c68270a22a889b1f461d16d9ae04a8876ed20341f12dda432a4bd41522cf5ba1

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 17:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_85993b8114b5fe60a2efc47fa1fbf0f6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 7.7MB
Sample260816-v4tw1atvbx
SHA256 c68270a22a889b1f461d16d9ae04a8876ed20341f12dda432a4bd41522cf5ba1
MD5 85993b8114b5fe60a2efc47fa1fbf0f6
SHA1 8cae46c3969be228f69afac73071e3182a10de8e
SHA512 0b4f0c36ec29d4561c3913f9e211a8b8835e8c8ed68c6154c1caff77ee468d129c7d4fee9b919da237e7a1cf282dc82a8486542668c7daf2c17f29e9d4ea2632
SSDEEP 49152:U+ES+ES+E2+ES+ES+EZC5WU+ES+ES+E2+ES+ES+EZC5Wib6LgA97HrsdochZVNhr:a5/5lA91pH2WpjHrgBFFu416AWvE
TLSH
T187865AA5A2E720ECE0BFD175897AC332EA717C130231935F167CD64A2F636646D29723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBCCCCCAAABCBCCACCBBCCCACABABCBAACACBAACBBBCACBCABCBBAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBCCCCCAAABCBCCACCBBCCCACABABCBAACACBAACBBBCACBCABCBBAA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4168	svchost_BBCCCCCAAABCBCCACCBBCCCACABABCBAACACBAACBBBCACBCABCBBAA.exe
1708	svchost_CACCBCCBABBACACAAAACCBCCBABBBBCCCCBBBABABCABCACBACCBCCC.exe
4268	svchost_BBCCCCCAAABCBCCACCBBCCCACABABCBAACACBAACBBBCACBCABCBBAA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBCBCCCCBABACBBBAABCABBABAACCBCCCBACAAABBBCAACABABACBAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCCCCCAAABCBCCACCBBCCCACABABCBAACACBAACBBBCACBCABCBBAA.exe"	2026-08-16_85993b8114b5fe60a2efc47fa1fbf0f6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCACBCAABABAABBCBABCBACBBCABAAAAABCCAABACAABAACACCAACACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACCBCCBABBACACAAAACCBCCBABBBBCCCCBBBABABCABCACBACCBCCC.exe"	svchost_BBCCCCCAAABCBCCACCBBCCCACABABCBAACACBAACBBBCACBCABCBBAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1240	sc.exe
4924	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3996	cmd.exe
2356	cmd.exe
1516	cmd.exe
3228	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_85993b8114b5fe60a2efc47fa1fbf0f6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCCCCCAAABCBCCACCBBCCCACABABCBAACACBAACBBBCACBCABCBBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACCBCCBABBACACAAAACCBCCBABBBBCCCCBBBABABCABCACBACCBCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2300	schtasks.exe
4980	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
716	2026-08-16_85993b8114b5fe60a2efc47fa1fbf0f6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
716	2026-08-16_85993b8114b5fe60a2efc47fa1fbf0f6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
716	2026-08-16_85993b8114b5fe60a2efc47fa1fbf0f6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
716	2026-08-16_85993b8114b5fe60a2efc47fa1fbf0f6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4168	svchost_BBCCCCCAAABCBCCACCBBCCCACABABCBAACACBAACBBBCACBCABCBBAA.exe
4168	svchost_BBCCCCCAAABCBCCACCBBCCCACABABCBAACACBAACBBBCACBCABCBBAA.exe
4168	svchost_BBCCCCCAAABCBCCACCBBCCCACABABCBAACACBAACBBBCACBCABCBBAA.exe
4168	svchost_BBCCCCCAAABCBCCACCBBCCCACABABCBAACACBAACBBBCACBCABCBBAA.exe
1708	svchost_CACCBCCBABBACACAAAACCBCCBABBBBCCCCBBBABABCABCACBACCBCCC.exe
1708	svchost_CACCBCCBABBACACAAAACCBCCBABBBBCCCCBBBABABCABCACBACCBCCC.exe
