f8120d32620fbb5286aa5c76222f628918658c50a5bca925955789f9d010866e

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 02:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_cc4e5b4e62ada43654760f13e8353d3a_cobalt-strike_elex_glassworm_icedid_njrat_vidar_wannacry.exe
Size 12.9MB
Sample260910-c6p2qavbja
SHA256 f8120d32620fbb5286aa5c76222f628918658c50a5bca925955789f9d010866e
MD5 cc4e5b4e62ada43654760f13e8353d3a
SHA1 97ef9a2940ee8f6cd314ee4c88406c3d132786bb
SHA512 8abd4ccd4800423c44a591a68d8744bfbf4fc99a1e55ea5bacaf9e8242c01e59831af781a432f7a3e07b27133c06acd299edb3ce2a4c6e9d7824dc7e5cd4a56b
SSDEEP 49152:U+E2+ES+ES+Eqk+ES+Ee+EH+E2+ES+ES+EqK+ES+ES+E2+ES+ES+Eqk+ES+Ee+Ef:mA91pH2WpjHrgBFFu416AWvR
TLSH
T1A3D67C55F59720F9E46F90B049ABC33AD671BC1341318B9FE7ACC65B2E23B506D28722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CABCCAAACAAABABABCBBCCABCBBAABCBACACBBAABAACBCAAAABCAAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CABCCAAACAAABABABCBBCCABCBBAABCBACACBBAABAACBCAAAABCAAA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CABCCAAACAAABABABCBBCCABCBBAABCBACACBBAABAACBCAAAABCAAA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CABCCAAACAAABABABCBBCCABCBBAABCBACACBBAABAACBCAAAABCAAA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4788	svchost_CABCCAAACAAABABABCBBCCABCBBAABCBACACBBAABAACBCAAAABCAAA.exe
5560	svchost_BBCCAACCBBBBCCCCBBBBABACCBACCCBBACAACCACCCCCCAAAABACAAB.exe
1760	svchost_CABCCAAACAAABABABCBBCCABCBBAABCBACACBBAABAACBCAAAABCAAA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACBBACCCCCACACCBCABBBABCABBCBACCBABCBBBCBCAAACBBBACAACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCCAACCBBBBCCCCBBBBABACCBACCCBBACAACCACCCCCCAAAABACAAB.exe"	svchost_CABCCAAACAAABABABCBBCCABCBBAABCBACACBBAABAACBCAAAABCAAA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCABAABBCCCABBCBABCAABBBCABCAABABABCCCBBCBCCCCABACABBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABCCAAACAAABABABCBBCCABCBBAABCBACACBBAABAACBCAAAABCAAA.exe"	2026-09-08_cc4e5b4e62ada43654760f13e8353d3a_cobalt-strike_elex_glassworm_icedid_njrat_vidar_wannacry.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5716	sc.exe
4612	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5648	cmd.exe
4960	cmd.exe
2140	cmd.exe
3904	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_cc4e5b4e62ada43654760f13e8353d3a_cobalt-strike_elex_glassworm_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABCCAAACAAABABABCBBCCABCBBAABCBACACBBAABAACBCAAAABCAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCCAACCBBBBCCCCBBBBABACCBACCCBBACAACCACCCCCCAAAABACAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1768	schtasks.exe
4844	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3360	2026-09-08_cc4e5b4e62ada43654760f13e8353d3a_cobalt-strike_elex_glassworm_icedid_njrat_vidar_wannacry.exe
3360	2026-09-08_cc4e5b4e62ada43654760f13e8353d3a_cobalt-strike_elex_glassworm_icedid_njrat_vidar_wannacry.exe
3360	2026-09-08_cc4e5b4e62ada43654760f13e8353d3a_cobalt-strike_elex_glassworm_icedid_njrat_vidar_wannacry.exe
3360	2026-09-08_cc4e5b4e62ada43654760f13e8353d3a_cobalt-strike_elex_glassworm_icedid_njrat_vidar_wannacry.exe
4788	svchost_CABCCAAACAAABABABCBBCCABCBBAABCBACACBBAABAACBCAAAABCAAA.exe
4788	svchost_CABCCAAACAAABABABCBBCCABCBBAABCBACACBBAABAACBCAAAABCAAA.exe
4788	svchost_CABCCAAACAAABABABCBBCCABCBBAABCBACACBBAABAACBCAAAABCAAA.exe
