cf00d24db5edd91c52088db574cca56806a697a32363054e518f19c667d3ff1d

Analysis

max time kernel
150s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_bb4d3dc0003276d2899b4c56bae7b71b_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 8.7MB
Sample260816-ecfbjaygkf
SHA256 cf00d24db5edd91c52088db574cca56806a697a32363054e518f19c667d3ff1d
MD5 bb4d3dc0003276d2899b4c56bae7b71b
SHA1 836d61750a3047938b69c04493fe82a914a574dd
SHA512 80becc627d5c36380d91ed790b57467271fe3b0d163c8c61b8f86dd85616f84062e620d8efbcf74a801c18bc5dc373383b1ef3c5375634513ab93a894ee979b3
SSDEEP 49152:U+ES+ESm+ES+ESgq+ESm+ES+ESm+ES+ESm+ES+ESgj+ES+ESm+ES+ESgq+ESm+Eg:oA91pH2WpjHrgBFFu416AWvm
TLSH
T1A7967A55E5A720FCE4AFD0B489ABC336D6717C1341328B5BA67CC6472F23A646D28723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBBABCCBBCACCCBAAACACBCABCBCBABBCBABBAAABBCCBCABBABCBBB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBBABCCBBCACCCBAAACACBCABCBCBABBCBABBAAABBCCBCABBABCBBB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBBABCCBBCACCCBAAACACBCABCBCBABBCBABBAAABBCCBCABBABCBBB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBBABCCBBCACCCBAAACACBCABCBCBABBCBABBAAABBCCBCABBABCBBB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1972	svchost_CBBABCCBBCACCCBAAACACBCABCBCBABBCBABBAAABBCCBCABBABCBBB.exe
2744	svchost_CBABCCCCBCCCCCCBCBCABCAABBCAACBCBCACBCBCABCAACCBBBBCCAC.exe
400	svchost_CBBABCCBBCACCCBAAACACBCABCBCBABBCBABBAAABBCCBCABBABCBBB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAACCAAACBABCACBCCCABABCCCAACACBBBCACCCACCBAAACCACCCBCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBABCCBBCACCCBAAACACBCABCBCBABBCBABBAAABBCCBCABBABCBBB.exe"	2026-08-16_bb4d3dc0003276d2899b4c56bae7b71b_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACAAABCBBABCCCACCBCABCCBAACAACCBCBBACABBBACCBBACCBAABAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBABCCCCBCCCCCCBCBCABCAABBCAACBCBCACBCBCABCAACCBBBBCCAC.exe"	svchost_CBBABCCBBCACCCBAAACACBCABCBCBABBCBABBAAABBCCBCABBABCBBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4464	sc.exe
5636	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3680	cmd.exe
7084	cmd.exe
6200	cmd.exe
1320	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBABCCCCBCCCCCCBCBCABCAABBCAACBCBCACBCBCABCAACCBBBBCCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBABCCBBCACCCBAAACACBCABCBCBABBCBABBAAABBCCBCABBABCBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_bb4d3dc0003276d2899b4c56bae7b71b_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2408	schtasks.exe
692	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
6308	2026-08-16_bb4d3dc0003276d2899b4c56bae7b71b_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
6308	2026-08-16_bb4d3dc0003276d2899b4c56bae7b71b_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
6308	2026-08-16_bb4d3dc0003276d2899b4c56bae7b71b_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
6308	2026-08-16_bb4d3dc0003276d2899b4c56bae7b71b_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
1972	svchost_CBBABCCBBCACCCBAAACACBCABCBCBABBCBABBAAABBCCBCABBABCBBB.exe
1972	svchost_CBBABCCBBCACCCBAAACACBCABCBCBABBCBABBAAABBCCBCABBABCBBB.exe
1972	svchost_CBBABCCBBCACCCBAAACACBCABCBCBABBCBABBAAABBCCBCABBABCBBB.exe
