6e8322480d14cd1440a23ffa39cc71806822daeb86b6189db19770b4f65e2c5a

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_815bf08685f45f73701613c828c7c4f3_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
Size 22.2MB
Sample260818-dpp6tswtas
SHA256 6e8322480d14cd1440a23ffa39cc71806822daeb86b6189db19770b4f65e2c5a
MD5 815bf08685f45f73701613c828c7c4f3
SHA1 54d9dc1a914ae5f49a9a03e06819181ec0acf62f
SHA512 f799eb1b06e9866a7833e6b2a367870161f189d18cab38550dfd654404034e3e16f8ed8cdd5594c14d88006d79b4712919f6eaaa6ec1efc38a8921ff21afda1b
SSDEEP 49152:U+ES+E0+ES+ES+E7+ES+ES+ES+E8+ES+ES+ES+E7+ES+ES+ES+Ej+E7+ES+ES+EE:DA91pH2WpjHrgBFFu416AWv2
TLSH
T112374B09F94350F5D92F50B04DDBD3BFC6707A2282224FABE65DCB5B6D23B616C28216
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BAAAABACACCBBAABCBAAAAAAABCCAACBBBCAABCAAABCCBABBACBCBB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BAAAABACACCBBAABCBAAAAAAABCCAACBBBCAABCAAABCCBABBACBCBB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BAAAABACACCBBAABCBAAAAAAABCCAACBBBCAABCAAABCCBABBACBCBB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BAAAABACACCBBAABCBAAAAAAABCCAACBBBCAABCAAABCCBABBACBCBB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3484	svchost_BAAAABACACCBBAABCBAAAAAAABCCAACBBBCAABCAAABCCBABBACBCBB.exe
2680	svchost_BCABCBBABCABCCCBCCCCBAABBAAACCACABABBCBACCCACABBBCCCCAB.exe
612	svchost_BAAAABACACCBBAABCBAAAAAAABCCAACBBBCAABCAAABCCBABBACBCBB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAAACCBCCBACCBCCABACBBAAAABCBCAABCBBABBCABCBCAABACCBACAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAAAABACACCBBAABCBAAAAAAABCCAACBBBCAABCAAABCCBABBACBCBB.exe"	2026-08-17_815bf08685f45f73701613c828c7c4f3_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBCAACCBBACABBCCCBABCCABCCBABABABABCCACABBBCBBBAACBBAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABCBBABCABCCCBCCCCBAABBAAACCACABABBCBACCCACABBBCCCCAB.exe"	svchost_BAAAABACACCBBAABCBAAAAAAABCCAACBBBCAABCAAABCCBABBACBCBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4868	sc.exe
3280	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1460	cmd.exe
3052	cmd.exe
4756	cmd.exe
2520	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABCBBABCABCCCBCCCCBAABBAAACCACABABBCBACCCACABBBCCCCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_815bf08685f45f73701613c828c7c4f3_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAAAABACACCBBAABCBAAAAAAABCCAACBBBCAABCAAABCCBABBACBCBB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4640	schtasks.exe
5940	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4828	2026-08-17_815bf08685f45f73701613c828c7c4f3_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
4828	2026-08-17_815bf08685f45f73701613c828c7c4f3_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
4828	2026-08-17_815bf08685f45f73701613c828c7c4f3_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
4828	2026-08-17_815bf08685f45f73701613c828c7c4f3_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
3484	svchost_BAAAABACACCBBAABCBAAAAAAABCCAACBBBCAABCAAABCCBABBACBCBB.exe
3484	svchost_BAAAABACACCBBAABCBAAAAAAABCCAACBBBCAABCAAABCCBABBACBCBB.exe
3484	svchost_BAAAABACACCBBAABCBAAAAAAABCCAACBBBCAABCAAABCCBABBACBCBB.exe
