dcc8d6562f7d387c4ae64cf58a750e248efa0b166ec3ebdc3a7f6866a4c60c89

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 08:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_48fcb2c3d202e28dee789fa3b2d7021c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 11.5MB
Sample260816-jv21gatthy
SHA256 dcc8d6562f7d387c4ae64cf58a750e248efa0b166ec3ebdc3a7f6866a4c60c89
MD5 48fcb2c3d202e28dee789fa3b2d7021c
SHA1 5da7c5744473b0a66487c5674c141e8478664718
SHA512 6efff81332ccb6711c57c534ddbefc7ce5e0f317a9b526f9538b59968c8d51ba63c52bb4c94268a207df574593b3122f074eaef45c4b0db88c491301ba45980e
SSDEEP 98304:85U5U5H5j5U5U5H5dA91pH2WpjHrgBFFu416AWv0:85U5U5H5j5U5U5H5dmHpn6F44IAWv0
TLSH
T1DFC66D58B7E710E8F57BD5B488BAC376DE717C124231879F562CD60A2E23690AC39723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABABACAABAABAAAABCBACBBAAACCBACAABBACACABCCACCACBAABBAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABABACAABAABAAAABCBACBBAAACCBACAABBACACABCCACCACBAABBAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4808	svchost_ABABACAABAABAAAABCBACBBAAACCBACAABBACACABCCACCACBAABBAB.exe
3596	svchost_BCBCBBBBACBABBBCABCCABBBBCCABBCBACBAAABBBCBCCACABBCBABB.exe
1928	svchost_ABABACAABAABAAAABCBACBBAAACCBACAABBACACABCCACCACBAABBAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBBACCAABABBACCBACAAACABCBBAABAACBABBBAAABBAABABCBCCBCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABABACAABAABAAAABCBACBBAAACCBACAABBACACABCCACCACBAABBAB.exe"	2026-08-16_48fcb2c3d202e28dee789fa3b2d7021c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBCACCABCBCABACCBCCBABCCCAAAABACABCAAAABCABBACCBAACCABCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBCBBBBACBABBBCABCCABBBBCCABBCBACBAAABBBCBCCACABBCBABB.exe"	svchost_ABABACAABAABAAAABCBACBBAAACCBACAABBACACABCCACCACBAABBAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3476	sc.exe
1996	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4852	cmd.exe
2800	cmd.exe
4076	cmd.exe
768	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_48fcb2c3d202e28dee789fa3b2d7021c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABABACAABAABAAAABCBACBBAAACCBACAABBACACABCCACCACBAABBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBCBBBBACBABBBCABCCABBBBCCABBCBACBAAABBBCBCCACABBCBABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1868	schtasks.exe
2020	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2996	2026-08-16_48fcb2c3d202e28dee789fa3b2d7021c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
2996	2026-08-16_48fcb2c3d202e28dee789fa3b2d7021c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
2996	2026-08-16_48fcb2c3d202e28dee789fa3b2d7021c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
2996	2026-08-16_48fcb2c3d202e28dee789fa3b2d7021c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4808	svchost_ABABACAABAABAAAABCBACBBAAACCBACAABBACACABCCACCACBAABBAB.exe
4808	svchost_ABABACAABAABAAAABCBACBBAAACCBACAABBACACABCCACCACBAABBAB.exe
4808	svchost_ABABACAABAABAAAABCBACBBAAACCBACAABBACACABCCACCACBAABBAB.exe
4808	svchost_ABABACAABAABAAAABCBACBBAAACCBACAABBACACABCCACCACBAABBAB.exe
3596	svchost_BCBCBBBBACBABBBCABCCABBBBCCABBCBACBAAABBBCBCCACABBCBABB.exe
3596	svchost_BCBCBBBBACBABBBCABCCABBBBCCABBCBACBAAABBBCBCCACABBCBABB.exe
1928	svchost_ABABACAABAABAAAABCBACBBAAACCBACAABBACACABCCACCACBAABBAB.exe
1928	svchost_ABABACAABAABAAAABCBACBBAAACCBACAABBACACABCCACCACBAABBAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2996	2026-08-16_48fcb2c3d202e28dee789fa3b2d7021c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4808	svchost_ABABACAABAABAAAABCBACBBAAACCBACAABBACACABCCACCACBAABBAB.exe
Token: SeDebugPrivilege	3596	svchost_BCBCBBBBACBABBBCABCCABBBBCCABBCBACBAAABBBCBCCACABBCBABB.exe
Token: SeDebugPrivilege	1928	svchost_ABABACAABAABAAAABCBACBBAAACCBACAABBACACABCCACCACBAABBAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3188	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 4852	2996	2026-08-16_48fcb2c3d202e28dee789fa3b2d7021c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	99
PID 4852 wrote to memory of 1868	4852	cmd.exe	101
PID 4808 wrote to memory of 116	4808	svchost_ABABACAABAABAAAABCBACBBAAACCBACAABBACACABCCACCACBAABBAB.exe	113
PID 116 wrote to memory of 3628	116	notepad.exe	114
PID 2996 wrote to memory of 2800	2996	2026-08-16_48fcb2c3d202e28dee789fa3b2d7021c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	118
PID 2800 wrote to memory of 3476	2800	cmd.exe	120
PID 2996 wrote to memory of 4076	2996	2026-08-16_48fcb2c3d202e28dee789fa3b2d7021c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	121
PID 4076 wrote to memory of 1996	4076	cmd.exe	123
PID 4808 wrote to memory of 768	4808	svchost_ABABACAABAABAAAABCBACBBAAACCBACAABBACACABCCACCACBAABBAB.exe	127
PID 768 wrote to memory of 2020	768	cmd.exe	129