1972	svchost_CBBABCCBBCACCCBAAACACBCABCBCBABBCBABBAAABBCCBCABBABCBBB.exe
400	svchost_CBBABCCBBCACCCBAAACACBCABCBCBABBCBABBAAABBCCBCABBABCBBB.exe
400	svchost_CBBABCCBBCACCCBAAACACBCABCBCBABBCBABBAAABBCCBCABBABCBBB.exe
2744	svchost_CBABCCCCBCCCCCCBCBCABCAABBCAACBCBCACBCBCABCAACCBBBBCCAC.exe
2744	svchost_CBABCCCCBCCCCCCBCBCABCAABBCAACBCBCACBCBCABCAACCBBBBCCAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	6308	2026-08-16_bb4d3dc0003276d2899b4c56bae7b71b_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	1972	svchost_CBBABCCBBCACCCBAAACACBCABCBCBABBCBABBAAABBCCBCABBABCBBB.exe
Token: SeDebugPrivilege	400	svchost_CBBABCCBBCACCCBAAACACBCABCBCBABBCBABBAAABBCCBCABBABCBBB.exe
Token: SeDebugPrivilege	2744	svchost_CBABCCCCBCCCCCCBCBCABCAABBCAACBCBCACBCBCABCAACCBBBBCCAC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 6308 wrote to memory of 1320	6308	2026-08-16_bb4d3dc0003276d2899b4c56bae7b71b_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	93
PID 1320 wrote to memory of 2408	1320	cmd.exe	95
PID 1972 wrote to memory of 5340	1972	svchost_CBBABCCBBCACCCBAAACACBCABCBCBABBCBABBAAABBCCBCABBABCBBB.exe	96
PID 6308 wrote to memory of 3680	6308	2026-08-16_bb4d3dc0003276d2899b4c56bae7b71b_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	99
PID 3680 wrote to memory of 4464	3680	cmd.exe	101
PID 6308 wrote to memory of 7084	6308	2026-08-16_bb4d3dc0003276d2899b4c56bae7b71b_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	102
PID 7084 wrote to memory of 5636	7084	cmd.exe	104
PID 1972 wrote to memory of 6200	1972	svchost_CBBABCCBBCACCCBAAACACBCABCBCBABBCBABBAAABBCCBCABBABCBBB.exe	107
PID 6200 wrote to memory of 692	6200	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-16_bb4d3dc0003276d2899b4c56bae7b71b_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_bb4d3dc0003276d2899b4c56bae7b71b_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABBCCCCCCABAACCCBACCBBACBBBBBACABCBBABCBBACCABBCBCCBACABBCABBBBCCABBACCBCCBBAACBBCCABCCACABCCBBACBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABCCBBCACCCBAAACACBCABCBCBABBCBABBAAABBCCBCABBABCBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABBCCCCCCABAACCCBACCBBACBBBBBACABCBBABCBBACCABBCBCCBACABBCABBBBCCABBACCBCCBBAACBBCCABCCACABCCBBACBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABCCBBCACCCBAAACACBCABCBCBABBCBABBAAABBCCBCABBABCBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABACAABCBCABABBBCACAABBABBAABBBCBABABACBAABABAAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABCCBBCACCCBAAACACBCABCBCBABBCBABBAAABBCCBCABBABCBBB.exe" start= auto displayName= "UserDataSvc_AABACAABCBCABABBBCACAABBABBAABBBCBABABACBAABABAAACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABACAABCBCABABBBCACAABBABBAABBBCBABABACBAABABAAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABCCBBCACCCBAAACACBCABCBCBABBCBABBAAABBCCBCABBABCBBB.exe" start= auto displayName= "UserDataSvc_AABACAABCBCABABBBCACAABBABBAABBBCBABABACBAABABAAACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABACAABCBCABABBBCACAABBABBAABBBCBABABACBAABABAAACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:7084
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABACAABCBCABABBBCACAABBABBAABBBCBABABACBAABABAAACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5636

