862e80e445aad7d6316ef11eef5c5e51ad2873f3c0b901221358105ca2bc7aaf

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 03:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_7a9f2518d70bdbec976a44a5f2ad6525_elex_glassworm_icedid_njrat_vidar.exe
Size 10.4MB
Sample260808-dvex2sbd87
SHA256 862e80e445aad7d6316ef11eef5c5e51ad2873f3c0b901221358105ca2bc7aaf
MD5 7a9f2518d70bdbec976a44a5f2ad6525
SHA1 b9e4c30235c480d65691bf1278f29f410a5f4497
SHA512 1b757a06d00a87af0daf9392f4ba734b51415b70a65109b0037c59040ce3a99d8c037ee71972a1b478765419c9c3ea18e605d599b7ff046f997379cacf55e687
SSDEEP 98304:lKRuy5auKRuy5aL1MbQ9yDAD7KjjqkusjmqMhI:lqNq61tIDewjqkjiqM6
TLSH
T1F8B69E29FBE480F1F9ABA47899ABC376EA717A110833471BCA95C61F6F336514D18331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCBCABCAAABCCCABBABACABCABBCCBABBCBCAAABBCCAAABABCABCAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCBCABCAAABCCCABBABACABCABBCCBABBCBCAAABBCCAAABABCABCAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4156	svchost_BCBCABCAAABCCCABBABACABCABBCCBABBCBCAAABBCCAAABABCABCAB.exe
1836	svchost_BCACCCBACCBCAACACBACACACAACAABCCABCCAACBCACCACCBCCABCBA.exe
2456	svchost_BCBCABCAAABCCCABBABACABCABBCCBABBCBCAAABBCCAAABABCABCAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CCCBABBCBBBCAABCABBABCBBAAACBBBCABBCCBAAAAABBBCABCBCBCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBCABCAAABCCCABBABACABCABBCCBABBCBCAAABBCCAAABABCABCAB.exe"	2026-08-08_7a9f2518d70bdbec976a44a5f2ad6525_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CBCBBCABCBBABABBCBCACCBCAAAACCCBBCABAACBAACBAABBAACABBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCACCCBACCBCAACACBACACACAACAABCCABCCAACBCACCACCBCCABCBA.exe"	svchost_BCBCABCAAABCCCABBABACABCABBCCBABBCBCAAABBCCAAABABCABCAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3136	sc.exe
4872	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1700	cmd.exe
2096	cmd.exe
4120	cmd.exe
2956	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCACCCBACCBCAACACBACACACAACAABCCABCCAACBCACCACCBCCABCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_7a9f2518d70bdbec976a44a5f2ad6525_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBCABCAAABCCCABBABACABCABBCCBABBCBCAAABBCCAAABABCABCAB.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4164	schtasks.exe
1492	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2960	2026-08-08_7a9f2518d70bdbec976a44a5f2ad6525_elex_glassworm_icedid_njrat_vidar.exe
2960	2026-08-08_7a9f2518d70bdbec976a44a5f2ad6525_elex_glassworm_icedid_njrat_vidar.exe
2960	2026-08-08_7a9f2518d70bdbec976a44a5f2ad6525_elex_glassworm_icedid_njrat_vidar.exe
2960	2026-08-08_7a9f2518d70bdbec976a44a5f2ad6525_elex_glassworm_icedid_njrat_vidar.exe
4156	svchost_BCBCABCAAABCCCABBABACABCABBCCBABBCBCAAABBCCAAABABCABCAB.exe
4156	svchost_BCBCABCAAABCCCABBABACABCABBCCBABBCBCAAABBCCAAABABCABCAB.exe
4156	svchost_BCBCABCAAABCCCABBABACABCABBCCBABBCBCAAABBCCAAABABCABCAB.exe
4156	svchost_BCBCABCAAABCCCABBABACABCABBCCBABBCBCAAABBCCAAABABCABCAB.exe
1836	svchost_BCACCCBACCBCAACACBACACACAACAABCCABCCAACBCACCACCBCCABCBA.exe
1836	svchost_BCACCCBACCBCAACACBACACACAACAABCCABCCAACBCACCACCBCCABCBA.exe
2456	svchost_BCBCABCAAABCCCABBABACABCABBCCBABBCBCAAABBCCAAABABCABCAB.exe
2456	svchost_BCBCABCAAABCCCABBABACABCABBCCBABBCBCAAABBCCAAABABCABCAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2960	2026-08-08_7a9f2518d70bdbec976a44a5f2ad6525_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4156	svchost_BCBCABCAAABCCCABBABACABCABBCCBABBCBCAAABBCCAAABABCABCAB.exe
Token: SeDebugPrivilege	1836	svchost_BCACCCBACCBCAACACBACACACAACAABCCABCCAACBCACCACCBCCABCBA.exe
Token: SeDebugPrivilege	2456	svchost_BCBCABCAAABCCCABBABACABCABBCCBABBCBCAAABBCCAAABABCABCAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2340	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2956	2960	2026-08-08_7a9f2518d70bdbec976a44a5f2ad6525_elex_glassworm_icedid_njrat_vidar.exe	105
PID 2956 wrote to memory of 4164	2956	cmd.exe	107
PID 4156 wrote to memory of 344	4156	svchost_BCBCABCAAABCCCABBABACABCABBCCBABBCBCAAABBCCAAABABCABCAB.exe	110
PID 344 wrote to memory of 3632	344	notepad.exe	111
PID 2960 wrote to memory of 1700	2960	2026-08-08_7a9f2518d70bdbec976a44a5f2ad6525_elex_glassworm_icedid_njrat_vidar.exe	116
PID 1700 wrote to memory of 3136	1700	cmd.exe	118
PID 2960 wrote to memory of 2096	2960	2026-08-08_7a9f2518d70bdbec976a44a5f2ad6525_elex_glassworm_icedid_njrat_vidar.exe	119
PID 2096 wrote to memory of 4872	2096	cmd.exe	122
PID 4156 wrote to memory of 4120	4156	svchost_BCBCABCAAABCCCABBABACABCABBCCBABBCBCAAABBCCAAABABCABCAB.exe	125
PID 4120 wrote to memory of 1492	4120	cmd.exe	127