C:\Users\Admin\AppData\Local\Temp\2026-08-16_48fcb2c3d202e28dee789fa3b2d7021c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_48fcb2c3d202e28dee789fa3b2d7021c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBBCCBABBAABAACBBCBBCBACAAAACCACCBBABCBBBABCBBBCCAAACBACBBBACCCBCCCAABACBCAACBCBCABBABBAABBACACACBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABACAABAABAAAABCBACBBAAACCBACAABBACACABCCACCACBAABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBBCCBABBAABAACBBCBBCBACAAAACCACCBBABCBBBABCBBBCCAAACBACBBBACCCBCCCAABACBCAACBCBCABBABBAABBACACACBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABACAABAABAAAABCBACBBAAACCBACAABBACACABCCACCACBAABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCCCCCBBAABABBAABBCCCBBCBBBBBACAABBCABABACCCBBAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABACAABAABAAAABCBACBBAAACCBACAABBACACABCCACCACBAABBAB.exe" start= auto displayName= "UserDataSvc_CCCCCCCCBBAABABBAABBCCCBBCBBBBBACAABBCABABACCCBBAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCCCCCCBBAABABBAABBCCCBBCBBBBBACAABBCABABACCCBBAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABACAABAABAAAABCBACBBAAACCBACAABBACACABCCACCACBAABBAB.exe" start= auto displayName= "UserDataSvc_CCCCCCCCBBAABABBAABBCCCBBCBBBBBACAABBCABABACCCBBAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3476
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCCCCCCBBAABABBAABBCCCBBCBBBBBACAABBCABABACCCBBAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCCCCCCBBAABABBAABBCCCBBCBBBBBACAABBCABABACCCBBAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1996