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABCCBBCACCCBAAACACBCABCBCBABBCBABBAAABBCCBCABBABCBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABCCBBCACCCBAAACACBCABCBCBABBCBABBAAABBCCBCABBABCBBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAACAACCCCAAABBCCCBCCCCACBACCBBBBCCBABCCCCABABCACCCAABCBAAAACACACCBBACABBACBCBBCCAACCCBCAACABBBCBBBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCCCCBCCCCCCBCBCABCAABBCAACBCBCACBCBCABCAACCBBBBCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6200
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAACAACCCCAAABBCCCBCCCCACBACCBBBBCCBABCCCCABABCACCCAABCBAAAACACACCBBACABBACBCBBCCAACCCBCAACABBBCBBBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCCCCBCCCCCCBCBCABCAABBCAACBCBCACBCBCABCAACCBBBBCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:692

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCCCCBCCCCCCBCBCABCAABBCAACBCBCACBCBCABCAACCBBBBCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCCCCBCCCCCCBCBCABCAABBCAACBCBCACBCBCABCAACCBBBBCCAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2744

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABCCBBCACCCBAAACACBCABCBCBABBCBABBAAABBCCBCABBABCBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABCCBBCACCCBAAACACBCABCBCBABBCBABBAAABBCCBCABBABCBBB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 18303fad19876f56ad5d6c2d88e33b414eb94aa4329f65ddaef05a327d2d2069
MD5 d3bdcf51bcb847841e7f615ffb16e09f
SHA1 7bfd1823f9cc75bc9c6bd77bb81a02e17b482cd5
SHA512 0e0ac4fd609894ec3b09a82fb9f0b489e7a40307558e27121c1650e9f2edd62fa0c4c53070d99d456f3615f55213db6bf1bd6458017bb54ef7427772cf722715
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 78ab7b23303a7e338a3a7b8dabcc8f24f3b07fa3fce4597d3e297b95e0c75908
MD5 e9b4d9584d90979f60f184ee988b4dd8
SHA1 51b7247e1f95d9bfac829cd08e3a473a624a8363
SHA512 4375849cd5f039f206585326bb57e587e0999fb5eb7343e888d6fd0a9a8bf742b0c9692aa75c16b8230315010afccc255d739506ccb4928ea9389df9e95fdffd
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 9.3MB
SHA256 225ea3623dfcbb1957b98a934f4d16fb75561f294e9d54f11b987c2709013714
MD5 911f629347489993f52a10136659e252
SHA1 e1e98a24a7033b906795ef193bf0f935082a3e1e
SHA512 95f3a212ae2710b533d2fce75c854ca5e9828afd79574ac663d177dfcfff74ab2adbfcf03fac3b2893f11d07e4bbc4af6ca447ee403e45486a1c26f59327a834
SSDEEP 98304:oA91pH2WpjHrgBFFu416AWvpgZ2Hb9t+2x5:omHpn6F44IAWvpgZ2j5
TLSH
T160A67B65E59720FCE4AFD0B189ABC336DA707C1341318B5B96BCC6472F23A646D29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 577b6406bc75a1ed678ca9554980159dcf45e9039f09b031cabb74d44552e101
MD5 7e8ba75abcb460e3d51ff28fe55ebd74
SHA1 2a670685dc865ac2d43c32ea489f5063aac8f39c
SHA512 ae82e00f375857654874b5377c7322821e2cdab2f72abbb617bb218a71b6cbcbff729f5ce94cce037863173a97974c2bd38bf4b6cdd185e3ea8141a1c5cf82f0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\qap`g`v~dtlq
Size 10B
SHA256 a6c753cff6d76b73a400013cf15495f9dfd04907dcf114bfe51ea86df074565c
MD5 3d5b6798939799ad3ba71a1117e22a28
SHA1 6f39fd007c70cab0eab6672a05cab0f087529ccf
SHA512 477da5ff25d4d79b819a33f2558832d96d291b451b42824954403be008815e057af7584a098e8ee1195965537cff6df6c36b3505e31dfa3eb7cadd94b2b202d2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 a15f6e6bf53d0c65aa5a9b15b55c245c0f7feacf2478e1d2255de599d6678288
MD5 42ca8c9a5fa9f9c228d2daa6789fcd27
SHA1 756d7743deea93dcf5cc4dd435ed038d9ffe3aa4
SHA512 b244860d00828b90894bbbf4b382f6fa7a900e29ba7192bd430da0c0697b7e682760e2c27805da7a1ee05faf42a54e002e4dcc01df134c63b62c6682a2213d41
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\cs\qap`g`v~dtlq
Size 10B
SHA256 8860de62ed62ce58ea2b536f1e01c54ada78169b249d569c8cefa2e4f3fa1e1c
MD5 4da904f071069efb73b3d036e24aec87
SHA1 2021fd49db97e525d36745f5b97c585b72b5900a