4788	svchost_CABCCAAACAAABABABCBBCCABCBBAABCBACACBBAABAACBCAAAABCAAA.exe
5560	svchost_BBCCAACCBBBBCCCCBBBBABACCBACCCBBACAACCACCCCCCAAAABACAAB.exe
5560	svchost_BBCCAACCBBBBCCCCBBBBABACCBACCCBBACAACCACCCCCCAAAABACAAB.exe
1760	svchost_CABCCAAACAAABABABCBBCCABCBBAABCBACACBBAABAACBCAAAABCAAA.exe
1760	svchost_CABCCAAACAAABABABCBBCCABCBBAABCBACACBBAABAACBCAAAABCAAA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3360	2026-09-08_cc4e5b4e62ada43654760f13e8353d3a_cobalt-strike_elex_glassworm_icedid_njrat_vidar_wannacry.exe
Token: SeDebugPrivilege	4788	svchost_CABCCAAACAAABABABCBBCCABCBBAABCBACACBBAABAACBCAAAABCAAA.exe
Token: SeDebugPrivilege	5560	svchost_BBCCAACCBBBBCCCCBBBBABACCBACCCBBACAACCACCCCCCAAAABACAAB.exe
Token: SeDebugPrivilege	1760	svchost_CABCCAAACAAABABABCBBCCABCBBAABCBACACBBAABAACBCAAAABCAAA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3360 wrote to memory of 5648	3360	2026-09-08_cc4e5b4e62ada43654760f13e8353d3a_cobalt-strike_elex_glassworm_icedid_njrat_vidar_wannacry.exe	92
PID 5648 wrote to memory of 1768	5648	cmd.exe	94
PID 4788 wrote to memory of 1520	4788	svchost_CABCCAAACAAABABABCBBCCABCBBAABCBACACBBAABAACBCAAAABCAAA.exe	95
PID 3360 wrote to memory of 4960	3360	2026-09-08_cc4e5b4e62ada43654760f13e8353d3a_cobalt-strike_elex_glassworm_icedid_njrat_vidar_wannacry.exe	99
PID 4960 wrote to memory of 5716	4960	cmd.exe	101
PID 3360 wrote to memory of 2140	3360	2026-09-08_cc4e5b4e62ada43654760f13e8353d3a_cobalt-strike_elex_glassworm_icedid_njrat_vidar_wannacry.exe	102
PID 2140 wrote to memory of 4612	2140	cmd.exe	104
PID 4788 wrote to memory of 3904	4788	svchost_CABCCAAACAAABABABCBBCCABCBBAABCBACACBBAABAACBCAAAABCAAA.exe	107
PID 3904 wrote to memory of 4844	3904	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-08_cc4e5b4e62ada43654760f13e8353d3a_cobalt-strike_elex_glassworm_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_cc4e5b4e62ada43654760f13e8353d3a_cobalt-strike_elex_glassworm_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABBCCCCBBBAAAABCBABCBABABACABBCCABBCCCBBCACCABABAACBACCCCAAACABABAACCABACAACBBBACBAABCACABBCCACCBBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCAAACAAABABABCBBCCABCBBAABCBACACBBAABAACBCAAAABCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5648
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABBCCCCBBBAAAABCBABCBABABACABBCCABBCCCBBCACCABABAACBACCCCAAACABABAACCABACAACBBBACBAABCACABBCCACCBBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCAAACAAABABABCBBCCABCBBAABCBACACBBAABAACBCAAAABCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACACAACBACCBBBABBCBABBBAACBAACCCACBACCCCABCBCACAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCAAACAAABABABCBBCCABCBBAABCBACACBBAABAACBCAAAABCAAA.exe" start= auto displayName= "UserDataSvc_BACACAACBACCBBBABBCBABBBAACBAACCCACBACCCCABCBCACAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACACAACBACCBBBABBCBABBBAACBAACCCACBACCCCABCBCACAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCAAACAAABABABCBBCCABCBBAABCBACACBBAABAACBCAAAABCAAA.exe" start= auto displayName= "UserDataSvc_BACACAACBACCBBBABBCBABBBAACBAACCCACBACCCCABCBCACAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACACAACBACCBBBABBCBABBBAACBAACCCACBACCCCABCBCACAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACACAACBACCBBBABBCBABBBAACBAACCCACBACCCCABCBCACAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4612

