABCAACCABACAACBCAAAABBCAAACBAACBABCABBABCBCAACCBBBAAC.exe
2384	svchost_CAABCAACCABACAACBCAAAABBCAAACBAACBABCABBABCBCAACCBBBAAC.exe
3260	svchost_CAABCAACCABACAACBCAAAABBCAAACBAACBABCABBABCBCAACCBBBAAC.exe
3260	svchost_CAABCAACCABACAACBCAAAABBCAAACBAACBABCABBABCBCAACCBBBAAC.exe
5560	svchost_CBCAAACBBABAABAACCABABCAAABCCBBACACCACABACBACCAABBACBBC.exe
5560	svchost_CBCAAACBBABAABAACCABABCAAABCCBBACACCACABACBACCAABBACBBC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1032	2026-08-14_48636e651be9270fe745740383a4a263_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	2384	svchost_CAABCAACCABACAACBCAAAABBCAAACBAACBABCABBABCBCAACCBBBAAC.exe
Token: SeDebugPrivilege	3260	svchost_CAABCAACCABACAACBCAAAABBCAAACBAACBABCABBABCBCAACCBBBAAC.exe
Token: SeDebugPrivilege	5560	svchost_CBCAAACBBABAABAACCABABCAAABCCBBACACCACABACBACCAABBACBBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 4276	1032	2026-08-14_48636e651be9270fe745740383a4a263_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	92
PID 4276 wrote to memory of 928	4276	cmd.exe	94
PID 2384 wrote to memory of 1140	2384	svchost_CAABCAACCABACAACBCAAAABBCAAACBAACBABCABBABCBCAACCBBBAAC.exe	95
PID 1032 wrote to memory of 712	1032	2026-08-14_48636e651be9270fe745740383a4a263_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	98
PID 712 wrote to memory of 5736	712	cmd.exe	100
PID 1032 wrote to memory of 3136	1032	2026-08-14_48636e651be9270fe745740383a4a263_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	101
PID 3136 wrote to memory of 2412	3136	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-14_48636e651be9270fe745740383a4a263_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_48636e651be9270fe745740383a4a263_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBAABCCBBBCCACACACACCCCAABACAACBBABCAACABABCABBACABCABACCABAABCCCABBCABBCBACBCCCABBCBBCBBACCCBBACCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCAACCABACAACBCAAAABBCAAACBAACBABCABBABCBCAACCBBBAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBAABCCBBBCCACACACACCCCAABACAACBBABCAACABABCABBACABCABACCABAABCCCABBCABBCBACBCCCABBCBBCBBACCCBBACCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCAACCABACAACBCAAAABBCAAACBAACBABCABBABCBCAACCBBBAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:928
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBBCACBAACBBAABCCBABBBBABBACCACAACACCBAACCCCBAACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCAACCABACAACBCAAAABBCAAACBAACBABCABBABCBCAACCBBBAAC.exe" start= auto displayName= "UserDataSvc_CCBBCACBAACBBAABCCBABBBBABBACCACAACACCBAACCCCBAACBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:712
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBBCACBAACBBAABCCBABBBBABBACCACAACACCBAACCCCBAACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCAACCABACAACBCAAAABBCAAACBAACBABCABBABCBCAACCBBBAAC.exe" start= auto displayName= "UserDataSvc_CCBBCACBAACBBAABCCBABBBBABBACCACAACACCBAACCCCBAACBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBBCACBAACBBAABCCBABBBBABBACCACAACACCBAACCCCBAACBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3136
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBBCACBAACBBAABCCBABBBBABBACCACAACACCBAACCCCBAACBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2412

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCAACCABACAACBCAAAABBCAAACBAACBABCABBABCBCAACCBBBAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCAACCABACAACBCAAAABBCAAACBAACBABCABBABCBCAACCBBBAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1140

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAACBBABAABAACCABABCAAABCCBBACACCACABACBACCAABBACBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAACBBABAABAACCABABCAAABCCBBACACCACABACBACCAABBACBBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5560