SHA512 ee5b23486a3d3c20b4400f79ec07884071216bf64c2bd3c37d4d1237d7df39b273853b0bf7930dadaef0e8e49626e3ce43f4de89d83eefc90e24c366c133e1a1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 5cd7db2d7dd46e128aba4da9fb93c44e3110c509396b5073515f7f364ee39207
MD5 23eaffaa31bf7fe3eb2c177786bd3c45
SHA1 1ba8c1360e574e93d1aa590b457fcef42dc67b70
SHA512 785646dfe8cf2606a7d25239b8a429d6d37e78d733b17eed8d38b395ebfbebdc6fde607e32a005ea77b42d130fd38ac9c5834a948d2207a11f01658f30181b93
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6eagavx.default-release\cache2\doomed\qap`g`v~dtlq
Size 10B
SHA256 4ab9cc078fdac35ba1a21414360718472c11afa4a309bd1836be7ac7d2365bdb
MD5 96bacb9f50bf6100addb694b016d2a02
SHA1 3c75f01a18a33ed722846f639e16a220c4a91985
SHA512 049e798936e72ecfd5cc764b698eb20525c6be8bf30fcc15c2d36281962920b67dcd7a3d86e8250dbce3cadc1388ee3a4573af209c5ebb3bfb8488c0107889c0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kmevy7f8.Admin\qap`g`v~dtlq
Size 10B
SHA256 9fbafdb2f12311622f5768f4bc557df9d9af3a4b9cb98e1ac3a124adef0b25af
MD5 84970ec8aa801b39c3e62cd2aef2a38a
SHA1 2e85dd21dfe7a0cafa585870190b5f232033b20b
SHA512 b8398efc16c4f146c9928c24457bc95adee1056a498356f7d8b8e959ea019a19442abd22edb857bdc9ffeb3f0faa8585b6a93e5bac211ed2470786e67067dc5f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\qap`g`v~dtlq
Size 10B
SHA256 ef254aae0c22ccef348f6fa67ae8b0e29a2d725bce74f903ba0131457f5670ea
MD5 b8e051f9171b2e96d33cdf25c4ab3307
SHA1 7acc0e1a04a965d96a2a8141b0dfef07cb64fdc7
SHA512 5c02f878f3ce96b2ff4022ff861c38fe01b55d2fe486176b43545d78c535da15208e7fdfa536040f7b64457e015c962cce5aa7c1f3a80b7ee634dc1801a2d8eb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8f3a4db5a14123f6a6c0528517aaf7811367cd671a0f0630a0bfa261b5ce4d18
MD5 18a00d7f0fca5a5374e34296623e9e72
SHA1 79e16fa4af1de005742e89bacfe073b06209e85a
SHA512 992777bad4e2c9f9e708515f4b25cdb48ff0d892dd156c887d31a6b8edf5249fbca03bee6cb7d405b0d00f5c28031244fd0e0b980a04082e0f7be3d5749981bc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e2be96bf4a2f9375a599797523e0cbe01286158a11913152f32e9de85a431245
MD5 7f2bfbfbc7552c71ecd6df29abbb6ee6
SHA1 46981f9e0185ec7a5f862be997abe21daf3b9b04
SHA512 91df0782ff69277af435775a16521745267a51935af0b550d0b9be0272a3c57e0100fbdeb60f2346917860a9090009597ba63bc8aca2cae98628c60e39c7fc86
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2c44460431f230aeea06fae44fc9fcf1823201187225229ef6b2e827a38f1c9f
MD5 2002913bd859dc5dff2043380d30e12d
SHA1 4ca133f21239bee1ee5e79b285624a0156f0e4cb
SHA512 a477a5a219932b655f830e4f0a40e4a0547432fe9141f2604bb72f2e83df80a6b08dd8156c75a99b849e842f285d67c90e951d467308970e800da27268cf1ef8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 810b7613ef64acf6f14f3bec786c7da948ca135c35fa70e81b6f5ae5f7227295
MD5 ddb462f293dd6bf3597f58f5891a7cfb
SHA1 594495017d0f8b959ed2cf2a93be53ce941e6328
SHA512 452df0368c64686d94f6662e3ccda8ac148e13551dd1f0afeaef9ecf540e104986ec1d7e7fdd2498c153ac072b92f81f1bd18a0725dcce59a01d59eca027808a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e6f6323622f032a6d4d27a83126fa8dd642517a070ad15db537d86ac7bc31df4
MD5 755114cce946c1f63b8c0ce2d466ce64
SHA1 05bebd78ca5b1f5d7ab503618b796e2b1c0886e6
SHA512 f07f6aa957e43144b5ddbfe6bd5d9b7c14f22473156d2ec23ed6964f2b7bf710da63c827badbe67715359f8625d902c458ca048ad04b1dfdc1c4be48a336772e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 43f354eeae27831f23fe27becfbf84660cb6febf755e6e147209228fa42f918e
MD5 5ee558f6521a39c9232f98d7fef6dff9
SHA1 6c0b5971625b014be51cb8877a61f331abc5e0a8
SHA512 d218fe818ba19a2eccf9a27e9c942804f6ac87d8ad1b9320002bba19d250a3aa2c544526f05ab3d2ed0ce0297a872fe1ebfe488897ec428c847b6834373cfdc6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 41678728f7c9f8b5efafdb61053aaa4b1b9af7dc948c54c1d8361be9b0950fe4
MD5 30024a6aa8184cf8fcd0353bbeba5cbd
SHA1 e2a92a6aa1100ca15b36dea88953cf379ce7c0a1
SHA512 2061dc90084ee4e53a47aab07c92aaa8fe04f1222d69684b4d070e2e645f595231027a03dce33ba5be9e3cf19fb8bce97f251fd222e7924a05dfa23768e839f7
MD5 SHA1 SHA512