C:\Users\Admin\AppData\Local\Temp\2026-08-08_7a9f2518d70bdbec976a44a5f2ad6525_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_7a9f2518d70bdbec976a44a5f2ad6525_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBABBACABACBBCACACCBCBBBACAACBCBAAABCABCCABACAABABBABCBABBCACCACCBCAAACBAACACACCCCCBCABABACBACCABAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCABCAAABCCCABBABACABCABBCCBABBCBCAAABBCCAAABABCABCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBABBACABACBBCACACCBCBBBACAACBCBAAABCABCCABACAABABBABCBABBCACCACCBCAAACBAACACACCCCCBCABABACBACCABAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCABCAAABCCCABBABACABCABBCCBABBCBCAAABBCCAAABABCABCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBCBBBACBABBCAACACBBBBBBBCCBBBBBBBCBABBACAACABBCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCABCAAABCCCABBABACABCABBCCBABBCBCAAABBCCAAABABCABCAB.exe" start= auto displayName= "UserDataSvc_BBBCBBBACBABBCAACACBBBBBBBCCBBBBBBBCBABBACAACABBCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBCBBBACBABBCAACACBBBBBBBCCBBBBBBBCBABBACAACABBCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCABCAAABCCCABBABACABCABBCCBABBCBCAAABBCCAAABABCABCAB.exe" start= auto displayName= "UserDataSvc_BBBCBBBACBABBCAACACBBBBBBBCCBBBBBBBCBABBACAACABBCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBCBBBACBABBCAACACBBBBBBBCCBBBBBBBCBABBACAACABBCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBCBBBACBABBCAACACBBBBBBBCCBBBBBBBCBABBACAACABBCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4872

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCABCAAABCCCABBABACABCABBCCBABBCBCAAABBCCAAABABCABCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCABCAAABCCCABBABACABCABBCCBABBCBCAAABBCCAAABABCABCAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:344
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAACBBBAAABCACCAABACCBABCBBBBCABACABABCABACBBACCBBAAAAAAACBBACBCCCAABACABBABBBBAABABACABACBABBBACBBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCCBACCBCAACACBACACACAACAABCCABCCAACBCACCACCBCCABCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAACBBBAAABCACCAABACCBABCBBBBCABACABABCABACBBACCBBAAAAAAACBBACBCCCAABACABBABBBBAABABACABACBABBBACBBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCCBACCBCAACACBACACACAACAABCCABCCAACBCACCACCBCCABCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1492

