dc0734055deee40cdacdc1f9dea35f6b4d98a000fa547644b6b74d2f89844a52

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 16:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_5c009ef7570b68812e22cb173e5a10fd_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 10.1MB
Sample260908-t9h61seq9t
SHA256 dc0734055deee40cdacdc1f9dea35f6b4d98a000fa547644b6b74d2f89844a52
MD5 5c009ef7570b68812e22cb173e5a10fd
SHA1 9b4412449013cc453f53fa1c4abb6bbe0f705b82
SHA512 b694efd84c47b2f5161f110b5efc58e6585870b2cb23d5247eae49ffec7c2bd4afa74e66906709e61330928079cbf1f30dc28b1a577574c0094d349bbb771693
SSDEEP 49152:U+ES+ES+Ek+ES+ES+E2+ES+ES+Ey+ES+Et+ES+ES+Ek+ES+ES+E2+ES+ES+Ey+EH:dDGA91pH2WpjHrgBFFu416AWv9
TLSH
T122B67C55F59720F9E46FD07089ABC33AD6717C1342328B9BA67CC6572E23B646C28723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCBCCBCCABACBBAAABAAABABBCBBCCCACCBCCCBACCBAAABAACACABB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCBCCBCCABACBBAAABAAABABBCBBCCCACCBCCCBACCBAAABAACACABB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4312	svchost_BCBCCBCCABACBBAAABAAABABBCBBCCCACCBCCCBACCBAAABAACACABB.exe
2520	svchost_BCBACCBCBAACBCABCCACCBCACACCBBBACCCACCBBCBBBCCCCCACCBAA.exe
2920	svchost_BCBCCBCCABACBBAAABAAABABBCBBCCCACCBCCCBACCBAAABAACACABB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACCCCCBCBBABBBABACAABACABCCCCBBACBCBCBCAABCABBACBCBABBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBCCBCCABACBBAAABAAABABBCBBCCCACCBCCCBACCBAAABAACACABB.exe"	2026-09-08_5c009ef7570b68812e22cb173e5a10fd_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACAAACABBACCBBCBBCBACCABBABBCACACAABBCBBBCCACAACACCACBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBACCBCBAACBCABCCACCBCACACCBBBACCCACCBBCBBBCCCCCACCBAA.exe"	svchost_BCBCCBCCABACBBAAABAAABABBCBBCCCACCBCCCBACCBAAABAACACABB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2348	sc.exe
3048	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2800	cmd.exe
3992	cmd.exe
3844	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_5c009ef7570b68812e22cb173e5a10fd_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBCCBCCABACBBAAABAAABABBCBBCCCACCBCCCBACCBAAABAACACABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBACCBCBAACBCABCCACCBCACACCBBBACCCACCBBCBBBCCCCCACCBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1640	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3912	2026-09-08_5c009ef7570b68812e22cb173e5a10fd_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
3912	2026-09-08_5c009ef7570b68812e22cb173e5a10fd_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
3912	2026-09-08_5c009ef7570b68812e22cb173e5a10fd_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
3912	2026-09-08_5c009ef7570b68812e22cb173e5a10fd_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4312	svchost_BCBCCBCCABACBBAAABAAABABBCBBCCCACCBCCCBACCBAAABAACACABB.exe
4312	svchost_BCBCCBCCABACBBAAABAAABABBCBBCCCACCBCCCBACCBAAABAACACABB.exe
4312	svchost_BCBCCBCCABACBBAAABAAABABBCBBCCCACCBCCCBACCBAAABAACACABB.exe
4312	svchost_BCBCCBCCABACBBAAABAAABABBCBBCCCACCBCCCBACCBAAABAACACABB.exe
2520	svchost_BCBACCBCBAACBCABCCACCBCACACCBBBACCCACCBBCBBBCCCCCACCBAA.exe
2520	svchost_BCBACCBCBAACBCABCCACCBCACACCBBBACCCACCBBCBBBCCCCCACCBAA.exe
2920	svchost_BCBCCBCCABACBBAAABAAABABBCBBCCCACCBCCCBACCBAAABAACACABB.exe
2920	svchost_BCBCCBCCABACBBAAABAAABABBCBBCCCACCBCCCBACCBAAABAACACABB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3912	2026-09-08_5c009ef7570b68812e22cb173e5a10fd_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4312	svchost_BCBCCBCCABACBBAAABAAABABBCBBCCCACCBCCCBACCBAAABAACACABB.exe
Token: SeDebugPrivilege	2520	svchost_BCBACCBCBAACBCABCCACCBCACACCBBBACCCACCBBCBBBCCCCCACCBAA.exe
Token: SeDebugPrivilege	2920	svchost_BCBCCBCCABACBBAAABAAABABBCBBCCCACCBCCCBACCBAAABAACACABB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4456	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 3844	3912	2026-09-08_5c009ef7570b68812e22cb173e5a10fd_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	105
PID 3844 wrote to memory of 1640	3844	cmd.exe	107
PID 4312 wrote to memory of 3120	4312	svchost_BCBCCBCCABACBBAAABAAABABBCBBCCCACCBCCCBACCBAAABAACACABB.exe	111
PID 3120 wrote to memory of 3000	3120	notepad.exe	112
PID 3912 wrote to memory of 2800	3912	2026-09-08_5c009ef7570b68812e22cb173e5a10fd_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	116
PID 2800 wrote to memory of 2348	2800	cmd.exe	118
PID 3912 wrote to memory of 3992	3912	2026-09-08_5c009ef7570b68812e22cb173e5a10fd_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	119
PID 3992 wrote to memory of 3048	3992	cmd.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-09-08_5c009ef7570b68812e22cb173e5a10fd_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_5c009ef7570b68812e22cb173e5a10fd_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACBBBAACBACCABBBCCCCCBABCCCAABCABAAAABBAACBBCAABBABBBBAACABCBCBABBCABCACAAAAAABCCACBAABCCBCCBAAAABCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCBCCABACBBAAABAAABABBCBBCCCACCBCCCBACCBAAABAACACABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACBBBAACBACCABBBCCCCCBABCCCAABCABAAAABBAACBBCAABBABBBBAACABCBCBABBCABCACAAAAAABCCACBAABCCBCCBAAAABCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCBCCABACBBAAABAAABABBCBBCCCACCBCCCBACCBAAABAACACABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAACCCACBCACACACAABACABAABAAAAABBABCCCBCCCCACBCCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCBCCABACBBAAABAAABABBCBBCCCACCBCCCBACCBAAABAACACABB.exe" start= auto displayName= "UserDataSvc_AAACCCACBCACACACAABACABAABAAAAABBABCCCBCCCCACBCCCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAACCCACBCACACACAABACABAABAAAAABBABCCCBCCCCACBCCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCBCCABACBBAAABAAABABBCBBCCCACCBCCCBACCBAAABAACACABB.exe" start= auto displayName= "UserDataSvc_AAACCCACBCACACACAABACABAABAAAAABBABCCCBCCCCACBCCCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAACCCACBCACACACAABACABAABAAAAABBABCCCBCCCCACBCCCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3992
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAACCCACBCACACACAABACABAABAAAAABBABCCCBCCCCACBCCCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3048