3484	svchost_BAAAABACACCBBAABCBAAAAAAABCCAACBBBCAABCAAABCCBABBACBCBB.exe
612	svchost_BAAAABACACCBBAABCBAAAAAAABCCAACBBBCAABCAAABCCBABBACBCBB.exe
612	svchost_BAAAABACACCBBAABCBAAAAAAABCCAACBBBCAABCAAABCCBABBACBCBB.exe
2680	svchost_BCABCBBABCABCCCBCCCCBAABBAAACCACABABBCBACCCACABBBCCCCAB.exe
2680	svchost_BCABCBBABCABCCCBCCCCBAABBAAACCACABABBCBACCCACABBBCCCCAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4828	2026-08-17_815bf08685f45f73701613c828c7c4f3_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	3484	svchost_BAAAABACACCBBAABCBAAAAAAABCCAACBBBCAABCAAABCCBABBACBCBB.exe
Token: SeDebugPrivilege	612	svchost_BAAAABACACCBBAABCBAAAAAAABCCAACBBBCAABCAAABCCBABBACBCBB.exe
Token: SeDebugPrivilege	2680	svchost_BCABCBBABCABCCCBCCCCBAABBAAACCACABABBCBACCCACABBBCCCCAB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 1460	4828	2026-08-17_815bf08685f45f73701613c828c7c4f3_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe	92
PID 1460 wrote to memory of 4640	1460	cmd.exe	94
PID 3484 wrote to memory of 4872	3484	svchost_BAAAABACACCBBAABCBAAAAAAABCCAACBBBCAABCAAABCCBABBACBCBB.exe	95
PID 4828 wrote to memory of 3052	4828	2026-08-17_815bf08685f45f73701613c828c7c4f3_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe	98
PID 3052 wrote to memory of 4868	3052	cmd.exe	100
PID 4828 wrote to memory of 4756	4828	2026-08-17_815bf08685f45f73701613c828c7c4f3_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe	101
PID 4756 wrote to memory of 3280	4756	cmd.exe	103
PID 3484 wrote to memory of 2520	3484	svchost_BAAAABACACCBBAABCBAAAAAAABCCAACBBBCAABCAAABCCBABBACBCBB.exe	106
PID 2520 wrote to memory of 5940	2520	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-17_815bf08685f45f73701613c828c7c4f3_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_815bf08685f45f73701613c828c7c4f3_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAACCACCCBBABBAAABBBBCAAAACACCCACCCCAAACACBABBAAABCBBCACCACBABCBCACBAACABBCAACAAABCCCAACCBBACBBCCBCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABACACCBBAABCBAAAAAAABCCAACBBBCAABCAAABCCBABBACBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAACCACCCBBABBAAABBBBCAAAACACCCACCCCAAACACBABBAAABCBBCACCACBABCBCACBAACABBCAACAAABCCCAACCBBACBBCCBCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABACACCBBAABCBAAAAAAABCCAACBBBCAABCAAABCCBABBACBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBABBABCBBCCCBBCCBBBABCABAABBABCAABBCBBCCCBACCBCCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABACACCBBAABCBAAAAAAABCCAACBBBCAABCAAABCCBABBACBCBB.exe" start= auto displayName= "UserDataSvc_CBABBABCBBCCCBBCCBBBABCABAABBABCAABBCBBCCCBACCBCCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBABBABCBBCCCBBCCBBBABCABAABBABCAABBCBBCCCBACCBCCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABACACCBBAABCBAAAAAAABCCAACBBBCAABCAAABCCBABBACBCBB.exe" start= auto displayName= "UserDataSvc_CBABBABCBBCCCBBCCBBBABCABAABBABCAABBCBBCCCBACCBCCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBABBABCBBCCCBBCCBBBABCABAABBABCAABBCBBCCCBACCBCCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBABBABCBBCCCBBCCBBBABCABAABBABCAABBCBBCCCBACCBCCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3280

