1f0016a798b19d9451e9ac1e018d3f1218027686235ad50e75f54f45bdfb4106

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 16:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_5fdcc58c3aa26ae52aa75d42846d0f29_elex_glassworm_icedid_njrat_vidar.exe
Size 25.3MB
Sample260810-tvq83sysas
SHA256 1f0016a798b19d9451e9ac1e018d3f1218027686235ad50e75f54f45bdfb4106
MD5 5fdcc58c3aa26ae52aa75d42846d0f29
SHA1 ac4083ddfbb98b8451aa641128c207d1b88ea027
SHA512 b8667a4f5c470d285787a6eb445ec607b2905708da9e6c2a401b23ab867e2acd5fecde5c3e6c0460e3e49df2079f898b1a871382393e7cebf9afcfede69c161f
SSDEEP 49152:U+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ED:F1MbQ9yDAD7KjjqkusjmqMha
TLSH
T14A476D19F94680F1E96B50704DDBD2BFDA707A2186224FE7EA89C71F7E337915C28221
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_AAABBABACACCAABAACCBBCCABAACBBCABABBACCBBBCBABCCACBBBBB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_AAABBABACACCAABAACCBBCCABAACBBCABABBACCBBBCBABCCACBBBBB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4120	svchost_AAABBABACACCAABAACCBBCCABAACBBCABABBACCBBBCBABCCACBBBBB.exe
2832	svchost_BBAACACCBABBBBACACBAAABBCCBCBAAAABBCBBBAABCBACCCBCCBCCB.exe
4088	svchost_AAABBABACACCAABAACCBBCCABAACBBCABABBACCBBBCBABCCACBBBBB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CABCBBAACABAAACCAACAABCBBBCBACCACCACABACCABCACCCACBACBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABBABACACCAABAACCBBCCABAACBBCABABBACCBBBCBABCCACBBBBB.exe"	2026-08-10_5fdcc58c3aa26ae52aa75d42846d0f29_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_AABBABCABCACCCBCAACCCCCCACCCACBACCBCACAACABCCBAAACCACCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBAACACCBABBBBACACBAAABBCCBCBAAAABBCBBBAABCBACCCBCCBCCB.exe"	svchost_AAABBABACACCAABAACCBBCCABAACBBCABABBACCBBBCBABCCACBBBBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4212	sc.exe
3968	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2460	cmd.exe
2300	cmd.exe
3620	cmd.exe
1876	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_5fdcc58c3aa26ae52aa75d42846d0f29_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAABBABACACCAABAACCBBCCABAACBBCABABBACCBBBCBABCCACBBBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBAACACCBABBBBACACBAAABBCCBCBAAAABBCBBBAABCBACCCBCCBCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1144	schtasks.exe
1404	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2388	2026-08-10_5fdcc58c3aa26ae52aa75d42846d0f29_elex_glassworm_icedid_njrat_vidar.exe
2388	2026-08-10_5fdcc58c3aa26ae52aa75d42846d0f29_elex_glassworm_icedid_njrat_vidar.exe
2388	2026-08-10_5fdcc58c3aa26ae52aa75d42846d0f29_elex_glassworm_icedid_njrat_vidar.exe
2388	2026-08-10_5fdcc58c3aa26ae52aa75d42846d0f29_elex_glassworm_icedid_njrat_vidar.exe
4120	svchost_AAABBABACACCAABAACCBBCCABAACBBCABABBACCBBBCBABCCACBBBBB.exe
4120	svchost_AAABBABACACCAABAACCBBCCABAACBBCABABBACCBBBCBABCCACBBBBB.exe
4120	svchost_AAABBABACACCAABAACCBBCCABAACBBCABABBACCBBBCBABCCACBBBBB.exe
4120	svchost_AAABBABACACCAABAACCBBCCABAACBBCABABBACCBBBCBABCCACBBBBB.exe
2832	svchost_BBAACACCBABBBBACACBAAABBCCBCBAAAABBCBBBAABCBACCCBCCBCCB.exe
2832	svchost_BBAACACCBABBBBACACBAAABBCCBCBAAAABBCBBBAABCBACCCBCCBCCB.exe
4088	svchost_AAABBABACACCAABAACCBBCCABAACBBCABABBACCBBBCBABCCACBBBBB.exe
4088	svchost_AAABBABACACCAABAACCBBCCABAACBBCABABBACCBBBCBABCCACBBBBB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2388	2026-08-10_5fdcc58c3aa26ae52aa75d42846d0f29_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4120	svchost_AAABBABACACCAABAACCBBCCABAACBBCABABBACCBBBCBABCCACBBBBB.exe
Token: SeDebugPrivilege	2832	svchost_BBAACACCBABBBBACACBAAABBCCBCBAAAABBCBBBAABCBACCCBCCBCCB.exe
Token: SeDebugPrivilege	4088	svchost_AAABBABACACCAABAACCBBCCABAACBBCABABBACCBBBCBABCCACBBBBB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1856	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2460	2388	2026-08-10_5fdcc58c3aa26ae52aa75d42846d0f29_elex_glassworm_icedid_njrat_vidar.exe	98
PID 2460 wrote to memory of 1144	2460	cmd.exe	100
PID 4120 wrote to memory of 3764	4120	svchost_AAABBABACACCAABAACCBBCCABAACBBCABABBACCBBBCBABCCACBBBBB.exe	101
PID 3764 wrote to memory of 3244	3764	notepad.exe	102
PID 2388 wrote to memory of 2300	2388	2026-08-10_5fdcc58c3aa26ae52aa75d42846d0f29_elex_glassworm_icedid_njrat_vidar.exe	107
PID 2300 wrote to memory of 4212	2300	cmd.exe	109
PID 2388 wrote to memory of 3620	2388	2026-08-10_5fdcc58c3aa26ae52aa75d42846d0f29_elex_glassworm_icedid_njrat_vidar.exe	110
PID 3620 wrote to memory of 3968	3620	cmd.exe	112
PID 4120 wrote to memory of 1876	4120	svchost_AAABBABACACCAABAACCBBCCABAACBBCABABBACCBBBCBABCCACBBBBB.exe	115
PID 1876 wrote to memory of 1404	1876	cmd.exe	117

