d5803758bc67ad4641ca3b06dfac86c9ab694e4ee427bfd9083919cb0f156602

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 15:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_68ac52b3911bdec835fea427bd9a2264_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 14.5MB
Sample260827-tddxesxelf
SHA256 d5803758bc67ad4641ca3b06dfac86c9ab694e4ee427bfd9083919cb0f156602
MD5 68ac52b3911bdec835fea427bd9a2264
SHA1 b505933a03e65fd0e9243c1937186967bcb4ce57
SHA512 fddabaaf989d1cd87479c3472ed1cad3056e1f4e83522a8cda71e7d4e708b537233279925944bb26c3da9dcfdf1d7fe660617dc61e98e7313aef96e33bae348b
SSDEEP 196608:B7APhNNECwHrc8u3x3AEcq/fByuKlWH3CToun:BahvQHrc8u3xXJ/f4uUWH+
TLSH
T137E69D13B35681E6C02AE2B88A474212E7BA7C440334B7DB16E5B7692F77BE4573B350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Detects executables packed with Dotfuscator 2 IoCs

resource	yara_rule
behavioral2/files/0x000f00000001bc19-19.dat	INDICATOR_EXE_Packed_Dotfuscator
behavioral2/files/0x000c00000001c534-26.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 2 IoCs

resource	yara_rule
behavioral2/files/0x000f00000001bc19-19.dat	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/files/0x000c00000001c534-26.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 2 IoCs

resource	yara_rule
behavioral2/files/0x000f00000001bc19-19.dat	INDICATOR_EXE_Packed_Yano
behavioral2/files/0x000c00000001c534-26.dat	INDICATOR_EXE_Packed_Yano

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBCCCBBBCBABACCAAAACCCBBACACAAACAABACBBBBACCBBAABCCACBC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBCCCBBBCBABACCAAAACCCBBACACAAACAABACBBBBACCBBAABCCACBC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5072	svchost_BBCCCBBBCBABACCAAAACCCBBACACAAACAABACBBBBACCBBAABCCACBC.exe
5216	svchost_AABACCBCCABABCCCABCBACCCBACBCBBCCCABCCCCCBAACAACACCCCAB.exe
5264	svchost_BBCCCBBBCBABACCAAAACCCBBACACAAACAABACBBBBACCBBAABCCACBC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBACAAAAABBACBBAACACAAABBACCAAAABCCACBBCCBAABBCCABCBACBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCCCBBBCBABACCAAAACCCBBACACAAACAABACBBBBACCBBAABCCACBC.exe"	2026-08-27_68ac52b3911bdec835fea427bd9a2264_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBCCCAAACCBBCBBACCCCACAABCCBBAACBACACBBCCCCCABCBBBCACCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABACCBCCABABCCCABCBACCCBACBCBBCCCABCCCCCBAACAACACCCCAB.exe"	svchost_BBCCCBBBCBABACCAAAACCCBBACACAAACAABACBBBBACCBBAABCCACBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2904	sc.exe
5672	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4940	cmd.exe
4324	cmd.exe
1348	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_68ac52b3911bdec835fea427bd9a2264_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCCCBBBCBABACCAAAACCCBBACACAAACAABACBBBBACCBBAABCCACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABACCBCCABABCCCABCBACCCBACBCBBCCCABCCCCCBAACAACACCCCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6048	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5992	2026-08-27_68ac52b3911bdec835fea427bd9a2264_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
5992	2026-08-27_68ac52b3911bdec835fea427bd9a2264_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
