43527d1ceaf2eba0303dfef7a5decf0a1d723e23145d32f1454b5ca8b7b79297

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_acd2c0f94afe6f2445831708efae4236_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 15.6MB
Sample260819-wlgdmasvbx
SHA256 43527d1ceaf2eba0303dfef7a5decf0a1d723e23145d32f1454b5ca8b7b79297
MD5 acd2c0f94afe6f2445831708efae4236
SHA1 b3c6445cca7af02e827b6de4deed410df20c99e8
SHA512 2ef2388861a984aa28e99f98ff7b65992b30463b8be34ce098a4b344e5aac97ed73f89e4acc22329088654f6f1cd508a982ccb3298f1a32d5bb5316c84675b62
SSDEEP 196608:m7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouk:mahvQHrc8u3xXJ/f4uUWHZ
TLSH
T170F69E17B35681E6C02AE2B88A474323D7B5BC440331A7DB16D5B76A2F37BE45B3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Detects executables packed with Dotfuscator 2 IoCs

resource	yara_rule
behavioral1/files/0x00070000000245f4-20.dat	INDICATOR_EXE_Packed_Dotfuscator
behavioral1/files/0x000200000000071f-93.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 2 IoCs

resource	yara_rule
behavioral1/files/0x00070000000245f4-20.dat	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/files/0x000200000000071f-93.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 2 IoCs

resource	yara_rule
behavioral1/files/0x00070000000245f4-20.dat	INDICATOR_EXE_Packed_Yano
behavioral1/files/0x000200000000071f-93.dat	INDICATOR_EXE_Packed_Yano

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCBAAABABCBBCBBBABCBBCCBAABAABABBBAABABCAABAACACABABCCB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCBAAABABCBBCBBBABCBBCCBAABAABABBBAABABCAABAACACABABCCB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1204	svchost_CCBAAABABCBBCBBBABCBBCCBAABAABABBBAABABCAABAACACABABCCB.exe
2776	svchost_BABBBAACACBBBCABCCCAACAACCABBACACAACCCCBAAAAAAAAAAABCBC.exe
1592	svchost_CCBAAABABCBBCBBBABCBBCCBAABAABABBBAABABCAABAACACABABCCB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BABCBBCABBCBAABCBCABAAAAABCCABBABCBBCBBCBBCCBACBCCCCAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBAAABABCBBCBBBABCBBCCBAABAABABBBAABABCAABAACACABABCCB.exe"	2026-08-19_acd2c0f94afe6f2445831708efae4236_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AABCCBAAABABAAACBAAAABBBAACABCBCCCAABCACBCBAAABCACABBABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABBBAACACBBBCABCCCAACAACCABBACACAACCCCBAAAAAAAAAAABCBC.exe"	svchost_CCBAAABABCBBCBBBABCBBCCBAABAABABBBAABABCAABAACACABABCCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4980	sc.exe
2884	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2220	cmd.exe
4228	cmd.exe
4452	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_acd2c0f94afe6f2445831708efae4236_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABBBAACACBBBCABCCCAACAACCABBACACAACCCCBAAAAAAAAAAABCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBAAABABCBBCBBBABCBBCCBAABAABABBBAABABCAABAACACABABCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3852	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1568	2026-08-19_acd2c0f94afe6f2445831708efae4236_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
1568	2026-08-19_acd2c0f94afe6f2445831708efae4236_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
1568	2026-08-19_acd2c0f94afe6f2445831708efae4236_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
1568	2026-08-19_acd2c0f94afe6f2445831708efae4236_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
1204	svchost_CCBAAABABCBBCBBBABCBBCCBAABAABABBBAABABCAABAACACABABCCB.exe
1204	svchost_CCBAAABABCBBCBBBABCBBCCBAABAABABBBAABABCAABAACACABABCCB.exe
1204	svchost_CCBAAABABCBBCBBBABCBBCCBAABAABABBBAABABCAABAACACABABCCB.exe
1204	svchost_CCBAAABABCBBCBBBABCBBCCBAABAABABBBAABABCAABAACACABABCCB.exe
1592	svchost_CCBAAABABCBBCBBBABCBBCCBAABAABABBBAABABCAABAACACABABCCB.exe
1592	svchost_CCBAAABABCBBCBBBABCBBCCBAABAABABBBAABABCAABAACACABABCCB.exe
2776	svchost_BABBBAACACBBBCABCCCAACAACCABBACACAACCCCBAAAAAAAAAAABCBC.exe
2776	svchost_BABBBAACACBBBCABCCCAACAACCABBACACAACCCCBAAAAAAAAAAABCBC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1568	2026-08-19_acd2c0f94afe6f2445831708efae4236_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	1204	svchost_CCBAAABABCBBCBBBABCBBCCBAABAABABBBAABABCAABAACACABABCCB.exe
Token: SeDebugPrivilege	1592	svchost_CCBAAABABCBBCBBBABCBBCCBAABAABABBBAABABCAABAACACABABCCB.exe
Token: SeDebugPrivilege	2776	svchost_BABBBAACACBBBCABCCCAACAACCABBACACAACCCCBAAAAAAAAAAABCBC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2480	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 4452	1568	2026-08-19_acd2c0f94afe6f2445831708efae4236_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	89
PID 4452 wrote to memory of 3852	4452	cmd.exe	91
PID 1204 wrote to memory of 1136	1204	svchost_CCBAAABABCBBCBBBABCBBCCBAABAABABBBAABABCAABAACACABABCCB.exe	98
PID 1136 wrote to memory of 2128	1136	notepad.exe	99
PID 1568 wrote to memory of 2220	1568	2026-08-19_acd2c0f94afe6f2445831708efae4236_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	103
PID 2220 wrote to memory of 4980	2220	cmd.exe	105
PID 1568 wrote to memory of 4228	1568	2026-08-19_acd2c0f94afe6f2445831708efae4236_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	106
PID 4228 wrote to memory of 2884	4228	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-19_acd2c0f94afe6f2445831708efae4236_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_acd2c0f94afe6f2445831708efae4236_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCBCBBBCBACAAAAACCCCAABABAABABCABBCBACBBBCBCCACCCACCACBCCCACBBCBBAACCBABACAACBBBCBBCACCBBBAABBCABACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAABABCBBCBBBABCBBCCBAABAABABBBAABABCAABAACACABABCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCBCBBBCBACAAAAACCCCAABABAABABCABBCBACBBBCBCCACCCACCACBCCCACBBCBBAACCBABACAACBBBCBBCACCBBBAABBCABACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAABABCBBCBBBABCBBCCBAABAABABBBAABABCAABAACACABABCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAAAACBABAACBAACAAABBCCCBABCACAABCBBABACCABCBACBBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAABABCBBCBBBABCBBCCBAABAABABBBAABABCAABAACACABABCCB.exe" start= auto displayName= "UserDataSvc_CAAAACBABAACBAACAAABBCCCBABCACAABCBBABACCABCBACBBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAAAACBABAACBAACAAABBCCCBABCACAABCBBABACCABCBACBBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAABABCBBCBBBABCBBCCBAABAABABBBAABABCAABAACACABABCCB.exe" start= auto displayName= "UserDataSvc_CAAAACBABAACBAACAAABBCCCBABCACAABCBBABACCABCBACBBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAAAACBABAACBAACAAABBCCCBABCACAABCBBABACCABCBACBBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAAAACBABAACBAACAAABBCCCBABCACAABCBBABACCABCBACBBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2884