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCBCCABACBBAAABAAABABBCBBCCCACCBCCCBACCBAAABAACACABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCBCCABACBBAAABAAABABBCBBCCCACCBCCCBACCBAAABAACACABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3120
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3000

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4456

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACCBCBAACBCABCCACCBCACACCBBBACCCACCBBCBBBCCCCCACCBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACCBCBAACBCABCCACCBCACACCBBBACCCACCBBCBBBCCCCCACCBAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2520

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCBCCABACBBAAABAAABABBCBBCCCACCBCCCBACCBAAABAACACABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCBCCABACBBAAABAAABABBCBBCCCACCBCCCBACCBAAABAACACABB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 c6b5f6eb5ae21600643db93e4d6d6ccc56eae87344fee581e645c6d64a73877a
MD5 4eca93a8a6aa0fce696abdd228fae454
SHA1 dfb8dfae9894f5bf4ead05665789d83dd150c7eb
SHA512 99b5115f27ccb7662f0a3f5faf0d7b7a58d75d5e24c84dd5d84b932f885b49f87c27f0ae16ec48c895279deecadb541a3ccd43088f33fd4277288b8e12863363
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 10.5MB
SHA256 18f3360f83a37cfeeb09954a0e585aa9005cf1baae17a282c89dce39907816c4
MD5 612d319f9aa277b58dbcbc2d4c9565e5
SHA1 a9134537a6b2212dc14f442bd4eea8ba5e86c7e6
SHA512 4b106ddf83e31f84003e5709f17b41d8679bf614add1963d44fb3efc2dfa176627cc59f2dbef0e884539d953792aa749fcc236529d0b327bf622a80bf135e6a8
SSDEEP 49152:U+ES+ES+Ek+ES+ES+E2+ES+ES+Ey+ES+Et+ES+ES+Ek+ES+ES+E2+ES+ES+Ey+Et:dDGA91pH2WpjHrgBFFu416AWvapij
TLSH
T181B67C55F59720F9E46FD07089ABC336D6717C1342328B9BA76CC65B2E23B606D28723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\uk-UA\qap`g`v~dtlq
Size 10B
SHA256 0c2077db20e0c1e41854931c5c1f69c2846f75a1342a6c4a9e55078773b3b57f
MD5 4174c2cb0c2ee5b12dc1c61c73e14b8d
SHA1 a797822b3dee9671e9a1dbe676cb3286164ce557
SHA512 4a700d7201cafab77bc6c974f9f353f2850e211f2dd106fc4bf9881ad6d16ad7148f1f4e1b575afb63be8efcf3c437371872c293e42b9ff2b5ffd792a6b10031
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 98bd80edb73ea355cb2e5ec9b5439aebb6adb3efbeb5459a125eb09292292002
MD5 ed2a86dc23df1144731e26acfcdb509f
SHA1 ea5bc69fa2875b5ae17065e4b71cb27e193f94b4
SHA512 17cc9831bec414daab55f19985afa0ac6e88d7a70bd0d2284cf46a827e44c61ea80815ae314ee6e0d0e427ed198ed5c013906b25acf131c7120ea6ee996f7f69
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pt_BR\qap`g`v~dtlq
Size 10B
SHA256 c73435a50b14057d64f5a7a54f151ffcf92c0ee448e6487e7b5aad4852313ee0
MD5 136b112f50f43d99c17409f52173a34e
SHA1 2ecf5da64305b04cde7922a564e90ff088ede168
SHA512 f91f4e16bacffdd9d7bfa7fec6f017e053737e823334cce08e813a8d886d079ecce4995d600cbcaac2dbb6a4c47cf834838e87f1992b38dab7b28eacb6cca957
