9e9b9649d8b16355fc4f17f85fc1a9052055b45bc919145a1cf9ae24bba0ba2a

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 13:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_55c28708145f61ecc40785dc129b2794_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 27.1MB
Sample260810-q6jrlazerd
SHA256 9e9b9649d8b16355fc4f17f85fc1a9052055b45bc919145a1cf9ae24bba0ba2a
MD5 55c28708145f61ecc40785dc129b2794
SHA1 18781c1c3d24e17e30ca0973ba88df0c970e3b36
SHA512 4241ab971f7aa4bc165db1185c129e32502687d3e11ab5b6b07bc7096e9f60f62871c203764a3c6867267e143b749e7538b2fbc92448549b0cc9b10feacfba35
SSDEEP 49152:U+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+Es:KA91pH2WpjHrgBFFu416AWvh
TLSH
T194575B05F94350F5D92B50B04DDBD3BBCA707E2282224BEBE65DDB1B2E337A16C28651
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACACABBBCBACCAACBCCBBBBCCBAAAABBCABACBCBCBCBACABCACCBAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACACABBBCBACCAACBCCBBBBCCBAAAABBCABACBCBCBCBACABCACCBAA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACACABBBCBACCAACBCCBBBBCCBAAAABBCABACBCBCBCBACABCACCBAA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACACABBBCBACCAACBCCBBBBCCBAAAABBCABACBCBCBCBACABCACCBAA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5876	svchost_ACACABBBCBACCAACBCCBBBBCCBAAAABBCABACBCBCBCBACABCACCBAA.exe
796	svchost_BCAACBCBBACBCABBCBCBBBABBBABBCBBBABCBACBAAACBAAABBCBACC.exe
2980	svchost_ACACABBBCBACCAACBCCBBBBCCBAAAABBCABACBCBCBCBACABCACCBAA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBCCCBACABBBAABABABACACBAACAABCACABACBBABBCCCABAABBCABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACACABBBCBACCAACBCCBBBBCCBAAAABBCABACBCBCBCBACABCACCBAA.exe"	2026-08-10_55c28708145f61ecc40785dc129b2794_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBCBAACBAABCABCBBCABBCCCCCBAAABBCABBABBBBBBAABAACABACBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAACBCBBACBCABBCBCBBBABBBABBCBBBABCBACBAAACBAAABBCBACC.exe"	svchost_ACACABBBCBACCAACBCCBBBBCCBAAAABBCABACBCBCBCBACABCACCBAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4996	sc.exe
4372	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
708	cmd.exe
4964	cmd.exe
3664	cmd.exe
2144	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCAACBCBBACBCABBCBCBBBABBBABBCBBBABCBACBAAACBAAABBCBACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_55c28708145f61ecc40785dc129b2794_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACACABBBCBACCAACBCCBBBBCCBAAAABBCABACBCBCBCBACABCACCBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2876	schtasks.exe
2164	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
420	2026-08-10_55c28708145f61ecc40785dc129b2794_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
420	2026-08-10_55c28708145f61ecc40785dc129b2794_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
420	2026-08-10_55c28708145f61ecc40785dc129b2794_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
420	2026-08-10_55c28708145f61ecc40785dc129b2794_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
5876	svchost_ACACABBBCBACCAACBCCBBBBCCBAAAABBCABACBCBCBCBACABCACCBAA.exe
5876	svchost_ACACABBBCBACCAACBCCBBBBCCBAAAABBCABACBCBCBCBACABCACCBAA.exe
5876	svchost_ACACABBBCBACCAACBCCBBBBCCBAAAABBCABACBCBCBCBACABCACCBAA.exe