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCAAACAAABABABCBBCCABCBBAABCBACACBBAABAACBCAAAABCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCAAACAAABABABCBBCCABCBBAABCBACACBBAABAACBCAAAABCAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCACBCBABACBAAACCBCCCCBCCCCBACBBBBCCCAAAAACCBAACBACACACABBAAAABAACAAAAABABCBCCBAACBBABCABCBBCCBBACCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCAACCBBBBCCCCBBBBABACCBACCCBBACAACCACCCCCCAAAABACAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCACBCBABACBAAACCBCCCCBCCCCBACBBBBCCCAAAAACCBAACBACACACABBAAAABAACAAAAABABCBCCBAACBBABCABCBBCCBBACCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCAACCBBBBCCCCBBBBABACCBACCCBBACAACCACCCCCCAAAABACAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4844

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCAACCBBBBCCCCBBBBABACCBACCCBBACAACCACCCCCCAAAABACAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCAACCBBBBCCCCBBBBABACCBACCCBBACAACCACCCCCCAAAABACAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5560

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCAAACAAABABABCBBCCABCBBAABCBACACBBAABAACBCAAAABCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCAAACAAABABABCBBCCABCBBAABCBACACBBAABAACBCAAAABCAAA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 55d747620b9feab4ba8e6d672bd8d411f88179d46925c6f73ee9bdde44484b59
MD5 b33a94d4119ccb37f4d99fd8e017b359
SHA1 b63278a1dec99185a8ff1bd2278638ec83855c15
SHA512 c21fa7b27ce8b24bf704a3d60ccfd7e76b110a8f6f8603082528bc0d40eb2bc8dc6d1c7b6cb85a00f4ccec8ed0875b22ce2e5a9a278b8458193c3d60865396ca
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 6bb6747fb39b33a8d48c17bc76f0229a06a94b9021d91d37c5e35d6c4a2a581c
MD5 00c1a9e472ab4ad95f3d4892be4c8083
SHA1 51310af3c027a25dc30213a312e0316e50222c06
SHA512 1d5df0712ae8549d5081ec671d928fb50ad534d85a4d046ef11bb78c71bac7a017c59211d82fe5fefe0b59cb97b8cf91ceba5251c7b8b33dc4e753e3e827fa74
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows Defender\LocalCopy\qap`g`v~dtlq
Size 10B
SHA256 705cc4ac7012432080b8a9617ac39e99dc49473434e23a2a6f7d3e6dcdc8024b
MD5 053eb76d5589ec43f6c8bc58aa848f6f
SHA1 107d5b57b0b449831ae04d80f9fb494e8964a4ab
SHA512 78b11a628565b9f360c1ea86788d832c216c468ee4d293adf8ba3a53fca407f26ca52237a7ed6b067a57d8f53d36ae3a3c7c90af7c2226d9704e70b7fe617e00
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq
Size 10B
SHA256 565a42bce26fb609e8b60e2f80679f48deee22ce07ee9293bc0068dca8fca0d5
MD5 ab06af96107409104fcce3381bcf4fdb
SHA1 c5b83221d03458e8a4ddcd324340344b8b0f67b7
SHA512 d47da95ce0a17da39422c96d351d6f030871a396791bc0b2d96a4f64ac8a91670cf490726720f5ada988f6e4edd6c347723246a212afa393abe93600233be81b
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 13.5MB
SHA256 8ba461b70f6760e19fc53e97f4c4d8c7bbd1fd96729dda9c9f233dcec0a0e713
MD5 b271eccfa18ff3cca4dac12ffbf586b1
SHA1 f3c1bbfe174ea02ccd573efdfa82001ae00b9a46
SHA512 801147c102a9a5555da36f2c4c71bfd887bbdc2e962c41f18f40c50747db8c4f289bae068cb7889ca107905162c6c5171e823c9d0066b4a3bd78c96212159119
SSDEEP 98304:mA91pH2WpjHrgBFFu416AWvwgZ2Hb9t+2xi:mmHpn6F44IAWvwgZ2ji
TLSH
T1FEE67C15F59710F9E46F90B049ABC33AD671BC1342318B9FE7ACC65B2E63B506D28722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 ea40fe1cdc3dc27135ad39a7081b736be7741878eb71a197c27d9d80ca203a0a
MD5 edf3aa5f01bde8257b9fb7d4fc861508
SHA1 16fb8d0d2976a1ad9058dbecf3603d0e58115563
SHA512 5aa62e7ef02699db586cd4c0fc86a7d64ccd6254f1a162d39d56bd803e2e2157ec242473db485d258c505dc42851455eb8708c795e00e76663a7aea73f8fd728
