5b27c1a7be5ce24ddd8c2962c7c9ac284c4647aca20cce003cb7b24bcd16f4e6

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/08/2026, 03:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_456c7dd1ec9a4ce69008b6791ec0f259_elex_glassworm_icedid_njrat_stealc_vidar.exe
Size 26.3MB
Sample260811-dvx4macb98
SHA256 5b27c1a7be5ce24ddd8c2962c7c9ac284c4647aca20cce003cb7b24bcd16f4e6
MD5 456c7dd1ec9a4ce69008b6791ec0f259
SHA1 595e7297384a6de94da8f954763b14915f46dccf
SHA512 9cdd85ca00a77ab18d5b0663f3f71f7a66e32d6f1b41bcc1a69d9942a67aac4eb556e5a7d12903ebb395ad3c1071db4b987d76177568c6dd70ffc9a9dd9f36f9
SSDEEP 196608:kFlfFlVFlfFl2QFlfFlVFlfFl221tIDewjqkjiqM7:i3Z3sm3Z3s28Kweky7
TLSH
T17C57D01AAFA880E0D86BD0788867D632E5323C194632979B89D1F61F6F337A15D3D731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral1/files/0x00070000000245c5-21.dat	UPX
behavioral1/files/0x000200000000071d-93.dat	UPX

