350cac16fab1f666c604d70d2b30506a3aab6db47082e1b8beebcaee48060c16

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_885762f5f734a68fe5c6d1d0c12dffd7_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 7.9MB
Sample260905-e4ybesen4s
SHA256 350cac16fab1f666c604d70d2b30506a3aab6db47082e1b8beebcaee48060c16
MD5 885762f5f734a68fe5c6d1d0c12dffd7
SHA1 9e6143bbde472298e95755909219672642eddb68
SHA512 de908781f53d02e01f15e123a1fdcd0cd23e48d9c0e4f93648241634fb0b304b95337b10ada903e6de96758d995517480e18d7436140f3b6ff4e703dc12108d7
SSDEEP 49152:U+En+En+En+En+En+En+En+En+En+ELG+En+En+En+En+En+En+En+En+En+ELAT:uA91pH2WpjHrgBFFu416AWv+
TLSH
T16E867AA5A1A720FCE0AFD075896BC336E6717C130232879F567CD6572F63A642D28723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_AABACBBCCBCAAAABBABABACCCABACCBCAACAABCBBCBCACCABBBABCC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_AABACBBCCBCAAAABBABABACCCABACCBCAACAABCBBCBCACCABBBABCC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2568	svchost_AABACBBCCBCAAAABBABABACCCABACCBCAACAABCBBCBCACCABBBABCC.exe
4124	svchost_AAABACBACCACCABACCCBBACACBBACCBBCACACABCCBCACCCCABCCACC.exe
4812	svchost_AABACBBCCBCAAAABBABABACCCABACCBCAACAABCBBCBCACCABBBABCC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCABCCBBCCCBBACACAABBACCBABAACCCABBCACCABACCBCABBBBBACBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABACBBCCBCAAAABBABABACCCABACCBCAACAABCBBCBCACCABBBABCC.exe"	2026-09-04_885762f5f734a68fe5c6d1d0c12dffd7_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACCABBBABCBACBAABCAABCCBBBBBACCAAAAABAACBCABACCBCCBCCACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABACBACCACCABACCCBBACACBBACCBBCACACABCCBCACCCCABCCACC.exe"	svchost_AABACBBCCBCAAAABBABABACCCABACCBCAACAABCBBCBCACCABBBABCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2332	sc.exe
4796	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2404	cmd.exe
3584	cmd.exe
4732	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_885762f5f734a68fe5c6d1d0c12dffd7_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABACBBCCBCAAAABBABABACCCABACCBCAACAABCBBCBCACCABBBABCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAABACBACCACCABACCCBBACACBBACCBBCACACABCCBCACCCCABCCACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2908	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5104	2026-09-04_885762f5f734a68fe5c6d1d0c12dffd7_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
5104	2026-09-04_885762f5f734a68fe5c6d1d0c12dffd7_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
5104	2026-09-04_885762f5f734a68fe5c6d1d0c12dffd7_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
5104	2026-09-04_885762f5f734a68fe5c6d1d0c12dffd7_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
2568	svchost_AABACBBCCBCAAAABBABABACCCABACCBCAACAABCBBCBCACCABBBABCC.exe
2568	svchost_AABACBBCCBCAAAABBABABACCCABACCBCAACAABCBBCBCACCABBBABCC.exe
2568	svchost_AABACBBCCBCAAAABBABABACCCABACCBCAACAABCBBCBCACCABBBABCC.exe
2568	svchost_AABACBBCCBCAAAABBABABACCCABACCBCAACAABCBBCBCACCABBBABCC.exe
4124	svchost_AAABACBACCACCABACCCBBACACBBACCBBCACACABCCBCACCCCABCCACC.exe
4124	svchost_AAABACBACCACCABACCCBBACACBBACCBBCACACABCCBCACCCCABCCACC.exe
4812	svchost_AABACBBCCBCAAAABBABABACCCABACCBCAACAABCBBCBCACCABBBABCC.exe
4812	svchost_AABACBBCCBCAAAABBABABACCCABACCBCAACAABCBBCBCACCABBBABCC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5104	2026-09-04_885762f5f734a68fe5c6d1d0c12dffd7_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	2568	svchost_AABACBBCCBCAAAABBABABACCCABACCBCAACAABCBBCBCACCABBBABCC.exe
Token: SeDebugPrivilege	4124	svchost_AAABACBACCACCABACCCBBACACBBACCBBCACACABCCBCACCCCABCCACC.exe
Token: SeDebugPrivilege	4812	svchost_AABACBBCCBCAAAABBABABACCCABACCBCAACAABCBBCBCACCABBBABCC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
408	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 2404	5104	2026-09-04_885762f5f734a68fe5c6d1d0c12dffd7_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	101
PID 2404 wrote to memory of 2908	2404	cmd.exe	103
PID 2568 wrote to memory of 3396	2568	svchost_AABACBBCCBCAAAABBABABACCCABACCBCAACAABCBBCBCACCABBBABCC.exe	104
PID 3396 wrote to memory of 3128	3396	notepad.exe	105
PID 5104 wrote to memory of 3584	5104	2026-09-04_885762f5f734a68fe5c6d1d0c12dffd7_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	109
PID 3584 wrote to memory of 2332	3584	cmd.exe	111
PID 5104 wrote to memory of 4732	5104	2026-09-04_885762f5f734a68fe5c6d1d0c12dffd7_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	112
PID 4732 wrote to memory of 4796	4732	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-09-04_885762f5f734a68fe5c6d1d0c12dffd7_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_885762f5f734a68fe5c6d1d0c12dffd7_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACBBBACACABACCCABABCCCCBCBABCBAABBCACBBBBABCCCBBCBCBACACBABBACCBBBCABCCABBABBBAAAAAABBBBBBAABAACBCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACBBCCBCAAAABBABABACCCABACCBCAACAABCBBCBCACCABBBABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACBBBACACABACCCABABCCCCBCBABCBAABBCACBBBBABCCCBBCBCBACACBABBACCBBBCABCCABBABBBAAAAAABBBBBBAABAACBCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACBBCCBCAAAABBABABACCCABACCBCAACAABCBBCBCACCABBBABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAAAAACACBAABBCBCCABBBACABACCACCBACCCACBBCCCCCACBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACBBCCBCAAAABBABABACCCABACCBCAACAABCBBCBCACCABBBABCC.exe" start= auto displayName= "UserDataSvc_CAAAAACACBAABBCBCCABBBACABACCACCBACCCACBBCCCCCACBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAAAAACACBAABBCBCCABBBACABACCACCBACCCACBBCCCCCACBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACBBCCBCAAAABBABABACCCABACCBCAACAABCBBCBCACCABBBABCC.exe" start= auto displayName= "UserDataSvc_CAAAAACACBAABBCBCCABBBACABACCACCBACCCACBBCCCCCACBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAAAAACACBAABBCBCCABBBACABACCACCBACCCACBBCCCCCACBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAAAAACACBAABBCBCCABBBACABACCACCBACCCACBBCCCCCACBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4796

