8cc3b9066d5df62116e470ce4007b64243eb4b87445793701c2cbfdfac84378f

Analysis

max time kernel
149s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_b90b830498a9d2e5bc9a7d0221cb5fbe_amadey_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
Size 16.4MB
Sample260826-pcafdsv1dw
SHA256 8cc3b9066d5df62116e470ce4007b64243eb4b87445793701c2cbfdfac84378f
MD5 b90b830498a9d2e5bc9a7d0221cb5fbe
SHA1 bfb9645f616902624b92121f381569b45576d97b
SHA512 239ff88b5a984da890500cf2e8eb5ae581752c4b36efec919de7e93560ab483c21842afedec513933ded8953a6a0235da5f53455e28dc474499be27ba98aa92a
SSDEEP 49152:U+ESm+ES+ESm+ES+ESm+ES+ESgq+ESm+ES+ESm+ES+ESm+ES+ESgX+ESm+ES+ES1:UA91pH2WpjHrgBFFu416AWvV
TLSH
T153074B15F98350F5D86F90B049DBD37FCA707E1281328FABE65DC6576E23B606C28622
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2816	svchost_ABCAAAABABABBBAABABACCBCAAACCCCCAACCACAAACAACBACBACCAAC.exe
2880	svchost_AABBBCCCBCACBBAACACCBBCCACCCBBBBABBBCCACCAACBCCBBABBACA.exe
2944	svchost_ABCAAAABABABBBAABABACCBCAAACCCCCAACCACAAACAACBACBACCAAC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAABCCABCCBCCAACAABCBACAAACCACABCBAAABCCCCBABCBACCABBCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCAAAABABABBBAABABACCBCAAACCCCCAACCACAAACAACBACBACCAAC.exe"	2026-08-25_b90b830498a9d2e5bc9a7d0221cb5fbe_amadey_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACBACCCBACCAACBCBCACACACBCBCCAAAABBBCABBBBCBABBCACBCBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABBBCCCBCACBBAACACCBBCCACCCBBBBABBBCCACCAACBCCBBABBACA.exe"	svchost_ABCAAAABABABBBAABABACCBCAAACCCCCAACCACAAACAACBACBACCAAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4820	sc.exe
4704	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1364	cmd.exe
2888	cmd.exe
4260	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_b90b830498a9d2e5bc9a7d0221cb5fbe_amadey_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCAAAABABABBBAABABACCBCAAACCCCCAACCACAAACAACBACBACCAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABBBCCCBCACBBAACACCBBCCACCCBBBBABBBCCACCAACBCCBBABBACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4140	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3732	2026-08-25_b90b830498a9d2e5bc9a7d0221cb5fbe_amadey_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
3732	2026-08-25_b90b830498a9d2e5bc9a7d0221cb5fbe_amadey_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
3732	2026-08-25_b90b830498a9d2e5bc9a7d0221cb5fbe_amadey_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
3732	2026-08-25_b90b830498a9d2e5bc9a7d0221cb5fbe_amadey_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
2816	svchost_ABCAAAABABABBBAABABACCBCAAACCCCCAACCACAAACAACBACBACCAAC.exe
2816	svchost_ABCAAAABABABBBAABABACCBCAAACCCCCAACCACAAACAACBACBACCAAC.exe
2816	svchost_ABCAAAABABABBBAABABACCBCAAACCCCCAACCACAAACAACBACBACCAAC.exe
2816	svchost_ABCAAAABABABBBAABABACCBCAAACCCCCAACCACAAACAACBACBACCAAC.exe
2880	svchost_AABBBCCCBCACBBAACACCBBCCACCCBBBBABBBCCACCAACBCCBBABBACA.exe
