76127278cad5b47ae9273ebb1fcfdec223db2a46cd2cdd7bc25718d2ea573041

Analysis

max time kernel
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_7f01d39aed36fb9119d94f5fe86e9f64_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 28.2MB
Sample260810-e76f7sbj9z
SHA256 76127278cad5b47ae9273ebb1fcfdec223db2a46cd2cdd7bc25718d2ea573041
MD5 7f01d39aed36fb9119d94f5fe86e9f64
SHA1 152bebb609cb9b2180fc0d6a0c50390830662593
SHA512 20cdf979c398f69fb710a23674bd27024be1b45612610cea7a1d3f341a3f0304d98d47dc971ab2494836a52f89e5fc4c6941cec2f001f5702140e7992fa27fdc
SSDEEP 49152:U+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+EV:jA91pH2WpjHrgBFFu416AWvh
TLSH
T148575B05F94740F5D92B50B04DDBD3BBCA707E2282224BEBE65DDB1B2E337A16C28651
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCBAACCCBABBCABBABBABCABACCBCBAABBBACCBCACCBBCCCCAABACC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCBAACCCBABBCABBABBABCABACCBCBAABBBACCBCACCBBCCCCAABACC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCBAACCCBABBCABBABBABCABACCBCBAABBBACCBCACCBBCCCCAABACC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCBAACCCBABBCABBABBABCABACCBCBAABBBACCBCACCBBCCCCAABACC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3024	svchost_CCBAACCCBABBCABBABBABCABACCBCBAABBBACCBCACCBBCCCCAABACC.exe
4616	svchost_BBACAABBBCBACBCBCABABBCABCAAACBABAABCCBCCABBCBAAAACBBBA.exe
5776	svchost_CCBAACCCBABBCABBABBABCABACCBCBAABBBACCBCACCBBCCCCAABACC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBABBBBABACABCACBCBCCACCBBBACCCCCABBACBBBCCAAAABBCCCACBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBAACCCBABBCABBABBABCABACCBCBAABBBACCBCACCBBCCCCAABACC.exe"	2026-08-10_7f01d39aed36fb9119d94f5fe86e9f64_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCAAABCCBCCBCBBCCCABCBCABCCABCABCCBBAABCCBCCAABBCAAACAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBACAABBBCBACBCBCABABBCABCAAACBABAABCCBCCABBCBAAAACBBBA.exe"	svchost_CCBAACCCBABBCABBABBABCABACCBCBAABBBACCBCACCBBCCCCAABACC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5248	sc.exe
5000	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5728	cmd.exe
4844	cmd.exe
2864	cmd.exe
2928	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBAACCCBABBCABBABBABCABACCBCBAABBBACCBCACCBBCCCCAABACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBACAABBBCBACBCBCABABBCABCAAACBABAABCCBCCABBCBAAAACBBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_7f01d39aed36fb9119d94f5fe86e9f64_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3380	schtasks.exe
4676	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4384	2026-08-10_7f01d39aed36fb9119d94f5fe86e9f64_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4384	2026-08-10_7f01d39aed36fb9119d94f5fe86e9f64_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4384	2026-08-10_7f01d39aed36fb9119d94f5fe86e9f64_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4384	2026-08-10_7f01d39aed36fb9119d94f5fe86e9f64_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
3024	svchost_CCBAACCCBABBCABBABBABCABACCBCBAABBBACCBCACCBBCCCCAABACC.exe
3024	svchost_CCBAACCCBABBCABBABBABCABACCBCBAABBBACCBCACCBBCCCCAABACC.exe
3024	svchost_CCBAACCCBABBCABBABBABCABACCBCBAABBBACCBCACCBBCCCCAABACC.exe
3024	svchost_CCBAACCCBABBCABBABBABCABACCBCBAABBBACCBCACCBBCCCCAABACC.exe