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACBBCCBCAAAABBABABACCCABACCBCAACAABCBBCBCACCABBBABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACBBCCBCAAAABBABABACCCABACCBCAACAABCBBCBCACCABBBABCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3128

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:408

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACBACCACCABACCCBBACACBBACCBBCACACABCCBCACCCCABCCACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACBACCACCABACCCBBACACBBACCBBCACACABCCBCACCCCABCCACC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4124

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACBBCCBCAAAABBABABACCCABACCBCAACAABCBBCBCACCABBBABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACBBCCBCAAAABBABABACCCABACCBCAACAABCBBCBCACCABBBABCC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 0b1affa5c87d1796b5dd603165dd20d6b936bd283f1d4a7f5d1fe9e4f8874c3e
MD5 300ff89f48512b799276e17ac4aed0d7
SHA1 9d7161a05ab63680ae724e2d2c6e3d2a01e60933
SHA512 db8f2a20ef2a8ab2ce55ce61c81cdf3b545ab6cfdee63030d43d22311aabfff7bf91b10a24d586dd6684e81ff996ff2b2c8e01126c9b506d4363820e5305dcae
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 8.4MB
SHA256 c5bca29dcbfe536d4e157250c1fea9fd90d873213b6f6d54ca8eb7a067acd82c
MD5 d3b058529d6190b75ccdafb6841d74c3
SHA1 3d5a32ee35afdbc7cc7c90388be9f598082d41b9
SHA512 b80bf9c9dde650fe30e63d7e20b23d6c9288768fed01a16f176b31832b308c2a9831449980b3a26e5f79a40a425b27b008e63fbff598c2fb64d50442ef44ef15
SSDEEP 49152:U+En+En+En+En+En+En+En+En+En+ELG+En+En+En+En+En+En+En+En+En+ELAl:uA91pH2WpjHrgBFFu416AWvppiz
TLSH
T1B9967B65B2A720FCE0AFD175897AC332E6717C130132874F56BCD65A2F63A646D28723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_10.0.19041.1023_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 e517090ead3af3428d182f441b419926d3947ff2a9d56d6049e0689f61262135
MD5 38041343b6ed1d57c94c6c300a8065c5
SHA1 761e9aec4633d1921e326878c5904e9857a4fca0
SHA512 11c021543639b5ffce5cd6db50cee516e6b29932142e39f243948794f3c3c1ff4dcabc03bdf33c94aa339f514e6dada1961e27e057a8e49ff06a7dd55d805d0e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.AssignedAccessLockApp_1000.19041.1023.0_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 542ad026252eb17327d164b0faa6b9024960f14371ad1795870c3aefbe52edd0
MD5 c23f42721417a7eab6cd9c3cd0fbf8f5
SHA1 5c385ec94b76a91c43aa8ea0185ac6ea9f39707b
SHA512 fa5b304a3d4948ac21bd4006ab161e7d9e7c9c3d1daf3b27e44ff47e4650b906d4f4a7b3786d0b09a36a2bf789defad3d28ba22bae4d466a3d6350f622ac8caf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tracking Protection\qap`g`v~dtlq
Size 10B
SHA256 7ab54cdb2d771b5172df9d76cea7ed9566fd80dccfe35e5c1f68aea7d8450f83
