b6f967b26e2329f9e2ac8d62a4f2bebe1916d12744838508416140a7f34601a0

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_e406129451afd35793da9938d88203e9_elex_glassworm_icedid_njrat_remcos_stop_vidar.exe
Size 30.2MB
Sample260810-eedwgszhpg
SHA256 b6f967b26e2329f9e2ac8d62a4f2bebe1916d12744838508416140a7f34601a0
MD5 e406129451afd35793da9938d88203e9
SHA1 e229f35557f0892c674637c4cfac74662cc5bb83
SHA512 df6364fa437e52dbf69ca3dbd3b70a7a07d558f834c67312d6a668d9fd8be56502c13d3963211afcc7bd9340b26627f668123da85dbd003a0dd6a399a9396225
SSDEEP 98304:Jp7Dp7Dp79rU5Ep7Dp7Dp79rU5F1MbQ9yDAD7KjjqkusjmqMhb:vBB+5KBB+5F1tIDewjqkjiqMt
TLSH
T135673A29A6A4C0E5E46A973899678271E9717C100A3243BFDDB0F62EDE3B5B14D3C731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBCCBBCBBBCBCBCCBABBAACBCCBAAACBBACCCBCBACCABCCCBCBABBB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBCCBBCBBBCBCBCCBABBAACBCCBAAACBBACCCBCBACCABCCCBCBABBB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBCCBBCBBBCBCBCCBABBAACBCCBAAACBBACCCBCBACCABCCCBCBABBB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBCCBBCBBBCBCBCCBABBAACBCCBAAACBBACCCBCBACCABCCCBCBABBB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5972	svchost_BBCCBBCBBBCBCBCCBABBAACBCCBAAACBBACCCBCBACCABCCCBCBABBB.exe
4288	svchost_BCCCAABABCCABCAAACBBBBBCCAAACCAACCBCCBBCCAABCCABCACCAAC.exe
1504	svchost_BBCCBBCBBBCBCBCCBABBAACBCCBAAACBBACCCBCBACCABCCCBCBABBB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABBACCCACBBAACCCCACBAABAABBCCACABBACBABCBAAABABCBCBCABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCCBBCBBBCBCBCCBABBAACBCCBAAACBBACCCBCBACCABCCCBCBABBB.exe"	2026-08-10_e406129451afd35793da9938d88203e9_elex_glassworm_icedid_njrat_remcos_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAACBCAACBABACBABBCCABBBBCBCBABBBBBCBABACAAACABBBBBACABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCCAABABCCABCAAACBBBBBCCAAACCAACCBCCBBCCAABCCABCACCAAC.exe"	svchost_BBCCBBCBBBCBCBCCBABBAACBCCBAAACBBACCCBCBACCABCCCBCBABBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3464	sc.exe
248	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6208	cmd.exe
6844	cmd.exe
5420	cmd.exe
4876	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_e406129451afd35793da9938d88203e9_elex_glassworm_icedid_njrat_remcos_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCCAABABCCABCAAACBBBBBCCAAACCAACCBCCBBCCAABCCABCACCAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCCBBCBBBCBCBCCBABBAACBCCBAAACBBACCCBCBACCABCCCBCBABBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1596	schtasks.exe
204	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4088	2026-08-10_e406129451afd35793da9938d88203e9_elex_glassworm_icedid_njrat_remcos_stop_vidar.exe
4088	2026-08-10_e406129451afd35793da9938d88203e9_elex_glassworm_icedid_njrat_remcos_stop_vidar.exe
4088	2026-08-10_e406129451afd35793da9938d88203e9_elex_glassworm_icedid_njrat_remcos_stop_vidar.exe
4088	2026-08-10_e406129451afd35793da9938d88203e9_elex_glassworm_icedid_njrat_remcos_stop_vidar.exe
5972	svchost_BBCCBBCBBBCBCBCCBABBAACBCCBAAACBBACCCBCBACCABCCCBCBABBB.exe
5972	svchost_BBCCBBCBBBCBCBCCBABBAACBCCBAAACBBACCCBCBACCABCCCBCBABBB.exe
5972	svchost_BBCCBBCBBBCBCBCCBABBAACBCCBAAACBBACCCBCBACCABCCCBCBABBB.exe
5972	svchost_BBCCBBCBBBCBCBCCBABBAACBCCBAAACBBACCCBCBACCABCCCBCBABBB.exe