C:\Users\Admin\AppData\Local\Temp\2026-08-10_5fdcc58c3aa26ae52aa75d42846d0f29_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_5fdcc58c3aa26ae52aa75d42846d0f29_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAACABBCACCCACACBBCAACACACAACABBCCBBACBAACCABCAAABCBAACCBBCAAACBCBCCCACAABAABBCABCBBBAACCAAAAABAACCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBABACACCAABAACCBBCCABAACBBCABABBACCBBBCBABCCACBBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAACABBCACCCACACBBCAACACACAACABBCCBBACBAACCABCAAABCBAACCBBCAAACBCBCCCACAABAABBCABCBBBAACCAAAAABAACCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBABACACCAABAACCBBCCABAACBBCABABBACCBBBCBABCCACBBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1144
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACCCABCACABACABCBAAAABBCCCBBAABACBACBBCBACBCBAABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBABACACCAABAACCBBCCABAACBBCABABBACCBBBCBABCCACBBBBB.exe" start= auto displayName= "UserDataSvc_AACCCABCACABACABCBAAAABBCCCBBAABACBACBBCBACBCBAABAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACCCABCACABACABCBAAAABBCCCBBAABACBACBBCBACBCBAABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBABACACCAABAACCBBCCABAACBBCABABBACCBBBCBABCCACBBBBB.exe" start= auto displayName= "UserDataSvc_AACCCABCACABACABCBAAAABBCCCBBAABACBACBBCBACBCBAABAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACCCABCACABACABCBAAAABBCCCBBAABACBACBBCBACBCBAABAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACCCABCACABACABCBAAAABBCCCBBAABACBACBBCBACBCBAABAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3968

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBABACACCAABAACCBBCCABAACBBCABABBACCBBBCBABCCACBBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBABACACCAABAACCBBCCABAACBBCABABBACCBBBCBABCCACBBBBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3764
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAAAABCACAACAAAACABCACABCAAACABCAAAABCBACBABABCAABAACAABBBBCBCCCBAAAAAABCBCBBCBACAAAABABBBCAABBBBABCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACACCBABBBBACACBAAABBCCBCBAAAABBCBBBAABCBACCCBCCBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAAAABCACAACAAAACABCACABCAAACABCAAAABCBACBABABCAABAACAABBBBCBCCCBAAAAAABCBCBBCBACAAAABABBBCAABBBBABCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACACCBABBBBACACBAAABBCCBCBAAAABBCBBBAABCBACCCBCCBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1404

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1856

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACACCBABBBBACACBAAABBCCBCBAAAABBCBBBAABCBACCCBCCBCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACACCBABBBBACACBAAABBCCBCBAAAABBCBBBAABCBACCCBCCBCCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2832