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BAACCACCCBBCCBBAAAACCACBCABCBACCAAACBACAAACACABBAABBBCC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BAACCACCCBBCCBBAAAACCACBCABCBACCAAACBACAAACACABBAABBBCC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2996	svchost_BAACCACCCBBCCBBAAAACCACBCABCBACCAAACBACAAACACABBAABBBCC.exe
4324	svchost_AAAABCBAABBBBBAAACBBACCACBCBABAAACCACBABABBABBBCABBCACB.exe
4540	svchost_BAACCACCCBBCCBBAAAACCACBCABCBACCAAACBACAAACACABBAABBBCC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BBCBBCBCBBAAAABAABBBCACBBBCBCCAABAAAAABCBCBAACCACACAACBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAACCACCCBBCCBBAAAACCACBCABCBACCAAACBACAAACACABBAABBBCC.exe"	2026-08-11_456c7dd1ec9a4ce69008b6791ec0f259_elex_glassworm_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CCCBCBBABCBABABBACBCCAACBCBCACCCCCABCCACBCAACCABCAAABBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAAABCBAABBBBBAAACBBACCACBCBABAAACCACBABABBABBBCABBCACB.exe"	svchost_BAACCACCCBBCCBBAAAACCACBCABCBACCAAACBACAAACACABBAABBBCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3100	sc.exe
1988	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3892	cmd.exe
2916	cmd.exe
1680	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_456c7dd1ec9a4ce69008b6791ec0f259_elex_glassworm_icedid_njrat_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAACCACCCBBCCBBAAAACCACBCABCBACCAAACBACAAACACABBAABBBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAAABCBAABBBBBAAACBBACCACBCBABAAACCACBABABBABBBCABBCACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2404	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1376	2026-08-11_456c7dd1ec9a4ce69008b6791ec0f259_elex_glassworm_icedid_njrat_stealc_vidar.exe
1376	2026-08-11_456c7dd1ec9a4ce69008b6791ec0f259_elex_glassworm_icedid_njrat_stealc_vidar.exe
1376	2026-08-11_456c7dd1ec9a4ce69008b6791ec0f259_elex_glassworm_icedid_njrat_stealc_vidar.exe
1376	2026-08-11_456c7dd1ec9a4ce69008b6791ec0f259_elex_glassworm_icedid_njrat_stealc_vidar.exe
2996	svchost_BAACCACCCBBCCBBAAAACCACBCABCBACCAAACBACAAACACABBAABBBCC.exe
2996	svchost_BAACCACCCBBCCBBAAAACCACBCABCBACCAAACBACAAACACABBAABBBCC.exe
2996	svchost_BAACCACCCBBCCBBAAAACCACBCABCBACCAAACBACAAACACABBAABBBCC.exe
2996	svchost_BAACCACCCBBCCBBAAAACCACBCABCBACCAAACBACAAACACABBAABBBCC.exe
4540	svchost_BAACCACCCBBCCBBAAAACCACBCABCBACCAAACBACAAACACABBAABBBCC.exe
4540	svchost_BAACCACCCBBCCBBAAAACCACBCABCBACCAAACBACAAACACABBAABBBCC.exe
4324	svchost_AAAABCBAABBBBBAAACBBACCACBCBABAAACCACBABABBABBBCABBCACB.exe
4324	svchost_AAAABCBAABBBBBAAACBBACCACBCBABAAACCACBABABBABBBCABBCACB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1376	2026-08-11_456c7dd1ec9a4ce69008b6791ec0f259_elex_glassworm_icedid_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	2996	svchost_BAACCACCCBBCCBBAAAACCACBCABCBACCAAACBACAAACACABBAABBBCC.exe
Token: SeDebugPrivilege	4540	svchost_BAACCACCCBBCCBBAAAACCACBCABCBACCAAACBACAAACACABBAABBBCC.exe
Token: SeDebugPrivilege	4324	svchost_AAAABCBAABBBBBAAACBBACCACBCBABAAACCACBABABBABBBCABBCACB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4632	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 3892	1376	2026-08-11_456c7dd1ec9a4ce69008b6791ec0f259_elex_glassworm_icedid_njrat_stealc_vidar.exe	96
PID 3892 wrote to memory of 2404	3892	cmd.exe	98
PID 2996 wrote to memory of 552	2996	svchost_BAACCACCCBBCCBBAAAACCACBCABCBACCAAACBACAAACACABBAABBBCC.exe	102
PID 552 wrote to memory of 4336	552	notepad.exe	103
PID 1376 wrote to memory of 2916	1376	2026-08-11_456c7dd1ec9a4ce69008b6791ec0f259_elex_glassworm_icedid_njrat_stealc_vidar.exe	107
PID 2916 wrote to memory of 1988	2916	cmd.exe	109
PID 1376 wrote to memory of 1680	1376	2026-08-11_456c7dd1ec9a4ce69008b6791ec0f259_elex_glassworm_icedid_njrat_stealc_vidar.exe	110
PID 1680 wrote to memory of 3100	1680	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-11_456c7dd1ec9a4ce69008b6791ec0f259_elex_glassworm_icedid_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_456c7dd1ec9a4ce69008b6791ec0f259_elex_glassworm_icedid_njrat_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAABCACAAAABBBBBBCCBAACBBCABBCCACBBBACCBBACACCBCBCCABBABBBABBABBBACABABBCACABCABBBABAABBAACBBBCBCBCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCACCCBBCCBBAAAACCACBCABCBACCAAACBACAAACACABBAABBBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3892
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAABCACAAAABBBBBBCCBAACBBCABBCCACBBBACCBBACACCBCBCCABBABBBABBABBBACABABBCACABCABBBABAABBAACBBBCBCBCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCACCCBBCCBBAAAACCACBCABCBACCAAACBACAAACACABBAABBBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBAAAAAABAAABACBAACBBAACCBCBAAABAABCCBABABBCACBACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCACCCBBCCBBAAAACCACBCABCBACCAAACBACAAACACABBAABBBCC.exe" start= auto displayName= "UserDataSvc_BBBAAAAAABAAABACBAACBBAACCBCBAAABAABCCBABABBCACBACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBAAAAAABAAABACBAACBBAACCBCBAAABAABCCBABABBCACBACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCACCCBBCCBBAAAACCACBCABCBACCAAACBACAAACACABBAABBBCC.exe" start= auto displayName= "UserDataSvc_BBBAAAAAABAAABACBAACBBAACCBCBAAABAABCCBABABBCACBACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBAAAAAABAAABACBAACBBAACCBCBAAABAABCCBABABBCACBACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBAAAAAABAAABACBAACBBAACCBCBAAABAABCCBABABBCACBACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3100