4288	svchost_BCCCAABABCCABCAAACBBBBBCCAAACCAACCBCCBBCCAABCCABCACCAAC.exe
4288	svchost_BCCCAABABCCABCAAACBBBBBCCAAACCAACCBCCBBCCAABCCABCACCAAC.exe
1504	svchost_BBCCBBCBBBCBCBCCBABBAACBCCBAAACBBACCCBCBACCABCCCBCBABBB.exe
1504	svchost_BBCCBBCBBBCBCBCCBABBAACBCCBAAACBBACCCBCBACCABCCCBCBABBB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4088	2026-08-10_e406129451afd35793da9938d88203e9_elex_glassworm_icedid_njrat_remcos_stop_vidar.exe
Token: SeDebugPrivilege	5972	svchost_BBCCBBCBBBCBCBCCBABBAACBCCBAAACBBACCCBCBACCABCCCBCBABBB.exe
Token: SeDebugPrivilege	4288	svchost_BCCCAABABCCABCAAACBBBBBCCAAACCAACCBCCBBCCAABCCABCACCAAC.exe
Token: SeDebugPrivilege	1504	svchost_BBCCBBCBBBCBCBCCBABBAACBCCBAAACBBACCCBCBACCABCCCBCBABBB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 6208	4088	2026-08-10_e406129451afd35793da9938d88203e9_elex_glassworm_icedid_njrat_remcos_stop_vidar.exe	93
PID 6208 wrote to memory of 1596	6208	cmd.exe	95
PID 5972 wrote to memory of 5404	5972	svchost_BBCCBBCBBBCBCBCCBABBAACBCCBAAACBBACCCBCBACCABCCCBCBABBB.exe	96
PID 4088 wrote to memory of 6844	4088	2026-08-10_e406129451afd35793da9938d88203e9_elex_glassworm_icedid_njrat_remcos_stop_vidar.exe	99
PID 6844 wrote to memory of 3464	6844	cmd.exe	101
PID 4088 wrote to memory of 5420	4088	2026-08-10_e406129451afd35793da9938d88203e9_elex_glassworm_icedid_njrat_remcos_stop_vidar.exe	102
PID 5420 wrote to memory of 248	5420	cmd.exe	104
PID 5972 wrote to memory of 4876	5972	svchost_BBCCBBCBBBCBCBCCBABBAACBCCBAAACBBACCCBCBACCABCCCBCBABBB.exe	107
PID 4876 wrote to memory of 204	4876	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-10_e406129451afd35793da9938d88203e9_elex_glassworm_icedid_njrat_remcos_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_e406129451afd35793da9938d88203e9_elex_glassworm_icedid_njrat_remcos_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCBBABACBACBCCCBAABCCCBBCACCABBAAABACCBCBBBBABCCBBCBCCCABCCCACACCCBAAACACABACCBCCCABBABBABAABCAABACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBBCBBBCBCBCCBABBAACBCCBAAACBBACCCBCBACCABCCCBCBABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6208
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCBBABACBACBCCCBAABCCCBBCACCABBAAABACCBCBBBBABCCBBCBCCCABCCCACACCCBAAACACABACCBCCCABBABBABAABCAABACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBBCBBBCBCBCCBABBAACBCCBAAACBBACCCBCBACCABCCCBCBABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAAAACCCAABCBAABBBBBCACBBAABACACBCBCCBBBABCBBBCCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBBCBBBCBCBCCBABBAACBCCBAAACBBACCCBCBACCABCCCBCBABBB.exe" start= auto displayName= "UserDataSvc_CAAAACCCAABCBAABBBBBCACBBAABACACBCBCCBBBABCBBBCCBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6844
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAAAACCCAABCBAABBBBBCACBBAABACACBCBCCBBBABCBBBCCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBBCBBBCBCBCCBABBAACBCCBAAACBBACCCBCBACCABCCCBCBABBB.exe" start= auto displayName= "UserDataSvc_CAAAACCCAABCBAABBBBBCACBBAABACACBCBCCBBBABCBBBCCBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAAAACCCAABCBAABBBBBCACBBAABACACBCBCCBBBABCBBBCCBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5420
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAAAACCCAABCBAABBBBBCACBBAABACACBCBCCBBBABCBBBCCBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:248