2880	svchost_AABBBCCCBCACBBAACACCBBCCACCCBBBBABBBCCACCAACBCCBBABBACA.exe
2944	svchost_ABCAAAABABABBBAABABACCBCAAACCCCCAACCACAAACAACBACBACCAAC.exe
2944	svchost_ABCAAAABABABBBAABABACCBCAAACCCCCAACCACAAACAACBACBACCAAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3732	2026-08-25_b90b830498a9d2e5bc9a7d0221cb5fbe_amadey_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	2816	svchost_ABCAAAABABABBBAABABACCBCAAACCCCCAACCACAAACAACBACBACCAAC.exe
Token: SeDebugPrivilege	2880	svchost_AABBBCCCBCACBBAACACCBBCCACCCBBBBABBBCCACCAACBCCBBABBACA.exe
Token: SeDebugPrivilege	2944	svchost_ABCAAAABABABBBAABABACCBCAAACCCCCAACCACAAACAACBACBACCAAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3732 wrote to memory of 1364	3732	2026-08-25_b90b830498a9d2e5bc9a7d0221cb5fbe_amadey_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe	92
PID 1364 wrote to memory of 4140	1364	cmd.exe	94
PID 2816 wrote to memory of 6072	2816	svchost_ABCAAAABABABBBAABABACCBCAAACCCCCAACCACAAACAACBACBACCAAC.exe	95
PID 3732 wrote to memory of 2888	3732	2026-08-25_b90b830498a9d2e5bc9a7d0221cb5fbe_amadey_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe	98
PID 2888 wrote to memory of 4820	2888	cmd.exe	100
PID 3732 wrote to memory of 4260	3732	2026-08-25_b90b830498a9d2e5bc9a7d0221cb5fbe_amadey_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe	101
PID 4260 wrote to memory of 4704	4260	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-25_b90b830498a9d2e5bc9a7d0221cb5fbe_amadey_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_b90b830498a9d2e5bc9a7d0221cb5fbe_amadey_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABAABCACCBBBCCAABABCCAABACCBCABABCACCBCACBCABBABCBBABBABBCBCCABBBCCACABBAAAABCCCCCCCABBBCABACACBCAABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAAABABABBBAABABACCBCAAACCCCCAACCACAAACAACBACBACCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABAABCACCBBBCCAABABCCAABACCBCABABCACCBCACBCABBABCBBABBABBCBCCABBBCCACABBAAAABCCCCCCCABBBCABACACBCAABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAAABABABBBAABABACCBCAAACCCCCAACCACAAACAACBACBACCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAACCBBCBAAAACCBAAAACCAAABBBCCBBBCABCAABBCBBBBBABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAAABABABBBAABABACCBCAAACCCCCAACCACAAACAACBACBACCAAC.exe" start= auto displayName= "UserDataSvc_BAACCBBCBAAAACCBAAAACCAAABBBCCBBBCABCAABBCBBBBBABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAACCBBCBAAAACCBAAAACCAAABBBCCBBBCABCAABBCBBBBBABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAAABABABBBAABABACCBCAAACCCCCAACCACAAACAACBACBACCAAC.exe" start= auto displayName= "UserDataSvc_BAACCBBCBAAAACCBAAAACCAAABBBCCBBBCABCAABBCBBBBBABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAACCBBCBAAAACCBAAAACCAAABBBCCBBBCABCAABBCBBBBBABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAACCBBCBAAAACCBAAAACCAAABBBCCBBBCABCAABBCBBBBBABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4704