MD5 fc2fa8f1feec47dfc11787edba369511
SHA1 ab3af76eae12641b91be4868c4dcdace268f9e33
SHA512 a6f4b981c636c9c0372c48a679d962123b964cf7132968889853d3428b9e07a5b506e7c8573425ce8302e94edbe75a0c0811585ca81127f0f870858390bfdbcf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.NET.Native.Framework.1.7_8wekyb3d8bbwe\AC\qap`g`v~dtlq
Size 10B
SHA256 1743363a25ce453ba8310e6e3500e4fade31dcfbcd62e0fceeeb1ec3ab59b3d6
MD5 4a6cfa66061ee2a1b4d65ed242e0c8d7
SHA1 5eabc584a7cd551828009f56ddf8fb71f3d346d3
SHA512 0add12d152ef6ad92f743216601bf148b0dc7c91738ad06c97e645e3b1538d0165014ca446f176d3d712c371e2ca50c9c72830259fc3a28ec10ecff6d43fe848
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 aa2ffbc2f0fb42972070f4b829e7bf4394adfa728e78e42dc2a1969f5888e212
MD5 ca07a2a0036a1aa4dd26e56e106964d8
SHA1 fb1e8f72a9a3f57cbf2892f1abe5c685e46d1e7e
SHA512 02c749ac48ccf8929fe380204c3154b86484da11883f7f8fe6465ed2a7c5fb6ce4f0d4c7d2777b9b966885dd23106c89c0131a3e2510d4195aa1dcfa1c19a436
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 25565fefc8a93728f5a9911f6038ab9c51eb052a0c23b2aa82e5ddfcd53243c9
MD5 444364acee9cbf4ca0c81c77aa4cc8cd
SHA1 7f2d5fa905e6c272240c581fd513d07fd31edd5f
SHA512 91e125814109cb4b506cb2149ea335615cef39c4c80e0cbca3c423a10871c873bd5ec1a4161825b9c7a97fb9eba6486b3997a29b8b5a74366a180e193f2fd3e5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fc20970165ac961bd2fae8b62b12842aa148f8c6eebab0e3bd45cafead3f6d88
MD5 ddaeb818eb7d76156ef6a65e2b694eac
SHA1 89bfd64a51b6ea5b1995cbcc7d8d49e20cd572e7
SHA512 b9e45bf5fd4a44507556b5a193a2cdea49ecc72a7f6108ff86e5b8def22119c76fa8928a3883e0fd9cbedd30b266c1cfa5ce5238cb328e30ebae1d9bcaf5dc92
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 26e7d17a9214141d66fad2dd4d9f749acf148238aef263db68b9f9e84fefdc6c
MD5 559a233ffb064da31d9257d461b265f4
SHA1 9e0fb28028206fb9fbc0d2b0c47e3420c27aec85
SHA512 a761efc026b31ea5089c8cb521805456f60edb6454111ece13ec218984c7a3cbd7556a349f8126b5d3350ad30c93a6bfd9bdaf346f0d7ed2d89dce2357474313
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ac34c13efe2fa3332359e433e2a34abbb90c65f0286b21c05616cf3fd339b7eb
MD5 ce8c005583d41f5f9b52db1b3897f896
SHA1 3d5650e96c101578fdc09e73b6c94dfb7a73061e
SHA512 9f8985483169e0400383023e768837030d4bc948ecbaaf59eff247526b27a286e00987bd9efd7966f5de8705109ba0066980dfaa3788e85744cfef087fc4bf61
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 32d3abd8f71b0336d5269302dc0fd114f2aa5fe4b08d8371878e058cebc8ebbb
MD5 ef9a3c81dfb3caa1cbcbfefa121e7861
SHA1 7aed9ee577ac7286730cc03d847ce2ce63eee30d
SHA512 bcdaf2c49c0928a728fd5ab7e105c0004b56edaf2046b9085dcffbab72fcd57096b2865da7cefb188bb90d98d02b70d2128aaeed656c7035ac942ee652e0cb72
MD5 SHA1 SHA512