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAABABCBBCBBBABCBBCCBAABAABABBBAABABCAABAACACABABCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAABABCBBCBBBABCBBCCBAABAABABBBAABABCAABAACACABABCCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2128

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2480

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBAACACBBBCABCCCAACAACCABBACACAACCCCBAAAAAAAAAAABCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBAACACBBBCABCCCAACAACCABBACACAACCCCBAAAAAAAAAAABCBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2776

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAABABCBBCBBBABCBBCCBAABAABABBBAABABCAABAACACABABCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAABABCBBCBBBABCBBCCBAABAABABBBAABABCAABAACACABABCCB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 59cae4a6f3391bf50896e8697a0c0fe7777fc6a4f4248a86d0b4056c27d38794
MD5 7bd859c5362ab055e11523e0d92941a2
SHA1 2edd99ba556a4279ccccf12932a9146638416d9e
SHA512 b3ca3a39db66e8772f847520d35a7a6adb1b1815df39fb066c5774509208bdfb60be18610a9f30d620dc00f50fc1efa8e7456aa3852468f4d87727dc32ef3cf0
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 16.1MB
SHA256 e5d20f1c436db222d1f8035f658eec97e32e603114cd2a9d9da291b643d53645
MD5 483c1b7fee91a4e01fa972698503549f
SHA1 7cbec017189262298b018d5fed10c668ff48bfeb
SHA512 ecb984ef6368afb9fe7ce9bf6f219d9b6573378127c73de4b7272f07fe2827e72d9c1b21ca418e3dbdd8ad9f6931c1f19b68f3ac8cf90b26e81997638824c232
SSDEEP 196608:m7APhNNECwHrc8u3x3AEcq/fByuKlWH3CToub:mahvQHrc8u3xXJ/f4uUWH4
TLSH
T136079D17B35A81E6C06AE2B88A574322D7B5BC440330A7DF12D5B7692F37BE45B3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 75efaa68992e5538994aa496f51170ab095d89ef243791d5a19c57c3f123682e
MD5 387ecb15a8ef1b04b52eeca37776b409
SHA1 9427b9671473ca53561511d7b5c6c63351efbfd9
SHA512 a225ed52697e0a0a1c4699114d409e57eae9701eb3ef4fead27b3330fecb916f908f65c0e0901f865bdb8ac7253c07e56906c1445651745464cc1c646fe26b14
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 591a63d55d9c38d713aa22c3074c462b60c39254458a491793a0219c32b1fb0d
MD5 cd83ab8ef75bf3843c2f3625302a7b5a
SHA1 397194ac28d32a215715237077ba68620339bc3d
SHA512 a0bfc9fabcc3fb94404a572c6b3af463af343261fe61145b26b36d700c48ab458590e53492a5b3c86b9ce67226c38a1e3749d22b386c8b7b4a0496c5cc71d70d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.CapturePicker_10.0.19041.1023_neutral__cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 3570a8efe850c27d3436717afcda04930946098b6b70d1ff135d558119656088
MD5 5d007cfe1b30a0b02a0b9d3766dfa9e1
SHA1 22e209099fcd0b8e0b5fb7635bee4464b636fa76
SHA512 b1419811c5b9bec4541b08cd444f93a09d08a3a29849e6ba0f803b157b4d2d68aa2c00e2c93e0316c5fc9296d1592a2ba1a5a8e832bfb43d4e1da6317a0f099e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 8d74609db729fdf133cb5524e95b9175ef3d54df3405e018efb96fbc66566052
MD5 7910bbe0df7545733aa643da84aabfd1
SHA1 2d7c5e18812d13b8b9e13a2413f494e40f43f095
