b6b158b3d777566d1b8da0d803d1d2233f8a4d66157940b71c564884380cd519

Analysis

max time kernel
151s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 13:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_ac14b28820c13527f79023a341afeeed_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 14.5MB
Sample260826-q4e1maem5x
SHA256 b6b158b3d777566d1b8da0d803d1d2233f8a4d66157940b71c564884380cd519
MD5 ac14b28820c13527f79023a341afeeed
SHA1 5db7318d7fbdf18da0972bf3f04e5b0db0f475f3
SHA512 11e2ec8dcafd251e6b747c23fd7ea80b1f90be3c35939dea59465e6b5ef6743c8d2b026d8ea20e94fd230fd7968cd48a24a58476188ab6e2c96af559d3f3f6a3
SSDEEP 196608:m7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouI:mahvQHrc8u3xXJ/f4uUWHx
TLSH
T141E69D13B35681E6C02AE2B88A474212E7BA7C440334B7DB16E5B7692F77BE4573B350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Detects executables packed with Dotfuscator 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c558-18.dat	INDICATOR_EXE_Packed_Dotfuscator
behavioral2/files/0x00080000000182b1-394.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c558-18.dat	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/files/0x00080000000182b1-394.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c558-18.dat	INDICATOR_EXE_Packed_Yano
behavioral2/files/0x00080000000182b1-394.dat	INDICATOR_EXE_Packed_Yano

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCCBCABBCACCAACCABBAACCAACBABCABABCABCABCCACCABCCCACBAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCCBCABBCACCAACCABBAACCAACBABCABABCABCABCCACCABCCCACBAB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCCBCABBCACCAACCABBAACCAACBABCABABCABCABCCACCABCCCACBAB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCCBCABBCACCAACCABBAACCAACBABCABABCABCABCCACCABCCCACBAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1280	svchost_CCCBCABBCACCAACCABBAACCAACBABCABABCABCABCCACCABCCCACBAB.exe
908	svchost_CBBBBBCAACABBABACCBCACBCBCAAABCAAACABACACCBCABBCACAACAB.exe
5872	svchost_CCCBCABBCACCAACCABBAACCAACBABCABABCABCABCCACCABCCCACBAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBACBACACCCBABBABAAABBBBBBCCBCAAACAACBBCCBCAABABBBACBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCBCABBCACCAACCABBAACCAACBABCABABCABCABCCACCABCCCACBAB.exe"	2026-08-25_ac14b28820c13527f79023a341afeeed_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBAAABCCABBBBACBCCCAACCABCABBCBAABBACBBCABBBBAABCBBACCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBBBBCAACABBABACCBCACBCBCAAABCAAACABACACCBCABBCACAACAB.exe"	svchost_CCCBCABBCACCAACCABBAACCAACBABCABABCABCABCCACCABCCCACBAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2424	sc.exe
2876	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4640	cmd.exe
2088	cmd.exe
3484	cmd.exe
4424	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCBCABBCACCAACCABBAACCAACBABCABABCABCABCCACCABCCCACBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_ac14b28820c13527f79023a341afeeed_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBBBBCAACABBABACCBCACBCBCAAABCAAACABACACCBCABBCACAACAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6016	schtasks.exe
4780	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
700	2026-08-25_ac14b28820c13527f79023a341afeeed_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
700	2026-08-25_ac14b28820c13527f79023a341afeeed_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
700	2026-08-25_ac14b28820c13527f79023a341afeeed_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
700	2026-08-25_ac14b28820c13527f79023a341afeeed_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
1280	svchost_CCCBCABBCACCAACCABBAACCAACBABCABABCABCABCCACCABCCCACBAB.exe
1280	svchost_CCCBCABBCACCAACCABBAACCAACBABCABABCABCABCCACCABCCCACBAB.exe
1280	svchost_CCCBCABBCACCAACCABBAACCAACBABCABABCABCABCCACCABCCCACBAB.exe
1280	svchost_CCCBCABBCACCAACCABBAACCAACBABCABABCABCABCCACCABCCCACBAB.exe
908	svchost_CBBBBBCAACABBABACCBCACBCBCAAABCAAACABACACCBCABBCACAACAB.exe
908	svchost_CBBBBBCAACABBABACCBCACBCBCAAABCAAACABACACCBCABBCACAACAB.exe
5872	svchost_CCCBCABBCACCAACCABBAACCAACBABCABABCABCABCCACCABCCCACBAB.exe
5872	svchost_CCCBCABBCACCAACCABBAACCAACBABCABABCABCABCCACCABCCCACBAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	700	2026-08-25_ac14b28820c13527f79023a341afeeed_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	1280	svchost_CCCBCABBCACCAACCABBAACCAACBABCABABCABCABCCACCABCCCACBAB.exe
Token: SeDebugPrivilege	908	svchost_CBBBBBCAACABBABACCBCACBCBCAAABCAAACABACACCBCABBCACAACAB.exe
Token: SeDebugPrivilege	5872	svchost_CCCBCABBCACCAACCABBAACCAACBABCABABCABCABCCACCABCCCACBAB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 700 wrote to memory of 2088	700	2026-08-25_ac14b28820c13527f79023a341afeeed_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	92
PID 2088 wrote to memory of 6016	2088	cmd.exe	94
PID 1280 wrote to memory of 4564	1280	svchost_CCCBCABBCACCAACCABBAACCAACBABCABABCABCABCCACCABCCCACBAB.exe	95
PID 700 wrote to memory of 3484	700	2026-08-25_ac14b28820c13527f79023a341afeeed_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	98
PID 3484 wrote to memory of 2424	3484	cmd.exe	100
PID 700 wrote to memory of 4424	700	2026-08-25_ac14b28820c13527f79023a341afeeed_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	101
PID 4424 wrote to memory of 2876	4424	cmd.exe	103
PID 1280 wrote to memory of 4640	1280	svchost_CCCBCABBCACCAACCABBAACCAACBABCABABCABCABCCACCABCCCACBAB.exe	106
PID 4640 wrote to memory of 4780	4640	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-25_ac14b28820c13527f79023a341afeeed_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_ac14b28820c13527f79023a341afeeed_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCCCCBBABCABACACBCCCCBCABABBACCACBCABCCCACAABBBCCCAACACCABCABCCAABACABBCAAACCCBCACCBCABBCBABBAABABAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCABBCACCAACCABBAACCAACBABCABABCABCABCCACCABCCCACBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCCCCBBABCABACACBCCCCBCABABBACCACBCABCCCACAABBBCCCAACACCABCABCCAABACABBCAAACCCBCACCBCABBCBABBAABABAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCABBCACCAACCABBAACCAACBABCABABCABCABCCACCABCCCACBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCBBAABBACABBCAAAACCCABACCBBABACACACCBABACACAAABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCABBCACCAACCABBAACCAACBABCABABCABCABCCACCABCCCACBAB.exe" start= auto displayName= "UserDataSvc_ABCBBAABBACABBCAAAACCCABACCBBABACACACCBABACACAAABAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3484
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCBBAABBACABBCAAAACCCABACCBBABACACACCBABACACAAABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCABBCACCAACCABBAACCAACBABCABABCABCABCCACCABCCCACBAB.exe" start= auto displayName= "UserDataSvc_ABCBBAABBACABBCAAAACCCABACCBBABACACACCBABACACAAABAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCBBAABBACABBCAAAACCCABACCBBABACACACCBABACACAAABAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCBBAABBACABBCAAAACCCABACCBBABACACACCBABACACAAABAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2876