5876	svchost_ACACABBBCBACCAACBCCBBBBCCBAAAABBCABACBCBCBCBACABCACCBAA.exe
796	svchost_BCAACBCBBACBCABBCBCBBBABBBABBCBBBABCBACBAAACBAAABBCBACC.exe
796	svchost_BCAACBCBBACBCABBCBCBBBABBBABBCBBBABCBACBAAACBAAABBCBACC.exe
2980	svchost_ACACABBBCBACCAACBCCBBBBCCBAAAABBCABACBCBCBCBACABCACCBAA.exe
2980	svchost_ACACABBBCBACCAACBCCBBBBCCBAAAABBCABACBCBCBCBACABCACCBAA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	420	2026-08-10_55c28708145f61ecc40785dc129b2794_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	5876	svchost_ACACABBBCBACCAACBCCBBBBCCBAAAABBCABACBCBCBCBACABCACCBAA.exe
Token: SeDebugPrivilege	796	svchost_BCAACBCBBACBCABBCBCBBBABBBABBCBBBABCBACBAAACBAAABBCBACC.exe
Token: SeDebugPrivilege	2980	svchost_ACACABBBCBACCAACBCCBBBBCCBAAAABBCABACBCBCBCBACABCACCBAA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 420 wrote to memory of 708	420	2026-08-10_55c28708145f61ecc40785dc129b2794_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	91
PID 708 wrote to memory of 2164	708	cmd.exe	93
PID 5876 wrote to memory of 1868	5876	svchost_ACACABBBCBACCAACBCCBBBBCCBAAAABBCABACBCBCBCBACABCACCBAA.exe	94
PID 420 wrote to memory of 4964	420	2026-08-10_55c28708145f61ecc40785dc129b2794_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	97
PID 4964 wrote to memory of 4372	4964	cmd.exe	99
PID 420 wrote to memory of 3664	420	2026-08-10_55c28708145f61ecc40785dc129b2794_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	100
PID 3664 wrote to memory of 4996	3664	cmd.exe	102
PID 5876 wrote to memory of 2144	5876	svchost_ACACABBBCBACCAACBCCBBBBCCBAAAABBCABACBCBCBCBACABCACCBAA.exe	105
PID 2144 wrote to memory of 2876	2144	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-10_55c28708145f61ecc40785dc129b2794_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_55c28708145f61ecc40785dc129b2794_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBBAAABCBCABBBCCBACBAACCCCAAACBAABCBBAABCBAAACCCCABACCBCBABCCBBBBCAABCBBCBCACBAACCAABACCBAACBCAABBCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABBBCBACCAACBCCBBBBCCBAAAABBCABACBCBCBCBACABCACCBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:708
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBBAAABCBCABBBCCBACBAACCCCAAACBAABCBBAABCBAAACCCCABACCBCBABCCBBBBCAABCBBCBCACBAACCAABACCBAACBCAABBCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABBBCBACCAACBCCBBBBCCBAAAABBCABACBCBCBCBACABCACCBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBABBCBAACBCCCCBABBBCCCBCCBACBBABCCBABAABCCABACBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABBBCBACCAACBCCBBBBCCBAAAABBCABACBCBCBCBACABCACCBAA.exe" start= auto displayName= "UserDataSvc_CBABBCBAACBCCCCBABBBCCCBCCBACBBABCCBABAABCCABACBABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBABBCBAACBCCCCBABBBCCCBCCBACBBABCCBABAABCCABACBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABBBCBACCAACBCCBBBBCCBAAAABBCABACBCBCBCBACABCACCBAA.exe" start= auto displayName= "UserDataSvc_CBABBCBAACBCCCCBABBBCCCBCCBACBBABCCBABAABCCABACBABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBABBCBAACBCCCCBABBBCCCBCCBACBBABCCBABAABCCABACBABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3664
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBABBCBAACBCCCCBABBBCCCBCCBACBBABCCBABAABCCABACBABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4996