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBBCBBBCBCBCCBABBAACBCCBAAACBBACCCBCBACCABCCCBCBABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBBCBBBCBCBCCBABBAACBCCBAAACBBACCCBCBACCABCCCBCBABBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5972
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCABBCCBBACCBCBBACACACBACACCBBBBCCCCABABCCCBCCABCBBBCCCACCCCACAABAAACCBAABCAABABABBCAAACBBACAABBAAACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAABABCCABCAAACBBBBBCCAAACCAACCBCCBBCCAABCCABCACCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCABBCCBBACCBCBBACACACBACACCBBBBCCCCABABCCCBCCABCBBBCCCACCCCACAABAAACCBAABCAABABABBCAAACBBACAABBAAACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAABABCCABCAAACBBBBBCCAAACCAACCBCCBBCCAABCCABCACCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:204

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAABABCCABCAAACBBBBBCCAAACCAACCBCCBBCCAABCCABCACCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAABABCCABCAAACBBBBBCCAAACCAACCBCCBBCCAABCCABCACCAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4288

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBBCBBBCBCBCCBABBAACBCCBAAACBBACCCBCBACCABCCCBCBABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBBCBBBCBCBCCBABBAACBCCBAAACBBACCCBCBACCABCCCBCBABBB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 cf8c80595be69d12ed7956260cbfaaa49fd58ab349f157970da6915a780d7001
MD5 d6b25372657d446664676b9375868d69
SHA1 2114b663e7e26dbce674003043c08c6b31bc90db
SHA512 58f021b371d51509220fba67074777b3f1a1ee4afc4101c13eee49ce8f28ab1d926376b6f3728f72e46fb71de70b18f4ef14e1a8928c5156e5bcc9b23a35d202
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 2e9b029813d50b61ccde31b68b44ffbf4306ee9f21cb10b993feffda6221b927
MD5 516135f82363ae7b6019b6599956a8bb
SHA1 3465fec6642b322e088f19d9e14536906b20d495
SHA512 1de02ac71fbbe15701fa312eee3f0bb77bbefe6992219b9f0673f5a94958eeb02f243e894fc1f698915c2c68426d9ad4c65b2406fb58613da589e3a7700603c4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\CapabilityAccessManager\qap`g`v~dtlq
Size 10B
SHA256 6c1177962efe4c1d373ebb2ede1083cfff978388cb651abd95480c0e28ac3b8f
MD5 07b0c0d40c404f3d4cb4128df9e15de1
SHA1 1e5c85a75f595a20885b48ebb14d6c104568d949
SHA512 abac40356c4667c507cfeecb1a4e7f2fa6918730e475833617044113f0d531083eaa983bea4fb5f99e59bd6d9b30b57dbdfcb2d5ac29f94d867cbdc8ae06a828
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 4ac8ef4dae5e4d38ca4ef5438502f4889f70e648c9edb68ad5bc9ef6d847bb5d
MD5 953d2715ce2e1ca89863795f29ce0c66
SHA1 9b1ec626ad3dbaa2c34483ed5b866a8748cb1214
SHA512 827422742bc327028ab82416e5e4343ba1cbbc7ef0268938e42e49321f58fbe7b467fef9550aaa515704245fcda3c1221a363744be62aaa929cc6d20dd751709
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 453162e8164149ad02b7ce12a564fe44dadf57c4b6bb52072a16288be118d6d3
MD5 3be6b859b21ce706074befa112524adb
SHA1 cab3b9c893b58a8a58154d99370aa234dfc66860