4616	svchost_BBACAABBBCBACBCBCABABBCABCAAACBABAABCCBCCABBCBAAAACBBBA.exe
4616	svchost_BBACAABBBCBACBCBCABABBCABCAAACBABAABCCBCCABBCBAAAACBBBA.exe
5776	svchost_CCBAACCCBABBCABBABBABCABACCBCBAABBBACCBCACCBBCCCCAABACC.exe
5776	svchost_CCBAACCCBABBCABBABBABCABACCBCBAABBBACCBCACCBBCCCCAABACC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4384	2026-08-10_7f01d39aed36fb9119d94f5fe86e9f64_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3024	svchost_CCBAACCCBABBCABBABBABCABACCBCBAABBBACCBCACCBBCCCCAABACC.exe
Token: SeDebugPrivilege	4616	svchost_BBACAABBBCBACBCBCABABBCABCAAACBABAABCCBCCABBCBAAAACBBBA.exe
Token: SeDebugPrivilege	5776	svchost_CCBAACCCBABBCABBABBABCABACCBCBAABBBACCBCACCBBCCCCAABACC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 5728	4384	2026-08-10_7f01d39aed36fb9119d94f5fe86e9f64_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	91
PID 5728 wrote to memory of 3380	5728	cmd.exe	93
PID 3024 wrote to memory of 4776	3024	svchost_CCBAACCCBABBCABBABBABCABACCBCBAABBBACCBCACCBBCCCCAABACC.exe	94
PID 4384 wrote to memory of 4844	4384	2026-08-10_7f01d39aed36fb9119d94f5fe86e9f64_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	97
PID 4844 wrote to memory of 5248	4844	cmd.exe	99
PID 4384 wrote to memory of 2864	4384	2026-08-10_7f01d39aed36fb9119d94f5fe86e9f64_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	100
PID 2864 wrote to memory of 5000	2864	cmd.exe	102
PID 3024 wrote to memory of 2928	3024	svchost_CCBAACCCBABBCABBABBABCABACCBCBAABBBACCBCACCBBCCCCAABACC.exe	105
PID 2928 wrote to memory of 4676	2928	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-10_7f01d39aed36fb9119d94f5fe86e9f64_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_7f01d39aed36fb9119d94f5fe86e9f64_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABACCABBBAAAABBCACABBAACBCCBCACACCCCCBACBBBABCCCABCBCCBBCBACBABAACBCCCCABCCBABBBBCCBCCACCCACBABCAACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACCCBABBCABBABBABCABACCBCBAABBBACCBCACCBBCCCCAABACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5728
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABACCABBBAAAABBCACABBAACBCCBCACACCCCCBACBBBABCCCABCBCCBBCBACBABAACBCCCCABCCBABBBBCCBCCACCCACBABCAACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACCCBABBCABBABBABCABACCBCBAABBBACCBCACCBBCCCCAABACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3380
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACCAACABACBBBACABCAAACAACAABABABABBAABCCBBABCAACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACCCBABBCABBABBABCABACCBCBAABBBACCBCACCBBCCCCAABACC.exe" start= auto displayName= "UserDataSvc_BACCAACABACBBBACABCAAACAACAABABABABBAABCCBBABCAACBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACCAACABACBBBACABCAAACAACAABABABABBAABCCBBABCAACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACCCBABBCABBABBABCABACCBCBAABBBACCBCACCBBCCCCAABACC.exe" start= auto displayName= "UserDataSvc_BACCAACABACBBBACABCAAACAACAABABABABBAABCCBBABCAACBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5248
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACCAACABACBBBACABCAAACAACAABABABABBAABCCBBABCAACBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACCAACABACBBBACABCAAACAACAABABABABBAABCCBBABCAACBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5000

