f03523c09685eb7975ba1593bebeb5894a874699a6c006d64dcd3b55e6d58ec9

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 04:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_8bed12af9272446cbd570ed5e9462432_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 9.3MB
Sample260905-eqa9qss1g1
SHA256 f03523c09685eb7975ba1593bebeb5894a874699a6c006d64dcd3b55e6d58ec9
MD5 8bed12af9272446cbd570ed5e9462432
SHA1 449c2cb824edeb18bc81d6838fd972a75bf31509
SHA512 c4fb67746344fb7261b0eab13863486bb8f64a5fac2d72132ce491f457901cfa4e4fbc0314f8434307d4f15486550370904acc4f49e3d6faaee4d5686d89a668
SSDEEP 49152:U+EkqaqQN+EkqaqQ/+ES+ELEj+Et+EkqaqQ/+ES+ELEj+Et+EkqaqQ/+ES+ELEjC:fA91pH2WpjHrgBFFu416AWvc
TLSH
T161A65A51B6AB60ECE0BFD174897AC332E6717C134631874F22BCE65A2E736546D28723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBACBACBCBABBCBCBABABBABBCCCBACAAAABCBBCCAACCCBABABACBC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBACBACBCBABBCBCBABABBABBCCCBACAAAABCBBCCAACCCBABABACBC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4064	svchost_CBACBACBCBABBCBCBABABBABBCCCBACAAAABCBBCCAACCCBABABACBC.exe
2520	svchost_ACACCBCBBACABCACAABCCCCCAABCCABBCCACBABCCCCACACCBCACCAC.exe
4904	svchost_CBACBACBCBABBCBCBABABBABBCCCBACAAAABCBBCCAACCCBABABACBC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBCBABCABAAAABCBBCCACCABCCBCBAACCBBACBCCABACACCBBCBACBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBACBACBCBABBCBCBABABBABBCCCBACAAAABCBBCCAACCCBABABACBC.exe"	2026-09-04_8bed12af9272446cbd570ed5e9462432_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACCCBCABBCCBACBBBCCBBAABCBCABCACBACBBCABCBABCCBBCCABAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACACCBCBBACABCACAABCCCCCAABCCABBCCACBABCCCCACACCBCACCAC.exe"	svchost_CBACBACBCBABBCBCBABABBABBCCCBACAAAABCBBCCAACCCBABABACBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3956	sc.exe
2940	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1768	cmd.exe
4704	cmd.exe
3436	cmd.exe
1648	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_8bed12af9272446cbd570ed5e9462432_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBACBACBCBABBCBCBABABBABBCCCBACAAAABCBBCCAACCCBABABACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACACCBCBBACABCACAABCCCCCAABCCABBCCACBABCCCCACACCBCACCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2012	schtasks.exe
1280	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2332	2026-09-04_8bed12af9272446cbd570ed5e9462432_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
2332	2026-09-04_8bed12af9272446cbd570ed5e9462432_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
2332	2026-09-04_8bed12af9272446cbd570ed5e9462432_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
2332	2026-09-04_8bed12af9272446cbd570ed5e9462432_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4064	svchost_CBACBACBCBABBCBCBABABBABBCCCBACAAAABCBBCCAACCCBABABACBC.exe
4064	svchost_CBACBACBCBABBCBCBABABBABBCCCBACAAAABCBBCCAACCCBABABACBC.exe
4064	svchost_CBACBACBCBABBCBCBABABBABBCCCBACAAAABCBBCCAACCCBABABACBC.exe
4064	svchost_CBACBACBCBABBCBCBABABBABBCCCBACAAAABCBBCCAACCCBABABACBC.exe
2520	svchost_ACACCBCBBACABCACAABCCCCCAABCCABBCCACBABCCCCACACCBCACCAC.exe