SHA512 d01d870fdac756485532ec8ffe73a8fe354fb045da3e920a505301ded21ba51511f1504a501ef6aefe78533bbdb346894944e5c10639b39bde78ddd1bee636f3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 20773eef939d73fde92ae31dce362bfe12d0e16acc915fdd72912fa6c85d6f22
MD5 c850f31d716620d7d6a7f9677078d7c9
SHA1 e8a0861ea301df690382476f8be2831f34f29834
SHA512 52ce80c36a849585ddc861c06b8a194db0aae857fa64e5d9b9ed5b09d7a28e32c45398b56b2eda23008fc82ee6b5f9ac02693f3a770218434b93f792680e5403
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 0f6402a203c8f5e4eec345f6cc5e6f8e9bc6537554cafb64ce0bce9398f23e70
MD5 df01d428d29b6f92325b2b84dd8802de
SHA1 6de8a4c1ffa2aaa35c20b0b56c3bf8b884cbdf6c
SHA512 534fd003d2ddc84b6329732fd2b32b9156ab80c1b01f72b1a2ca3af05e484c208984bca72f9ff17c13ae8e5f4d6814d14ad6b49cd199cc0c042c0475bcb518ac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB\qap`g`v~dtlq
Size 10B
SHA256 e5a9a10bfc082cae974df6a3a1c8177dd36e56bc4cccecfef2d8f1257ab8d124
MD5 3a381301ae7b8f77589c20e7ccdc0256
SHA1 9787727f92c9f20af80960312c3e193225b6e78d
SHA512 3fc5199656d5894eb241309f32f93aaaff41d15783560b2aff131706f7f6946dbc09b38950eea83a7c4db3813dd5cb79ea1a6ce65fc9c283dbf08ccf0994b183
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 77f258476c981832f166f1e87b348b53e071e92d0e66cbfe58a77aa7f3869815
MD5 122e7d7a82b0a421edc47917fc9ac8f9
SHA1 1764e188772cae8d3289eaf505b4842f2787f598
SHA512 3154e09098c2ee45c85f36e1306c7ff28fdb5defc85b91b1e964eb95d6eca2423501b6cdcb637a7eae0bb33ee973ebd7cdecd1eda4ad1bb9f8a56b02e959d86f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 7fceb216f4f5c3a4f852b42f8a0f91e19857f78fb570482a8093ab092f5f12fb
MD5 c857d2ecabed9aeb12fad0592686f16a
SHA1 77335787f5cb54d3d2fd6f531b434e3912ee8d18
SHA512 53be6bd94429601820f4c97953678980a64cb41f403e7ea400b9e53375f32af2f9812ec8e55391040bd4456c05ac9eeabd4964f5610ad170a4e20bb99820ae42
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Credentials\qap`g`v~dtlq
Size 10B
SHA256 5cc6a83e35217965118eddba27847fab83f0942ccf362c50e96cdeb1a408758c
MD5 4d2e9c852b70524756597d531eb86512
SHA1 99878e755dc1cb366843a6a4b490751abc158aad
SHA512 cb20076f79539dbfdcf960efffe3f60ac0a1be3cec289ef34be28aec8be073c2e9935678ee60ffe1b4480fe572bf6ba40264a93167c74897346f243eafe7a0a3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\qap`g`v~dtlq
Size 10B
SHA256 af3b491dd1e54876e651f30adf9bfbcc3f1d61308996c9093d099bb065f04184
MD5 2b77838fdc984ce8cb3463b796bbf551
SHA1 048765552b81181bad9e8390ca6118a052b323e6
SHA512 4845d07a662d0be22556e8e76c365d832604e792576b0ca644d4b607e8bf15a723121da86049a7c13c747f6d417f3224e85598df028639f29ef2757f333b5f89
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 83f26166e37edad1da79d85943422f337b076a896108459bb4bcdea7fba0c538
MD5 aa7e8878300640b3b26276cea1f4a448
SHA1 66b8141569b01a7bb09812dfabed47e0ed7ab818
SHA512 2e171a2ac98bef7ef093c22ffdeed7f3bde712678363deb230002bbe95472b411c660a7f8a226e77107907a2b94abe7187196fb2f0e6662db58edc74140ab332