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCABBCACCAACCABBAACCAACBABCABABCABCABCCACCABCCCACBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCABBCACCAACCABBAACCAACBABCABABCABCABCCACCABCCCACBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBACABACCCBCBBACCACACACABAABBAABCCCBBCACBCBAACAABBBAAABCACCCABAAABAAAACABACCCACBAACABABAACBBCCBCCACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBBCAACABBABACCBCACBCBCAAABCAAACABACACCBCABBCACAACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBACABACCCBCBBACCACACACABAABBAABCCCBBCACBCBAACAABBBAAABCACCCABAAABAAAACABACCCACBAACABABAACBBCCBCCACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBBCAACABBABACCBCACBCBCAAABCAAACABACACCBCABBCACAACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4780

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBBCAACABBABACCBCACBCBCAAABCAAACABACACCBCABBCACAACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBBCAACABBABACCBCACBCBCAAABCAAACABACACCBCABBCACAACAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:908

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCABBCACCAACCABBAACCAACBABCABABCABCABCCACCABCCCACBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCABBCACCAACCABBAACCAACBABCABABCABCABCCACCABCCCACBAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 66aa9c1afb342e83b4f770145257c1b1e1aeee9572abb2022c578cef49cd8c49
MD5 d41f7a62f1a71e88b526c79a3fc62a69
SHA1 8cde4c28c384f72db6803f39b4873c76f5f278de
SHA512 e90397baf0cd4f6af7e992b966c9708d8be1e036b1781b3b870f76ca64741e4c0e93d1b1b987ef8a8f94ca33577e5c7896d6b9e5631cf0562cd17551d6352902
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 04a1ab03683a042f7407bbeb17200cbf1f5f3b4cd9bbfd3479f23d82e7011eb2
MD5 c582289a378b62368c274a33233d40ee
SHA1 81ee81e6898fc062a07f2870f3db6b31880a850c
SHA512 08e091afda2a77bf7eb851eb08915c708925dd88eda663cee9e06555b5a3050ab9e96256de2c291c5d78fd0fb547f414ebe150f6c65223ee8b9633933150832d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 cf672ae168874a5343e3c1e47486f9e6e1fbb5265ef75ae19aad0a91b8dde15b
MD5 adca86731fb03bd17221b4224a74a2d8
SHA1 cd199fd392deea7d5bd35e09e1744e7f76b045ea
SHA512 e0290498fe8cb4c2ebd31fd1ebe9489fc0fae4fb28cb5303cacaf39929ac125817079b66db276baaec48e8a21e056946ea55aa3fef604f876e7feca38fc6562c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 b1d60c67692fcd01fc443714f5b0bdba7b8d4b9a5dfa1b429939ace415377818
MD5 bed55ef823d3e43c5594e1817c3fd28c
SHA1 abd7074cce0d83367cdebf93eaa34c763c19895c
SHA512 6b718169d103c36afce1965b75b0e49a0fbc15443f70db8354bda0d6bb28f0608c7520ea3243ac724f88044c23c9d7d0512c8d5d3528ba6d88f6b1aed3ee3856
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 15.0MB
SHA256 a71ba6f22bc4933a6d2403156c219a1c4269b82c0a8c48c6339f45d2c2ae33bd
MD5 b52b820c12420b5bfcf33987458e6288
SHA1 c04177dc64f1115f54bd6e30381c375f711a89c9
SHA512 6553cccf89c56f22c8826efd2a47a7f92dec13e53218bd65ba92496424170f97093ac31df48250113520ea2de901fe0d431e5ee560ec9d1ddc46f50b03269fc5
SSDEEP 196608:m7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouHgZ2jV:mahvQHrc8u3xXJ/f4uUWHd2R
TLSH