2520	svchost_ACACCBCBBACABCACAABCCCCCAABCCABBCCACBABCCCCACACCBCACCAC.exe
4904	svchost_CBACBACBCBABBCBCBABABBABBCCCBACAAAABCBBCCAACCCBABABACBC.exe
4904	svchost_CBACBACBCBABBCBCBABABBABBCCCBACAAAABCBBCCAACCCBABABACBC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2332	2026-09-04_8bed12af9272446cbd570ed5e9462432_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4064	svchost_CBACBACBCBABBCBCBABABBABBCCCBACAAAABCBBCCAACCCBABABACBC.exe
Token: SeDebugPrivilege	2520	svchost_ACACCBCBBACABCACAABCCCCCAABCCABBCCACBABCCCCACACCBCACCAC.exe
Token: SeDebugPrivilege	4904	svchost_CBACBACBCBABBCBCBABABBABBCCCBACAAAABCBBCCAACCCBABABACBC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1360	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 1768	2332	2026-09-04_8bed12af9272446cbd570ed5e9462432_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	96
PID 1768 wrote to memory of 2012	1768	cmd.exe	98
PID 4064 wrote to memory of 4604	4064	svchost_CBACBACBCBABBCBCBABABBABBCCCBACAAAABCBBCCAACCCBABABACBC.exe	99
PID 4604 wrote to memory of 1092	4604	notepad.exe	100
PID 2332 wrote to memory of 4704	2332	2026-09-04_8bed12af9272446cbd570ed5e9462432_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	104
PID 4704 wrote to memory of 2940	4704	cmd.exe	106
PID 2332 wrote to memory of 3436	2332	2026-09-04_8bed12af9272446cbd570ed5e9462432_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	107
PID 3436 wrote to memory of 3956	3436	cmd.exe	109
PID 4064 wrote to memory of 1648	4064	svchost_CBACBACBCBABBCBCBABABBABBCCCBACAAAABCBBCCAACCCBABABACBC.exe	112
PID 1648 wrote to memory of 1280	1648	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-09-04_8bed12af9272446cbd570ed5e9462432_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_8bed12af9272446cbd570ed5e9462432_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBBACCBCACCBBABABCBCBABCCCACCCCBBBBBAAACABCBABABCBCABCCCCBCCBCBACCAACBABCCBAACBACACCBABABCBCCBCACBBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBACBCBABBCBCBABABBABBCCCBACAAAABCBBCCAACCCBABABACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBBACCBCACCBBABABCBCBABCCCACCCCBBBBBAAACABCBABABCBCABCCCCBCCBCBACCAACBABCCBAACBACACCBABABCBCCBCACBBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBACBCBABBCBCBABABBABBCCCBACAAAABCBBCCAACCCBABABACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCBBACABCCCAABBBCCABBCACCBABBAAAAABACAABABCCCACBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBACBCBABBCBCBABABBABBCCCBACAAAABCBBCCAACCCBABABACBC.exe" start= auto displayName= "UserDataSvc_ACCBBACABCCCAABBBCCABBCACCBABBAAAAABACAABABCCCACBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCBBACABCCCAABBBCCABBCACCBABBAAAAABACAABABCCCACBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBACBCBABBCBCBABABBABBCCCBACAAAABCBBCCAACCCBABABACBC.exe" start= auto displayName= "UserDataSvc_ACCBBACABCCCAABBBCCABBCACCBABBAAAAABACAABABCCCACBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCBBACABCCCAABBBCCABBCACCBABBAAAAABACAABABCCCACBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCBBACABCCCAABBBCCABBCACCBABBAAAAABACAABABCCCACBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3956