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3b6138428fe3465eb0fadd1a3a2861dd2efb0a87fed339204d9c193b92ea59f9
MD5 39bf5bd92dd5d11259d1eb1e44b8048c
SHA1 944c1a52f2dce861771f1143ad68bd69b87efe70
SHA512 b2e53f2253290f7627469b77b9d627c0f16ddf8a889edf15b14b2453da99b4479f2f49289481947cfa508cfd76ea8bd326109c56b465c018d938de1f87866bac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9afce6624ba5566148f35071c8030c2ed1ad74215e73801b795209e1d225079a
MD5 b466fc9429e16950618bf64702fc1d8f
SHA1 27633a9aa8ee611c2d052f678f4a699c4dd0cf98
SHA512 ca820de562e6b2da7832e7bf853d3636da4d8a137b5247ae6d63da92db5f2b37f19b2d0634a00c336e048ec17fc7af16af72160bf9d9d74ae119f86637444380
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 52bedfd0493a6dc5e3f57c44ddc0af23e2dbda43e2fb01cc8b1e7572f6bee29f
MD5 75c942535fcd0f1f9369c515e9f36268
SHA1 a332a2eadce84ee632718621daafe2e732624afa
SHA512 b6524b331e279cc04697686c635b90d39e352f7b03e94e35ef46a95d824262c9b2399f43a95d8d7537384b99bed2df464ae82fbc610a066ce6075dca0c8b9925
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 15ab031f2ce69712c62690100ed2bcde23ded3156171945608065a1c8d1a8fcd
MD5 73b6082023262c8dcd249ff937842b3c
SHA1 1f3aa20113677cb78bae13c73c5c44564c8c666b
SHA512 04392b1bcfaacaaae7bf0cbd9c4ab063c69bbb5cb1aca1375ebcda9765122a67242e5bae995d1162fc088a6b092f1cffc41ffa2e70b7b3f69cb1447767f5b07f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9700440ac8250a7b35243c93b075865fba7cfac8ff1cfc314f6684eba2d277e2
MD5 988437f11901cdc705110849908c9abb
SHA1 9133710674d9d7d38b0e4c7fc66c60c6c86d6ab4
SHA512 ad8f0d7a46c73985cee7f79bff9cc036b2339ea100723c9d8a19c8119736eafab632d86c887eef26498b6ce6f3971d33ce1d458fb14dcfd022bda90049094df1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Music\qap`g`v~dtlq
Size 10B
SHA256 904871882013beff785f104459ab644642cee21ef458518a9651b580dc2614a3
MD5 d7a1e79e87f05044b81f3714e8beb216
SHA1 d17286e4a8f4733a82ba7c29f0837b317cba8b46
SHA512 5adfd88344aa1e6b746b31f5f18251305a7c6ea582dab2a9e344fcb4c5e4c477537f5d3fb193546030353d709dc654d96d62eb3a49e7609a449543d5d4a8c786
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Music\qap`g`v~dtlq
Size 10B
SHA256 e585a76b858184743425bf581db8c5713b6a7cb8663d580279aec7bb3c54350b
MD5 8164c3e8599a0c302873934f6db6b261
SHA1 4984f414c6fb273eb62d75ead8554ca2ee164fd3
SHA512 85c309ed4603f71342202f5a9ebce89a49065f3787b9ab43be4dc4c4cd29bc95486216da55885ab9bf4acb80eb029dd3560258fe3d7b9c073f8367a44ed18796
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\Videos\qap`g`v~dtlq
Size 10B
SHA256 a11373e0c98c9e9e324cfc45c7f18c0347764c7f844864baca5f5189a5537912
MD5 6ffa6b5e428c579c2d2a993d1c989304
SHA1 9a88f506662dcbf2ab9687a89c09c7c58725a775
SHA512 1afd6f4fa5723f0483233655b6d50d36f68c7c50990e515dddb05c17f2cf22032227c0c90977265b27e3133dbba49a9e3bc4fa22da1494028587ae017c18cea0
MD5 SHA1 SHA512