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABBBCBACCAACBCCBBBBCCBAAAABBCABACBCBCBCBACABCACCBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABBBCBACCAACBCCBBBBCCBAAAABBCABACBCBCBCBACABCACCBAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5876
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCAACCACBBBCCCACBCAAABCABBCBBCCCCBCBABCBACBACBCBBAABCCCCACCBBACAACCCBBCBBCBCABACABCCBCAAAAABCBBABBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACBCBBACBCABBCBCBBBABBBABBCBBBABCBACBAAACBAAABBCBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCAACCACBBBCCCACBCAAABCABBCBBCCCCBCBABCBACBACBCBBAABCCCCACCBBACAACCCBBCBBCBCABACABCCBCAAAAABCBBABBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACBCBBACBCABBCBCBBBABBBABBCBBBABCBACBAAACBAAABBCBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2876

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACBCBBACBCABBCBCBBBABBBABBCBBBABCBACBAAACBAAABBCBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACBCBBACBCABBCBCBBBABBBABBCBBBABCBACBAAACBAAABBCBACC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:796

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABBBCBACCAACBCCBBBBCCBAAAABBCABACBCBCBCBACABCACCBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABBBCBACCAACBCCBBBBCCBAAAABBCABACBCBCBCBACABCACCBAA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 9e4c0d0a8f13d1f1ecf15045107af4e626e85f5c8acc34fc414b7597c3bfc26d
MD5 05d40ec4d03280b9a4111d047dffbff9
SHA1 86ecfb4ddf4b813762117a98b9471eb61d808f9d
SHA512 190d6f4b8d993109097d3933646ad405e992bfe06bd6ba3b069f8e9e0072d9f923f69b395cfcdeffceaf7f4947f90bb0f95054ca4ace49256579d039caf16a08
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\Setup\qap`g`v~dtlq
Size 10B
SHA256 f01d35479b0b9331619be1fa534baed2eab3342fdbca69de09c6d5d2e12be037
MD5 006814937b98b8bf155954bea4706a60
SHA1 aaa37ff1a2b27a6411cf6af4ccf9dfa795cdccc7
SHA512 92bc09d6ae31f69a4b6c6db87d57eab5d5456b230a27093b73bb0f18ca717c774214865a6a3b96e5011b0de2d896fb6c2b95f414ed04a98a86a2aa56e67f856e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 f8cf0e559a8d15690d06bb7d9adec22f37292b4bf427c81eb5da7c699a110074
MD5 53ceb20b522372819ece518b377e14c4
SHA1 77690d19595b9d1f9c0c28e5d6b97e033d549624
SHA512 dbf2e4e9092465b829118392b95e794543b7269cf8b05c3ea28c14d4e2dd9f2bd6fbfce3953ce57a595e2bdedae7a23d97cef2accc10717066c4b6b29c96c35f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\WindowsAIK\qap`g`v~dtlq
Size 10B
SHA256 9e8f6261f2114d85fb3ad391524729eeeded38d4335854573393ce3c89ed6e6f
MD5 4ff838a6c63bc8f4a6f070d0a6818ccc
SHA1 77a1585d77c648466132daec147683c3c99dfbec
SHA512 a7d5a324ee83a5bba617d34e99d9e9fba9f7f62ab5dcf3d3283f0620d136d6754a4f5c73cadb418eeb59107adc370644bb608e14d14495b0ebb480634ebb096c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 356e3a4f7749f3582a66606b7671ff88a9b50f6fc90330eafe0199336689eb81
MD5 2afa1fcc7fe73b6e132d4015259d1451
SHA1 61dc73539cab9a652d4337b2b33a0730f3a81017
SHA512 d5934c80bffb3849f74cea8709c1ab114e2f73b75dcca3188c79d0c21727aed97bc18925af161c772178872757d061b110b8130c5cf64086359405651abcdb7a
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 27.7MB
SHA256 0ce97772f7378bbdd145dc78f94b4867ea1e888cddf12076ac810e894dbd1fe3
MD5 72aebe31e221ed20bc873b610cd5ccf8
SHA1 114b2fb828468cb3de68967effd424995895ef3d
SHA512 d53bcb0cc7e0d7e2f54b2a3c00a599d9bfc3258bdebe5c4934e87f752fe53d73cebac383ca75d5a41fa6740549b8908ac828565d8d654869d6edb206acbb7847
SSDEEP 98304:KA91pH2WpjHrgBFFu416AWvAgZ2Hb9t+2xK:KmHpn6F44IAWvAgZ2jK
TLSH
T12E576B05F94350F5D92B50B04DDBD3BACA707E2282224BEBF65DDB1B2E337A16C28651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 980bb7d3e56aa2c7619e3e07d6f4addd5b15a431eb5bdcbccd5629ffa18c3c7a
MD5 839e2ccd0a58752148e2011a2874d5f2
SHA1 181775823b253455d43cefc0014684934067a7a5
SHA512 98cb9ebd9a92faa27ac12d03d6e81d12200ce9b17c5753175e1fc962abedad28597ba444e53fc496bd0823560f36a5aadfdbb64867fce6af2b0626ae5930fa09
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 6abe288f17f158470b2162126d88cc5fa2a1cdf18d7cd044ea580415fed4710b
MD5 977442dec89a771e16a0eafbb47b7544
SHA1 eb39adacc74babbc4d254cf04114249f3cbe52d5
SHA512 6615a376fad0e6004af8f83e262b9c7a225cfafa695192ae74ce69ee8ebe6feefc4cff4db3086b5d993df85d2c72cf7a43093231badf80edd1adecceb9853448
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 1daa86eafb38b3b015385b5c0ab98beb8e30a1be11a874416c6c3d603b4a77a8