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBABACACCAABAACCBBCCABAACBBCABABBACCBBBCBABCCACBBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBABACACCAABAACCBBCCABAACBBCABABBACCBBBCBABCCACBBBBB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 d5f74424eaab38e63bb3a2b5f632fe3e7c0ebd1fbd6140c3e7c519e5313dd7f5
MD5 fcbf72e80b0f4e90e3997ff37175452f
SHA1 980d95e42598a874ee9df6f110120b21a27a3180
SHA512 a36b46d103a934147f248e45a984d433021fbeebe7ef56d957ee1b7b4cf041bbae17382794a6b35d9a00db7e28ff992e1bc51a25d1b9aed98f5b78ae93dd302e
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 25.8MB
SHA256 28aa727f0d55233a1436f3f07e2b59db7d7e395e3b09eaff57147a11342a2556
MD5 1b4de7d1bcbaf1f0c1f6877d3c882db7
SHA1 c75c535b82136efb05a6661ac6646151e09ddea7
SHA512 f39c9551f8ff138647b2f51fc6bb2b2373fa3de4cf82551029f1789b24c103c4c840f5ff1e1dda334b44dba5082286013cab7f9dcb6863474fda22f8449381a3
SSDEEP 49152:U+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+Ex:F1MbQ9yDAD7KjjqkusjmqMhVpif
TLSH
T1F1477E19F98680F1E96B50704DDBD2BFCA707E1146224BEBEA89C71F7E337915C28621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\Setup\qap`g`v~dtlq
Size 10B
SHA256 5ed5807a4398f466d5c73c56d1167415afa573fffefceb7fb11e9f2005ba9016
MD5 c4d2ba68068d1998c707991d4ff71041
SHA1 2daca6303b908b6f25950e43eee326aa8cbde050
SHA512 8ef31f5729c4fa915855bf9d6594a8abf33aad70ded454704ce62d69390f3e91fd505d04a0e7165b7b4f6f2efef396ab28ee0838699a9476fe1d09c2f68fe21c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\DiagnosticLogCSP\DeviceStateData\qap`g`v~dtlq
Size 10B
SHA256 f1c7c6a9b16043cd3103a07ca04b0489c464bd55d49b25ab13962b084e01cda5
MD5 21ad6acbed3abf8eb62bda309022aef5
SHA1 4f02ed9932699a72dddc9811386e3f0fae863773
SHA512 08efd0292a5465accc1f53e397123220bd71b1a863f2e7298ba0d42fc1b0471df243e81f5d274862568d2dfa53c66a908130fd7e8a4f21a9f2e419fd73be8dfe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 7c52de685e4acee311e31f7683ec189e2cb994a20ab82646a8cf5aec86a29096
MD5 8fd690277d2c1ec019fb00f89433334e
SHA1 2f4ec42c556bd9e54f417d52931674e44b7d8e19
SHA512 0b39befee649a93ca0de37fbae44d3614d835b452850e6ddad32ec7b437bda07150c1f3ee1d12ae5f0fcf8446dd5dad87f7a08efe08365c74bc3af84b3bea92e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 b8ab6ea3d0f68c9cfec35a22a4ad902406b5c1193b4dc19416b0de8307f2eb02
MD5 2ea9597bae321c15c1e1db0a97418355
SHA1 952190a583a68d817764fe83970b2ddc6a9e82a6
SHA512 27ffb134a5bde938ab2aca98481fcb20e91ea968cbb8ee4b69a48da9131ba1391017cb67eec723204f5ff7e1cf7e4a7adb800bb351c6baf9685f87a596ac3d43
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 c8facec12d0ef49a6dd3869e7323109c52fb3d151e5995882c18cd21926d246e
MD5 bd41c006d7a1360dee6de3824ef5d791
SHA1 1f77d32ab8e764317ef16d881e41874c2a26bc05
SHA512 20329dec1ef26e3a618e2f7d0b7c165c53ad1b803b04e110333750cbeb5eafd2939b6a540fc34ae99befdb324ffb376954f39df19b3ec38c7ede49ba3781fa4a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_1\_locales\uz\qap`g`v~dtlq
Size 10B
SHA256 22556761570f7068c2ed58c2448f318388bc4b1d68c2458e62954de13a600eb5
MD5 3b7fb58bb865e1bceba06f96526076d9
SHA1 b6c224e2a8cb68f1d2644203b2fc1bae153bb094
SHA512 409069bac10a196dd8bb7c098e3cb025318be1a721956cb2e3814b8dcefc4a3725dad298f23c08a1b1103610db422e03b410eff896b97518da19bfcd9af064a7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Window.2\qap`g`v~dtlq
Size 10B
SHA256 15fb038ab9bc73a3d7502b7408b376567c7b50f2bb30bb1630668af6fb217cb9
MD5 de3dbdb37620e57fc013ac5ea3135ee8
SHA1 a715a59386f9d854cc434636f5590b0546e821cf