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABACAABAABAAAABCBACBBAAACCBACAABBACACABCCACCACBAABBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABACAABAABAAAABCBACBBAAACCBACAABBACACABCCACCACBAABBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:116
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCBABCBCAABBBCBCBBBABABBACCBCCABAABACAAACBBABBBBCCBAAAAABCCCABABCACBCBACBCBBCBCCCABCCCABBBACABCBABCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBBBBACBABBBCABCCABBBBCCABBCBACBAAABBBCBCCACABBCBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:768
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCBABCBCAABBBCBCBBBABABBACCBCCABAABACAAACBBABBBBCCBAAAAABCCCABABCACBCBACBCBBCBCCCABCCCABBBACABCBABCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBBBBACBABBBCABCCABBBBCCABBCBACBAAABBBCBCCACABBCBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2020

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3188

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBBBBACBABBBCABCCABBBBCCABBCBACBAAABBBCBCCACABBCBABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBBBBACBABBBCABCCABBBBCCABBCBACBAAABBBCBCCACABBCBABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3596

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABACAABAABAAAABCBACBBAAACCBACAABBACACABCCACCACBAABBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABACAABAABAAAABCBACBBAAACCBACAABBACACABCCACCACBAABBAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 9b4f1e64cd816d31bca47959f753202d6a997f01108798ce934ca0c9d2aff2b5
MD5 f8e02be7bbd3990f88054166a20def91
SHA1 c1146d1e96b09f0f26191c7dfb7fe6adfca0f5c7
SHA512 20128d79b2ebde0b2ac82e640b7577d60c93ee473e53d0ee5ff020c3990058917e5a372481aca71436b2bc1e315269bc41838ae383d5f1d0108b78f29315f7e1
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 12.0MB
SHA256 50346c9e4fb70b3bd5165c539246ad5d5bfc5a956ca348f6e54813c84736bf11
MD5 59992bd87f808974c777e42f47ec3317
SHA1 61bf11a68dd1fd5817840271628adf49450002e6
SHA512 cbb3e143a763263b5c4c5ff627e2618e122599940f96c7773d29e467b2a07f76787cfbd5b737c9fad141c87c91e4d379b05b13c6e6f5346be248e3410ff0a6ec
SSDEEP 98304:85U5U5H5j5U5U5H5dA91pH2WpjHrgBFFu416AWv3pi2:85U5U5H5j5U5U5H5dmHpn6F44IAWvJ
TLSH
T14CC66D58B7E710E8F5BBD57088BAC376DE717C124631879F562CD60A2E23690AC39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 4be292a7beb56f01ca258b25ea873f7a3e7fd6e5d803b027003b581848db6844
MD5 fb330c1a6e96c2547a002a057e5755e5
SHA1 841251ccc1bfc532f3cd4b7451f25f55e1c70fc3
SHA512 03d7e38fe35128644f7ac146524c318ff843b8f3d25c077456c35924507d8e9bd449a6c01228d287a32983dae256e8e5ec7433f4ea3a22972be00a964cb5d64a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\Parental Controls\qap`g`v~dtlq
Size 10B
SHA256 cef1633a0d70529fac0b6ca10ca3eb4658c8020812ca40c57ebd5d14a8e5fb2f
MD5 56e48b8e257c6bb894f0de4b564d28b4
SHA1 947108593c447bdde5dea4b301e4ff6a7e4e05ee
SHA512 753f02c6ece75b52f416b5143821c4b399fc0fd796b423a42bf5aece6e6aa29b20f7dc7800eeb212d9579a33aad8567f6f4ed049e1360b55db282578f40c49fc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 96f5432b5547d30f935e26222a61a68b1bece92d35f6ba86374da75878a77738
MD5 efa9eb4b18af02e9c3eb58f509189fe6
SHA1 bd6fd8e8efee6c79cad436a79b4e11d64055313b