4268	svchost_BBCCCCCAAABCBCCACCBBCCCACABABCBAACACBAACBBBCACBCABCBBAA.exe
4268	svchost_BBCCCCCAAABCBCCACCBBCCCACABABCBAACACBAACBBBCACBCABCBBAA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	716	2026-08-16_85993b8114b5fe60a2efc47fa1fbf0f6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4168	svchost_BBCCCCCAAABCBCCACCBBCCCACABABCBAACACBAACBBBCACBCABCBBAA.exe
Token: SeDebugPrivilege	1708	svchost_CACCBCCBABBACACAAAACCBCCBABBBBCCCCBBBABABCABCACBACCBCCC.exe
Token: SeDebugPrivilege	4268	svchost_BBCCCCCAAABCBCCACCBBCCCACABABCBAACACBAACBBBCACBCABCBBAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
744	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 716 wrote to memory of 2356	716	2026-08-16_85993b8114b5fe60a2efc47fa1fbf0f6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	90
PID 2356 wrote to memory of 4980	2356	cmd.exe	92
PID 4168 wrote to memory of 1504	4168	svchost_BBCCCCCAAABCBCCACCBBCCCACABABCBAACACBAACBBBCACBCABCBBAA.exe	99
PID 1504 wrote to memory of 3376	1504	notepad.exe	100
PID 716 wrote to memory of 1516	716	2026-08-16_85993b8114b5fe60a2efc47fa1fbf0f6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	104
PID 1516 wrote to memory of 4924	1516	cmd.exe	106
PID 716 wrote to memory of 3228	716	2026-08-16_85993b8114b5fe60a2efc47fa1fbf0f6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	107
PID 3228 wrote to memory of 1240	3228	cmd.exe	109
PID 4168 wrote to memory of 3996	4168	svchost_BBCCCCCAAABCBCCACCBBCCCACABABCBAACACBAACBBBCACBCABCBBAA.exe	112
PID 3996 wrote to memory of 2300	3996	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-08-16_85993b8114b5fe60a2efc47fa1fbf0f6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_85993b8114b5fe60a2efc47fa1fbf0f6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCACBCAABBBBCCAAAACBBCBBACAAABCACAABCACCBCBABBBBACCCACACAAABCBCBBCCAACBBCBBACABACBAABACBBCACABCCABCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCCAAABCBCCACCBBCCCACABABCBAACACBAACBBBCACBCABCBBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCACBCAABBBBCCAAAACBBCBBACAAABCACAABCACCBCBABBBBACCCACACAAABCBCBBCCAACBBCBBACABACBAABACBBCACABCCABCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCCAAABCBCCACCBBCCCACABABCBAACACBAACBBBCACBCABCBBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBABCBBAAAAACBABCCCABACCACCAAAABABCCBCCCCABACCBCCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCCAAABCBCCACCBBCCCACABABCBAACACBAACBBBCACBCABCBBAA.exe" start= auto displayName= "UserDataSvc_BBABCBBAAAAACBABCCCABACCACCAAAABABCCBCCCCABACCBCCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBABCBBAAAAACBABCCCABACCACCAAAABABCCBCCCCABACCBCCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCCAAABCBCCACCBBCCCACABABCBAACACBAACBBBCACBCABCBBAA.exe" start= auto displayName= "UserDataSvc_BBABCBBAAAAACBABCCCABACCACCAAAABABCCBCCCCABACCBCCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4924
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBABCBBAAAAACBABCCCABACCACCAAAABABCCBCCCCABACCBCCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3228
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBABCBBAAAAACBABCCCABACCACCAAAABABCCBCCCCABACCBCCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1240