Submit Download

svchost_CBBABCCBBCACCCBAAACACBCABCBCBABBCBABBAAABBCCBCABBABCBBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABCCBBCACCCBAAACACBCABCBCBABBCBABBAAABBCCBCABBABCBBB.exe
Size 8.7MB
SHA256 cf00d24db5edd91c52088db574cca56806a697a32363054e518f19c667d3ff1d
MD5 bb4d3dc0003276d2899b4c56bae7b71b
SHA1 836d61750a3047938b69c04493fe82a914a574dd
SHA512 80becc627d5c36380d91ed790b57467271fe3b0d163c8c61b8f86dd85616f84062e620d8efbcf74a801c18bc5dc373383b1ef3c5375634513ab93a894ee979b3
SSDEEP 49152:U+ES+ESm+ES+ESgq+ESm+ES+ESm+ES+ESm+ES+ESgj+ES+ESm+ES+ESgq+ESm+Eg:oA91pH2WpjHrgBFFu416AWvm
TLSH
T1A7967A55E5A720FCE4AFD0B489ABC336D6717C1341328B5BA67CC6472F23A646D28723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 81d90b6c8d9277faa5ebe19008d3cbe5ec37dd82c05c640374782b78523ba46d
MD5 8023207ea74ec68245c7419a08391613
SHA1 f65039ebc18c403f346b20264c65c571cfe3bb67
SHA512 2773fd0183212f55258ae2cc91c89e48aafeb25f4af58db40ce09a0b2c70753870929acbaea4ff9ef03a238f33dc21f0cea1b9744a77122d125ebd49762a7dcc
TLSH
T16611E460E5F5C8A7F83368EF512ECEE208A97BDBAC986A20130D4518F7E5C334D190E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 44590fd86ef5e01fea82bb6fc9b7bb73047b65bee3b4be538ed02c5a2d157b06
MD5 9072df76bacdbe52e4b2fc905d91d0de
SHA1 e1d5d0a3e1b88d2c56068a242aa70e2b5cbb0255
SHA512 f90792b93d786e129e208a477383db646b9c371a1ff289226b5b46236e1f26f63801ec80e9b080bc51b0c26d933de0eedb4f5c1f48d49aa9b4d66cec7952a083
TLSH
T189219260E5F5C8A7F83368EF522ECEE248A97BDBAC946A60230D4518F7E5C334D190D1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 22a48b1fdbcd3289fd48bed219229b9e32e36f56bc2551afe111c0ec69ce21b4
MD5 b006ae55a164673cd02b1f9da89aa715
SHA1 491a05ad808d03139729d6c80471ca3604b61d29
SHA512 35d20f993bd75746845100b82c4381af81c776b3eb9bf6ba9fa86bf9e4f13f7b7a69a4d9b4836a8516b8fe50725e5aacb6d5f57fa4747eabf39956be0a780c99
TLSH
T15C11C190E5F5D897F83368EF512FCEA248A57BDBAC54AA34130D4518F7E5C324D190E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/400-1541-0x0000000000650000-0x0000000000671000-memory.dmp

Download

memory/400-4159-0x0000000000650000-0x0000000000671000-memory.dmp

Download

memory/1972-32-0x0000000000650000-0x0000000000671000-memory.dmp

Download

memory/2744-70-0x0000000000840000-0x0000000000861000-memory.dmp

Download

memory/2744-4157-0x0000000000840000-0x0000000000861000-memory.dmp

Download

memory/6308-6-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download