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBACBCBABBCBCBABABBABBCCCBACAAAABCBBCCAACCCBABABACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBACBCBABBCBCBABABBABBCCCBACAAAABCBBCCAACCCBABABACBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBCBBBBCCAAAABBCABAAAABACBACCCABBAACBBBCCBABACAACBABBAAACCABBCAAABCBAACABCBCCBBABACBABABABBBBBCACAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBCBBACABCACAABCCCCCAABCCABBCCACBABCCCCACACCBCACCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBCBBBBCCAAAABBCABAAAABACBACCCABBAACBBBCCBABACAACBABBAAACCABBCAAABCBAACABCBCCBBABACBABABABBBBBCACAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBCBBACABCACAABCCCCCAABCCABBCCACBABCCCCACACCBCACCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1280

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1360

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBCBBACABCACAABCCCCCAABCCABBCCACBABCCCCACACCBCACCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBCBBACABCACAABCCCCCAABCCABBCCACBABCCCCACACCBCACCAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2520

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBACBCBABBCBCBABABBABBCCCBACAAAABCBBCCAACCCBABABACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBACBCBABBCBCBABABBABBCCCBACAAAABCBBCCAACCCBABABACBC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 09d9150ac1683b5ee3b1e23880b7e2c4ab0eadbdd62dab73f63de0dd3b7211d8
MD5 f50f718f116e48cd0fdbfb0aac177ffd
SHA1 2512545f78e58a63485033f25a81c4eb7fc9c493
SHA512 cb5e47726ee24d59b968887917aba3bcb026847bfae2a98d5c7ebc6b89dac80d22932177efd586ec22e3d755e08b44f728cad1f1b0bb1bed6022ddf9ea3c91ec
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\qap`g`v~dtlq
Size 10B
SHA256 a3ebdda84c89496f5624486c188069dc700d4dfb274499f4a1fe9f21152f0d5c
MD5 7bf08d8f75961a493a72c1ca91b33c53
SHA1 7465709158aa2c47c376c4c2685784de51a72dbe
SHA512 3080a768a37d274d2596d1482171d22a81d73e7c03684ba3b93c2cbf2615add7a8512a766d21db845463a44763fd56e3f5ff268a167c12d20abd426e9c42064f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\TempState\qap`g`v~dtlq
Size 10B
SHA256 04bfad2c58e09eeb09a421683ebda51a3af9f4e0e44a7c8dfa590765a17dad0e
MD5 4d19683c32e45b059a6dc0030aaf6f8d
SHA1 ffdfebf142063708bc7e15f7129090129b31ecfc
SHA512 18a735517153d4154ee59dcdfc77b5f621ac66062261dcd7184415b9703b10abafd9cfd1828ad9f7b687a58410896909c9598c9a2e522656bbd44998d09c8e38
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\AC\INetHistory\qap`g`v~dtlq
Size 10B
SHA256 b036e311acf934dae0ab684a78886216394a1497faae13bc5ee9237c1494087b
MD5 fe0b061330a0c84ce3963cac6f56008a
SHA1 59c53bb4b9640c006500d8d2fb15102f8de03dd3
SHA512 3819c184a8aeab9ccdac16594026bd4be6d2c14ecdb034aa1f597d1f8549c75d35dea236689046176297f71d473aff0fc2a4f16e1fa262f2e8bc1c0855e4f548
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e919dd2d01479893b6de1da514efc951fb2a19b3335b426fd6d18c71cf2508f1
MD5 5ae8db9c63b607b88caadc4bef56c19c
SHA1 5281e7634796467b3eac5c83cb6fe3958f6e40ce
SHA512 7f5cc29ea8f4c4d16a5d0c4bf761c38b2205b9f7dace88234b5ad5a4521f54e8cfb118931dbe06b71807194a282e544d41105c692e07f5ad5e65127268599f5b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1bb76ae19cf22e940020a0dd80fa4c1adfb936bb702f887e90cdbd04233a488f
MD5 6b3c497e6742e39cfb90a4eb56d95f0f
SHA1 20fc4b76b8bcda092e1e30afca0ebe82aa89be23
SHA512 d93192167670239f8fb325365b3682ae056e8e7724c0647ca9a1fa7032d0a30eb230447e92b7c06f0e4f1ae472ad11447072b6ede278d348d57111a68e4797a4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b6cd5ef8f9d38ea55727ec787684ca51f53a154e85fe4768a8e9fb914d3dd3a6
MD5 a353d3aded27ec111f8c965983c78f29
SHA1 b655179654eb580e7e8b69fe02f8bd37aa2ec8ce
SHA512 5f0c8c6da177117157c22a1c7e0986d48c57bd002f6bc084edb7079f2ff673467f25bd5f45e12f1d72a1552ff1fd04a44ddb2b4d214ae0362755beff4c8c249c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bfaf57535f67564057cdb38556d0830b25e3d9a040fdc2cf9ab5d3ccc13d0ada
MD5 e13934be5113484207e993f58982292f
SHA1 889a3f3e26d73fee01950b017520a3ad327cfdb1
SHA512 b573db4172a978a6d888e07abeee941380836053e9a2ac62eaaafaabd571ad0f767f902e117f345409359773d109166063051d86ec344174ac0c31c839908406
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dddf560a94c3783cd39a4ecab3f475e05d589b2921bd8b09c104c7aac461f554
MD5 a4282eb7e766a7b020309a3e116e895a
SHA1 44231651e6bc4f7e06b82e8fc213657d1eda6d06
SHA512 7a74d8c8f5474408c3810e76025b6de490c03e31ceeb715a6f65e9b5daa3321970e781210e429a34fe7abec0fd7413de9578e1ee929d1e9dcfea142cd1c6a3c1
MD5 SHA1 SHA512