SHA512 05e70b91b3bf5bf936dcf6c8a2af8407bc0e9e0b029cab01524194ae73e139585452bc3eae02184c7df9987c7d2419b6728e6a573014af6732f7c89bd2716595
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\qap`g`v~dtlq
Size 10B
SHA256 276089c0dd5f8f4aa905eb5564763a52b4130ffe5cf482deabfe56bd4f438ae8
MD5 c88e20e90c1c5e502bf83ffc43a8ba06
SHA1 0921039c2230db74fe33206d0e267e2fe280dc99
SHA512 e292206f73b1dcdd189ea1f17365f98ba768ac42d0291368329612e748040134087a8713211d83dfd3b0090e3b56ce38900eccaa470e00078b6bdf143aa3be8c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\qap`g`v~dtlq
Size 10B
SHA256 e3a1db52e1dd81080d804ad1998f0c9b287a73478f42a6ea54cc586b837f43d1
MD5 d7db4c27fe93fbd188db534cfc3ccef8
SHA1 ef95addb32066630a141b46bcb54b6474098ca50
SHA512 1e4251e7dfd4a3244c47924674ee30d45a7a68d908e4d3fa27dc91365dad44264c220301352b5de4627276d68010466f57ad32efde8a411962b47cd72dc5a86b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 380ff627d3336eca577d6b5061c258633d708823ff3be40dd2e23ce530982a3f
MD5 4c5376a4ec36079a92ed86cd265edc75
SHA1 444b0511de9513e16a62df58c2af1d951ffd427d
SHA512 eca622b56e1cc24ff977a0794675e018bd145a13746c0c9107e61676980af7f9b0226c5fd64bcf046f2d8acfacfb4262a507918c2c5dc149fd0742134c333365
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 22e86d6495e281520fe15ac3dd0e87f1720df37bd40835ccac52926e4f2aebf4
MD5 b4910f9d38253f4b837dcd57a8a9b38e
SHA1 ef3a6792038ea2c8c6ba491a5da07bd58131b1e5
SHA512 fc27f70439c9fd814b18c1d94ca173e1562c65e052c7f82b8d388de6ef3c96adf372a2ff04c28f8ef94b3fda2783d7d10fdc5fba20ea91014c3dad4f79ddb6ac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 90e22f1ffe62d52b66b1cb77e256e069f959d6c97a614851301676aedcaa6c29
MD5 955c054e841d8b09db9df745dc9568aa
SHA1 959a3c58b9086a9aa1c29b142ae234469bb5fbbb
SHA512 4b0761cac3210e0179ffad0e0dd129e7c694e8301d4013f566e8515a580f8468ff568fddfc334b6504feaeec9983ab64542a9efcd45dcad9997fe1c58acced46
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0791d28964cd1de549f6e6d1fc94809c140656b79e51d9f976d8822eb216625d
MD5 23b09a1b9aeaef8857773e656d6e11fb
SHA1 86c9a98acb37c1fd06d5d47b692ad595acd5bfe9
SHA512 529fccf1a723f20410ac6c22f357a2f6a0588abe6a9f98e12b288c0d8c785968e75e332feddbfb5a3b20b7d095792e60b886ed0b44f5233b450f6641df3a0e74
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e13e8186bf8d25e7e4716dd0813c31e77f6167db3eef1697e85f9c051aaac6ea
MD5 f23c73b13d39c7100a6115c53f3654ce
SHA1 3e3d29cd0362c38d09f408d891a46b58026e7678
SHA512 5c046c53af0e19e0ba4ae5beada1f6fffed355e75d755f26056c8b27a81e8bb28507126e07ba8c9c2f2d2a9a78eb48224d06a281d0fd9268d9607ad4cd74dfdd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ba4ee3b78d7a532ceb065169a7786faf4c9ada15ce5dd707e4433b832e265696
MD5 d4a515cbbc95ccb1ea2e813740563519
SHA1 3cad0e45431e67029a70ff385370e1e767212d98
SHA512 bc65fe32375294a0c0b6132823589e1985d701405891aa4659212272331d79293609809ab3fa00edbe1c5921a8932a9c4cb6d647de94acefdf49ef20fd735772
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d3489ed6cab48549463bb74cf62c7c59069b496eabf751a5491bfeaf39709711
MD5 5698eca91b8f1d008af95c423614efd3
SHA1 6c2d91ef05d9d6d3a6355b2e5433e6e086ebfeb1
SHA512 eb89da03f00b5136d65ff4ebd3aa9f6a477215c46ffe452ab2f9fbce16fe2a49caf959cfbbedfc0348ffce0a6d7a5520e71ac535b4c6c861f60b08c6d1d71a74
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3899ffeba946f807bef4f2538388996fe06b80c0251736928761b031f36b9652
MD5 3ce21de34aab33d4d504ba10e60c931a
SHA1 52c2c9f6f858d5454e58be4f26a08ef9561aa3c7
SHA512 1f96f8aeb6fafe3ff7ead9772d880182b30f5385ebe246a5d1111c86513a79f6ffbea06b3c52898aa830984145adead609c6675d578cc12f6bbe8336c3a65e80
MD5 SHA1 SHA512