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACCCBABBCABBABBABCABACCBCBAABBBACCBCACCBBCCCCAABACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACCCBABBCABBABBABCABACCBCBAABBBACCBCACCBBCCCCAABACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCAACCCBABCBBBBBABCCBBBBCCCABBCBACABCBBBAAABCCCAACBCCABABCCABBACBACBAABCAABCABCBBBACBCABCBABABAACAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACAABBBCBACBCBCABABBCABCAAACBABAABCCBCCABBCBAAAACBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCAACCCBABCBBBBBABCCBBBBCCCABBCBACABCBBBAAABCCCAACBCCABABCCABBACBACBAABCAABCABCBBBACBCABCBABABAACAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACAABBBCBACBCBCABABBCABCAAACBABAABCCBCCABBCBAAAACBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4676

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACAABBBCBACBCBCABABBCABCAAACBABAABCCBCCABBCBAAAACBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACAABBBCBACBCBCABABBCABCAAACBABAABCCBCCABBCBAAAACBBBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4616

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACCCBABBCABBABBABCABACCBCBAABBBACCBCACCBBCCCCAABACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACCCBABBCABBABBABCABACCBCBAABBBACCBCACCBBCCCCAABACC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 33b3b05ecb1393b9641f772f884c7ca0b6d059d9e0d7ade71ad0664344943a81
MD5 0b0cf750796dee2b1e560887e2fd328a
SHA1 b1631c63578d6b30b73efd7a07cacd80f98f7be9
SHA512 841b46eb05b039ff5cba89fc8a80e80cede530bf9bac4d906829874435246704bb1441741b4f923f5a1a6b3a829661da5e69454694d28198628cbab069a4ce21
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 6482fba318795bdc2b34c2dde2d935d268cbaf3a5d35975bc8d7f2db6a2da412
MD5 73476d7bafb58bb3e666b197e3e42f11
SHA1 511aaffade8184855d56c582cead2e955a46a0f8
SHA512 941ae73e2f65c39b6861c066276c137f72b9b8db25dccc60d2d20b1622937f95c3ef4d1204b9ee0e6798b188388837e86b1fbf6b6193c73e914a0921fb3cba23
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Diagnosis\TimeTravelDebuggingStorage\qap`g`v~dtlq
Size 10B
SHA256 1ae649709d23a5ae483eeca4d8d3482d35f8ef84a16fc1528aa1c0f3f1903ece
MD5 3433d4586576bde1dbc337ae879ab95a
SHA1 85048b5a9c4fef96e7d7033347bd355c2ef68c00
SHA512 773228a3d4476e5959e32ff61b66fb0b84b5ea4d1adb48702a2362fcbc1d7c3009b9c2dc1349f12b8ec5f4b8f039c32726393d7a88e2b3fc6ee528675b3e62db
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Oracle\qap`g`v~dtlq
Size 10B
SHA256 77eb5c5a1cb0b983242722e43b4fe036ac4ddf06f3cbf987215e346f0e189a56
MD5 6096bd979b5705977858555b30858aab
SHA1 026903b8f3a738bb55fe23a56eb344e753dc5b92
SHA512 08f00eaf6b265d591eeb041e60028251e52883b019861b8767b064b3dc36ba1b3e9b4c78d3040e552d31d0a5a16018afb8085447f5d8ddb0023679db1731752e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\qap`g`v~dtlq
Size 10B
SHA256 6de1161cfc504bb623c2da2e94cda22ee16b2f4a750c49bfaf4c5ecc6ef99d5b
MD5 715a7cd1bedcff4b1ae090cca4378c0a