SHA512 996d893a186d86f051e82901b1a03433a3dc7c663c276bd6cfc4332900d3266df5e24055f4aced4a6b2e85fed5aeaf67e4cbf32bb519bb009d54ddc7182ee45d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\qap`g`v~dtlq
Size 10B
SHA256 dd802252d49f1707e6207687df1f08d663c6e193936facb752172a6a06343903
MD5 dfcc391c5478a809e57dad3b06b53c96
SHA1 09040aab3db5f388d199bcc431dd990886712713
SHA512 874b28ac37dc109ea64587ae56f39788f3f998a27afb7d6b562b3a078876e365569add0f897b0188893e5e4deb9b6c4692067c99d021e8e8a0e882b5cfc483c8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 a854696ce963e8ec332b4d205bff53d22ea7a6580c0ae79dfbedd23ae552d2b1
MD5 633ae504ed4864feea00ec85abc5f5c4
SHA1 e3132ce1edc596c904511b38358618621a6e63c4
SHA512 c1a7e80a7822078f7890a0e405cafa6a9058ef1db4de8b911c95c7deeb6e93b0a52d347d7c891c71503ddef0cebebc70cca18dee079bc6b74caa8c53b02aa627
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\qap`g`v~dtlq
Size 10B
SHA256 1e6b07391dbf30da1b25a817ea361ea605090c49a535bd7d6746ca28e4cd907b
MD5 beb6dcc46de44223ab516a3b8183da59
SHA1 4b9c685128284af6d5bf72b0c49527e09a50da8f
SHA512 998e35c43e11bacf479f0ff8dc4d90c63b3ff89a2c8399b6ae85d3824792858fa9f3b5943089ba102807e15715f3a4efe92e24a535fc8f3cf4979668fa680890
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 68a0a8e9ab2c7c9b3a4abf5b3ae3a4ec42d3f92fed535a3fce8d8f29dfbfa8a3
MD5 444fb8829362d69956f57e8ce66859d8
SHA1 7436ce151d876a948df699f255238ab8f03bb54f
SHA512 f9132f42b704f453171b1649c599b8c32624a83df2e1abd47e562ae9997fe4b975c2ce4aefff408d709ea109a28fa3b7297b98875dd88474c7dd9cdeea4704a2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a58a006d526d815b785324dd419e6dbca8660747afdcc6c5ae0ecfaafc65d39d
MD5 cf663d1cdf74defac9c064a61cd49d82
SHA1 0ad0630e8916a817fd2ca2469e8131c3bcf307f9
SHA512 030933fa9c47ba4e1414ae7309c96f9af6487509a4235342c4055c2b374b0caeac0d999e1682f02fd9a49696ac8dcd74659eb1baa4b35bcfa86ee973ed7fc3ad
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2f3fad7555668f04ed103b8019a500456d32732b1804e69de59505a66f0bb972
MD5 81950ea88d35bab3bc2b259504c2f070
SHA1 8ec7a97ec58d5877d4ac3005a294f7be05fa8ef9
SHA512 a04f528a5a166560a7cfed136ebc3340bcfa9bfae527e9639caa0f5dff2c109c475292b300e08c86864eff9285c0704ef4fb419f2e9fc58265ab245223861830
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 634e5b22b1bff823315a67656fc894235b1b472ca8161777df8b9574171d9cb3
MD5 aa884dd2fd93adf5706419e3930756f9
SHA1 1cd0294c266feb4a6cb87a3c8be3b2923630b8e4
SHA512 f64f4ed6ec19946f9760cd2a4a9dfd38544fbf6cd02fd2c2a784fee7e10b3d9babf532814cf25e0e81f14eb050172f14c2a07c32ec95a06acdc126be672a097a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c903b2842cd9def657624c4543be758d8dc734722567d2c3dfae64bf2765d489
MD5 e49a67a824e21885d51e71e0e4ca6b5c
SHA1 972064091d1a9ee2379c153a612218bacbd5c3a8
SHA512 a4062e076d0dad73b85e846fb473387052afbf4cd716d8b3ba28ad2ff88be39e149c84969f17fccc185514a394a0552c0e66f88f2800fdbcfe2405d180bef1c1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Pictures\Camera Roll\qap`g`v~dtlq
Size 10B
SHA256 09191c73102ef8ad68b9b04c80efcea686b5c6756b08ee2e2ba92a7e677f496f
MD5 8dd668bdee2d98268a851565ad44eca1
SHA1 b71aeb23fbaef208380504b75d9607a27cfcdc88
SHA512 1ee8de7a12ba2644e1d38a485218599122a9033f5a96fba6e7758905c1f340f0caf722310208ccad7d1e9c68c23a68868161727aed21b8ebfc0216b09dd80345
MD5 SHA1 SHA512