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAAABABABBBAABABACCBCAAACCCCCAACCACAAACAACBACBACCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAAABABABBBAABABACCBCAAACCCCCAACCACAAACAACBACBACCAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6072

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBCCCBCACBBAACACCBBCCACCCBBBBABBBCCACCAACBCCBBABBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBCCCBCACBBAACACCBBCCACCCBBBBABBBCCACCAACBCCBBABBACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2880

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAAABABABBBAABABACCBCAAACCCCCAACCACAAACAACBACBACCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAAABABABBBAABABACCBCAAACCCCCAACCACAAACAACBACBACCAAC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.AAD.BrokerPlugin_1000.19580.1000.0_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 8ed49491af1b01b8b34a59b922940018f9cfc4bd04a9c97da5627fdbf9103d11
MD5 6e1782ad7897b264ab5c4f54fc121e91
SHA1 d2406ddff33fdd42b25b7ec01482b79d6c4aa45a
SHA512 cfb29a021fbd6b1b7b6a99c359df65ed2276358a00fec0e5db06dcbfffb00d01d754652da6ff64ef9fc16f49a5bb7d6e47e6a3d33b7d916fa62847c7f1299b54
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 17.0MB
SHA256 35f08bb5dffd364c7cd2daf65bf0918302788d8acd3eb96d395f57a35eea086d
MD5 ebeaf2eacb0f16a60ade4619eb53d83b
SHA1 f5c2f5196c4864c19c4382a5b171a8f3e4f3ed5e
SHA512 d76c7dc0f644dd1eaa2e059723e5d3ba9d3d349816016b8b4a8b111779c3940f499731094454e1edc84a1cbd7ad97ea83f47e4739b076be008b0696a8eab69a5
SSDEEP 98304:UA91pH2WpjHrgBFFu416AWvkgZ2Hb9t+2xk:UmHpn6F44IAWvkgZ2jk
TLSH
T121074B15F58350F5D86F90B04D9BD37FCA707E2281328FABE65DC6576E23B606C28622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\qap`g`v~dtlq
Size 10B
SHA256 ea4eda17071017b40820c26e9db3ae17aacdafef703f6dcd5a172e7d213e9989
MD5 f5b4077822cc5861666d43b860c01c3c
SHA1 2c4ff4f71ba4d0e313c7610eed166752d154b804
SHA512 d6b09ed3efcb18ba4520e825cdeecad183470ef31e4ff45e0df1c7765b8729ad3582ee1a4b187e572e1ea7e5a21cf28f5bb2133638a716519c3f824a02732306
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\qap`g`v~dtlq
Size 10B
SHA256 c6d6a092634f4590e2575ddc72416734012cd7d38ecdb40c5fffac2ed5c322ed
MD5 124d4d63588e72d68f526f3c8c224997
SHA1 77e2aa61d6162bef6bc08fbcda2b2ee6d18ba96d
SHA512 639b27f6bc1af5dbb58fedc4124841f7eb88c5dd7438bd098efb72f935e27665943aecc237099d45fa4153c8c66d3cff7e86572f12f1d6f61bd1fedf5cf5db44
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 bf1e2d9ee227804d222f9d315c297d3b46af22ad2cbeca4bad0124ebdb1fd503
MD5 ea9b966ce61aa4d88959f053cb9ffbb9
SHA1 16fe8d5d1490d6354e7c76a908966f1a9f232b37
SHA512 80ce0bd1216668b9744fdeb3873a51a49600f2dbd6f38c5b4dc10aae16a491d55f008a11d59f69dbb3eb93a2e547e0306a17f3370702cca16fc664e837341273
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5e62bf0a397a1defaf120c6d7ff685e9872114de0fa48241b4408c3b7bb151e3
MD5 1f6afc9baffc82322eef12277b5e1983
SHA1 1c8b16cada149a7f40d6f752c3a2b0d0b0c26f0a
SHA512 fe7d8970feaab892831f3bac813d08bc1fb1de60012af718fc0f200243f608365094814fe737146c0ebbeb58fc658974c70c3278be0d1ce784741f44c6d6a512
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8f4b9ffa29f036a54ba05cffb996496cb61c33a00418e7b1b5b9031d1cc2a4a9
MD5 28b9c4ab750af75636caeda2cb8f0def
SHA1 2114baf558c30419549222d91907a7a4d743de58
SHA512 81057da6bc581f2fcdb52ff2d4ee1d5e73305bc1b5eda3a728d3a28a08cdc9a25de7f95080b9394a06f0396acdb9da294915970eabc3b7bcd78dd2d938fd6649
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b77e70e04d3f49f08f493e44cbf81baa673c6ff3583a705915605d66cf134da9
MD5 ba58bc09f927e70679c9a051a3c219be
SHA1 0a44dd631a9be4e00e0da5b77f692510b628c7a8
SHA512 f5ef12fc758e336dad5223e5edd7ea6728c1689c36cf5728dcedd90e6b23188e48efa220267dc9455fcaeff432ca4461ebc867544c5792595bb066050186d414
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 64d0b393108a07bb83efb4b569688cce9a1e9fc19fbff36f7be32a986f829ab7
MD5 63ae1bbae7e39c30602f8ee6bbc6bf39
SHA1 cbe7a16383aca653385e93310ec2690df76d82c4
SHA512 15d9242f0e45a18beb1974c8ec20599d7f053b0828b97e84afd35f901e8e5659d7ca5b59621fb7cc9e7b2ac588eed4acbcda812e9ba78d5a53022d632106c969
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bb0d5e71faea02ec961e354da7a0e3abf47c4b9203a3c1444403a8e499cd1410
MD5 04dd8bc2a1ee5d4c16717ff8b5cd538b
SHA1 559519aa132ca451fce5b96c25006e6dda51d919
SHA512 18a7b9764bab8a04af03dc95582c3d025fa03638289d54b25f54bd195ddaed371b84030db16d328018416a1e5d82df07f2731737206934cd1aa3bcafc1b2a125
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 64a916ff3614d5bb5c01848442834d2ab73ca6bbf37ce77995add260b5c6afc8
MD5 6006b75fd6a464d8f056e57c24c881ff
SHA1 6885bf9d070d9f9f154d538575221768e867cc68
SHA512 98908a3b628fed59f462c465c0ef95af971d4aba2af604a21bfedebc2ec1ed98da6ccd797ed54acb31a6d3323053b82819b80b0ded3f0a4831f57d3c913d768b
MD5 SHA1 SHA512