SHA1 d9b1a5196940b76b3c29157b929e8daf04e7077a
SHA512 dc0d21354e9a524ffab74b3d8fba2d91a265810eb8cb89807b251638be57f16bb6a44cd90ef9925a1059bb914146c4f5424372cebd597893e50ed62e22266c61
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 7141f7ce200fa9d26951b5b2da7f881b0f0f24ee83f2470f23ec5f6fee6c5b58
MD5 993d92601389f416afb74d10c0ff734c
SHA1 1c57dda4f90f9ec3003805c3c4295cbd50c31cd8
SHA512 785850dd7b48aec1cca7c031bd434cea2f615e1ef2ec612fd2ab4b4e393482d4f550f04ee0fbd48c6162f67d8e1f424534f6b8952c9bfa876b532507143fa432
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 719865247ea42f8f693c8673798f966ce7666a2e25e565c140f9b98b9db8cedf
MD5 14306c0cc2358828340663882dac25d0
SHA1 a44d976ea56a9ecee20c72e5caaae981eb5a682b
SHA512 fbc92a8a6d02571f6a889acef3c5176c85847095f49ba0326a20b9edfa04b9046a5222f63b5db99bec902cdc039294235afe84139686144cf2b2f43f40b01d92
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 33aa49964723e9bb5ab5f7cbf3a55a0beb0a64db038565ffd35f0df19f7a6c93
MD5 f602d334c611420607f53f71cb2bf1be
SHA1 afbf80bc981c37833a6de8982951cfd3f6fc4724
SHA512 e099e4753814152803cff51440832a0e8ccf71985b50834b12c2bf756b89482d6cc20d05e94a393d7930d152e0d9fe16394bf39dab54877625fc3ddbd08cbc27
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\qap`g`v~dtlq
Size 10B
SHA256 666ce289c3d666d9dd63aa5db00532bf19a1fa044a667d7b803b1ae38d751427
MD5 7a44f81d83cf9f5fda012ed765b5ff84
SHA1 f9820d4fe859d65b09e890f2dac717359eb77532
SHA512 b6664c0a5d4fb6f0abe06764f5e6052cf8ab68a1ae30938e881a1e14a41ebfc8c28b100303b3a65f20ad3c827f5b8caa60e363fc15b8137d0a8118dc63099aa0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Extras\qap`g`v~dtlq
Size 10B
SHA256 f791f312781dbe4648b9167a5fb073f3725440ea6fe5e05a49e612d8e099462d
MD5 8233540aab9d48490c9fa3acbc4beca3
SHA1 6cb7037fe8666b22312a433e937541bf7321fbaa
SHA512 03c5da6b6549ff82038fb074db9dd7298daab7c998577df6eefa2e0cec4e91db26fcb9f772194307bf70dfe695f227a97f6fb861df381263cea88bfba50df0b6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\qap`g`v~dtlq
Size 10B
SHA256 8a959c1d5b5755616800abba65a35d46cca83de8daea3e21e77e59bc1a0a01fe
MD5 69e5c50a35216520bb38be3c5b96bfbf
SHA1 a4345ff6e1849a10798ed08229d61cd592a457ef
SHA512 db5832794e90217e3f87e4b4f48065deaa3298ef5b5c1402e2017f88ba35e55b27915ac25572b48f8375f1548cd2ddd8d526f6ad30ba9cb3ed6b7b466db121b9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\qap`g`v~dtlq
Size 10B
SHA256 8827b2131711a8ae0721274e9bf94e72cab9df6eab709cd3638ae71f276b3807
MD5 05ff5ac24c24cd3e65e31ee08c7d4ae1
SHA1 75ddf8aa3891f2972acdaaadf364f972eaa645b4
SHA512 3f6df40a74cb4924cec10d98abd205161ba82d9e7b476659e3ff89ce24189be33fcaf3331a3c3deeb4bcdedf495f8c75e3516adda1b655bb07bbfc95a96efa27
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\Keys\qap`g`v~dtlq
Size 10B
SHA256 55b7b0bb5dbebc6c8453f7242a8305358fc4c1643e090d5cb89a5c3d81a1c74e
MD5 05e38c54ad1e5b4b8b4634daf46d9956
SHA1 3af6a04d06586cdb2ef4fcd07d624564a09158a5