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 086d1fe6a9d4379a18c01b9df8163f5667a9bfec2c95c14d08d8ae514f9d489d
MD5 93d49a1b1015ebedb5140c7d3c1222ac
SHA1 ed821094449c900b949a8d1589aff5766be37a8f
SHA512 7102728680e8d21ce991c1cb51c840e27d5dea13759922e2be67b7a51ade4bc1ee6e971d36b2e39cbecaaa5a3b82907688c49f6c7d3dc66728c6c3e6cccc79b6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\qap`g`v~dtlq
Size 10B
SHA256 f2114d51c78d51c9a7c54a3a2497cf9d5e555d6e3248be3485a25136a9d76105
MD5 095e5506e65ae75a9e117e629f4e0b66
SHA1 4d10a1ed0807b8f675edcdbf9060a7f6c1b6346f
SHA512 89b3f4a10e256e901cf9d150722e97496f8c3ff9db1f867df5e7f9ad30b158a9d44f52ca3462ea9c93cf19cc51c49528905c6681689ed4f32d341b9741a0b3e5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 25f71b3f23fb0f5083ec815b27878d7411d1d253b7b29f153330d0f126550ea3
MD5 24fdbcf379dc7a0bad5158665bf1466c
SHA1 d5c26c213cfac3372146650165b9afb76e1189fe
SHA512 a71047c90fd918f87040517758aa84036bdeec759002491dcea215fbb651402c5e45b0a36df9838366cf6aeda511a88b09325668fad4a680c5fe75a4ad2103b0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 ece84fe5f0f0b7c53952ce904e8cdb80c1078189f1022c23d7a0b45395bb2cc8
MD5 8bf4ee8fc9aa3d7c5c9452e4f597e074
SHA1 020dab0cf43961d94ad125bc2f3445f6448c561f
SHA512 8b90364334926a8267565041d3ffcc5127ff1737a87d8b1cf8c18a943298a8b2a2c9e3e941144aa2f68aad6120b9dbf3c39a077c8ec60f0daaaad313fbff85b3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ca5201718a3964840661e564409fa8f162c950e245fa0e1ce1b398cc61675148
MD5 d05e7d394621b7a4ce1d20ed4827a1c2
SHA1 8d77b4afb5baf4ba0a2cf53fb150dd630d8bb7af
SHA512 ef2c335d6a3583ea275671e4b336f0d0251bc45dcd6fd9a518378e4f1470c2b1b01900f627335da5ddba717deb07e1f3fd888d4502792eaf59ebcb9f8e0453af
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 17eab9d5f6bc63caf92f409dffe963122065bdd334b9c1b5682f618e47d45c37
MD5 c4925d72eed803d365cec059417637e7
SHA1 f06d3daae854559d05a68207541ac80017cd9064
SHA512 0edcea527ccc4f585983fb63469cdbb46a00eb9f0117a546d42d347c49a484d4dc57262f2d5f6fff9e245168165d9bd96cf357133feb1d1f301a088f808b355b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a5c4e45dc736bef19d5513818f8129253493e5edf0a0da5335c5f7da8797ca34
MD5 73945aefba3446b379961dd5ea709028
SHA1 d477615a4ec7567b77a53c60ac43d50300d30dfb
SHA512 748383123d32b4aec9c98efffa3ff8ea77c4809db1265b064873255acc164fb8ede7554c28b371d2ecb4da8a9f261be0c43d7b311f22aa18cd7fb3ea95347ea2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\qap`g`v~dtlq
Size 10B
SHA256 1776c54d0f444474e9aae16a83c14f09cbd9d6efd75770544e80cba6f7bff365
MD5 6d1014dc5e278495b4d3349d946bdc43
SHA1 3edd05f577a54a18052f238dd853bf7da7cd3f48
SHA512 4ca83e50dae286c779c7d51443bb91089168ebf78a47c3648be4ea32f28cedc4e5924b59cb6cc0ceb455770335bf8661863c1b1d7dd53efd0d8e4b73a164f545
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b0084ed20a5399b1871c2b2c46dae1c59c68344f23b80bfe260adcb5564d5df2
MD5 6e46e5492df6c01b682a6b2d39158664
SHA1 4de68d258aceea24331804d6b1698f840c67b676
SHA512 b571e24b8544b39d2382ae88ac2d11eddad35b1dc894790d6a1f22e4faef779593a0697900244bf33ee691b615e802ca37380bf935271e6dffa231ea2a8584aa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1cf173f54baace0802c82ef7166a11f01c69c8a5a297ef21fe70c7f54102c566
MD5 416ce3b213d6251617ed29bd8b423a12
SHA1 bf439cc65cc498e2c789a06134f42d7a8af96a33
SHA512 b6f8a34d0c27fb1e7e52a62ada2d5a8f55924d20cbb9c6464eaedd7dc4425b943fce262de5671ed25a11430b14f86b418d399f4c3f7c1811b0a92a25d2e8239f
MD5 SHA1 SHA512