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\ActiveSync\qap`g`v~dtlq
Size 10B
SHA256 39453801a554452e4971b370f531730e65ba01dae80f9469476b509a59a17a49
MD5 4598058fde93b9eab57dd2304eb2ed78
SHA1 001cbb0136c275859f92d308509df159e148ad32
SHA512 2a97ba5dbdda7dbbfbddec6a76afbe6123f27f2545d74ba8148ffe19666009b8487cde57eb796cef3d51d9c3cec96cc7e58e277efb64741c74cc475128a774fc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4764_1012381361\CRX_INSTALL\_locales\no\qap`g`v~dtlq
Size 10B
SHA256 32cc5675830ca0ef964eb3a5e64b5629894be479dc31083793803ff4ac45be0c
MD5 007e38d4b3873b7ee288a95e8d70f31b
SHA1 0af06efa8fd157796d0d68d5faa78f15c46284b5
SHA512 5367f9dc41c7f8e97514648ca359c2ac56f29127ef1b9651db94ff96d1f09b54cb97c3a392a4275f9e206ac4066ec9b8b34849724db42a4680c09e9daa4a5950
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c476b58f2a7360ae76fe794128c6d666c815287e43a5dcb48220df1aa14ef9ea
MD5 33ce0aaa05d61c7adc98dbad18ba423b
SHA1 e13d7c6ef4858bf217bd1b04b0f3aa7e87cf3956
SHA512 5bac69b055707c949d1cd016f7f63d537f2a49b06cccac0aea01d79b56dc9f7967bf9817148197df1c90a6f1dc91ec81192e2c4def83cc8324f60ef95bb7c405
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ff49a380d2eee03bf20c6fed03b34d4392b28197b5bab98ec936fc6288b12f9a
MD5 ec714b33ff165aad0ab8a970bf2736dd
SHA1 2df9c99de63f03be96c6f81e72609d0abafcb9ae
SHA512 bfa5f9572919a55863af1bfdb52f1a2ac4d5796a2782db387b77e88d3978012eb5939c81810191d2e0d7898ec7113a0cc3fa2664b59cd2b2ae8d6496bfbb378d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6be5cb487d50643cf32bc22b426997510657feaa568e432a5fd78f7cbe5edb91
MD5 601c89498590f544e0686fc66d84dc98
SHA1 c542c7641970565c93b908c7d51b7d54f958c0b7
SHA512 b6e94c2fbfa3bc21d6b14326aaf4a97529ca527346c4e324fb4dafc168028ec49169a70ab16015507ac7ebf38a7739dab9e701a0bcc4d6d074c8e86b52d31339
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 58dbff98dce6b02f0a54ca6f6243d90ea3cff6150e17c35380627f493c8c3612
MD5 41dd1027391d196580fff3a2f4632367
SHA1 0a7b445556dd8110a6750bcf16e411f0552d4347
SHA512 33a7d000a3c1c294eb03a66b9466ca4c6212266a2a1b20736934d1787f754dd5e07bb6ad93b5591eea285ed8fda4afaccd9283d9dc2a48733188e03c4d972f20
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3fff3982b01375ee671575fcd06cf24a846046d9165192703b99fbb677a2c06f
MD5 2e94694b878ec00957b961bd9c166591
SHA1 fb55d29e80da5757ba72ba05a7e26e0f0a320a88
SHA512 10d4e482627084b937252843e9c9f85a3f65a052da8892573442f1472469d0b8bb4ccbf672b9d4220c4c47c03d2f0a0ae6aeb7e9e4f26daec99a348d2adae619
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 69af9113752c83331ff2cc37271dc201a10115c42fdb2bcb9bef8d2c56f5f49e
MD5 2fe1b5364a51357c06ce4e93a0508d90
SHA1 c26d8742a8ab086f23e895642c0c711abf1f25ee
SHA512 e9d1ce71ab609e33225384d696ead4289ff7206724753542ee0a1b402d2153cb39edc8d60be74d8f419dd1b1283fa1b501100112807fbd2b909adffd070ae482
MD5 SHA1 SHA512