SHA512 f8aab2ea00d82f78fa2c6583ac323cbcbbd087ae02b6ae1d3d131e5d3f639decef22e998d52ee22146f1f71b28352fbb26023bd22929a364fa7fad6f5e0a73e8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 24090b2830849ad0e3fb7575df62d5d4abb3e94dc72fd5420f7d730cebdbab75
MD5 b6622a3dfccb785968ac0cacd735f19c
SHA1 1c8349025dc3f18df1985d51e6877baf1f7326b0
SHA512 33ad56e8d79342615e3bf20919377759188ed90825f3749e519f00d9921b85868bf8fcfb1191c6cbbd4bd28889463451f22f69944386d020301e9002fda270e9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fcc49da4f2baf152fb57c69ac4b691d7a0aba8d01fd00da09fa7c47320ffadec
MD5 c954857f0739ca62ce65f85d58d2357c
SHA1 5a8b963456ec3b937d679c59ee8a02519ebba05b
SHA512 58c644317d7250b6ed6e2d691af6e43e96803c7d781c1f5bf4a02aa5600ad93c4b18929c91aa36983276d390c1942f5f04edd8637013983e24d07b6e6d7951ae
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f95b99776048252d7c49f4ae8e97496a11bcd1ad86ab134e19a013da1545e2ff
MD5 f8211c708cf61a9e080a55a4644e8857
SHA1 7fa245d22b3bc28598ef51b4ec4be67d86e7db90
SHA512 886227403a8309cc64a17af13a07f657e8df777d90731bd70ba9880850d7a81c99141a899cb39dd789a4514056eac7452383ab9e17be3003a717aa9ba0822fe2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2d159746bb3fd63eeb56231fae6ac399f291aa1d2d67037438b677d9b32075a3
MD5 93817ae79a8629e7d8b4f8cad1d60bd5
SHA1 32668c2efb001afe8533f8b84d23b9a0acf869c1
SHA512 3daee6a64f20340828992de8a1766b4296fbd79c75624c675a4dd8e2e279a99d5e9799a72e269686024a0b8621b840dd76a2e84cede5927b8f31386d26a27872
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f064444c8f6de06e51a8a993adb335d1823b8c2073318242cb76405eb6ebf743
MD5 2b47ef843e63e8126c15d17f7496cf3b
SHA1 15a46ced4874b77af378c36e43b232c002aad3b8
SHA512 2d15116251ce140310ec26426d2a5fd62fd3095fe015196e240ae05f2802cd77a4a375ff9e592e09ff339adfdf96b598d824cb7d89a7ca22d52b89d9b7594ca4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c6795764f3fbefbe08a0e107cb946bc9ab4f4f1f33e58edde5ebb80da2ea00f7
MD5 ec98c7f0d8d68834d85479d216058a89
SHA1 c11983f8303ee018b7146b70fa9c1e8df213c5d4
SHA512 6f3eb780c0ef7fa36b5fe1074de992a7b6789aea4afc79970292abd57dcd4d240a17cb64be2ea452838ea42131266d18c82468ccbbc834b9e82d85f992eba570
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Music\qap`g`v~dtlq
Size 10B
SHA256 5799bd2e853e2fab2afd10a7bd0131f4a764609c68a7410999b70d2f47a3c0fc
MD5 39787ae13df26a8c6121b9b405121528
SHA1 54fbf3e43cab43c97a49fdaeb6ceca335dd71825
SHA512 48c2b9f4175518d69afbb9423525e3d3d0b3a2fe85904885332df4e5573f6ff023c4f79864484ca03ee9ac7e496e9adb86c60d5a481febe6aab4eaedec0f9d20
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Music\qap`g`v~dtlq
Size 10B
SHA256 6bf55cb9c2830c78c2b9e0489edf1a32b7a5dd83be25a484a09dc01cf402b026
MD5 9656cc2042a19df819bc4102d97abfe8
SHA1 e943a94afc6ebad8de008d06579aaef5de449a33
SHA512 af2b2e3c1eb3b0ca4d9cc3a2e6544c8f78683f35d92f56744b9a9f6cc386d350d0ece4f7b57bdf5d6d3aa59a13ccb8fda080b102327518c850551cfa8d4ab0e8
MD5 SHA1 SHA512