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCACCCBBCCBBAAAACCACBCABCBACCAAACBACAAACACABBAABBBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCACCCBBCCBBAAAACCACBCABCBACCAAACBACAAACACABBAABBBCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:552
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4336

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4632

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABCBAABBBBBAAACBBACCACBCBABAAACCACBABABBABBBCABBCACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABCBAABBBBBAAACBBACCACBCBABAAACCACBABABBABBBCABBCACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4324

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCACCCBBCCBBAAAACCACBCABCBACCAAACBACAAACACABBAABBBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCACCCBBCCBBAAAACCACBCABCBACCAAACBACAAACACABBAABBBCC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 47ee3ac7761dfd3a928caa5ffb18ed4767147d506a252e6665b99acb69bcd21c
MD5 ae28f391c4d21893ab3179f4441a6aaa
SHA1 ccba0f2b83d9cfa60481bbe7520387e79ec0ca98
SHA512 771450ca067f53925df7c5af4865088f7991e0fff93e53573b5c0499e42ea37e5ba85b12ba8bfb8e8b146b3f19e785624c31579710b1602b4c4e0b8308312f5a
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 26.7MB
SHA256 1af7cc1241b0b512c10440b8ca2dd692ab0a1e2ea356c201341e46229629c6bb
MD5 2c1c5b9f954e97d9843f932823a28c54
SHA1 c04a9ffddf5136b9357a826728b39c0232bf44bd
SHA512 3a68cd145dca7302a65902d3f6f2d515d62df151f5e81c557da57a389b45aca002eb1661e191a8f182bf9814109c90715db7dca6db29ee68dbadd7c59d52d8e4
SSDEEP 196608:kFlfFlVFlfFl2QFlfFlVFlfFl221tIDewjqkjiqMR:i3Z3sm3Z3s28KwekyR
TLSH
T14457D01AABA880E0E87BD0788867D632E5323C194532979B89D1F61F6F337A15D3D731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 24f3116e8e8b861d3dc5b30e61faf9d68fbcf0e91684ee9282eee5db904f65f1
MD5 180cf8a89fdd834dd32815a3d5bc636b
SHA1 478d107932703c2ff8957fdc3d4211badeb8e70b
SHA512 ab38a0f4cb83a1af18972ea8da367e5fee1d2ffeb1e41366661f51867aa15135812a455895401f1e50a1db4d05ad5a4f10d20c5384e098c38f55dd262329571d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Win32WebViewHost_10.0.19041.1023_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 1df3eec6ce99afb0493c60b3614d5a7c923926d161d0db5687ce2131a78c44f7
MD5 c8d3b26ddd3f1c47c3c2967ff1cffdc7
SHA1 1dbfe242cc63a4b0c38b714b31761cb65c1ff114
SHA512 67727760aafbd41742c53dd4f86407537de50d5c8847ff10a76a8ca983b23cc60dcdc7fb9e444b5fa3f1df5d289533cc9945789d5dd9a5f46f18f852864f19ce
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.CapturePicker_10.0.19041.1023_neutral__cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 b4bf1098ea79c273ede8bfd877d485c44067dd0e1941782aa37de7c0b66ace56
MD5 f3dfdaaddc72fdc545452589fdb07b9d
SHA1 67071dddb21efffa3282a4ca109183b9c327f8a9
SHA512 9444eb5d440a2c7b1d6c35ee761820fbc500cd57a656bb4d936104f0feca02dcc3a887b4b66b0db86eafd02a048229232ade7d69623ceb1eeca93f90527031c8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\qap`g`v~dtlq
Size 10B
SHA256 9dbbb1434aa05f8fc5d9b6f2934b3b51b8d0ab0d06847df8e14a3159898cc7ec
MD5 2c5dd6b67c43d943d075065b274d9489
SHA1 d22349e3cb9dcdba3d37f40af88842caa107064f