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCCAAABCBCCACCBBCCCACABABCBAACACBAACBBBCACBCABCBBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCCAAABCBCCACCBBCCCACABABCBAACACBAACBBBCACBCABCBBAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACABCABCABBABBBCACCBBAACBCBABCCBCCBABBBACACACCCBABBACAAACBACACAACBACCAACACCABABACBABBCCBBACCBACBCBBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBCCBABBACACAAAACCBCCBABBBBCCCCBBBABABCABCACBACCBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3996
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACABCABCABBABBBCACCBBAACBCBABCCBCCBABBBACACACCCBABBACAAACBACACAACBACCAACACCABABACBABBCCBBACCBACBCBBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBCCBABBACACAAAACCBCCBABBBBCCCCBBBABABCABCACBACCBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2300

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:744

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBCCBABBACACAAAACCBCCBABBBBCCCCBBBABABCABCACBACCBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBCCBABBACACAAAACCBCCBABBBBCCCCBBBABABCABCACBACCBCCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1708

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCCAAABCBCCACCBBCCCACABABCBAACACBAACBBBCACBCABCBBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCCAAABCBCCACCBBCCCACABABCBAACACBAACBBBCACBCABCBBAA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 fbdc01b28ee4f31d9d495b26e39d558a0b30269163b2a183f018fb161fa36ece
MD5 88737d214dc794390884277431576179
SHA1 92925945d101afdebb7972bc5e7911d02668590d
SHA512 86f8292c05577923b0a7091a60dfd7ef7b0c5cd0861a027521f4c987b08bf3dc6fa515797e78f0e08a19f99523e140653592b4686018bb84ee9954368fdd57f4
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 8.2MB
SHA256 dd8ed5f52c983307d635e2d134ff45d7390533beba4939f729e4ccfab6e9f39c
MD5 6d9fd67a95391540239a4a8a0ec37591
SHA1 f9c6017ea68c4edda1b8afb513c4d470ff293eab
SHA512 806a2711dea7b2d39a4e6f5e47debf947bb88aab86e86833de38078ac5228e997e5b81df26cdd105ae4737964d3c5d90ba29a11d7a5be07189aef8bf94430891
SSDEEP 49152:U+ES+ES+E2+ES+ES+EZC5WU+ES+ES+E2+ES+ES+EZC5Wib6LgA97HrsdochZVNhO:a5/5lA91pH2WpjHrgBFFu416AWvHpiE
TLSH
T1A4864AA5A2EB20ECE1BFD175897AC332EA717C130231934F167CD64A2F636546D29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 5f89a26a97770015706682c51f245a92b731abad1c2f218ca44efde58fc78015
MD5 6353ecfc49bf0207bcf5536f55a42148
SHA1 59fcbf34cd95d0105c37f34c324aef74b3fbc677
SHA512 3f916486f167e8ed64b45541a2fc42030099b82dcd8594ac8e1f469ee6ce32109018b2d65e93cef79938afa8c959fdf4c1bcc3c7c18f5fb028f956909c0cefb9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\DSS\MachineKeys\qap`g`v~dtlq
Size 10B
SHA256 a20a40ed54c62c8db9b559e603bda8620bd43b573812abc7cd40550ef4583fdb
MD5 0f9e0a7a3e0127670488e3598a1eb7a6
SHA1 cedea08e84e59f4a6e7a3e63906acf77bbc0f8bf
SHA512 089f8aff67ec67ac5a42a3bc74ca521607a02f011fe00e0a9941180180017f7de14229f97bc70f2b843117cb892b08292c2b1d91b5c952145246f4429f67de0f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 cb4af2bce1214d2ece771fc16cf3446a07508230264ea52320d9877591b0e1f6
MD5 15a15a2d62706988b2ba917a4fcf97b7
SHA1 c4ebc0aa4d75be3cc399801e154330f1fd5c104a
SHA512 8b9335cd7c194ff86db68db2f64b164a048bef41469dc47d008f8149fd10252b12f9aaf4586c44640b34421a6f9c36ffdc6c6a99a5daa18ecb766294dd8492b3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 5a1872ad379dbb732fa5950bfa6cfe38b900ac03fcb4abf9394fd94d29825259
MD5 cf3fec030803d1422d16a092e1c5078e
SHA1 ad8ab3989b70c877f5589eb96ee30aa6835a2ea2
SHA512 0e8c767b9ad42f2b88ee354da7a1b0057f8fd16a4f70127b3b9de7103f569d04f2412f2c963da8e3cba58612724a306982c14f925a813552554058c5e810ec15
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\Settings\qap`g`v~dtlq
Size 10B
SHA256 59930fba1264610b49bc0f538d3b4c12038a35a9dfaddc5c52c1caeefc9b5d33
MD5 bc6f4c02509056bc18278f9579ebfe7b
SHA1 9ba7cd706131b7eeb026b579665fdd86273ba496
SHA512 295f842791a3e0fd20156d8185e99d244adf268b45ead7d6c23da87a017cf18c53e95abee3b21c9e1199f5efef5b7b38ba2e72f93de51587662c58d1085ab713
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 59a122037a23d3a47cc6f16c07b8ed1552272b12fb12dca7269f433c0f06a79a
MD5 9a95325a48ac7ae7bc2b62c5dfd412be
SHA1 36295d888c8c980926b0264e13c77ee8f2fa81a4
SHA512 5c3c3744006ef9ca68852f7c84f8b6d6f2e81128328f10331f1a6d09ac027cfb5ed814e09297ab36b85e61015bb758f1e90b86bb1869e8c8de2daa0973a3c065
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 69ed3537877a2492c0c64747bf424bb6affd5991fc0a97f5172fded7449b1ed8
MD5 71bf65c6fb38993fb58fb1e7a06339ec
SHA1 3e2079bbd92d7c2989b4bddb1db47b6064b6df5e
SHA512 79007e5804c6ed2c4f1dcc0e78f1875bd72aa46461a3ea9f9650dcd9901538bc8da702c7a9d929f89deaf6749f3d17cd47146500d7bf038c735cebcbc76d103f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5bc77e6d319ad488e5ddc35f7486b9e15eb08a7fc0389e74fac882292738ca5f
MD5 2a6b422f9126bb2dea556e06c84ae605
SHA1 b9bed75ddd1a02ff8e8628a62b9cfc442695ec70
SHA512 9c8b2a2d0b3b9d146765183a42f8e477051e3f0c6de016043a4dbe76f66910a51e82bf68d033e01f1a4776b69f314039f707099d45525ca57841dcbc4928cd73
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 97d51e52399244086a4cbff64b6772b5e962c70aa01ad5a65e5dafd378492875
MD5 d905e50db1ba4dee36f2b95ebd56779c
SHA1 f3a774ef78d59ac854d9bfe7e14be80562d551dc
SHA512 f44af3587e9d33fe868b22a9d74f2e61cf0e94111450a2df837ed17da6c380226bfd5a518e17921ebf7226297a2e02379f8316eabcf6ed69305e28c297d37276
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 144fa4ab040d9ee68c9e49ee110229565635d6128b613dec0ff09058a3a4e5b6
MD5 6c2c7a6fea37ccd70a91c1c355ec7c0b
SHA1 1672b9524f1683d006c7db73220202bddc5ebcfa
SHA512 617e1943e70c8698219d37a889160f6bd2b901c452b57291bd726c17010f439a719d3078b39e175bb27e255f014c3d8492f6f2b927b5f576c85e0fd49356c59b
MD5 SHA1 SHA512