Submit Download

SwitchInstall.exe

Path C:\Users\Admin\Downloads\SwitchInstall.exe
Size 2.1MB
SHA256 283bf7366a2b4d5890160d278291bfc503d539405a98762cd07c7356b9bc2369
MD5 34ecb783d0f21e9f1aee7a8f6ec007a8
SHA1 b712a7ebc20f612bf7a32318504924f385d8ef09
SHA512 787e33decd241afdfa37d9322fa2e510ab173f52c9452331ac649ac612ad9b09fca9832b2d6693e54f8361c2215f35555d0c1a0f32c14383b974bb3e716894ad
SSDEEP 49152:U+EkqaqQN+EkqaqQ/+ES+ELEj+Et+EkqaqQ/+ES+ELEj+Et+EA:W
TLSH
T1B0A54C06FAC540A5E47741704DABC2BA9531BD218F11CAEFF688A36E6D33BD09D34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchInstall.exe

Path C:\Users\Admin\Downloads\SwitchInstall.exe
Size 1.3MB
SHA256 622724001fa3cacdaf8094ec26730a8399af4ac90c11d2c526ba0684b262fb73
MD5 c724563073578ae81fe3279b4b492a1e
SHA1 e507cc4af80f3ee4efcd7e08b1620adc5a6450f9
SHA512 971f6dd45ff3b5c17b0b8bc7925da6c64648132621eb1d640af1935a2921cf0a5ab8ef5c2c47c31d31cf00aa684b50e461e5a3f40ecfacc2c151bcfadfcaecbb
SSDEEP 24576:m9+EM0bExqaqQL029+EM0bExqaqQLx9+EM0q9+EM0JELl9+EM0h9+EM0:U+EkqaqQN+EkqaqQ/+ES+ELEj+Et+E
TLSH
T187555C06FAC980A5E47741704DABC2BA9531BD218F11CAEFF688A35E5D33BD09D34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3fc11d1a8dad881f96aca952f2ace84c5526f23b459649cd9afdeb8ddeecf5fa
MD5 9ab0c0e080d2858cd6e683c7c1956052
SHA1 4945dd95ea0faa2990753b8029bbcd9921f2ae55
SHA512 92507c8fe0e55a496458c31803f4790eafbd14ee6b35a69904047122feb833b6db24607e4a2a066f4b1f4b4d0b8f47f5cfb2ac530746f68422055f4af40d4a95
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e22d47a8ba0f4d56f5a60a42b3a4196c3159be036d81310b351564fc5fad1012
MD5 38d638a7b5da6cffe4aafe850196d202
SHA1 ca594cb7878b255bc8998ba4c8a4021f5210b6bf
SHA512 27cb464ff9f7faa100f1956b10fe10f1ddcba25b9b09f781002a65a0a09bd3887dc3cc66569aba48fa938b470d7838018ebeffe4f0b53fb712bf617ba1cec53d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Music\qap`g`v~dtlq
Size 10B
SHA256 8f6649016f0b6f95c503609f9b920ff680bb59e6f0800998467d41efd905304f
MD5 6fa0ca29f71a873039282eba1237a89a
SHA1 44abe7af9e22b7457279899fd1dd648ff6096cbb
SHA512 7c14c52370bd23e44134d67cf4188d245695ad2a26540278143ea7a77130bf300b668e3eefde552166d1012f125aba05d7e52b68b08f1ef676d713a89bb9f82a
MD5 SHA1 SHA512

