2e6c133252e1ed734b905621d91113ed2884070235afff148096c67222a19d5d

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_5aa1fdcd21b53e5b70dc470798a7b619_elex_glassworm_icedid_njrat_vidar.exe
Size 25.2MB
Sample260810-2e7vwsvxey
SHA256 2e6c133252e1ed734b905621d91113ed2884070235afff148096c67222a19d5d
MD5 5aa1fdcd21b53e5b70dc470798a7b619
SHA1 98084e71d332be35b8dcfdc0bc6ee6d59fee3e73
SHA512 ac12f5332c86cf79bffd5b5d40f4e4379adb3ee3cd1aa8a3ee2ad9ebbb5ecf978a18195512012088341926e87c058af74ee37e5274c52d0e601e31d4f8b73444
SSDEEP 49152:U+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+Ej:Z1MbQ9yDAD7KjjqkusjmqMhw
TLSH
T148476D19F94680F1E96B50704DDBD2BFDA707A2186224BE7EA8DC71F7E337915C28221
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CABABCCBBACCACCBBCAAABABBBCAAAACCACBCACBACBBBBBBBCABBAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CABABCCBBACCACCBBCAAABABBBCAAAACCACBCACBACBBBBBBBCABBAA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1460	svchost_CABABCCBBACCACCBBCAAABABBBCAAAACCACBCACBACBBBBBBBCABBAA.exe
6072	svchost_CCBCCBBCAABABCBCBCBCCBACCBBBABCCBAABACAAABAACBACBCCBAAA.exe
5172	svchost_CABABCCBBACCACCBBCAAABABBBCAAAACCACBCACBACBBBBBBBCABBAA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBACCBBABBABAACBBABACCACCCCABBBBCCABAAACAAABABCBCCCAABAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABABCCBBACCACCBBCAAABABBBCAAAACCACBCACBACBBBBBBBCABBAA.exe"	2026-08-10_5aa1fdcd21b53e5b70dc470798a7b619_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACCCAACCCABAAABACAAABCAACCCBBABCBBCCCCACCBCBCACACCBBCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBCCBBCAABABCBCBCBCCBACCBBBABCCBAABACAAABAACBACBCCBAAA.exe"	svchost_CABABCCBBACCACCBBCAAABABBBCAAAACCACBCACBACBBBBBBBCABBAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3872	sc.exe
2276	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
908	cmd.exe
1260	cmd.exe
4072	cmd.exe
3556	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_5aa1fdcd21b53e5b70dc470798a7b619_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABABCCBBACCACCBBCAAABABBBCAAAACCACBCACBACBBBBBBBCABBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBCCBBCAABABCBCBCBCCBACCBBBABCCBAABACAAABAACBACBCCBAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3396	schtasks.exe
4208	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5844	2026-08-10_5aa1fdcd21b53e5b70dc470798a7b619_elex_glassworm_icedid_njrat_vidar.exe
5844	2026-08-10_5aa1fdcd21b53e5b70dc470798a7b619_elex_glassworm_icedid_njrat_vidar.exe
5844	2026-08-10_5aa1fdcd21b53e5b70dc470798a7b619_elex_glassworm_icedid_njrat_vidar.exe
5844	2026-08-10_5aa1fdcd21b53e5b70dc470798a7b619_elex_glassworm_icedid_njrat_vidar.exe
1460	svchost_CABABCCBBACCACCBBCAAABABBBCAAAACCACBCACBACBBBBBBBCABBAA.exe
1460	svchost_CABABCCBBACCACCBBCAAABABBBCAAAACCACBCACBACBBBBBBBCABBAA.exe
1460	svchost_CABABCCBBACCACCBBCAAABABBBCAAAACCACBCACBACBBBBBBBCABBAA.exe
1460	svchost_CABABCCBBACCACCBBCAAABABBBCAAAACCACBCACBACBBBBBBBCABBAA.exe
6072	svchost_CCBCCBBCAABABCBCBCBCCBACCBBBABCCBAABACAAABAACBACBCCBAAA.exe