Submit Download

svchost_AABACBBCCBCAAAABBABABACCCABACCBCAACAABCBBCBCACCABBBABCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACBBCCBCAAAABBABABACCCABACCBCAACAABCBBCBCACCABBBABCC.exe
Size 7.9MB
SHA256 350cac16fab1f666c604d70d2b30506a3aab6db47082e1b8beebcaee48060c16
MD5 885762f5f734a68fe5c6d1d0c12dffd7
SHA1 9e6143bbde472298e95755909219672642eddb68
SHA512 de908781f53d02e01f15e123a1fdcd0cd23e48d9c0e4f93648241634fb0b304b95337b10ada903e6de96758d995517480e18d7436140f3b6ff4e703dc12108d7
SSDEEP 49152:U+En+En+En+En+En+En+En+En+En+ELG+En+En+En+En+En+En+En+En+En+ELAT:uA91pH2WpjHrgBFFu416AWv+
TLSH
T16E867AA5A1A720FCE0AFD075896BC336E6717C130232879F567CD6572F63A642D28723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 0b5f3a4e5716391afb1193dd52b97c854afb769f850f02484bd07c6fecff89f3
MD5 630d3dee5842d86110d8c7f4037fd741
SHA1 f715123e863a96d40ee1204fbb1f322ffe482578
SHA512 f8d6534f4fbe0c8029b0218009aca012e98d4d05cf77232a2440a7477a01d55239ba5e6e2c4fc5b3dd78c165ee97431f85d8aec3cb25b27007d0452b4840fb64
TLSH
T160110135E4A59833E22124CF453ACF5708A13B6FFC98EB40230882083B25C36DE658D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 d6be5c447d5362b396e296e14a692864ae7aebd92e4888bf7b85ffceae2402b0
MD5 9784f7480f0d90a378e92e2f79c61921
SHA1 8c6209b0600bdcc9a058efbcf314f18e85629538
SHA512 e2bd76e9b3bc49f9150fddfae1356959dd1ae2ef302b303515855c1c99a35267b8a86a465e4e89b75d355824648b943a86d4e0bd341b9507e7b348f2509a7e11
TLSH
T1FE21DE79E4A58C33E23164CF967ADF9708A13B6FEC58EB40230842183729C36DE658D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2568-36-0x00000000009F0000-0x0000000000A11000-memory.dmp

Download

memory/2568-25-0x00000000009F0000-0x0000000000A11000-memory.dmp

Download

memory/3396-57-0x00000000058F0000-0x00000000058F1000-memory.dmp

Download

memory/4124-77-0x00000000006F0000-0x0000000000711000-memory.dmp

Download

memory/4124-2669-0x00000000006F0000-0x0000000000711000-memory.dmp

Download

memory/4812-1267-0x00000000009F0000-0x0000000000A11000-memory.dmp

Download

memory/5104-6-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download