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2340

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCCBACCBCAACACBACACACAACAABCCABCCAACBCACCACCBCCABCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCCBACCBCAACACBACACACAACAABCCABCCAACBCACCACCBCCABCBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1836

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCABCAAABCCCABBABACABCABBCCBABBCBCAAABBCCAAABABCABCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCABCAAABCCCABBABACABCABBCCBABBCBCAAABBCCAAABABCABCAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 71e60b799d4b396bc148cdda59431396b919fcc9e6e37e44cf71518967d20bcc
MD5 a46cc5af2a0e55b8282a71fe85a5fcd9
SHA1 4ceea8e0e2346af2b07bc44760e9e53f6191f55b
SHA512 bb31003a20307cc6d8acae93ca1cecb4b6933ce4e5e9089ae4f527f814ebfa6daf6304b71dbdc3da541b0d7ce106289b7269e992e060ba343073b82a018b4942
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\qap`g`v~dtlq
Size 10B
SHA256 2e3acb91cd4d87b4c5c04dda99f064b600ab486bc5f66c6c7496df59b9f30a3b
MD5 256f7b00f7ea341447dda23c41db0f2b
SHA1 26335b710e5a3462ec8f749cce250cec899f9024
SHA512 d80a97e18c5d0d52ebe6f1b66bb0cae7e7a71d6b5e9ece6b0bdd92cde5d3f4eb65ef9b97a99ca0728b5ff7356446233900492d760c5391b7329bacec0a685271
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\INetHistory\qap`g`v~dtlq
Size 10B
SHA256 2865de1c0e2abca4c68480166331d1ea47211a070ff7a97698a6f29f8502a192
MD5 de91e9fa1cef28792fe90c7d03c851a4
SHA1 aba6aa0e102fe8c9154da0d3fd4343fdca21388d
SHA512 e995eba188f32e581185d01be2c8133ca16960356704d6a4aa55bd1c949023823f0bc5c89fdbd37dd2479620c8fc48273112e2cba7183b3f56f93d139fc7b0ad
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\qap`g`v~dtlq
Size 10B
SHA256 91664c03435bdcf360ec9e35f0c1bbee4b0753af2caf9aa6901c98473d2c1810
MD5 21483db6e304059184dc8988e79840a5
SHA1 f5273898b05d758b89674b0a053ac172a4f7a3b5
SHA512 a39da9fe880e9ade39425b52a36a487c2e2c0a2b2f977b82a32e4572e3c942e351bd3f1ac21ce6819e2806067cc601e0c39bb769e3bb5f5e838776e2700b2dbb
MD5 SHA1 SHA512