Submit Download

svchost_CBACBACBCBABBCBCBABABBABBCCCBACAAAABCBBCCAACCCBABABACBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBACBCBABBCBCBABABBABBCCCBACAAAABCBBCCAACCCBABABACBC.exe
Size 9.3MB
SHA256 f03523c09685eb7975ba1593bebeb5894a874699a6c006d64dcd3b55e6d58ec9
MD5 8bed12af9272446cbd570ed5e9462432
SHA1 449c2cb824edeb18bc81d6838fd972a75bf31509
SHA512 c4fb67746344fb7261b0eab13863486bb8f64a5fac2d72132ce491f457901cfa4e4fbc0314f8434307d4f15486550370904acc4f49e3d6faaee4d5686d89a668
SSDEEP 49152:U+EkqaqQN+EkqaqQ/+ES+ELEj+Et+EkqaqQ/+ES+ELEj+Et+EkqaqQ/+ES+ELEjC:fA91pH2WpjHrgBFFu416AWvc
TLSH
T161A65A51B6AB60ECE0BFD174897AC332E6717C134631874F22BCE65A2E736546D28723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 974B
SHA256 0b0f52bffce8680cf5dccdcfe84a6cbeb571c7d3ef705b81c990cdb832e44083
MD5 a2dc729998b6476729fe1e874ab7217c
SHA1 8ad7d9e10a4a76d0525059de3f284de83ee03c35
SHA512 031cd20b09e5c97719282a7fd9c6be8514daa7c69b69ce670c4dae1cb2b842ccdda22e2b792bea9eee79d8bd6d794a03f35bc1285bec393b516a216be6e2b786
TLSH
T14611E671F4A5D827F13168DB611DCF970DB57BDAEC6CAB04234D41186B05839AF55CC2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 e0140f86c236b8259c7f3ea0b92acad59cf4e74cff7184f2087789eb71a91d19
MD5 a9a4933363fd6d65a48e288e868b87c5
SHA1 d96f06251a357b095ccb279411cac1e7e1a23e19
SHA512 73345fed21868b9812fe84cac0babdd48dfc531260e0f575d9a1c6a9f27bcb5fc2b8b7637d75183fed6ad10ccb32930e7725d5c5d10cfd6167ade676224bb9c7
TLSH
T17521B672F495CC63F13168CB9119DFD70DA87BEA9C6C9B04234E81186B89C39EE55CD1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 784B
SHA256 7a47318034f37cf1b2b05d51c6551f418017b2650ac8127a1872e521095d186c
MD5 261d55bb692546c70be35a3355620cba
SHA1 976d01b5371d57ef75d007334b3846906a3af60d
SHA512 b5544a0e9868824a137e7f142bfd86065e940476df31f52ff4b8f4d476af7a83ed9efacfe2fac837ba50d8cb22b920b382b821c732b1782baad9b6e880ad0079
TLSH
T1B5010072F4A5D823F231689B91198F9B0DA47BDAA8ACAB00234941186B05839AF56CC2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2332-112-0x0000000000F70000-0x0000000000F91000-memory.dmp

Download

memory/2332-10-0x0000000000F70000-0x0000000000F91000-memory.dmp

Download

memory/2332-1263-0x0000000000F70000-0x0000000000F91000-memory.dmp

Download

memory/2332-73-0x0000000000F70000-0x0000000000F91000-memory.dmp

Download

memory/2332-49-0x0000000000F70000-0x0000000000F91000-memory.dmp

Download

memory/2332-23-0x0000000000F70000-0x0000000000F91000-memory.dmp

Download

memory/2520-114-0x0000000000AA0000-0x0000000000AC1000-memory.dmp

Download

memory/4064-113-0x0000000000D80000-0x0000000000DA1000-memory.dmp

Download

memory/4064-74-0x0000000000D80000-0x0000000000DA1000-memory.dmp

Download

memory/4064-50-0x0000000000D80000-0x0000000000DA1000-memory.dmp

Download

memory/4604-77-0x0000000004F70000-0x0000000004F71000-memory.dmp

Download

memory/4904-1266-0x0000000000D80000-0x0000000000DA1000-memory.dmp

Download