Submit Download

svchost_ABABACAABAABAAAABCBACBBAAACCBACAABBACACABCCACCACBAABBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABACAABAABAAAABCBACBBAAACCBACAABBACACABCCACCACBAABBAB.exe
Size 11.5MB
SHA256 dcc8d6562f7d387c4ae64cf58a750e248efa0b166ec3ebdc3a7f6866a4c60c89
MD5 48fcb2c3d202e28dee789fa3b2d7021c
SHA1 5da7c5744473b0a66487c5674c141e8478664718
SHA512 6efff81332ccb6711c57c534ddbefc7ce5e0f317a9b526f9538b59968c8d51ba63c52bb4c94268a207df574593b3122f074eaef45c4b0db88c491301ba45980e
SSDEEP 98304:85U5U5H5j5U5U5H5dA91pH2WpjHrgBFFu416AWv0:85U5U5H5j5U5U5H5dmHpn6F44IAWv0
TLSH
T1DFC66D58B7E710E8F57BD5B488BAC376DE717C124231879F562CD60A2E23690AC39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 0c48fa8c44e3020ce60b41d5d6372406f897b9a99e479fe37c7da5597bb53675
MD5 60078ecd561e985e9fd57fcb0a83e16a
SHA1 2562557b7bd44f65327fec3430ca37903b7ea804
SHA512 c2231e4c26c95779b4a8bd2c26f4d5bc726c0a454e685ab31f6026b9df6c4401b96d6d983f7c5bbe51d6966a3d1ce68ba0c167ebb1a6ddbe8f8e414548f7d095
TLSH
T1BC218766D595DCD7D93264CBA22DDFD30C993B9BA85C5F00234EC618FAC9C318D194E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 c00a05fba37bfc7caf4c97cff5ea8e79476b97a2ebb77cb95d69d96548fdf163
MD5 e1b4245e813e8741f4caf16f2549b86c
SHA1 a059bda948fad8d4f6eeaee6fbdba36fa97596fa
SHA512 f0dc9f18e4ab8ff5f2517ae2f4fc1c6ec1db4ee7f65e05f7cc6240c468711c8c07be7d8065a2f2abd51270e8563ae5b4bb4b6121bc97f2d4c1100f999981afc9
TLSH
T11E1186628495DCC7D93264CBA26DDFC30C9A3B97685C6F14234EC218FBC9C328E194A2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 896e0a794b4556c447da7fd8b1bc35f680c075c6c7b7479411d5d7eec83b36bd
MD5 41b128928463fbb7f2266729de88d757
SHA1 23a75f7f836b240282ded797e18cd557b8ce06d0
SHA512 1eb10ccccf8ecb8d05f548c7a1fd602abdf08b03c6233fe1ca0d82943db0a689441791a850872483dd840d1aefbc95495b9e0b94fab2777ef4c08c07d30fdd04
TLSH
T16F21CB61C595DCC3D93264CBA22DDFC30C963B57585C5F00234EC118FBC9C318E190A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/116-59-0x0000000003590000-0x0000000003591000-memory.dmp

Download

memory/1928-1166-0x00000000001E0000-0x0000000000201000-memory.dmp

Download

memory/1928-2873-0x00000000001E0000-0x0000000000201000-memory.dmp

Download

memory/2996-6-0x0000000000A40000-0x0000000000A61000-memory.dmp

Download

memory/3596-87-0x0000000000200000-0x0000000000221000-memory.dmp

Download

memory/4808-35-0x00000000001E0000-0x0000000000201000-memory.dmp

Download