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABACACCBBAABCBAAAAAAABCCAACBBBCAABCAAABCCBABBACBCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABACACCBBAABCBAAAAAAABCCAACBBBCAABCAAABCCBABBACBCBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBABBBABABCCAAAACCCBBACCABCCBBCACCAABBBBBAABACBACCAACCACBCBBCCACBBCBCAABCCABCABBBBCCBBCBBABCCBAAAABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBBABCABCCCBCCCCBAABBAAACCACABABBCBACCCACABBBCCCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBABBBABABCCAAAACCCBBACCABCCBBCACCAABBBBBAABACBACCAACCACBCBBCCACBBCBCAABCCABCABBBBCCBBCBBABCCBAAAABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBBABCABCCCBCCCCBAABBAAACCACABABBCBACCCACABBBCCCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5940

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBBABCABCCCBCCCCBAABBAAACCACABABBCBACCCACABBBCCCCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBBABCABCCCBCCCCBAABBAAACCACABABBCBACCCACABBBCCCCAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2680

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABACACCBBAABCBAAAAAAABCCAACBBBCAABCAAABCCBABBACBCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABACACCBBAABCBAAAAAAABCCAACBBBCAABCAAABCCBABBACBCBB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 4dad46563e522d11a72a8919216971a475c41a4f0ddb779298c56aeb6b362a2c
MD5 b45474a4c70450349686b9131835cd38
SHA1 b6c9d569dad6cbf88ad8a154e6b8e41a658ab5f4
SHA512 86a67f8800055f94282729f11d24e396d757316772ae8f982b31ea4e2d6982e15f2e32ba3bbca5518c3d592d165775e5345f2054523cb4a0926980e0bf5d34b5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 1d45e761d4db5756464b14990bb64063fed9d6cf8e4cdd56c12c2521b4e58eb2
MD5 4d2e99840f4574fc1a5c2450eb696528
SHA1 ac96f517195486486bf7f1aba60cf7f229d9cec3
SHA512 c5081ebd8c84bb481d387bdbf705f7b6d57306f7487526f641dd5fc58e4391136348833a8ad33bf0ef825eb862e2b05b752801b591f1ad77f7dd06f784759267
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 c9ca18ec1f7b2fbf221f079eefdae199a08e559d5d38293095096b637e06939a
MD5 17d3ee6e7b7f9ad145f7636cbfcbd0bc
SHA1 1173a685fa5c163b59c60120ca0a2ede3762e7ac
SHA512 6e5178b949f506d509b61f11c35806c9a47d11fc01947633abcd8069a37547a33100197d2562dfc7a75500384a07aedce255e4a1eaef50f769edb03dea7c8d26
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.19640.1000_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 ce0be1edbbcedbd3b5ce5cb4421f5b74956f6e84bb36bb3ab8a9700bdfa7ce45
MD5 d8ac586acb18379360b316d87dccbef0
SHA1 4ec3ccfae785b3153048ea2ece701b818279e2a0
SHA512 ba4514cff7a6ab32bdd9bf809a0a6936e3c7a75605e83990688de09a3022bcd2110e1c7448eb3dde8be50eb151eca2a3c21a5bcd0f8886930c5b174921dc5591
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 22.7MB
SHA256 7f9f15b5a2a5c62ef828a17ab404937761c7c72d780218c3ef9b2ae67c76e88e
MD5 66c98eca651bf0fa79c3fef9e1bf3749
SHA1 10d0b2db070f854a425645b0c551c412b8e25924
SHA512 f57efdf7e4a5443415af1f0c0ab0a14ad33a02f7eac2d7e933c5cf1ad7957745e3b34f4247aed8571109c16a0c13a995b3c061d9db0b715d50f463e7727154d1
SSDEEP 98304:DA91pH2WpjHrgBFFu416AWv5gZ2Hb9t+2x+:DmHpn6F44IAWv5gZ2j+
TLSH
T125374C09F94350F5D92F50B04DDBD37FCA707A2282224FABE75DCA5B6D23B616C28216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 21fc82ac8a0bab20fc2949bad74dc7900bf4c2a1c840e643386a27ff747e2b03
MD5 543893a838c6920481556781c62fe865
SHA1 6797ba751bf40804969c14fd17606ed484b18d15
SHA512 ffd3d629a42a4fb66f50e3f9f5678f3b41d4f6ede0b45d7835c40493b7485d540cb5413bc1821f8bb4361f1cd5aeccd2f9eaedb40bc40dd0a21912e46104935b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 975f5292840ffe174d66b49fe585f17edd89034110095a8fc697067b7185755a
MD5 aef40ba92a4ea2e3ced3f24e7620eda1
SHA1 73e23e4632d1dbc65b8cf85fc0f10b95072390e4
SHA512 e684644a91670bbc222760cf1c916d115440dc77a03be0cf725f25d1f5355edc310f9a020502864ab96d9d31d8b2188fc5375697f9e32cccec62651ac7639948
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 37c153554e0350910939413d614e0687cc2c0aed56aa6835e7cc7046a52d7d68
MD5 36ab539ca499b58003354a7a260a93ad
SHA1 5a4c343f64dd1e182b46ba10ffc117b00b030858