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCAACCABACAACBCAAAABBCAAACBAACBABCABBABCBCAACCBBBAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCAACCABACAACBCAAAABBCAAACBAACBABCABBABCBCAACCBBBAAC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 0663744ddcfb40b484dbc05dd4942ff19ca34fc04bdfe89f7bff2b848a6c5161
MD5 3e5c783c96600ca905bbaa6a3fc3b226
SHA1 83448bbee5022214e4c2688e2eab7956c1a37220
SHA512 72f511b2eedd7e983a74cad67fd8c3942aa52ebe2c389eff539c072cd1319a6e370afcba0b9a3a5eec4268a756fd62172f8aa8d83346749b7cbd457a55f2d846
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 15.5MB
SHA256 a5234e2394de152ba35953c9eb7daa1200ab3eddbfb5ddbc1e05f944e7b44545
MD5 0bbf2e9d4b828a66b6b599683a089821
SHA1 33678546a931a5a6fda9a373c62988e65f3803a5
SHA512 be53652f9dbf8071568511e47a60d93df15b6bcd576d3eaaed18a662bc77482740998a9457975efe9300814f2f5e28c940addb7b2ee9af4cc097cb4ca033b468
SSDEEP 196608:i7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouIgZ2jp:iahvQHrc8u3xXJ/f4uUWHi2N
TLSH
T1F5F69E13B35A81E6C06AD2B88A474212E7B9BC440334A7DF12D5B7692F77BE45B3B350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 422710bf7460e94b9cbf4ce2018fc344bf4c714e321b9bc46695c6a9ab2270db
MD5 3a066abd4568b40aaf3253b1315ec7b9
SHA1 822a0c7d3b3821ec88c781ddc6192b02473fe446
SHA512 ca125d231abedd048cdcb9192bdddd650fb69a32c2eb022a7071267490ebd363fb910b46b890ea8e8c57de038aa5f8de9cded7fbeb83f93afa39189d70f6b86b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\qap`g`v~dtlq
Size 10B
SHA256 4902f910cada6f40655ecc24864fc67afaf71fc2c4d72461ce4c10720ac80a5f
MD5 5e23c4aeeb31757a2728457093471563
SHA1 a5f1c8705874cce3c75cf512c392d753645a49b3
SHA512 19c253633859a1ca25c3462452eb0336a0b53693319c8e6bb97c47068c3359d638bd4d16a4bd4a2d9c90f946e0986ea59831554dae01de9cd5fad97ba02429f2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Office\qap`g`v~dtlq
Size 10B
SHA256 984fc94bc64bc48ba55b51474a5804264dd3e587e10a26fabc540c701a2a0ec6
MD5 c97087f46858ea3e34456682f6975530
SHA1 469b76ddca6eb53922d839508ffd754e04432566
SHA512 bcafaebe57573899f8b06d7d8776d3742300e0f5d1b1447af1c1edaf81bf937503a5edad031c28b24d2e9b99c8c291cd062110f3ddd3ced2c72da40d3af78d14
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9396ffe0fdbe3eeb8cdb55b01b4cc100c395b876bc1580c26ede9dd2e4aa4ce9
MD5 60699883c833e9e27b5a77c5da4cbb78
SHA1 e1d6d682713ce50dbe1bb91a24197a4a32e48946
SHA512 d653cd2d299af3a16ef9d13812966b1c58472accb9e55fc9050feb30260d6aa0a0aa48e55b33d65e99839ca9b34e59be3ab1a75759ac1c5b5d83c110229f6371
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d6f726932a39b096f21cd541ebf6998184cb7d45d02a18cbd04c61dfe6030b5b
MD5 214d81f4298d61d1d35130ae8e09287e
SHA1 66485175149d99ae81d458cd6997260f231ade74
SHA512 7be8b75bfd64abbeba15c3826857d4b74d4dea48fb2044c212c3f6ed66ed89de73a33e60ea995695d45b5d224fdbb2f5dc49ad9fd6f4b338363ae99a4809745b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 93c0abeb2c280ba933a1793c9fe0c794310edf08cacb6289e7923ee087cbc2b7
MD5 0af2dcf2b26323b5d76187f05f3e9a0f
SHA1 5e6e557ed8bdd23b55dbf4f207fc648f86960a70
SHA512 171fb845445be0bb9d4d206741a8693478f17559235d4db9f9d592ffd56293a7f2418a9b38dd6bd6a8d20f3c58003e9afbb6b755ff72f7059bf5a875a5a41147
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 96d43e42af4fe525baa6da0836b715a2af369c96f3959832f6e4b704771a9356
MD5 78e2c9ec7eebcb0e6908eb8e4a15bac4
SHA1 ecc2561c6112b172a39a1a4d3909b8d3d75ddcc2
SHA512 972dee5ca4665f3875b171e79b6b035515ef52b81aa295ba514a85b397c9fb5bbea3bcee633433c178ca8d9b0bef8dc8cf42483ce48c16bda6a353f9de40f0f8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f77c8c8faeb8e4bad8d81efcbb7334cd507edf7e8dcfafde3c6e2a51efd1c8ae
MD5 93709c68d638e14d58cd8fa8417da3fd
SHA1 1155eaa0ffdc7c732970f8190dbcc5b09aecb775
SHA512 f9b82700688016d5ca0111302a6b8567030c1238a3704839895167cfcdc02442526698f0a22e0fec7cad5449a9627292283869c8a81604b16ece0cd7da258e2a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 72751a45984a7ae558866aa16df6616e138114e735704dae452f0411aaadc8fd
MD5 5e938e3d366569d7a56026c99cdefe6a
SHA1 b66e552c88669db57f50ce17272c4fd7a3e6f3b0
SHA512 5dcdc63041a7919e1b2b1d334c9e12cd1707ef633c6057e496ea46d84f2f4185cf2f6c6e2b1963a40712b580da19d7f83b11a8d3ba8d88e50df5d0363fc3626f
MD5 SHA1 SHA512