Submit Download

svchost_AAABBABACACCAABAACCBBCCABAACBBCABABBACCBBBCBABCCACBBBBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBABACACCAABAACCBBCCABAACBBCABABBACCBBBCBABCCACBBBBB.exe
Size 25.3MB
SHA256 1f0016a798b19d9451e9ac1e018d3f1218027686235ad50e75f54f45bdfb4106
MD5 5fdcc58c3aa26ae52aa75d42846d0f29
SHA1 ac4083ddfbb98b8451aa641128c207d1b88ea027
SHA512 b8667a4f5c470d285787a6eb445ec607b2905708da9e6c2a401b23ab867e2acd5fecde5c3e6c0460e3e49df2079f898b1a871382393e7cebf9afcfede69c161f
SSDEEP 49152:U+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ED:F1MbQ9yDAD7KjjqkusjmqMha
TLSH
T14A476D19F94680F1E96B50704DDBD2BFDA707A2186224FE7EA89C71F7E337915C28221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 28e10937cc2a385e13f4310be4a050177f2d1b402019e65acf2fd850f8a09c27
MD5 38b9542f93f6c75f39b2304bbdde369b
SHA1 2890ac2bd92e613111b4e557d45c2d9c3e4c06de
SHA512 03cecb11f2e30aabebabe8f8e6b6f8f221b8a84b43f16a06046c3d5fdf5b7779dc5b90ec218dc593f97cbe39eb0706b81b1635394a66b11a581702d345061bff
TLSH
T16D21A372E4EACC93A97364CB8629DBD20DA933AB9C5C1A94230D551877D8D31CD4F8F1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 2465696e689828da80f650429845eed71efe7e636226ea27c76eaec54a3648e7
MD5 af0f309efb297a57f0b70ebecd1c84d5
SHA1 a918e1e9dddbe563018d74c44ba71a0418386921
SHA512 3b9805e8f0476d1ff18cdbe41f17cbef68059682edafab798334e8cbcf88502727abc47d6cbe72a84bccb36ccc4764c322a26d115a6f5a03695e303c8e54e066
TLSH
T1F7112E92E4EAD853A87364CB8726DBC20ED937A7585C5AA8230C162877D8D31DD4B4F1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 01cf065051cd83d8f98ad96fc230db1182f094dbd87ced4004d460d886ada0b8
MD5 c1dd89007e147bfea8d59e8c0c6eb862
SHA1 18ad57bf4dda86458a1a037160f80dc56838ce28
SHA512 87967f252c06b2cc8e60bdf439bcfea442d6522c097eb5db1148c8550e448c084cff7d5d8723bd49d29d71dea6f61ea1e412096be6fbd08a1818d1634e81cbc8
TLSH
T10F216E92D4EACC53A87364CB8729CBC20DD937A7681C5EA82308152877D8D31DE4B4F1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2388-6-0x0000000000990000-0x00000000009B1000-memory.dmp

Download

memory/2832-1351-0x00000000002F0000-0x0000000000311000-memory.dmp

Download

memory/2832-75-0x00000000002F0000-0x0000000000311000-memory.dmp

Download

memory/3764-59-0x0000000005020000-0x0000000005021000-memory.dmp

Download

memory/4088-1454-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Download

memory/4120-36-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Download