SHA512 78adaae7c55aa1b7105688101a037f54bb7d8707e9e991f7b790e3cb3514dbfd6b3ce85dfe6886c3b680a369a90c6a7b160bb95c94a8d441b0e597716a30206c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\qap`g`v~dtlq
Size 10B
SHA256 6ffc0600da5094c0d6d31ec0fe4e7dbb337ec58c67e6bc751ca409d3e65ec786
MD5 a65ee5a8bb2ee7ffe58ca90a9764a9a0
SHA1 81638daa7c724c12934580ecebca743ff9cecf44
SHA512 a3358c291b1b2954eed1125df4e7eec44a865de2423f779d141faa7eaea8543995e7f998bef2421a350699d925bd385f2c7f2d9d0c97f77d6f5af43ab113ed53
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports\qap`g`v~dtlq
Size 10B
SHA256 aa0b146844ff8a8bd34f0aea6a4e506c44f665b6e4d5f89fe00568cffc51bff1
MD5 5474fbdb1a30fb2a259052bef7a6d93e
SHA1 0cfd18221a1a4c47a00b040308beefde2bff2ee9
SHA512 a24c7848a51aa47a31d21d45c3f0e82fd0bc25db48cd4781c189babab038ffbd977fea9aae2acef9fd431ddf66c1a03fc2948e368cef9e9d5631b51fa4881264
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 053bc2d7cfeb6c2443109ec8c91fc41cf35a62139ce5464b633461f11ee76d7f
MD5 edc2cac5c04495d2691b52d76b30d6b6
SHA1 a843309fe9b503d07e9276777574b86d593b4063
SHA512 c06ef9bf6f8d582d2adb218c58841d5eec9591abcef891f7a99216f952dd68e7c150498f2f96b46614c946ded1224281582170a0469e84d0da94b06436093901
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\SystemAppData\qap`g`v~dtlq
Size 10B
SHA256 5a2748a73207578e2a898a755a38c88211e1d86a49841bf0d45bc4df033b34e9
MD5 e23dfd34d8c869abc604b45c2fee1bc1
SHA1 126921fbdb09de94734579be652424df08c81ad9
SHA512 810642e6f3d8da7bc4c97fbaa7da2c498f9c10e67c0c81ec5711edd80a7db28d66def3445fca815ca8b76007769bc7fcd17739bb67bae9f9ea7c38df52746f4c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 051f7aafd0475d0c940690f11fdffdda56e51cc755d332de9f43c3ec29a910e4
MD5 8b3c049b6bdfe4e32a5c8f25a563e7db
SHA1 f48a94854b65e6f262ac2a04a0a9dd01f193c84c
SHA512 86460309ba69a4d96c0cc876c15e3da5778e1833a8011607e61d7faa35b1e12698967b721dbc9d881a62f118c3143c16e602b5859283839ae64242eba212dfc7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6cf2c61f79bba10fd0777b07f6d95fae6f669456bad4ed8f341e14dd4c5689d3
MD5 3cb0bcb83db98f46f6290af7cadb6452
SHA1 5d744420835cba19847f768439fb5bdcd1021b26
SHA512 0b98b930294a1aa4d25ae3055bc9325b06b5542469e05b56b4ec4aaca2b3c0f043812ece8cf5e6fd730b9fb1856b1977861dcb85d3067227c99f76525bd3f716
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4b29c8f8e7a564b9baa275aa84cc460045de42680031aafbb8275f9dec8afbaa
MD5 b1d6d8a49ba076721300cf662fcf3acd
SHA1 a873b25eb21748cd7dfbe36297fd21a01ac65075
SHA512 c2a7b21361a966a72011f9639b1f01f8d39d522dadef7476806fad9930531cef3c539bcd9a1361865861de6c05adbd33d8ee61c7e43cef2552364e9c6709c617
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0b6f1ac9e632db13beadd4fdeeea27181ef5ed41fb43248e9c13d5e82b8695e1
MD5 2b11215e5724b9e94a406a954abdc6bf
SHA1 806bf9344373e65e3469a698cc2ffd25d80f0dd0
SHA512 565f1f74c6c6696e4a48e3388fa45ebcb3705c290371063306fc9defdb5e44c8226ff2a502dab114a5bd0119efda0635e50f784abc8222ab0a2b15cb8fb2467f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 40b2be43a9b1774fe05555509aeae42ea906e84dd20fc6c2756619ec23d71cd2
MD5 0d05c627e94619cc543e4151333304ad
SHA1 5c50c795acb002c7f8b37bde421d7a3aee5582c0
SHA512 ee77b26b966f65489a328ded4dfc533a9f59556a8dc2c34e113a90dbd8ece44ceb9eaf0fc4c700c522e257163e42ff0129bb3724148935f7db6b84040ccfb81a
MD5 SHA1 SHA512