Submit Download

RedoCheckpoint.exe

Path C:\Users\Admin\Desktop\RedoCheckpoint.exe
Size 62.8MB
SHA256 f6b9cc30eb7c548bdde17e793197ca1a62f65ee2dee433463b7b700da60007b4
MD5 5c83d47291ad1e6fce66e5c83c020ef4
SHA1 292f6a78359aeb9bca00de593651c16fa04f1e13
SHA512 bf41a9dd460f54d0eb42dcbabed193ed84625b1a957bd0606e1090765ff7e65a3be7152ae3222c9307a63029e122aee129ba6ac49611fbb788323076559fd516
SSDEEP 393216:Qo68KwekyPo68KwekyPo68KwekyPo68KwekyPo68KwekyPo68Kwekyt/:knnnnnH/
TLSH
T109E79E29FBE480F1F9ABA47899ABC376EA717A110833471BCA95C61F6F336514D18331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5826f4a4e182a1acbf139e9d9bff117c7785cf94f700aef1ee0ed2f98c4b289f
MD5 a2e492b7b1fb300f5ccbe45ffaa6623b
SHA1 76bd882574e298237437fae35a11b096f5a82f6f
SHA512 5eee29c83ea948c9386731d90295eb85d7a81e5ca45c20234134e327fba3c972f10368d003e7724bb663ffc78276c2e9c7f1e2ec5151098109dc548cb3304c68
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 90bf09f3b9443b4fb707f86e47db6011361272b5b5ce7b7869732a781de2f008
MD5 ff36286b56d042034f1561992bed8e46
SHA1 fa78b415537672e7362ff96dfd1445a1639f9adb
SHA512 eb50643f93141d19e4f70e9fc8a26b6f7f7bf6b8cd16ef3a529d54147980c414c49f7a31133469babc83cb2da1ba4958122ac619f374cf8767f8ab8887bb2aa0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c08663fd91e7bc4091cad7c3211ad72da301d27194b9d5d56ec5b1f6438d3e84
MD5 2f7c06e1044221c6bef121dac5965ba4
SHA1 fbb219650675941801b36819703732d62aecc2b7
SHA512 4d4036e6d59a8ad771592b2ca35c42891777164bf1ceae6b3ad11969ddc254bd3b8c1057c9de3119e6b32fcac43f7cc6a393da956fb672b39c6918495d960c4f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f5536d91fe5db900c8363139583a0b722b8a9173125e987b1858cab922c84457
MD5 345043912baede5ab41c3c0b2e6b45ad
SHA1 ba96bfc8acad1dc985c9f6f677493eddc6714b67
SHA512 cc128a1cfbcae2e7d9cfd2467bcd98224baf3ad84f72b278828b9a196548e329bfeb05fdf3b939346cb487f5b1bddb36ae0f04f4ecba32774656f2281e1bdf38
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 521fff4d6a408b7bbb5719e78efa4ebea118467e235bd673c854e9cf93d70384
MD5 97d2b393c079c6accc5fce748e90c18b
SHA1 f7340fa81723ccd5339ba5e786e49788ee9c1693
SHA512 651cb107cba4a65cbaf3d1e279fe75b2a289b3262d4c985540a8df829324d5858cabf4c99811da97be68fd702773d9207b7b9480f8feaa9c70a896ac05f286f3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c1895939effb6131ea6725c7fa5d159f693e53babc15cfc856938bfd6f428685
MD5 3b88168894a7332683d520e39a6d1c98
SHA1 38269fddb7e9a72bb3117b86fc01fefaefd5a57b
SHA512 69e1ec9e64b925a6a85d47e66668e2b9b4d97b623b0bb68aaeed0f5b5a7bd15a8b47109a34ab9784795f6c187de79d00421647d76a0870ac28ac154d17d382f8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e29c715eb2fdeef00ded38642396196bd781f1ae40d6b70430430e13bfcd7559
MD5 2adcc495690a8debb633559bb2273516
SHA1 f03a78146030d982c8a8fd0742375432d5bd73a1
SHA512 2f37e6e76c7f03c3e684bc02bd0de742bbda5acd95323915ae525ca50232e5b328b14bb37f5505ab91719a4c1fab7a0a34ed35dbc4c159a9df22cd382c34b84f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Documents\OneNote Notebooks\qap`g`v~dtlq
Size 10B
SHA256 00119ae807f1e98c855acaac912c5bfcd4edb1331caebc1c294dad099c55ff25
MD5 5ecb64c80b091d61480ef46e864967d1
SHA1 06c3d1e282581af87037030f4eaae672a1416784
SHA512 1da172a8b5b4c0e74ee75bc3a6e5d7c84800476039447bc3d56457921374a77d51603e47f27cbdbfdc7ae18359f9cea3c5b57bb7cbf35d14cac193c39a4d3aac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 271e1047e3114819bff473b9b45c3f9121cce324285ca67ad6baab2f230de612
MD5 19e14c4ab663676cc3312ebbefc49284
SHA1 8f28edb321b41c686990ab95d71d421c870d05dc
SHA512 4db8ad69342476b9c3effbf6df1ea9bfcde59467ae12024e8d049b5ae19e9bbf6c36c751a65187b7be3a5e8cdcf5bc77d6b600b2ce88cc8a2e9167266a0d880a
MD5 SHA1 SHA512