SHA512 41e6a918a49c8b758be703318824cb072b8babe55a352c7df7d2ae512c077a7f3aca9e38286ba26a70c7050333331df55abc3eadd60f4ab7d5dda2aee8fc3fa1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\_locales\si\qap`g`v~dtlq
Size 10B
SHA256 3564b441528b78aa51552c7fa50cc3e35771a438c6741b277d13051c39a842c7
MD5 24b9b4228ec1c029415db98dcf4da459
SHA1 ea889635d9ab1f79a92865f0ff76c1e31200687d
SHA512 0abb66ea4a3e85f097ddd3692f40b32363b7379ea379876153f18b29efaf289b65bce2aa4657771eb87b99024dfcfb880beec9b445fb48a287fd7276d35485e3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 981218a629ae23833c91ff6339fb7b2cfa0a6764a31fdc769e200f2bde1ff4a9
MD5 98bc4f6c12d4fb5f6b6220135fc5fb1e
SHA1 35a014defedfe47a2f3376e0734722f16b8575ef
SHA512 62f36be3ee4c098e45878719d774d2ac1e1f265212e8836d70236150934eca7211dac3eee117e49857baa72a8ee2571d2c74f9315e2aa54a321ec51f3f1135e3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Settings\qap`g`v~dtlq
Size 10B
SHA256 56b19fbad1a4766ddccec5b88a1b0260b82d619b858464a9418accb0beb104c6
MD5 90ffd350f0f7ccf17ea83e298fbebf27
SHA1 de7e305a29cec9cab129b6ec4bdceecf234eced2
SHA512 e3dcd9cc356f7c2aacac6b1751a68ac4d4b6e50802de9f7388a9839745da31d181bd59f27ce07b4cfdb7b8b6614d1ae605206229984513252fbd169da6558690
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d6688880ada8d6d75996de78cb61e7e9d7405ec80a0aa42723beb1861c5f1643
MD5 6c15389b0e6d181ffd8154b50d11bc14
SHA1 f568e92e5883e0aaf1d2d736fce8d8f7fa29e03a
SHA512 e7531ab44a2b890b25bc2ccd09480ee83173aa0ed00117d2e5b1358b7b7d975a5872a4fa0dec9bc0a8563293de42e3dd2bbbf0680ef447b7f5c69124b1e15be4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a9b247cffbc787cbd44adae466350270720e79e5cacd5a3049fbe6f39eabacf2
MD5 52d9db848b0d3ed3f4ac1dd771f4f2ce
SHA1 50fe6a6cb7c456885a5b029b38cafb2522400ddd
SHA512 c8ba65d01b76c40e8154f9ebc1f8ce5ad231679b3f91689bf85fc0a04363f37ccbd79cc8c94285f62d6320f95d546156fea14a138dd583b573aad57c6dbd2399
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 af8740ae9f34901b3cc1ee34de160b599e96883b974b93ae3c552a000af125ad
MD5 e0d03a1ea16866573f3bd49eecccab3d
SHA1 807b7c804b331bb7d6ba8691156e08618ee66d81
SHA512 bd73c4fcd096f0fa565f95167ea5e70a0c404baa17b13814efc0308127b190b8627b012e51b2db94308290b6800149c3ccd87dd49cc9a9cb23bf284f95e041af
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7803bc4134e21f2fa84d1be84c45a72e200d1ff44e4c187b15ffdee66e08518a
MD5 b8cf62f98c843705dd4734d2e364ba6a
SHA1 3d2ecd8fa59de10ac2e9901f747b7cb801ab027f
SHA512 1cddcb8578ce439ae2a35ec74b3651b15168804a8d016da53db0ca1fab06fe2d44cfc5e5163cbb03821dffcf50e2d3065a16e6903b714a7ef715ee80d4bba331
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6bdf94dde0deafffba576c5730fecaf17d17765ddb24bab39d9a24ec6b3c0e1b
MD5 6ad4da3407ce39773fbaad289ffcfb80
SHA1 5361ef31bac2f4bff41da8b31899787f11c17e3d
SHA512 983e6fd54556e5d9b98df3c19f64872158acc7f06a626af406ed70eb67623a0660f85c40db8e30b2ec8ee9b30c14f405c5fd645b64928f6c102eca8bb322fe86
MD5 SHA1 SHA512