5992	2026-08-27_68ac52b3911bdec835fea427bd9a2264_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
5992	2026-08-27_68ac52b3911bdec835fea427bd9a2264_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
5072	svchost_BBCCCBBBCBABACCAAAACCCBBACACAAACAABACBBBBACCBBAABCCACBC.exe
5072	svchost_BBCCCBBBCBABACCAAAACCCBBACACAAACAABACBBBBACCBBAABCCACBC.exe
5072	svchost_BBCCCBBBCBABACCAAAACCCBBACACAAACAABACBBBBACCBBAABCCACBC.exe
5072	svchost_BBCCCBBBCBABACCAAAACCCBBACACAAACAABACBBBBACCBBAABCCACBC.exe
5264	svchost_BBCCCBBBCBABACCAAAACCCBBACACAAACAABACBBBBACCBBAABCCACBC.exe
5264	svchost_BBCCCBBBCBABACCAAAACCCBBACACAAACAABACBBBBACCBBAABCCACBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5992	2026-08-27_68ac52b3911bdec835fea427bd9a2264_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	5072	svchost_BBCCCBBBCBABACCAAAACCCBBACACAAACAABACBBBBACCBBAABCCACBC.exe
Token: SeDebugPrivilege	5264	svchost_BBCCCBBBCBABACCAAAACCCBBACACAAACAABACBBBBACCBBAABCCACBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5992 wrote to memory of 4940	5992	2026-08-27_68ac52b3911bdec835fea427bd9a2264_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	92
PID 4940 wrote to memory of 6048	4940	cmd.exe	94
PID 5072 wrote to memory of 1148	5072	svchost_BBCCCBBBCBABACCAAAACCCBBACACAAACAABACBBBBACCBBAABCCACBC.exe	95
PID 5992 wrote to memory of 4324	5992	2026-08-27_68ac52b3911bdec835fea427bd9a2264_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	98
PID 4324 wrote to memory of 2904	4324	cmd.exe	100
PID 5992 wrote to memory of 1348	5992	2026-08-27_68ac52b3911bdec835fea427bd9a2264_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	101
PID 1348 wrote to memory of 5672	1348	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-27_68ac52b3911bdec835fea427bd9a2264_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_68ac52b3911bdec835fea427bd9a2264_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCAABBCBBACAACBBBBABBCBBABCBCACCBCACCCCABABCABACBACACBACCACBCACCBCBBBCBAACBACCACACAACBABBCBCCAABACAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBBBCBABACCAAAACCCBBACACAAACAABACBBBBACCBBAABCCACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCAABBCBBACAACBBBBABBCBBABCBCACCBCACCCCABABCABACBACACBACCACBCACCBCBBBCBAACBACCACACAACBABBCBCCAABACAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBBBCBABACCAAAACCCBBACACAAACAABACBBBBACCBBAABCCACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCBAABAABBABCAABACACCBBABBBCBAACBBCBAABACCAABBBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBBBCBABACCAAAACCCBBACACAAACAABACBBBBACCBBAABCCACBC.exe" start= auto displayName= "UserDataSvc_BCCBAABAABBABCAABACACCBBABBBCBAACBBCBAABACCAABBBAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCBAABAABBABCAABACACCBBABBBCBAACBBCBAABACCAABBBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBBBCBABACCAAAACCCBBACACAAACAABACBBBBACCBBAABCCACBC.exe" start= auto displayName= "UserDataSvc_BCCBAABAABBABCAABACACCBBABBBCBAACBBCBAABACCAABBBAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCBAABAABBABCAABACACCBBABBBCBAACBBCBAABACCAABBBAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCBAABAABBABCAABACACCBBABBBCBAACBBCBAABACCAABBBAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5672

