f8d946432cd1d63edac686d8cc4d46ea22767cfe4f884448a08b8d6e270ac91a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_3b25f42dedc001bf81db3a1c35a85e34_elex_glassworm_icedid_njrat_remcos_stealc_vidar.exe
Size 26.5MB
Sample260819-gpwkdszvbx
SHA256 f8d946432cd1d63edac686d8cc4d46ea22767cfe4f884448a08b8d6e270ac91a
MD5 3b25f42dedc001bf81db3a1c35a85e34
SHA1 2c42b069513ceccc5fa1ce9fb9375143d9d4e06c
SHA512 276957d936b56cb468a46da76cf63e862dd71cd7d59c7aab44883f5447c88f5d497ac9f38e89db85801fa55a3ec04f2daf295c36173bc5f01f060a9df108f576
SSDEEP 98304:kFPdLbFPdLpFPdLbFPdLi1/tr37wbrU5h1MbQ9yDAD7KjjqkusjmqMhb:kFlfFlVFlfFl2v5h1tIDewjqkjiqMN
TLSH
T13657AE19AAA4C0E0E86AD2389867C272E9727C150532537FCDE1F61EAF376A14D3D731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral1/files/0x000700000002459c-21.dat	UPX
behavioral1/files/0x000200000000071b-92.dat	UPX

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCACBBABCCCBACCCBAAABABBAAAACBBAAAACBBCCAACABBBBBBBAACA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCACBBABCCCBACCCBAAABABBAAAACBBAAAACBBCCAACABBBBBBBAACA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2708	svchost_BCACBBABCCCBACCCBAAABABBAAAACBBAAAACBBCCAACABBBBBBBAACA.exe
3144	svchost_ABABACAAACBBAABCBBCBBBCBACAABCBABCCAACAACCBCBCAACABCAAA.exe
2256	svchost_BCACBBABCCCBACCCBAAABABBAAAACBBAAAACBBCCAACABBBBBBBAACA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CAAACACABACACCBBCAAAACBBCBCBCACAABBAACBBACAABCBAABCCABAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCACBBABCCCBACCCBAAABABBAAAACBBAAAACBBCCAACABBBBBBBAACA.exe"	2026-08-19_3b25f42dedc001bf81db3a1c35a85e34_elex_glassworm_icedid_njrat_remcos_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CABCABBBBCABCBAACACCBBCAABACABBABCABACBACABCABCBAAAAABCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABABACAAACBBAABCBBCBBBCBACAABCBABCCAACAACCBCBCAACABCAAA.exe"	svchost_BCACBBABCCCBACCCBAAABABBAAAACBBAAAACBBCCAACABBBBBBBAACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4000	sc.exe
3940	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4868	cmd.exe
1568	cmd.exe
2632	cmd.exe
4716	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_3b25f42dedc001bf81db3a1c35a85e34_elex_glassworm_icedid_njrat_remcos_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCACBBABCCCBACCCBAAABABBAAAACBBAAAACBBCCAACABBBBBBBAACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABABACAAACBBAABCBBCBBBCBACAABCBABCCAACAACCBCBCAACABCAAA.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3704	schtasks.exe
2704	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2800	2026-08-19_3b25f42dedc001bf81db3a1c35a85e34_elex_glassworm_icedid_njrat_remcos_stealc_vidar.exe
2800	2026-08-19_3b25f42dedc001bf81db3a1c35a85e34_elex_glassworm_icedid_njrat_remcos_stealc_vidar.exe
2800	2026-08-19_3b25f42dedc001bf81db3a1c35a85e34_elex_glassworm_icedid_njrat_remcos_stealc_vidar.exe
2800	2026-08-19_3b25f42dedc001bf81db3a1c35a85e34_elex_glassworm_icedid_njrat_remcos_stealc_vidar.exe
2708	svchost_BCACBBABCCCBACCCBAAABABBAAAACBBAAAACBBCCAACABBBBBBBAACA.exe
2708	svchost_BCACBBABCCCBACCCBAAABABBAAAACBBAAAACBBCCAACABBBBBBBAACA.exe
2708	svchost_BCACBBABCCCBACCCBAAABABBAAAACBBAAAACBBCCAACABBBBBBBAACA.exe
2708	svchost_BCACBBABCCCBACCCBAAABABBAAAACBBAAAACBBCCAACABBBBBBBAACA.exe
2256	svchost_BCACBBABCCCBACCCBAAABABBAAAACBBAAAACBBCCAACABBBBBBBAACA.exe
2256	svchost_BCACBBABCCCBACCCBAAABABBAAAACBBAAAACBBCCAACABBBBBBBAACA.exe
3144	svchost_ABABACAAACBBAABCBBCBBBCBACAABCBABCCAACAACCBCBCAACABCAAA.exe
3144	svchost_ABABACAAACBBAABCBBCBBBCBACAABCBABCCAACAACCBCBCAACABCAAA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2800	2026-08-19_3b25f42dedc001bf81db3a1c35a85e34_elex_glassworm_icedid_njrat_remcos_stealc_vidar.exe
Token: SeDebugPrivilege	2708	svchost_BCACBBABCCCBACCCBAAABABBAAAACBBAAAACBBCCAACABBBBBBBAACA.exe
Token: SeDebugPrivilege	2256	svchost_BCACBBABCCCBACCCBAAABABBAAAACBBAAAACBBCCAACABBBBBBBAACA.exe
Token: SeDebugPrivilege	3144	svchost_ABABACAAACBBAABCBBCBBBCBACAABCBABCCAACAACCBCBCAACABCAAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3376	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2632	2800	2026-08-19_3b25f42dedc001bf81db3a1c35a85e34_elex_glassworm_icedid_njrat_remcos_stealc_vidar.exe	96
PID 2632 wrote to memory of 3704	2632	cmd.exe	98
PID 2708 wrote to memory of 3360	2708	svchost_BCACBBABCCCBACCCBAAABABBAAAACBBAAAACBBCCAACABBBBBBBAACA.exe	99
PID 3360 wrote to memory of 4556	3360	notepad.exe	100
PID 2800 wrote to memory of 4716	2800	2026-08-19_3b25f42dedc001bf81db3a1c35a85e34_elex_glassworm_icedid_njrat_remcos_stealc_vidar.exe	104
PID 4716 wrote to memory of 4000	4716	cmd.exe	106
PID 2800 wrote to memory of 4868	2800	2026-08-19_3b25f42dedc001bf81db3a1c35a85e34_elex_glassworm_icedid_njrat_remcos_stealc_vidar.exe	107
PID 4868 wrote to memory of 3940	4868	cmd.exe	109
PID 2708 wrote to memory of 1568	2708	svchost_BCACBBABCCCBACCCBAAABABBAAAACBBAAAACBBCCAACABBBBBBBAACA.exe	112
PID 1568 wrote to memory of 2704	1568	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-08-19_3b25f42dedc001bf81db3a1c35a85e34_elex_glassworm_icedid_njrat_remcos_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_3b25f42dedc001bf81db3a1c35a85e34_elex_glassworm_icedid_njrat_remcos_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACCBCCBABBACACBBCCABACBCCACBBCBCCCABCCCCCCBCBBBCAABABABCACCBABBCCABCCCBBBCCCCACAACBCCAABBCBACBBAACCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBBABCCCBACCCBAAABABBAAAACBBAAAACBBCCAACABBBBBBBAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACCBCCBABBACACBBCCABACBCCACBBCBCCCABCCCCCCBCBBBCAABABABCACCBABBCCABCCCBBBCCCCACAACBCCAABBCBACBBAACCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBBABCCCBACCCBAAABABBAAAACBBAAAACBBCCAACABBBBBBBAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABBABBBBCCCBAACBACAACBAACABBAACCCACCABBBCBBBCBCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBBABCCCBACCCBAAABABBAAAACBBAAAACBBCCAACABBBBBBBAACA.exe" start= auto displayName= "UserDataSvc_BABBABBBBCCCBAACBACAACBAACABBAACCCACCABBBCBBBCBCAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABBABBBBCCCBAACBACAACBAACABBAACCCACCABBBCBBBCBCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBBABCCCBACCCBAAABABBAAAACBBAAAACBBCCAACABBBBBBBAACA.exe" start= auto displayName= "UserDataSvc_BABBABBBBCCCBAACBACAACBAACABBAACCCACCABBBCBBBCBCAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABBABBBBCCCBAACBACAACBAACABBAACCCACCABBBCBBBCBCAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABBABBBBCCCBAACBACAACBAACABBAACCCACCABBBCBBBCBCAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3940