Submit Download

svchost_CCBAAABABCBBCBBBABCBBCCBAABAABABBBAABABCAABAACACABABCCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAABABCBBCBBBABCBBCCBAABAABABBBAABABCAABAACACABABCCB.exe
Size 15.6MB
SHA256 43527d1ceaf2eba0303dfef7a5decf0a1d723e23145d32f1454b5ca8b7b79297
MD5 acd2c0f94afe6f2445831708efae4236
SHA1 b3c6445cca7af02e827b6de4deed410df20c99e8
SHA512 2ef2388861a984aa28e99f98ff7b65992b30463b8be34ce098a4b344e5aac97ed73f89e4acc22329088654f6f1cd508a982ccb3298f1a32d5bb5316c84675b62
SSDEEP 196608:m7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouk:mahvQHrc8u3xXJ/f4uUWHZ
TLSH
T170F69E17B35681E6C02AE2B88A474323D7B5BC440331A7DB16D5B76A2F37BE45B3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 42844c25f7586184b0ec5fb47d52b0859b5d48ff59c3779e83df042bb4098062
MD5 15f7ec1bc6ef297feb1a77211a54f82a
SHA1 9ea5621368e74c94ac150132098d2170af97d960
SHA512 25b1a11b041155133b003c11ef47c9d4d6e45345e6df84bf9c2538c80d59802d648bacb951565b7d6552132e7cd2c612e0f1e5e4d51b16354908de45892df3d7
TLSH
T1A221D17095E5D89BFE73288BA23DDFC38CE8365B6C9CEA05224941196795831DE094B2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 1e447575b377fe4d080a2daa3ee6cf9e86a4706ecd2029f896826270de3eba17
MD5 5b7f9f36f428d428d5f3c09e12f849f4
SHA1 47de13655cb0460c3badf5d6812512990482cb97
SHA512 d688acee905e40c2d0bf20e17741805f32599c5c0079d026231cc55ff0dd3f582f8da886302e5d57f7d8f2dd9acc8399b279073d057858348127b0faba68f5f8
TLSH
T13311273095E5D89BFE72288B623DDFC38CE8325B6CDCEA0533494208A7D5831DD054B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1136-57-0x00000000028C0000-0x00000000028C1000-memory.dmp

Download

memory/1204-35-0x0000000000A30000-0x0000000000A51000-memory.dmp

Download

memory/1204-25-0x0000000000A30000-0x0000000000A51000-memory.dmp

Download

memory/1568-6-0x0000000000C70000-0x0000000000C91000-memory.dmp

Download

memory/1592-79-0x0000000000A30000-0x0000000000A51000-memory.dmp

Download

memory/1592-3025-0x0000000000A30000-0x0000000000A51000-memory.dmp

Download

memory/2776-77-0x00000000007A0000-0x00000000007C1000-memory.dmp

Download