SHA512 d47ff65e4be4fc55250d7b57e6db47abf2aaea13680b932dd526d7d8f8bb0b582546f95f259d89a793af0c18069e13a3fba98609a5b572d483d4041711d01b68
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_metadata\qap`g`v~dtlq
Size 10B
SHA256 2c9346da99df7bb3492f76dd8b6d0d2f01a8c8fba6bcd8128275dfdf3cede07a
MD5 696066cb16755af2263f88a5bfc9f54a
SHA1 cf5b401f3193dde7c3883da946e04486f0abd508
SHA512 d1f184c3a2bcc32d7e8d9eb9c440e70764cb326c4a8c9a93388524986e5412205b333e8bfbabec58856aec2be19a3b17ed4e2ec0a6cca5c9c999fbad9afd1087
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 deb3eaf6318c84a1a2dba7245f7df7c4da56274e3a8c196d9c0ed5fd81459d0c
MD5 6f3685689c274dd108e199f5f48f3194
SHA1 ee40e3810f853fdad27d01b589745fa93b181092
SHA512 a2ed9426b38bf901dad7e31d6e66af3e264d1e911b863ec8c55834b661d96ad9e0370e36fbd845b1647fe59c11ba39905ab964c035458fd0dd5980c9949c2000
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 2ab02a392d4ab106ca2c1e3a69e3fd25bf561ea7020c4760ca296741b5edd1c0
MD5 9ae02dcdd16033ea42f9f7fc9f155d52
SHA1 48d0871c3f2b756cbc60a9c393f3e2f796175dae
SHA512 2418e3d228e47a6ceb09f1763435120f54e16e2dee656b1b8b209297178bba104c97bf8d372cca5b6f7633cfc8ef1debde5c2c021d1bc3bf4c85837000323262
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalCache\qap`g`v~dtlq
Size 10B
SHA256 06e5692f6f38e5efccdd053fd5caf470eb232661301912d015e9853e1f95e8fc
MD5 ecec2f1135649cd9e96ffeabf5463f05
SHA1 a84e35ae7cb878d3d4625d2fcff3f8a5eb6cdcea
SHA512 8bca69b649ed403e41aa1ca98557d80edd9e4028d8dc4317225dcb814496ba7fa1418ee43288ecfe01761d2602157f0034d4bf75f3b28daa35b9e294920b133d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c8e1c0f526a9b39573a6f98354e1174ebca838a5713dfa0cd293c9a94baa8417
MD5 648ee56fb8848ba233657c0ad3927a4e
SHA1 5ebf5523519da1f36dc2fc9d82acfd53cf1f6e54
SHA512 8fe38a2c782d9d7a6a0e11288744750ae949b3afe0f78ebe40fb2f4b829b6e73866b69125615e6591b7c2ac6240d686210e89249ccff741e8700557bae6548c5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ac310ffd09d1e26e0a4b3b8b201c56b451f536cab462b014324c55efc4082ddf
MD5 e05bc0cf9df381db5b803857264f251e
SHA1 6fb41a7501a37e3e8ea34998feb446690ff573fc
SHA512 d70f5d6a514a8ca55919b47b15c9b5c1975881ec76670a5fd474ad66f46cf4883b72517b5e636250bc51125224117ff201336477d3b2e1e67c76d0bd805d4b0f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d045fd576aba95e3c73719684f8f785111f1456437fae5e5bac71b6095ad81fd
MD5 fb0068fc40e1848640f5b3ae16be00e1
SHA1 41f3c21caa4a166060157e477325cfdf75490d2e
SHA512 e1ff61423edff5afb7323a2b1fc382a54252bcb832e8bba6db3a1d814268117341d4b521ffdfdfdb2286660548dd607d3142c3a796f58aa466b8398891a15471
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 da7d24ea9055e986f2eefd6621f63da37b61a7ae0c41f853e616a2f010da9c61
MD5 f4c85a381f017a9c75679e17e319ad16
SHA1 538e34db83bf7163b56d78ee37ee2face4cce148
SHA512 1e976ac1157f781f23f8fbf216f4a2e2d5a70eaa2fa9d77f71cb54bdd1c6351517c907fa3e793e7bf80e1bc1cc48206dd9b9571ac90bdf971ae054d4eb2bb648
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7f704e34d5a0bac645af5de0877ef64c83230ead2ec8d55c0444ce4c2bd64ef9
MD5 f957bc30949c74dd94bfc2c4b62b6438
SHA1 5f9b001aa19e3abbc8f1641c7ffdf3f63ba496cc
SHA512 c19bbde8b9494d5936c335d967f87167f2937e9a6844d76f113a067bd75fa96add3f55c93cc3e76bee3714c140aee7a282f3dbdf7d77e1488882a6422d24a7c7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8264e8a4b4dd361fde57e37e7c45d04fc50ef1d5ad18cebd5ad745fd34029e3c
MD5 80047aebf054a34c4e4d4a0ceaa3c102
SHA1 277672792ab7c72532f1fcadbd01d0fd6af869e8
SHA512 c075bd2c075a484f11fb07792674e6de481bf633ef12398599298941b6d5715cb48f144dde839f62cb152b6ec14af9eef5aa758d3c5b71790bf39fed3538ecaa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Local\Microsoft\Windows\Shell\qap`g`v~dtlq
Size 10B
SHA256 b63a018dacfbaf7bd7b05bd2d07b2e7410c33a7d2b183eea884f012a14abe7aa
MD5 179d86946372ee597b13171eedc5e3a0
SHA1 196c6edcbd9463adc6ffd3300315914232ac6b6e
SHA512 13efac7573f0aa754944b7cd5b34407df2830840e7087e77f422021390fdbd3fd8b04d7981461d81925e90a1dc2796801179356eb898110469fde77e0c0881e5
MD5 SHA1 SHA512