Submit Download

svchost_ABCAAAABABABBBAABABACCBCAAACCCCCAACCACAAACAACBACBACCAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAAABABABBBAABABACCBCAAACCCCCAACCACAAACAACBACBACCAAC.exe
Size 16.4MB
SHA256 8cc3b9066d5df62116e470ce4007b64243eb4b87445793701c2cbfdfac84378f
MD5 b90b830498a9d2e5bc9a7d0221cb5fbe
SHA1 bfb9645f616902624b92121f381569b45576d97b
SHA512 239ff88b5a984da890500cf2e8eb5ae581752c4b36efec919de7e93560ab483c21842afedec513933ded8953a6a0235da5f53455e28dc474499be27ba98aa92a
SSDEEP 49152:U+ESm+ES+ESm+ES+ESm+ES+ESgq+ESm+ES+ESm+ES+ESm+ES+ESgX+ESm+ES+ES1:UA91pH2WpjHrgBFFu416AWvV
TLSH
T153074B15F98350F5D86F90B049DBD37FCA707E1281328FABE65DC6576E23B606C28622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 201e8877fad0e2e75b6449384b213478f07aa15f38de67960819479a8cf68d59
MD5 50ec6984ef8ec37eb4f3c683a7932f40
SHA1 8581b6e933f0cbe052c237b859733221615349a7
SHA512 0fe5dfd655d9dff0f3ef3734b9aa6d798c30a92a7021d8dd9e6201136129227ffe00e8edc5f748f9cb85644be4e122231e452878d0f83ef35c7242a1d38ce26a
TLSH
T1E411E7A9D0F5D427FC3264CF533D8E9218E537CF9CE86A182309421ABB85C354F596D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 ddb8f0ff7d12eb9d95653002730fcd83b27c8a1b801379a379f3000aaba1dde1
MD5 e1fd74ba00c468b773ba2ce07655980d
SHA1 bd48c99af0e6b2afd364e7c76bf45e42949994e7
SHA512 3772ef6c56f9df6c4325170b15f714069891704e622e9a32f739f84222e66c06ad9cb274126f78123a4fe2d92bec2c902ea51ac5e693e13acb5442790d0a04e9
TLSH
T1FB21D7A9E0F5D433FC3268CE523D8E9218A5378F9CA86A182309521AB685C358F596D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2816-33-0x0000000000A30000-0x0000000000A51000-memory.dmp

Download

memory/2816-23-0x0000000000A30000-0x0000000000A51000-memory.dmp

Download

memory/2880-78-0x0000000000020000-0x0000000000041000-memory.dmp

Download

memory/2944-81-0x0000000000A30000-0x0000000000A51000-memory.dmp

Download

memory/3732-0-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download

memory/3732-7-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download