6072	svchost_CCBCCBBCAABABCBCBCBCCBACCBBBABCCBAABACAAABAACBACBCCBAAA.exe
5172	svchost_CABABCCBBACCACCBBCAAABABBBCAAAACCACBCACBACBBBBBBBCABBAA.exe
5172	svchost_CABABCCBBACCACCBBCAAABABBBCAAAACCACBCACBACBBBBBBBCABBAA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5844	2026-08-10_5aa1fdcd21b53e5b70dc470798a7b619_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	1460	svchost_CABABCCBBACCACCBBCAAABABBBCAAAACCACBCACBACBBBBBBBCABBAA.exe
Token: SeDebugPrivilege	6072	svchost_CCBCCBBCAABABCBCBCBCCBACCBBBABCCBAABACAAABAACBACBCCBAAA.exe
Token: SeDebugPrivilege	5172	svchost_CABABCCBBACCACCBBCAAABABBBCAAAACCACBCACBACBBBBBBBCABBAA.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5844 wrote to memory of 908	5844	2026-08-10_5aa1fdcd21b53e5b70dc470798a7b619_elex_glassworm_icedid_njrat_vidar.exe	92
PID 908 wrote to memory of 3396	908	cmd.exe	94
PID 1460 wrote to memory of 5708	1460	svchost_CABABCCBBACCACCBBCAAABABBBCAAAACCACBCACBACBBBBBBBCABBAA.exe	95
PID 5844 wrote to memory of 1260	5844	2026-08-10_5aa1fdcd21b53e5b70dc470798a7b619_elex_glassworm_icedid_njrat_vidar.exe	98
PID 1260 wrote to memory of 2276	1260	cmd.exe	100
PID 5844 wrote to memory of 4072	5844	2026-08-10_5aa1fdcd21b53e5b70dc470798a7b619_elex_glassworm_icedid_njrat_vidar.exe	101
PID 4072 wrote to memory of 3872	4072	cmd.exe	103
PID 1460 wrote to memory of 3556	1460	svchost_CABABCCBBACCACCBBCAAABABBBCAAAACCACBCACBACBBBBBBBCABBAA.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-10_5aa1fdcd21b53e5b70dc470798a7b619_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_5aa1fdcd21b53e5b70dc470798a7b619_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABCBBCCCCABABACBCBCCAACBCCBABAAACACACCCBCCABAACCBCCBBABABCCBBACAAAAACBBCAACCBCCABCAABBCBCACBBCACBCBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABCCBBACCACCBBCAAABABBBCAAAACCACBCACBACBBBBBBBCABBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABCBBCCCCABABACBCBCCAACBCCBABAAACACACCCBCCABAACCBCCBBABABCCBBACAAAAACBBCAACCBCCABCAABBCBCACBBCACBCBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABCCBBACCACCBBCAAABABBBCAAAACCACBCACBACBBBBBBBCABBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACABBCCCBBABBABBACAAABBBCCBABABCBBBBCCCCCCCBCCBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABCCBBACCACCBBCAAABABBBCAAAACCACBCACBACBBBBBBBCABBAA.exe" start= auto displayName= "UserDataSvc_AACABBCCCBBABBABBACAAABBBCCBABABCBBBBCCCCCCCBCCBCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1260
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACABBCCCBBABBABBACAAABBBCCBABABCBBBBCCCCCCCBCCBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABCCBBACCACCBBCAAABABBBCAAAACCACBCACBACBBBBBBBCABBAA.exe" start= auto displayName= "UserDataSvc_AACABBCCCBBABBABBACAAABBBCCBABABCBBBBCCCCCCCBCCBCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACABBCCCBBABBABBACAAABBBCCBABABCBBBBCCCCCCCBCCBCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACABBCCCBBABBABBACAAABBBCCBABABCBBBBCCCCCCCBCCBCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3872