Submit Download

svchost_BBCCCCCAAABCBCCACCBBCCCACABABCBAACACBAACBBBCACBCABCBBAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCCAAABCBCCACCBBCCCACABABCBAACACBAACBBBCACBCABCBBAA.exe
Size 7.7MB
SHA256 c68270a22a889b1f461d16d9ae04a8876ed20341f12dda432a4bd41522cf5ba1
MD5 85993b8114b5fe60a2efc47fa1fbf0f6
SHA1 8cae46c3969be228f69afac73071e3182a10de8e
SHA512 0b4f0c36ec29d4561c3913f9e211a8b8835e8c8ed68c6154c1caff77ee468d129c7d4fee9b919da237e7a1cf282dc82a8486542668c7daf2c17f29e9d4ea2632
SSDEEP 49152:U+ES+ES+E2+ES+ES+EZC5WU+ES+ES+E2+ES+ES+EZC5Wib6LgA97HrsdochZVNhr:a5/5lA91pH2WpjHrgBFFu416AWvE
TLSH
T187865AA5A2E720ECE0BFD175897AC332EA717C130231935F167CD64A2F636646D29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 68fd0b7f925d6b5fca80ba01952d892acf7d2df69c724ff67c619dff173ed899
MD5 a09ea12d106c6a89a5ddff3cd7fc763d
SHA1 e9f08e506241ff196ea0e00521d242a319cb1399
SHA512 08cd7b9fe9e7234bb4e730e4a17ac56a2da6feb23022c1abed17acd68ec4a9f4bf31a24bcfe1a825abada6129c7a3d86cd4fbf186780456d47606ba31ddbd1f8
TLSH
T10B21D250F4E4EC63ED6268CF866DEF921CA9375BEC98AA04234E82187798C328D154D1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 2e62c861a80c8136052c65b05fa590e742b63d4bd0d88bb095b751eb343b164f
MD5 44ae4b4cb25ad2551a299686f15baeec
SHA1 3ec98d987f4a481258d936e2af45512485b167dc
SHA512 9284d6582b485f000ad248cc488591d18ffffbfd9a0e51c3b989cd9330efb8ae9fbdd868c08c208a0a5000b226e18975989bcae84ad75a65342595c77a4e534c
TLSH
T14111C150F4E5EC23FD7228CE466EEF531CEA3757AC58BA04238A82197798C328E154D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 13bc26b6e25744dac8907424d4407ae9ddf763ff9e8af055c2b8b0711a578169
MD5 84341221e96676d49189e0abd6b38aec
SHA1 d67385dd1f2f61738675bff26ba4390122fd36c5
SHA512 5a643a3abcc9b2c789dc8306b9c8d96108a41b159ae6bb87438f013f987f598a47ca7bde450655d594f0f91b039ae4ff5ee09b07a328be72943833f790fdc942
TLSH
T1EB21BE50F4A5EC23ED7228CE566EEF931CA63757AC58BA04234A42187798C328E158D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/716-6-0x0000000000210000-0x0000000000231000-memory.dmp

Download

memory/1504-57-0x0000000004F10000-0x0000000004F11000-memory.dmp

Download

memory/1708-85-0x0000000000EA0000-0x0000000000EC1000-memory.dmp

Download

memory/4168-33-0x0000000000B30000-0x0000000000B51000-memory.dmp

Download

memory/4268-3011-0x0000000000B30000-0x0000000000B51000-memory.dmp

Download