Submit Download

svchost_CABCCAAACAAABABABCBBCCABCBBAABCBACACBBAABAACBCAAAABCAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCAAACAAABABABCBBCCABCBBAABCBACACBBAABAACBCAAAABCAAA.exe
Size 12.9MB
SHA256 f8120d32620fbb5286aa5c76222f628918658c50a5bca925955789f9d010866e
MD5 cc4e5b4e62ada43654760f13e8353d3a
SHA1 97ef9a2940ee8f6cd314ee4c88406c3d132786bb
SHA512 8abd4ccd4800423c44a591a68d8744bfbf4fc99a1e55ea5bacaf9e8242c01e59831af781a432f7a3e07b27133c06acd299edb3ce2a4c6e9d7824dc7e5cd4a56b
SSDEEP 49152:U+E2+ES+ES+Eqk+ES+Ee+EH+E2+ES+ES+EqK+ES+ES+E2+ES+ES+Eqk+ES+Ee+Ef:mA91pH2WpjHrgBFFu416AWvR
TLSH
T1A3D67C55F59720F9E46F90B049ABC33AD671BC1341318B9FE7ACC65B2E23B506D28722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 9a471762e40c32ec654b9ee3ae7d85f5ba4efbece36c35ff497a4db843848ea0
MD5 bab5e8dcc30ce5fe2d99f61c06751d13
SHA1 01d392fa53f40a5b621a6c63c6830289e09049de
SHA512 baa1a864caca7cac20b7de83b0d5eea9ddcade73403c472f8c161d28deee755f5612768b16a89874140d4faf5c2ac5914f9e57695ca2c2c4ff99b7250cb29a69
TLSH
T186219161E1B5D823F131ACCF8529EB960CE8375F6C9CAE4053498218AFD5D36DE198E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 ad2f8d49fa08938b93a80aab959c03b47f86017c056607bef62bf7a69730414c
MD5 09e9b2cffe5c788e2b88c68c755683b0
SHA1 37b8c74bfedd11108338a4b085279c3787705675
SHA512 5f94adafc0ce6a3bc7d9262db156b63c6ea59bd807a37af50704d39184759cb9956d747c328130bb58f51e715a3b760e25f4cbe169dc11992391fccad9ea3efc
TLSH
T18511BF55E1B5D433F131ACCF822AEB560CE8375F7C98AF5423448219AF89D26DE198E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 f64e22b448e9592c0e96caf452907d91bec22b98ac827d6f4a1f35e58ee246c4
MD5 79ec6693d8f2c6cc032da5381f872793
SHA1 53df19c14f851801329084c78d003764b514cb86
SHA512 4f7e48d2e8ac99474a0b76d37ab13e279270cb442a8c663c8eba417e710a30d7ea539885bd2acc48cffabfeedb8d70684e756b48ae9e1c5014d5f503433b22b3
TLSH
T18F21A461E1B5D423F131ACCB812AEB960CE8375F7C58AF5413458119AF89D36DE198E2
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Public\Libraries\qap`g`v~dtlq
Size 10B
SHA256 530ee22d0e284d50a7dbeee359a68152c15c7fd16b3b3fa27eec28edd9b44c18
MD5 80e889c5fca66e31fe5f8d6933aec48f
SHA1 62a8b30012e71fe785ed9c96676966bbad28137b
SHA512 b4da56a42e42de458af020abf253ee8b45a38f4ca9f7d64fe54971f5a06ddf54c84c8e1157f654cc33336d66a932a91faee2eacbb50aeec5d4db9a3dfcbd99ef
MD5 SHA1 SHA512

Submit Download

memory/1760-1718-0x00000000008F0000-0x0000000000911000-memory.dmp

Download

memory/3360-6-0x0000000000F00000-0x0000000000F21000-memory.dmp

Download

memory/4788-33-0x00000000008F0000-0x0000000000911000-memory.dmp

Download

memory/5560-1717-0x0000000000090000-0x00000000000B1000-memory.dmp

Download

memory/5560-69-0x0000000000090000-0x00000000000B1000-memory.dmp

Download