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABCCBBACCACCBBCAAABABBBCAAAACCACBCACBACBBBBBBBCABBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABCCBBACCACCBBCAAABABBBCAAAACCACBCACBACBBBBBBBCABBAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAACBABCACCBBACABCABCABBBBACCCBBCCBBBAABAAABCAACAAACACBCCAAACCBABCBBCAAABBAABAABBACAABACCCACCACBCAACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCBBCAABABCBCBCBCCBACCBBBABCCBAABACAAABAACBACBCCBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:3556
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAACBABCACCBBACABCABCABBBBACCCBBCCBBBAABAAABCAACAAACACBCCAAACCBABCBBCAAABBAABAABBACAABACCCACCACBCAACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCBBCAABABCBCBCBCCBACCBBBABCCBAABACAAABAACBACBCCBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4208

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCBBCAABABCBCBCBCCBACCBBBABCCBAABACAAABAACBACBCCBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCBBCAABABCBCBCBCCBACCBBBABCCBAABACAAABAACBACBCCBAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6072

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABCCBBACCACCBBCAAABABBBCAAAACCACBCACBACBBBBBBBCABBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABCCBBACCACCBBCAAABABBBCAAAACCACBCACBACBBBBBBBCABBAA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 e29e89e15c4d408afecea3b5a66caacec8c75a55c24c32e8686e4d67278e025c
MD5 81209577a31438ce80b34995b7ad0bd5
SHA1 10bb5bf1e8fcb2fcd26864adcbfe1c0ac56fd8e9
SHA512 28cd41cee4048c439c735562712ae94f0fe0f28000bb7e309c550ac3d53e0164ed7feceef08b0fd9a51c7facfc117351554916351e30150d5a8592c65f494641
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 ff52ce45951b731a533b490657ccd433bcd768a31048c7e1fb617532cadca544
MD5 34ed11b9a4a7cfa88e270734aa1d7e96
SHA1 fac1e72e442e8e88aa6b1c2176bce80aa8eaaf9e
SHA512 0a0f5c574e4e9951c0859b076b62cbcc3c2a115ca82cffbc2bd468b0addb95382e3da7d519f1cc8980106adfe4c7c5a68b75d8da44cac2dceb0671176e04320d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 2ea75de8eea8e27eb1d704fa2536224138e8dc75d3c79a44ff4a533c7e749f09
MD5 f2901acaa4d90eb4e5b49b646531c111
SHA1 f2741eaa919d3266407347e13048c742bec67238
SHA512 5775b5ce24bb4b6402de2f3a2923ad002a04f3f382e3b40cd75652eec35dd5b256b6a38147beecfad272998f68afbcf1cc52691845882dc8496fb218266e9eec
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools\qap`g`v~dtlq
Size 10B
SHA256 2979c9e20d51c8baf3192a80bfd2b3757105625e7be24e4db7948bb41269120b
MD5 2ecfdbd9b4ce7a6f3691d9eb2ae2c32a
SHA1 dcd0ae4e83ec9c6c171b0899e3842ef2227fb869
SHA512 e36d5ce3eb2fb5791e9bde1021d1e294188d81283dbae2a8ba91521ef75fddbf2eb6a9da7ad05f7fccec1bead0580050e97efedb74b86c6f5bcd8d8a62ac3b35
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 25.8MB
SHA256 9e83dbe9515c1247b12e428a7a0c3a1b5fdb78dd55a9d8299bc240029575b8cb
MD5 3097f7c396a72bd8ac13f2b23a95b9ba
SHA1 d324330d206db8e9388508ac3707a652d405a94f
SHA512 1c3fb69bf3d5909c319baa7e91125b0e90464e5b63cd71fed0ab8b6f4f57312f2487ea051ff0d5b8ae3da37ee691f2f33414dffa99069712e46dc7be56b6303c
SSDEEP 98304:Z1MbQ9yDAD7KjjqkusjmqMhvgZ2Hb9t+2xU:Z1tIDewjqkjiqMtgZ2jU
TLSH
T14F477D19F94680F1E96B50704DDBD2BFDA707A2146224FEBEA89C71F7E337915C28221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 46b6b131614876bfed2d55a8e6e95e63d7fa32ddc3486af44007efdaa86a3469
MD5 eb87595e160319ecd55e7d27939cfd64
SHA1 66bd37a091ddf286ba2e96fdbd21475c4b1c0cc1
SHA512 0a5d9e40bc627c051f90921ada90cb63e2c66ac285fd76ad9a6fe400d23f16e225182431c4a3a720ddc1664d5cbcf4e90a962e20652c53ed0d080c9c840e8532
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 881026c5aa084ad33c9fe6e268430b06ecc419e459f1c554466c67803b949e31
MD5 e2da7ae30760a5bdee72fe9c28f18e84
SHA1 459d06079badaba4c22aa25f2c99a92750fef719
SHA512 dec02f1ff456c981ca590c392c6e711220325ef5e11b42109df10c35e777734b994433e19429c0fdb22d62264134b3384ff994a70554e4e42bd69d7494c779a5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 95b2bad237ce149a8d64eb0782315a82cf6f8f7dccdfa1cc12cc79876e3a1f58
MD5 69de9de19e5fed4d161a47f0e6a2bc6e
SHA1 481d2a6afec9eaecc83cdeca88499c1e38ebae18
SHA512 c6844bc207cd79641dc13f71a04423b22b04f731ea3201d8e61f2ea31a28813d67e3fb3a051ebe65c9315cd5920bc3a3660622206976d1de6dc3f45ea3ba5a36