Submit Download

svchost_BCBCABCAAABCCCABBABACABCABBCCBABBCBCAAABBCCAAABABCABCAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCABCAAABCCCABBABACABCABBCCBABBCBCAAABBCCAAABABCABCAB.exe
Size 10.4MB
SHA256 862e80e445aad7d6316ef11eef5c5e51ad2873f3c0b901221358105ca2bc7aaf
MD5 7a9f2518d70bdbec976a44a5f2ad6525
SHA1 b9e4c30235c480d65691bf1278f29f410a5f4497
SHA512 1b757a06d00a87af0daf9392f4ba734b51415b70a65109b0037c59040ce3a99d8c037ee71972a1b478765419c9c3ea18e605d599b7ff046f997379cacf55e687
SSDEEP 98304:lKRuy5auKRuy5aL1MbQ9yDAD7KjjqkusjmqMhI:lqNq61tIDewjqkjiqM6
TLSH
T1F8B69E29FBE480F1F9ABA47899ABC376EA717A110833471BCA95C61F6F336514D18331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 b56ccd40299f275f81ca2a00042d88ff5097ae0f17fc2eba00e69b5e88c5713e
MD5 0d46d3666d7511fc7742bdbc41c575be
SHA1 46e2eb7cc9a94e67ce72c586c231b249f9b4ec6c
SHA512 f0cbb4c23bf2ca0cefa5e3d895913e1ae88fda2ac14c72a2935828ac049be32d896b0943acceb806dd83945aa9ccc58710bcc105ef1418e46c27cd4ba92598db
TLSH
T19411EB60F0D9EC33E42328CF9A29DF574CE1379FDC585AA5A31C42186B85C328E92CD2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 f0f07fd703326752cb6e63656ed8ae98ec2258c4b2cc94d030f39a2dfac2451e
MD5 f840ad33745a2d044a52b8ae85f73655
SHA1 bc944b73d308b2036cbf6f64e899d7ec992c103c
SHA512 2e94361b93476253fca47adc3dd4856956063a10e552dc9cfe9248f3242a68088c4bfaf58a2a2a0815512314815bb91b8e4e78bc710ea2a518adb1f26f4c9aab
TLSH
T11821A760B0D9EC63E423288F9629DE534CB5379FDC985AA5A31C41186B85C32CE96CD6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 569171ce34f5c1c8fa4bbc688dcb29413d876685e9c5f18436074ab7d27d43bd
MD5 eae09caa2e35c5537cad9da016f5a92b
SHA1 e2806b53484a88c8414e3db9bc948c1bb5e6a0a6
SHA512 b35da8401a2876b6bf0757bdabc30636af67d2a4a87cee174ef4d3eac40f61d5cdd27870b09641f7ceec9da6129c327ca730f75475eda7d9375f1361903f8f57
TLSH
T1ED21D670F0D9EC63E52328CF9A29DE934CA436AFDC9C59A5931982086BD5C32CD96CD1
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Public\Libraries\qap`g`v~dtlq
Size 10B
SHA256 2e65d05c5ea4e8760c8e091332fb7f7915af17430d9c8422442dc983f7a8ba6a
MD5 d5f7122234fccd5d34379894bd24cda4
SHA1 59a26fad1111a9aa8cb30da0b70398f6b015e0fe
SHA512 93254e697b7414f38cefc3c0598c65acb4fb63b0898e42e114caf0d5e6ef895469e055f894a15fe9f9d27cc271336ea19ae36edd3343616b7d37095c663038c5
MD5 SHA1 SHA512

Submit Download

memory/344-77-0x00000000027B0000-0x00000000027B1000-memory.dmp

Download

memory/1836-116-0x00000000008E0000-0x0000000000901000-memory.dmp

Download

memory/1836-95-0x00000000008E0000-0x0000000000901000-memory.dmp

Download

memory/2456-295-0x0000000000510000-0x0000000000531000-memory.dmp

Download

memory/2960-10-0x00000000002A0000-0x00000000002C1000-memory.dmp

Download

memory/2960-100-0x00000000002A0000-0x00000000002C1000-memory.dmp

Download

memory/2960-73-0x00000000002A0000-0x00000000002C1000-memory.dmp

Download

memory/2960-49-0x00000000002A0000-0x00000000002C1000-memory.dmp

Download

memory/2960-23-0x00000000002A0000-0x00000000002C1000-memory.dmp

Download

memory/4156-101-0x0000000000510000-0x0000000000531000-memory.dmp

Download

memory/4156-74-0x0000000000510000-0x0000000000531000-memory.dmp

Download

memory/4156-50-0x0000000000510000-0x0000000000531000-memory.dmp

Download