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBBBCBABACCAAAACCCBBACACAAACAABACBBBBACCBBAABCCACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBBBCBABACCAAAACCCBBACACAAACAABACBBBBACCBBAABCCACBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1148

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCBCCABABCCCABCBACCCBACBCBBCCCABCCCCCBAACAACACCCCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCBCCABABCCCABCBACCCBACBCBBCCCABCCCCCBAACAACACCCCAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5216

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBBBCBABACCAAAACCCBBACACAAACAABACBBBBACCBBAABCCACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBBBCBABACCAAAACCCBBACACAAACAABACBBBBACCBBAABCCACBC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 db8a69ca35977d2af0d0c18cbe79211e5f7deee83de6da59409b5d635a7b7b34
MD5 83c2ef642f727277094331419e8bd699
SHA1 3f7a7e3a15b8d8f17b5f51bc385c67760a729217
SHA512 64ffaeb6f3d60b62e39060227f96a8ff2cca721ca29596ae2e15e0e889eca4112d79101705cadbe1e90a6573e7160f064c0270369f7d957ee7e7921502fa736b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 f640bc02d6aa2ad1e759ac4d43f6f9041d6db4bd110bdd189821a72c4258de83
MD5 b48fd245e201f668efcc3b2438370687
SHA1 dbce686fa1979ddeff08cbdf1ae36ecf738a0086
SHA512 0e379d70f7bfec0d658e751fb3ed6887db082d56f6bd5152bc761a1fa4b23bfb545dad0f92f278b5816091d31228d26cdc7d25167fe8e9cc6be8c05c93b548b7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 924ec85dc5f4915f0a1e60d85d30b991bd16a0f8fbdb74ef0af42d77f72cad91
MD5 7054dea39f0d77b4f77bc1452603726e
SHA1 9c886f7bf68f83c03e4c6c478219791312bc171c
SHA512 0b31b45c249dd52fa2edb52196554dda14551156383c8b6c7613aa0f0d7305102807b63a2306dc3e19ca106a8fa0b74539a61aefb978ba73616a5bf5dd633e3d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 19dbe10546ccb01261ecc99d9e1bb71c20ceda0fef0cbc54d8de6bf7348a8178
MD5 f3678feff621e8972a2b48ad87b749c4
SHA1 e6ecc8b7870369bcb2a3ef4c09c6e098dced948d
SHA512 93cf04b19c5566a53048b2c5214bc8f48d30d5e73f999d39ad07c418c7e2ffb911455fff5ce986b2fa018f565a651e0882da4cc39c745856bfbd48d4318e04c9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\qap`g`v~dtlq
Size 10B
SHA256 11bfa1e334f864427410af6f685a1d851133557a65c30720aa3473dadce1d6be
MD5 6dc3b7fcbca6ff8bf8babf64cca36608
SHA1 d445ed962c684b0055eb1d1408d7468a12f119c4
SHA512 6e480ea21e15ee99f5cb5228b230609f2756baa55ba95f7af3d53c093812cf7997772bc8dbcb84810c1102cddbdc33c9cc671de71ba09711e0379e6f3224590d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 61318584372e28fd79dc97141f537af1d39ea551f445de55d325f7bae200bd6f
MD5 b717e2acc5ff8d8f5aec5541587e4ba7
SHA1 ab7e7a534e0ee0b6896f03af2d1e1fa42265e2e3
SHA512 b3d9d917d8bb7a09679d3c464c5662c8dec3a09954f279eb217777429c35af776867704413c7420fa253fa8a54ce9d51bc0fac6c807e4527923b0129f7d3f532
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9d6074ce00162efe20ca2829f389c558f342810ec8187ac526fb17565b5ec48a
MD5 a38686263603a06e3607e297b7b984a3
SHA1 cb18073defd103ba0e1f7c9402edb005e8451101
SHA512 c3c55907de1dacfdf73b7d9b86e9eeecb3b87a3a542446991dd65dc6ef9999ab4428fbfed938b3b912d01c9b3314764d27949c445b8704f4ed04202dc9e1bd48
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bf22c304e1ff1fdf02a425eadad7a5391ecaf5a43642cc97e58e376ba1bf961e
MD5 40088c835ae173b803097ab240e69a95
SHA1 044ad8e0145d1d2876aec2d8c957f36526ebe10e
SHA512 e40982c5e721b38e8760e1223f11f59a8d3e656ed522fdb4a1cbcb7fae15612d5785121fced354b9360302cc0027653a7ba0b46f6fe073d476c1c517e990d2c7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c9463f4dca40a1e312aa43d13c6f0a4e422b7b7bc5282f65c63af395b1ccc9a0
MD5 5ef41e11c880b5104888c299309659bf
SHA1 385b11c78f8954a17c6022b3b1a1b4607da38185
SHA512 f4e39b6386a9973218287576d81737d25d408dbfd5a8e0a92e016b3798b17d084003a86fc917ccb41eb789d09411c339b552709f8ba487fcf1c710e0bff02410
MD5 SHA1 SHA512

Submit Download

ExitWatch.exe

Path C:\Users\Admin\Downloads\ExitWatch.exe
Size 43.9MB
SHA256 3e9a66a1737d36338c18271317755744743cc1daf88400bbaafc71b00f75a9d0
MD5 8d7165b9618a9c166c95824df83bfeb6
SHA1 899a334d8dd5cf30c77851ab25a5d6a7514038a5
SHA512 23bbe75521e7c57603be5efc00f2e3f5ffbdf9fc390ea7da7c4752096437b79a45f36544222f6a90f86f6a14342cfc4059ae8f7ba8e86bb4b75493e262ca4d3a
SSDEEP 786432:avQHrK5/f4uUEvQHrK5/f4uUEvQHrK5/f4uUuf:avQHW2SvQHW2SvQHW2Yf
TLSH
T142A79D13B35681E6C02AE2B88A474212E7BA7C440334B7DB16E5B7692F77BE4573B350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExitWatch.exe