MD5 e3a907b64766e75d38a787f6f75bc4ab
SHA1 7d594e824851c1387b7a3602207940d46cb4f348
SHA512 4f8c179dc1dfd4aa6efc5aa41f7e63b0899625b87b62c2cd19aaaa06e1b8076fc6a45bc23c0e8140556dbeff67d0176713366fd7837794082f4307c5dc5505ec
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 d3cfbbb790cac28f585d630471cae4d61b00c567b6ef11d0dd9fe765531a97fd
MD5 f84e1baa9e3a73963f27b65a67e0f798
SHA1 cfc48e12fd14e78a2ae5f350bf8efa127eb734e1
SHA512 44e684825ef45be65f81eadcf6d2aa65181ba47281a6eb3b4f5563076cffc8d07f3072476617acef0b90388c843526af8c47f84a600d895277f5cbcd54d628af
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 530384a08a003e5bbd7885ab81425cf82545928aab426915e10338b3bc437432
MD5 60f20f1af0e75afe978767dd3dd5c188
SHA1 16a835e2661faa50373061c3c8ebe3786259eec1
SHA512 b4485111e57efee2d0e48ef5525fd6ee04f93f1f3c76d3ad2c62dfe7d97027ac0617b9e159cd17009aaa79a5da1d71c8a110ba49eace4b4a07e81ecbc722225f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 59a066dc20c473beee1da2f63cf210537283711c69358189222c4988f680b82b
MD5 6d1aee43900959ffe0981096444804e0
SHA1 81f496b5f6733a4fd1105169eff0bd74368d2c08
SHA512 d2cbc92706c5fff0ea87f6307bfcbe39b4fe4487617a2d0197a0758a8ba899343690c2e585e10a3a95d4a8aa12b3c371c0940f745ea6c06d4316c27eee29cc12
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 39f3bc478e7858b397053b357c97c066230320ea4ca70e75df1bade64e5e38c6
MD5 67044dcfb7018d1b56d48058434f2760
SHA1 5bc2c05e96f211fa2c780782b616e5de1aa94b48
SHA512 d119f09dd6b4a791a144ca5f8dec41b086f6f3737462ced29b1ca08cb6fd19baf436101cbac9613cc5b6e5922e0fa54db868e145b45272ee3d3ff531f2989fd4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 0bcb75f2ac9c5eb1395630251b90b06f370baea1d98443642ef73533c0b9acef
MD5 aa0e027260602bfc771524ce08c78c81
SHA1 a1cd67bf0951a0e5ea1bc26df059c123674a9854
SHA512 ec71be9466146040c1a3673481419716a0f662df96b84602b1f086df86394aacfdd66e8385ea54e31a2b0119a0cfdaa8f0b26146944052f661b8c81d3cba1ad9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 40742175d6afcc615a14b34536df081a3d015b13ac9c7c6420419411fe97edfd
MD5 2058502c0e706c7ff45c46341f60e31d
SHA1 d43f9701f174ec36dd21afd927400873982a7f32
SHA512 7157878cb7db0ae5ebfd614be6855688de00d50ae70f8b90cda7a4cd33257c92cdb9f3c88c9024d81f71befc666bf621a18b82bbf75153a06c8319db69dc1247
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 42c63f8460b1668385f617823c6def68459a68754809e1fcb1ed8e547e02e86d
MD5 ccf5b1700aa6f4006de3559d9035a514
SHA1 e68b7638ca12676b2516c9596f3ee26b67213c56
SHA512 d27f72ccb18caad770105f110c54373d5015c4dc341a168e1226b9271c40e813e75e75944745e0f71912f786209c1a4682232f193a15536bf2a0cfa0740a3430
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6cc64c48df25d835b95df2290adf1e886e7fff8361e7daacad98c0e4b4283e47
MD5 4188ccb2c6141dce242cee89e9fd8d05
SHA1 80dfd43868e3172ef8b46489e7fdad38b211b2ae
SHA512 d5e6872047f2d01728e235bded7f7f5447e474031945583765cd0ede02b75fdf8d756d867661c0e43fba38c943cc706e3b913657d61c2b0f51858c096d985161
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 35ae1b7dd3ebbfb11116d1f3d93fdb960ea80a945d30cef169e3bf48fd78a2f2
MD5 a824774cd9202365b7896b34de12372d
SHA1 d5dd6d983cdfe0d2610b1876838b598c0c012ea7
SHA512 c754b1e5588f551124837ca49deb7e6c472a0cfeaf59d15c14af1d4a19d1d0d9002eb67195f5bde0208d1bff048edda26034aed9ca99406c0745b63f67702130
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0050392b628871f026de75ccddef01bd4ff136d4d153e7953eb760fb5bd10cf0
MD5 6b5eaf760ea4ca0eb053d167fde4feb9
SHA1 e8ca5d6869e2b0d331af0adbb02c06a14237c81b
SHA512 0a1ca0297073f5685016acd78edaa0d35d38c3a5199e19e627bbf1a0ef9db8cd655e28a45844dc338529f5e754acdfa465358ebf9ad911663786ee06a1df6fa8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f3b2a286adb444d3c313820eb90823e299a39ed0fb69f5bc55b2547a9b89a998
MD5 4adab57eaa9a07021408eb40a4990e58
SHA1 2a71c760ed5a9a2bff20c09d04b13250a7ce1767
SHA512 240ab9024fb6833f1cdf3328f8ac43d9e371b9a1e36eb3cf3365c0da0ecd7f9b29f55a7017d2710727ae6290640512b79bc0bf13310585f5a5e3ef1e6e5775db
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Local\Microsoft\GameDVR\qap`g`v~dtlq
Size 10B
SHA256 a423ca8bdd121ecfa71d1dc8471cbcbdfb79067f4fd2c75fe330db23dae2d7cc
MD5 6a1ca62bd954ec10a238d0de6fcbcc2b
SHA1 5c86ba109c1cc947598e40f53a6c19efd809b622
SHA512 df483a11493cf05152f03e4736243eb2293d8670d70526b80e2d13e7e76d1fc075c0034f862c7ddcb29de737fb72570c69bfe32cb508b6ee5d5a83ca879c60ac
MD5 SHA1 SHA512