T18AF6AE13B35681E6C06AE2B88A474212E7B9BC440334B7DB12E5B7692F77BE4573B350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 805b6bcf6cf8a3ebe1c7160f72b3c31b99421a50cb39c367ab0db367c80a3917
MD5 99424546f7d72a943b6b65b85c949193
SHA1 222f4a7d953d7145cebb61e99b370906544f5a30
SHA512 23469a6a0bfff4eecec45c505a16dc4e6067f8b73eb758b924d017cdad3f475741fb394f5408a60d44b41949794ae0b49608cc67b9475aa570ec619676c25311
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}v12.0.40660\packages\qap`g`v~dtlq
Size 10B
SHA256 3e0e11a03e79d5967100d5497440da0076a17f7e70ab5e519dd8588699a973ce
MD5 bc54246ccfc4e2865b2482b7020c2b45
SHA1 09aad71f58d02903cd644fc0faf53aca8614d362
SHA512 2f838247491ffacb3fa71840384df683a0e7fe10fe21fa8b9ea494f172dda811ed99d48f9b4559ec39a3f552516523ca5867a751a3bb03cd6218bce56c43fff6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\qap`g`v~dtlq
Size 10B
SHA256 008ff01c5fe0ee51b53df9bb461fc737b7d93899168c0c4b894f70c2924eb91b
MD5 3c8465fdbdc9de3c9bbda32f595b1b8e
SHA1 4f7c3afa3c0ea3b6b6a78eb49873f77e8792a628
SHA512 9875c10eda19f8eb5b90bf86b1d75a433d1583c8d228d37270aa4c416db8e158c0af66c669b842015219f4467f1abeb36ec0810b6cc296a6a768a95fbecc03c5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\zu-ZA\qap`g`v~dtlq
Size 10B
SHA256 27e26340d34569f9ca3459d9a3d7065736301ea0117f4baafe468258b1e80480
MD5 80426cf687afe1be51e931cfbebc92c2
SHA1 4bf81bb07b126e6ec4ed91965a5adcfc3cedb747
SHA512 ab915eb09941141ccebf7f4998546966f47140fb7eb356694c130e8137e4cd80d886b2d7fc1bcca43d48c79150d9efe1221696de367bd47f9907ebc57fe5df8d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 ca3b397a2a7eeec8af2ad6da7a77c4ec946fdc27c6b0b82cf866316356736df5
MD5 a4d5946076e85a51ef104b66dc7c5a14
SHA1 92cf55127ba28b8b937e00895f99c8e4c4c41ef3
SHA512 54c13a050fa42e80813a85fa645a80b83d7736f7ae86fa3b1d5dd98d230a0a15fa746b951e38df1eb36a1e76e0e8055bf3f8ba2821fee02ef864f528635c591c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0818be611efb12339e91d0cef5201153140ada1229268d43e4ebb2a1463ddaca
MD5 9b82ab1ffe07c6fa46271f351c1f0c5c
SHA1 9ff26201c10787851baac36ffaa22c59e990a773
SHA512 036da2c4d91f29e996161a171640ab24f9d1b4693212f79e9c6d04f5f2a99630355b1603a745a38e5fec2140cc42af6698017069e9b032ae8a9d77c146f63cae
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 77661a1079aacdaefac021c75a9fb0c139cdd0d39ec0ded8888c4fa25c1baabe
MD5 5537b7413b08a3343e92407ad28fe49a
SHA1 00b9047a94c7cd38e8162e2dac42dc62cddb109a
SHA512 61d25ac2b317e7df636f5e56ba70218ed30370f08da2f971ac4bd0e863f508e4df3746a37d78108f331529aa4d856da78b7d5db38ed921afee2e2d136b454985
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f140f28cf5a9cda7c9959156fe024a9456a0844a8c0b56cb36a3b0e2d164acd0
MD5 9c9b193918026346dc8a6830a7cdf8b4
SHA1 871958c1e6d789b7924b167369af0d1d753c8bf7
SHA512 16728b93d339c7a0c759bf81332db4d613c65601eb431754f03f0de74e754f650a83da0e58468619fbf30b39b85171b528845a1c04a95a0adcd3c781607fc568
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 18f12de2612c836ba50cc5a0d32bfb4026c0fb52b465abf8711d5d3229aa57af
MD5 3bd6f145d6925a77bae24415264c4449
SHA1 176837b6925acead273b065707549b863af21dcc
SHA512 d7063dcadca2a2ac7b3ccff6aba54216162f5e7f38f1a93c892d3d0d74a5bba437d3628fa43648e3f73e610fb761414e30904d8f86d042eb11bbf59b8321e6b0
MD5 SHA1 SHA512