Path C:\Users\Admin\Downloads\ExitWatch.exe
Size 960KB
SHA256 fd9b3a5fbebe007076ba9bb7e996a509ef80ce5ca85d94977c4e55d4848ac07d
MD5 a26d5404c9a627fd68709d9da5c33d3d
SHA1 f37d288debdf5d209f58ae4d9c0b87317ec4a070
SHA512 fc849c1ec866c3e02f543bac99bf13ad94f8d045ed8d3c07236072b5149008a9a8f0204d8b3fca8ffe41aa04b1c54bd1ff84d64ba841ef07c0aabeef7b15e6fd
SSDEEP 12288:mgUFgEsnojAKgUFK1yt2TLNKPD3SDnPrlwqn6DVvU7yzdfeaQmAn4zx12f+K3D:m9+EM0v9lM5e0nPhwvU7Yfeszj2f+K3D
TLSH
T1B1256B07E29610E9E05DC1BD8B47923AE9B2B4850B36B5EF47508B622F27FE05B3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 abf6e79347bb4d721055de805fbe11de280a0fd8b6b48e001830749e9edd5724
MD5 3cc67705a5328bbe52d29ad51c93b1ee
SHA1 31a7d92d8aeb5a58efbf2e90419e99268245dbf7
SHA512 8b7ec582646809d407f1cf05c48186c963decff5af6a4e482cf6b3ee75ce9bf723475e5e62a2f74271db8ab1ff0b9560c4a78d29e5c676a0383d1b55fe3131e8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Music\qap`g`v~dtlq
Size 10B
SHA256 ed195b709c633093b52fdbf3e9436f14ae7c9b898c35b2a6fc57f07d0bb51a5b
MD5 8e9af3a80ebe306194f4eed9f1f5d9f0
SHA1 8362edace89023fea3a0ba305816def203f9b369
SHA512 036100dbfb45d890d3bd770f98586a65696a59f7364748efda9fd0d49fa50590d499ac0aad4591b97a66c56facf64d53446b301732ec503cee8070ffb9cd1bfa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\qap`g`v~dtlq
Size 10B
SHA256 4d1d56c16a41955c6815e3f045f0d5f4a7d425e3f367f51a5fdee0a16ea73e00
MD5 3df1dcdd2155061f49a31f75ef246805
SHA1 467fc4ca50dd176e44dea40e3a9f0128cf08a86e
SHA512 0e39224b49228957184a7519c5e7331b23257f2a429206de9cb3303586e0c007c62e53129d4a768cd6087bf76144fe3a9986c0bc41c5f41c86a96aea31ec8b54
MD5 SHA1 SHA512

Submit Download

svchost_BBCCCBBBCBABACCAAAACCCBBACACAAACAABACBBBBACCBBAABCCACBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBBBCBABACCAAAACCCBBACACAAACAABACBBBBACCBBAABCCACBC.exe
Size 14.5MB
SHA256 d5803758bc67ad4641ca3b06dfac86c9ab694e4ee427bfd9083919cb0f156602
MD5 68ac52b3911bdec835fea427bd9a2264
SHA1 b505933a03e65fd0e9243c1937186967bcb4ce57
SHA512 fddabaaf989d1cd87479c3472ed1cad3056e1f4e83522a8cda71e7d4e708b537233279925944bb26c3da9dcfdf1d7fe660617dc61e98e7313aef96e33bae348b
SSDEEP 196608:B7APhNNECwHrc8u3x3AEcq/fByuKlWH3CToun:BahvQHrc8u3xXJ/f4uUWH+
TLSH
T137E69D13B35681E6C02AE2B88A474212E7BA7C440334B7DB16E5B7692F77BE4573B350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 ad79f47025f4e8ebbf206b185cc4a4db01ed9c04da9f5dbeedee1a9511310adc
MD5 1d64f56478ce14e211ddad61af84e96c
SHA1 ad991b24608877b2703279d4fe1252c17954a7ce
SHA512 008f08dbff7141a75dd879baae7197fdc12b5b9491c9f1bf3f2c7e0a7197ca4825c50919bedc865b83ab633ba8e281ddab0193698bc3d484c5bab8f34bb55f2f
TLSH
T13111C870D0F6DC6BFA3328CF4139DA422CA4379F59987A5813089118776EC318D964D6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5072-45-0x0000000000970000-0x0000000000991000-memory.dmp

Download

memory/5072-83-0x0000000000970000-0x0000000000991000-memory.dmp

Download

memory/5216-80-0x0000000000470000-0x0000000000491000-memory.dmp

Download

memory/5264-1494-0x0000000000970000-0x0000000000991000-memory.dmp

Download

memory/5992-64-0x0000000000440000-0x0000000000461000-memory.dmp

Download

memory/5992-0-0x0000000000440000-0x0000000000461000-memory.dmp

Download

memory/5992-84-0x0000000000440000-0x0000000000461000-memory.dmp

Download

memory/5992-22-0x0000000000440000-0x0000000000461000-memory.dmp

Download

memory/5992-11-0x0000000000440000-0x0000000000461000-memory.dmp

Download