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 a0eb8043c8db314e815aa5c7bdbb9764674624b9e8c1b777fb5a0468ab58f49d
MD5 c312cd053cc53a21a7176cdb63cc6424
SHA1 6a7af019c2ce4790755e0792138875f52b4e7a21
SHA512 12dbc1790950ff1bcc6e9d1d8fd151b363f8ca3fa91749bba8d37638ee73c75f6a3b121b0e197a7c765c3623fbd4f17ca103f71ed822a407c3080321d104b449
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57\qap`g`v~dtlq
Size 10B
SHA256 6b989c7d9a7acd1fd67ca8977de23e8edf52420f2050d6a518f1bd64a1e720d0
MD5 d26efca36a4f3bb8d5020d97b6dcef50
SHA1 36e9618cf2f747b15dd0a2b160223e72743e36ca
SHA512 0a27f124d815cac8f886ad4c00a7a35b87251959208543f99b37535662afda44cfc437d9f8ef4f240d18eb0c6a6040edbf46028fc2857c359d7b9bff5be96ecf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\qap`g`v~dtlq
Size 10B
SHA256 461000ea25aa674c6d3bb0a21937e78b9589ec5d53c75a6229a24fd85f378c8b
MD5 09ddd7a7aafc0565f293407c2f1992db
SHA1 d793180de948cf0ecbe86897d3c53ef1dc91c622
SHA512 f2392c25abb09eb6b4aab6733aa28fb4e2714648dc15e7718c05d32e61042658b4a6ff711b8da8cbea18b6d31dc16ebb0f9e466a7735c74fd7ae8858c37f1ab9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\prs-AF\qap`g`v~dtlq
Size 10B
SHA256 51e37cf42ea9a3e9ebf0b45b22affabc95bf276cf5a9b985d6afae76dfd97c1a
MD5 95aa7ae861d4eceb7e2aa0b2fa7f8188
SHA1 7053752ec0313f3e52f3266378c03162de1bde8e
SHA512 4faeee20b65784492207e4a93ae1d45154fa040c3eb1fc26fe268463d6979e6863ed21ae5bfa30efe918d34cada48ea90aa923cb23df4bdcbd37d35675c52c12
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 34c2a12b5d475ac250e1dadd5c4bf62e78821feb0b9f4705d5079cb2665b7c37
MD5 c0db599ef98e49892bbf50b2662706ff
SHA1 5152aaf06e77384964146cd785f92b2f4c7b8493
SHA512 eef8b5578e70cb3d505e2887e6d5343e73263d4420901658d7151eb3d4be96607317d8e432eecde819d329decc78d93585b6c6a209494ba5e0d352452fd12c1c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\qap`g`v~dtlq
Size 10B
SHA256 beb057f1c0e6848a82ce65ce5618b22cd1d7c20a2acf3412ea5c9cad0f763d50
MD5 4de2f0f0b80142adf794666313b1e0c9
SHA1 f71ef0b8ef4527091adb7300066b0380c1c0ad34
SHA512 d10e64e48064767452d2d389bea89bb33f7d424fa33cbcf06d055ef32bc4ac5b200fe0b9cdef4f6809cc4e47accf31aaabff43bffe67c7608b52ad26c2e5bd5e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8984800e4f01ff2cc9b03854396dbb767c18493cfcd3e05e81e3fbb92dfc3cc1
MD5 eedb43620ae490fbc1d4ec1acadbb502
SHA1 670c9d03d461aec8953f01e1e95ddedf10e9c566
SHA512 3f01efa8393f5a3b90f52c425d8b60a7c54e20cafea6face88d98273f0ba9d15323afd2385a140112cf826f8c4c767a685aaaf44ae2026dd6076f289a2764f3b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f1e48ca3877379134f5d48bc4e6f3e55f9e13a030f4969108bd65705610053a8
MD5 1ca32c00c93a400aaf2c3b951416f559
SHA1 fd314a5fd4df0de423f803fed63f7149738323e6
SHA512 2e36e33ecac724ceb25b535418294e5acfc28af4dbaf813fd458b059805a38658330b66bb67e95d9d663ac1735377f0e009497a62a9d16e3589dab038bca5d0f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 70dbf871642cc92068a5cbb22c16cf922fd19561363c78a01b65d6bde299c279
MD5 2092a71c5ce477bb78083f1e3fa029eb
SHA1 76884dbaddd41eb17c92fe1d184b117b4049f030
SHA512 52f2d205eb1d9388757ddff4507cd359addc2ea820985a121565d85ae002a130dd798b815cee208143ca0d91779b4dac8306fac5775b1ff098c11f92b8860283
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5ed52c9ddd10ab79aa3a9b052d06a3e78a17823f9922c7600b1a90c154f0152d
MD5 7d8b052fbae8a2bd700a2cf0f6e2a956
SHA1 9b168fa392e4e960649b269870130623c70d99ce
SHA512 2e81e88cbe2094009bbfff700b5447700be2848fe9c5db3091c6cb5460899059e10fadfede5df770b847ed244fe417661b06efba7a16e42a9bce0e35e1e6bdf4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e1417f681afc73f0be4cb40dddda8a5c020d332f72337b7554b1cc80ffb51155
MD5 81c86997a5798f7979761a8fe261c158
SHA1 595f047de63fce5a21adb3c877e10612927efae3
SHA512 5fad8081cfa9e2dc51372b63a873da70d97964aed9ae064a0171ab1a8d9d784aea5ea266baa8e8caeea62fdf9450e9ee9c789ed41c05b1a96e3d067010774117
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 54b38b804ab9f1115788cea71150170b6b6df18143a5fd8372a187e5fc6fdcfd
MD5 a022f967c544c63f0d09f236b395b18d
SHA1 fe31e8fce9a131319fe39e5f5a4ba1df9fe42b26
SHA512 14baac3cf43b20a8c98c20e9f317d0b25e3718b43959a066e85571d94bbd966f91e6599b509230644114aab7aacf5e613ba7ba860efcd6b82ed4917e04dcd5a4
MD5 SHA1 SHA512