Submit Download

svchost_CCBAACCCBABBCABBABBABCABACCBCBAABBBACCBCACCBBCCCCAABACC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACCCBABBCABBABBABCABACCBCBAABBBACCBCACCBBCCCCAABACC.exe
Size 28.2MB
SHA256 76127278cad5b47ae9273ebb1fcfdec223db2a46cd2cdd7bc25718d2ea573041
MD5 7f01d39aed36fb9119d94f5fe86e9f64
SHA1 152bebb609cb9b2180fc0d6a0c50390830662593
SHA512 20cdf979c398f69fb710a23674bd27024be1b45612610cea7a1d3f341a3f0304d98d47dc971ab2494836a52f89e5fc4c6941cec2f001f5702140e7992fa27fdc
SSDEEP 49152:U+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+EV:jA91pH2WpjHrgBFFu416AWvh
TLSH
T148575B05F94740F5D92B50B04DDBD3BBCA707E2282224BEBE65DDB1B2E337A16C28651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 25a1599c31b1697d07e7086f41bcd37c90629248cb7d26a301ab52819071ede1
MD5 b8ceaa9dc2a49b8f922be3be2ab1db37
SHA1 731fa5f782854d2be97f2584a940865419fdd33e
SHA512 46132a219acba7f733bd1920f049432c362f48860ce174acef61797390a64b61a5b71fe50280144307ce8cd837e4aceab1015db5084fe89c4efe2e3803858cdd
TLSH
T1FE212C51BCF9C8E3E93278DB551ADAF31C9427ABB86CBA00230D44186BC9D31DD954E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 d1f1675e24a80f0c6b8947df6134380d39781fe96782ae98cfbdb6fe891e577e
MD5 1163903e915918e663f370d83d1be9eb
SHA1 ef282608d72e7d26d8fb031ab88abae3d6c14dbb
SHA512 3dacb5601ff4a5c9b162cf1c2f257d04fd169c56a30259a03daa491db242dccd92fe80d867ccc70c382f9fdd81bd4121f8a1c9e6285db52f12154d956478aeaf
TLSH
T1E2210C61B8E8CCF3EA3368DB551ADAF31C9823EBB85CA900530D45186BD9D31DD954E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 64d7f21f3d4ae72f486a630d6b0d18fd95b3b8c0b19d1b8a4b21ec33ee9737e1
MD5 ce78cf9ace758c5068758a90b0d48510
SHA1 56d35ef0233b9c325a04b6afdfb0b2d86f3e3061
SHA512 1800cba2e530182c27422dc82ba6e96a1aa1e959dbc7ba487aa13d15bfab47cc4d341dcd6e5dbd6bfa4c0a0048c5c126c6ab2f4fc296563d0de446673cdc0bfa
TLSH
T1F1112B91BCE9CCE3E93278DB951BDAE31C9423EBB85CBA00230D41186F88D31DD954E2
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Public\Libraries\qap`g`v~dtlq
Size 10B
SHA256 e1565de104e0149c6bca17f8451f15db30b16fa8eb83c393ccc091574347cd59
MD5 fdb6e84c874c1076b8d38c1c7c03a6d2
SHA1 c563892621a8cb1f62208f749970fa11e90696ad
SHA512 73aefc7b6ba1f052aa524ad4f6c8f4c764c14d0923d4896dd73354e48b52f0e6b683a5ef393f40c06d8f3449f1626d939eaa8bb646d6815924c52b82b1047fb3
MD5 SHA1 SHA512

Submit Download

memory/3024-32-0x0000000000EF0000-0x0000000000F11000-memory.dmp

Download

memory/3024-47-0x0000000000EF0000-0x0000000000F11000-memory.dmp

Download

memory/3024-69-0x0000000000EF0000-0x0000000000F11000-memory.dmp

Download

memory/4384-10-0x00000000006B0000-0x00000000006D1000-memory.dmp

Download

memory/4384-46-0x00000000006B0000-0x00000000006D1000-memory.dmp

Download

memory/4384-97-0x00000000006B0000-0x00000000006D1000-memory.dmp

Download

memory/4384-21-0x00000000006B0000-0x00000000006D1000-memory.dmp

Download

memory/4384-67-0x00000000006B0000-0x00000000006D1000-memory.dmp

Download

memory/4616-1889-0x0000000000310000-0x0000000000331000-memory.dmp

Download

memory/4616-105-0x0000000000310000-0x0000000000331000-memory.dmp

Download

memory/5776-1389-0x0000000000EF0000-0x0000000000F11000-memory.dmp

Download

memory/5776-3463-0x0000000000EF0000-0x0000000000F11000-memory.dmp

Download