Submit Download

svchost_BAACCACCCBBCCBBAAAACCACBCABCBACCAAACBACAAACACABBAABBBCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCACCCBBCCBBAAAACCACBCABCBACCAAACBACAAACACABBAABBBCC.exe
Size 26.3MB
SHA256 5b27c1a7be5ce24ddd8c2962c7c9ac284c4647aca20cce003cb7b24bcd16f4e6
MD5 456c7dd1ec9a4ce69008b6791ec0f259
SHA1 595e7297384a6de94da8f954763b14915f46dccf
SHA512 9cdd85ca00a77ab18d5b0663f3f71f7a66e32d6f1b41bcc1a69d9942a67aac4eb556e5a7d12903ebb395ad3c1071db4b987d76177568c6dd70ffc9a9dd9f36f9
SSDEEP 196608:kFlfFlVFlfFl2QFlfFlVFlfFl221tIDewjqkjiqM7:i3Z3sm3Z3s28Kweky7
TLSH
T17C57D01AAFA880E0D86BD0788867D632E5323C194632979B89D1F61F6F337A15D3D731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 abd4710038d09cee8d2f388a429d9df87f93402c6b6fefe3f656fc4cda80f933
MD5 97f94206f1bda0d920116f965d4b8c8b
SHA1 2d5adb07e9480bfb5c3021816f12d068ca1bf0a9
SHA512 eab0b516e7d8b682cbb2aa63e775066eaf041735bef79781270d027ac1c747a736dcc1e1e99ef514d79b3b4a15fe6b2e0d0a209402d296444d2ded1bc53bf7ee
TLSH
T1B121D751D4E5E493F9336C9BE33A6AC30CE5358F58586BA413494218E6D8C738E594F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 2bbdef806c2fd94adc5ddba492cdaebae95b712a4bb3f2d7bde9b5aa716c89a4
MD5 85eae6e0ab57fe8b8b0c636411d54195
SHA1 8bfb310cc733e7e682347aea40e903714bf39b7b
SHA512 38b4437ae7185f5b56bcec54120e7cf835374cf00c517521c4e67d9d0e6deb29ded21055af34bc0b09fc3d221b23043ca347a0decd7a4cec4fded511ac88abdc
TLSH
T141112B11D4E5E453F9336C9FE33E5AC30CE5368F5C586BA413494208E688C338E594F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/552-58-0x0000000002660000-0x0000000002661000-memory.dmp

Download

memory/1376-6-0x00000000004D0000-0x00000000004F1000-memory.dmp

Download

memory/2996-36-0x00000000000D0000-0x00000000000F1000-memory.dmp

Download

memory/2996-26-0x00000000000D0000-0x00000000000F1000-memory.dmp

Download

memory/4324-77-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/4540-80-0x00000000000D0000-0x00000000000F1000-memory.dmp

Download