Submit Download

svchost_BBCCBBCBBBCBCBCCBABBAACBCCBAAACBBACCCBCBACCABCCCBCBABBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBBCBBBCBCBCCBABBAACBCCBAAACBBACCCBCBACCABCCCBCBABBB.exe
Size 30.2MB
SHA256 b6f967b26e2329f9e2ac8d62a4f2bebe1916d12744838508416140a7f34601a0
MD5 e406129451afd35793da9938d88203e9
SHA1 e229f35557f0892c674637c4cfac74662cc5bb83
SHA512 df6364fa437e52dbf69ca3dbd3b70a7a07d558f834c67312d6a668d9fd8be56502c13d3963211afcc7bd9340b26627f668123da85dbd003a0dd6a399a9396225
SSDEEP 98304:Jp7Dp7Dp79rU5Ep7Dp7Dp79rU5F1MbQ9yDAD7KjjqkusjmqMhb:vBB+5KBB+5F1tIDewjqkjiqMt
TLSH
T135673A29A6A4C0E5E46A973899678271E9717C100A3243BFDDB0F62EDE3B5B14D3C731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 ee439be67354604d951fa2e067e362331ab84b3608c166281c9ae6b9aa9571be
MD5 0619ab3531b41b18dede3509765c144a
SHA1 f9efc2bf9c04cec2d4227f5928ecb89820a63afb
SHA512 3cf563bef6ea8a0678b1f779c0970e1ead14d6281b75da0b9b4a0a061a34f86e89d455005506934a51e75323b4ba134103b38812ea72f7a47614eac3f87d5c9b
TLSH
T1CD21F8A0F498CC33F83268DB432EE9A20CA8274FFC546A241384951C7A88C23CD45CD1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 835973589092ade17f369442d39afae07ce6f96d4d3f2cdf967b938653007feb
MD5 46847e05ed68ca59f2fb146caab83608
SHA1 fd6130bc6a7d917012fabfd2494b87ee40253679
SHA512 b34e6c1fd6c700559d29cc22b25714e2ef4f593479470b379a992664c843a258a6b8cb41ba6ca626e7ed2e0c4eab1773924d6fac119bcb8c084634f5e93ac8f6
TLSH
T16821B6A1F498DC33E8326CDF572EEAA208AC375FFC586914138595187F99C23CD558D1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 87c0ab48bbd221a77b80f497df93ac79ecc32bcec7ed980be13b229a0a07bcca
MD5 bb0e43e8ae19300287661f0752296bf9
SHA1 0d92860033411591094dc4e638899d2285b1bdad
SHA512 76b80cb006d1e2499bfb404f997a46a78003fdc978ee7da74983d6cd475dabc6c6988de9a766870729a053684b50f2c1af3660f179ba067d8770ab4df98a3471
TLSH
T18C11E6A0F4A9DC73F8322CDE422EE9A20CA8635FFC546A241384851C7E88C27CD55CD2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1504-1877-0x00000000001C0000-0x00000000001E1000-memory.dmp

Download

memory/1504-3871-0x00000000001C0000-0x00000000001E1000-memory.dmp

Download

memory/4088-1875-0x00000000005B0000-0x00000000005D1000-memory.dmp

Download

memory/4088-10-0x00000000005B0000-0x00000000005D1000-memory.dmp

Download

memory/4088-46-0x00000000005B0000-0x00000000005D1000-memory.dmp

Download

memory/4088-70-0x00000000005B0000-0x00000000005D1000-memory.dmp

Download

memory/4088-67-0x00000000005B0000-0x00000000005D1000-memory.dmp

Download

memory/4088-21-0x00000000005B0000-0x00000000005D1000-memory.dmp

Download

memory/4288-84-0x0000000000A10000-0x0000000000A31000-memory.dmp

Download

memory/4288-1554-0x0000000000A10000-0x0000000000A31000-memory.dmp

Download

memory/5972-99-0x00000000001C0000-0x00000000001E1000-memory.dmp

Download

memory/5972-68-0x00000000001C0000-0x00000000001E1000-memory.dmp

Download

memory/5972-47-0x00000000001C0000-0x00000000001E1000-memory.dmp

Download