Submit Download

svchost_CABABCCBBACCACCBBCAAABABBBCAAAACCACBCACBACBBBBBBBCABBAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABCCBBACCACCBBCAAABABBBCAAAACCACBCACBACBBBBBBBCABBAA.exe
Size 25.2MB
SHA256 2e6c133252e1ed734b905621d91113ed2884070235afff148096c67222a19d5d
MD5 5aa1fdcd21b53e5b70dc470798a7b619
SHA1 98084e71d332be35b8dcfdc0bc6ee6d59fee3e73
SHA512 ac12f5332c86cf79bffd5b5d40f4e4379adb3ee3cd1aa8a3ee2ad9ebbb5ecf978a18195512012088341926e87c058af74ee37e5274c52d0e601e31d4f8b73444
SSDEEP 49152:U+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+Ej:Z1MbQ9yDAD7KjjqkusjmqMhw
TLSH
T148476D19F94680F1E96B50704DDBD2BFDA707A2186224BE7EA8DC71F7E337915C28221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 0a4d4433057ccf6989227374ed9b5fc5e29369d0d615771fea3d3c0c61b37e45
MD5 437817c536f140bcab7c481ce1a23e79
SHA1 2d8c294f63a094908b987c3796b89b9c12211512
SHA512 ceee4afa4b66a169b17cd4d4ab823279b97326251548034845f3c06997171435b9da67fa4e8b6d6f412164151ba2e02923f3657b895ac6b88a103162305a8832
TLSH
T12F218B65E4F9DC23B93354CB932AAAA20CA8377B9C5C9D1413098118A7D5C35CD5D4F1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 a55c16f5a06348a6faa1d0994f816bea662696e580f332d2dfd224831e2fcb13
MD5 dd1d3910d3a67115c179894110ac6299
SHA1 e29a41d4d4ac832d0575f53e1f7285de7ac65a56
SHA512 748be298e3e3742d0b974aeacb0a7040c4d349bff75d0d93572d2b279035303ebcc35dd2dffe749d655541b1a20b50e0b9d2ea436ddaf12c43ce099e6d2721ae
TLSH
T11F11A754B5FDDC23F93324CB922AAAA20C943777AC18AE1823098118A7D5C368D5D4F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 1e010c0ca92cc963996f7164ba4f72a9aaf1892a01ad7be14727c73bb7caf8a0
MD5 8747923103e55b43630798905e5f7b06
SHA1 7969912352e82b6d1ffb3a14113829dee93a96ba
SHA512 c75a41ff7a7828b6fc37a7f24351101b79ec9d863e1b107b97f83ccb9b0edf58f1fcb1b315471be03d71e5e8f40c560ffdf8d815a351ab4de02d9ed5ccdf1c4b
TLSH
T1E6219954B5FDDC23BD3364CB932A9AE20C983777AC58AE1823099118A7D5C36CD5D4F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1460-22-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download

memory/1460-32-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download

memory/5172-2910-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download

memory/5172-433-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download

memory/5844-6-0x0000000000540000-0x0000000000561000-memory.dmp

Download

memory/6072-78-0x0000000000DF0000-0x0000000000E11000-memory.dmp

Download