Submit Download

svchost_ACACABBBCBACCAACBCCBBBBCCBAAAABBCABACBCBCBCBACABCACCBAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABBBCBACCAACBCCBBBBCCBAAAABBCABACBCBCBCBACABCACCBAA.exe
Size 27.1MB
SHA256 9e9b9649d8b16355fc4f17f85fc1a9052055b45bc919145a1cf9ae24bba0ba2a
MD5 55c28708145f61ecc40785dc129b2794
SHA1 18781c1c3d24e17e30ca0973ba88df0c970e3b36
SHA512 4241ab971f7aa4bc165db1185c129e32502687d3e11ab5b6b07bc7096e9f60f62871c203764a3c6867267e143b749e7538b2fbc92448549b0cc9b10feacfba35
SSDEEP 49152:U+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+Es:KA91pH2WpjHrgBFFu416AWvh
TLSH
T194575B05F94350F5D92B50B04DDBD3BBCA707E2282224BEBE65DDB1B2E337A16C28651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 399e84266993a76aea1ef3c56cca436724ac03a8e8641567cbc025e181fc9807
MD5 a47a04210a717a05b1329ffd83bf3597
SHA1 eca3a8e11348b25defb9418663245b9b9f7e400a
SHA512 8e47ec36abebd2b5732e779d91a743c438efcbd7e985ed61121d31bad6dc95d7f98c0e88a4e696c04eacca59c24bf9102629b3d43c69e54e33c1cf5c0d3446d6
TLSH
T13F112E41B4EACC63E872748B9717DAD20CDC22EB185C6A08130D562CF2CDE314D554E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 de59bfd74c65130b7efde59ff53f4082a77138cfbc8429ad806c07ac0db2cf9f
MD5 d731a1ea2ca06a1b740532e63f723bbe
SHA1 7cf86aca8fb103a7f5c0dd984f1f8a9811c6c0d9
SHA512 a2a686644a5749d0b4d7199c95b42a4fee493cac36ef56b064983b8ae89af9afba86d62bd89bab1e007f550fdafc8d491d56263dbd6bbc0a44f641ca569f5f18
TLSH
T16D212C41B4EACC63E87264CB9727EED20C9C36EB5C5C6A08130D9629B2CDE318D554E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/420-6-0x0000000000910000-0x0000000000931000-memory.dmp

Download

memory/796-78-0x0000000000820000-0x0000000000841000-memory.dmp

Download

memory/2980-3739-0x0000000000580000-0x00000000005A1000-memory.dmp

Download

memory/2980-868-0x0000000000580000-0x00000000005A1000-memory.dmp

Download

memory/5876-32-0x0000000000580000-0x00000000005A1000-memory.dmp

Download

memory/5876-22-0x0000000000580000-0x00000000005A1000-memory.dmp

Download