Submit Download

svchost_BAAAABACACCBBAABCBAAAAAAABCCAACBBBCAABCAAABCCBABBACBCBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABACACCBBAABCBAAAAAAABCCAACBBBCAABCAAABCCBABBACBCBB.exe
Size 22.2MB
SHA256 6e8322480d14cd1440a23ffa39cc71806822daeb86b6189db19770b4f65e2c5a
MD5 815bf08685f45f73701613c828c7c4f3
SHA1 54d9dc1a914ae5f49a9a03e06819181ec0acf62f
SHA512 f799eb1b06e9866a7833e6b2a367870161f189d18cab38550dfd654404034e3e16f8ed8cdd5594c14d88006d79b4712919f6eaaa6ec1efc38a8921ff21afda1b
SSDEEP 49152:U+ES+E0+ES+ES+E7+ES+ES+ES+E8+ES+ES+ES+E7+ES+ES+ES+Ej+E7+ES+ES+EE:DA91pH2WpjHrgBFFu416AWv2
TLSH
T112374B09F94350F5D92F50B04DDBD3BFC6707A2282224FABE65DCB5B6D23B616C28216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 f461d20fd6f6443d3e68f98fbf4ada99f4024b74910084eee6352b05a50476b2
MD5 c083dfef5aa1e357a293ffb37a7b4479
SHA1 e7e00a18aaa1439f5d40418256448a3b66403ebe
SHA512 fe09cfba669f39aec4ebe90391f7d1349c3d749a36a44c6f77f3358be0acae4e2a0b828230dc93d43e25d5b8120306c01d30283b1492c1d62a01a4d231b38ad9
TLSH
T19621A461E4F6D453FD332A8B812EDA820CA8379B9D786A18130D4118BB95C39CF194F6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 c54e1c9b3e4e69af13450e17ce4b8dc5e55841c9b374be1869241d54bb9ae3ef
MD5 97343845cc0e429c56716c8d9320e4d9
SHA1 b6227985a9ead90ef50c4b3df2f5642c18f5d724
SHA512 922124067f06afcf8ad145c82903970a19b917536659b122c9110ce96147acd3d5cd81d1a473ede2ccc061e218f16b454ea4b8651a3ccc0cdde7d91692ebfe16
TLSH
T13821B761E4F6D863FD336ACB912DDA820CAC379B9D6C5A18130D8118BBD5C39CF194E5
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 b4676b74f4e3a78caffcc22c9b9c90214187f89f404b62b10f26a0bc154c31e9
MD5 6fcbdeacec416fcfa6a9971ac83f5683
SHA1 0e09d50ac6bf3b8f4d8885f18e7e96ee426d3e95
SHA512 b1af61c9d3c80d031513ac85061185a7d3675884496feca52be7759d5fc765c6c79aff4056b077d355caa959656f0dc5b5fdf3fe4a74d833777a7d38791a860c
TLSH
T109119161E4F6D457FD332A8B812EDA820CE8379B5D7C6A18130D8218BB95C39DF194F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/612-962-0x00000000006F0000-0x0000000000711000-memory.dmp

Download

memory/2680-67-0x00000000003B0000-0x00000000003D1000-memory.dmp

Download

memory/2680-3743-0x00000000003B0000-0x00000000003D1000-memory.dmp

Download

memory/3484-33-0x00000000006F0000-0x0000000000711000-memory.dmp

Download

memory/4828-6-0x0000000000C40000-0x0000000000C61000-memory.dmp

Download