Submit Download

svchost_CCCBCABBCACCAACCABBAACCAACBABCABABCABCABCCACCABCCCACBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCABBCACCAACCABBAACCAACBABCABABCABCABCCACCABCCCACBAB.exe
Size 14.5MB
SHA256 b6b158b3d777566d1b8da0d803d1d2233f8a4d66157940b71c564884380cd519
MD5 ac14b28820c13527f79023a341afeeed
SHA1 5db7318d7fbdf18da0972bf3f04e5b0db0f475f3
SHA512 11e2ec8dcafd251e6b747c23fd7ea80b1f90be3c35939dea59465e6b5ef6743c8d2b026d8ea20e94fd230fd7968cd48a24a58476188ab6e2c96af559d3f3f6a3
SSDEEP 196608:m7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouI:mahvQHrc8u3xXJ/f4uUWHx
TLSH
T141E69D13B35681E6C02AE2B88A474212E7BA7C440334B7DB16E5B7692F77BE4573B350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 f281f7bf7b447ec0a26a53f8f33c4041ff75e00d9e144055c3afd9404c1f7dad
MD5 dbc88d175951e80dadbaab27450ee679
SHA1 f5f6c6e989260d321a38943c3854df53ee5c9018
SHA512 589088218132227fef50b3eef3ef4af2e903e6a30a1be12945c01e7078b144b3e5a56665ca24a95e3ba9c119c9be6c5c800dd72571873a29d2aa5384d21113c9
TLSH
T11A212871E4F6CC23F52268CA6529EE5218B5339FDCDC5A0C530D5208B795C3ACD196E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 205fbe17ae82e633cb4cbe891695747c0827a50c5ed71081b2dd1b58046692f7
MD5 de064261ebcbafd99fbdda3771093a2f
SHA1 ec2858acf97c1f54318ffd7701871f0c79781973
SHA512 05f33960688d799247edfb1efb53749638a4da3e214580d48d2d54e0b6f024486b65e581b915993283e74355c3bfcc50a06138ff878bdbad0ab7d78d7e4656a2
TLSH
T14F113AA1A5F7CC23F93228CA66299E5218F6339FDCDC6A0C230C0119BB55C39CD596D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 052ab302cc1fdcd046ea48ad0157f1d5d004822e3da402bdf2acab73948e4dc5
MD5 86f68cacb9874bfa5f910cf008be95a9
SHA1 43c55e18898e2708a631fe1acad1746f98662470
SHA512 88b32603ca4f65cc5e071e69fe7af6acba0ac0a51220e3eaf4ce5ed83ab71efcbf1606d733ca8ecde60029b9ffb927e8e48d184cfbec6bebc6106cb9fccc26f4
TLSH
T1662126A1A5F7CC23F93228CA6629EE5218B6379FDCDC6A0C230D1118BB55C39CD596D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/700-6-0x00000000006F0000-0x0000000000711000-memory.dmp

Download

memory/908-79-0x00000000006F0000-0x0000000000711000-memory.dmp

Download

memory/1280-32-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download

memory/5872-946-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download

memory/5872-3931-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download