Submit Download

svchost_CAABCAACCABACAACBCAAAABBCAAACBAACBABCABBABCBCAACCBBBAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCAACCABACAACBCAAAABBCAAACBAACBABCABBABCBCAACCBBBAAC.exe
Size 14.9MB
SHA256 cff188d270cd7fcbec5bca70599e2cad6da1bc54823df9c4094c3986383012e0
MD5 48636e651be9270fe745740383a4a263
SHA1 022f9bdf5ca081cf1f2ea65b753b927a7fddf874
SHA512 23e29b540626bbd4b35910ab6a009988a3cfa7003962487015a34ca3eb586e349f98c1f7d7372b39869f7f6ad271dfe0dbd96aa65bbb83d40d817bcc99b89be2
SSDEEP 196608:i7APhNNECwHrc8u3x3AEcq/fByuKlWH3CToup:iahvQHrc8u3xXJ/f4uUWHs
TLSH
T151F69D17B35A81E6C02AD2B88A474212E7B97C440330B7DF16E5B7692F77BE45B3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 cdbaa4c64d6f6405a178b0374e232895e85738d8d6ef8690b0295619ac6358cc
MD5 aa2dcaa9f04556c69bb949e0286acd87
SHA1 7116741ba8144d4671cae621a4114dbc4e50f5b5
SHA512 6c1d9d6c8458645afee5df1c99e01754a649c3c778dd506fb919f5f20481e77b88b8e9a75f5dccdb2b4fcac8e31b7c3fde7bdd8cbb1a387a69f2c17ae13f847c
TLSH
T1C4216B51A8E4C833FA337CCB562ACB420CB072AF6C9CAA04530142296BD4D32DE554A6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 fbbb83afd68974daf21f227e5a5c9f3061bf5b9b05c5deaf255a6ca67084a342
MD5 3d434517d70d1a3e914f6e6d9969ef43
SHA1 d427907da3e3b89dc1b94d0337d872f19beb988e
SHA512 47bdab5f1d30ec67096c75b9cca7e826767424a8da459c53c459c1932a623550836160557a9d02fdd8171eeceda574a2e6fcb9593251a50fb4ddeba77a874059
TLSH
T19B112751A8E5D833FA327C9B562ADB820CB072AF6C9CAA0463054229ABD4D32DD554A6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1032-0-0x00000000004F0000-0x0000000000511000-memory.dmp

Download

memory/1032-7-0x00000000004F0000-0x0000000000511000-memory.dmp

Download

memory/2384-33-0x00000000004A0000-0x00000000004C1000-memory.dmp

Download

memory/3260-395-0x00000000004A0000-0x00000000004C1000-memory.dmp

Download

memory/5560-64-0x0000000000850000-0x0000000000871000-memory.dmp

Download