Submit Download

svchost_BCBCCBCCABACBBAAABAAABABBCBBCCCACCBCCCBACCBAAABAACACABB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCBCCABACBBAAABAAABABBCBBCCCACCBCCCBACCBAAABAACACABB.exe
Size 10.1MB
SHA256 dc0734055deee40cdacdc1f9dea35f6b4d98a000fa547644b6b74d2f89844a52
MD5 5c009ef7570b68812e22cb173e5a10fd
SHA1 9b4412449013cc453f53fa1c4abb6bbe0f705b82
SHA512 b694efd84c47b2f5161f110b5efc58e6585870b2cb23d5247eae49ffec7c2bd4afa74e66906709e61330928079cbf1f30dc28b1a577574c0094d349bbb771693
SSDEEP 49152:U+ES+ES+Ek+ES+ES+E2+ES+ES+Ey+ES+Et+ES+ES+Ek+ES+ES+E2+ES+ES+Ey+EH:dDGA91pH2WpjHrgBFFu416AWv9
TLSH
T122B67C55F59720F9E46FD07089ABC33AD6717C1342328B9BA67CC6572E23B646C28723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 43623263993bab4800707705c412417ae32ab9e2669a7fab9fc25118464ceeef
MD5 3932604acbaa031d52d06337bac136ab
SHA1 e4e6ba777c2d3ea9c671a1d8976b8f7dc182fd01
SHA512 e19585b00f00ee3da6050767d5c1d06f0715bd5f1fd8ebecec44b8c1b39940683633fa97fdbf8cacb5d62873e11609894b81527c29a824ae46dfa9d8f5c39454
TLSH
T12711CA40F5A5D4A7E53168DF4A354BD71CD43B8FAC64AF24130C53187B19C3B8E154E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 974B
SHA256 e686039ce443f7cefebdcfa06aa4f4b4a73d6ccaeed2ecf3a7613c5fa51a74bb
MD5 5b4f98abcf0290b04aac625e112fceac
SHA1 47de1fa81fced885ca7043659ff6dcd162edbed9
SHA512 9542a06618fc3f1b4cf491d98ace004f51d5195685e4f7c509547cb0d88f7fe390ddf214906c1fc4f1c5a046fe84bc0babca00071f5a9673bd2e1aedbce139c9
TLSH
T1AC119840F5A5D4A7E53168DF46354AD71CD43B4FAC64AF24230C63197B15D3A8F154E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2520-86-0x00000000008C0000-0x00000000008E1000-memory.dmp

Download

memory/2920-88-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download

memory/2920-1349-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download

memory/3120-58-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

Download

memory/3912-6-0x0000000000800000-0x0000000000821000-memory.dmp

Download

memory/4312-35-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download

memory/4312-25-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download