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBBABCCCBACCCBAAABABBAAAACBBAAAACBBCCAACABBBBBBBAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBBABCCCBACCCBAAABABBAAAACBBAAAACBBCCAACABBBBBBBAACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACABBCAABCBCACBCCAAACBCBACCAAACBBAACABCCBCCBCCBBACBACCAABABABBCCBABBBBBBBCCBBABBCAAABBABBBBAAACCCCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABACAAACBBAABCBBCBBBCBACAABCBABCCAACAACCBCBCAACABCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACABBCAABCBCACBCCAAACBCBACCAAACBBAACABCCBCCBCCBBACBACCAABABABBCCBABBBBBBBCCBBABBCAAABBABBBBAAACCCCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABACAAACBBAABCBBCBBBCBACAABCBABCCAACAACCBCBCAACABCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2704

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3376

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABACAAACBBAABCBBCBBBCBACAABCBABCCAACAACCBCBCAACABCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABACAAACBBAABCBBCBBBCBACAABCBABCCAACAACCBCBCAACABCAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3144

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBBABCCCBACCCBAAABABBAAAACBBAAAACBBCCAACABBBBBBBAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBBABCCCBACCCBAAABABBAAAACBBAAAACBBCCAACABBBBBBBAACA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 c8186fc830f811f834b8b256b30968eaf2e98d4a8ac0b9422fdc1c29738f45f2
MD5 8a4628f52ddeb32815d81d9e0747ce2a
SHA1 d7e3f3ecf38700473ce655ac8ec4b23c90b143d4
SHA512 709f7d8e297aef7a8fffae7dc3b516891d951babca11343025a6b3fd21cb4135c8cf08a6d71c941562f74f532bcfaac44e9b852f4ca0ead778d1bc8d728f2f95
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 27.0MB
SHA256 2a3aaf56a09a4eed56f86f1c2eb7a7a788b70142bd83dc6161497c928fe724e8
MD5 93508fd9275184690c1249bed9e4dc06
SHA1 719f2439ce04a049ebad1857ee1605c678928fad
SHA512 f014132a49d37d282bb4a47f3a7ff57b8bd2c607b92b9c319df7c5c93353d7dc014df2b0573b4d0d7ec54a3fa31aac7ff0e15571848a5a8a0a91e5fb8352f723
SSDEEP 98304:kFPdLbFPdLpFPdLbFPdLi1/tr37wbrU5h1MbQ9yDAD7KjjqkusjmqMhQpi1:kFlfFlVFlfFl2v5h1tIDewjqkjiqMJ
TLSH
T1F957AE19AAA4C0E0E86AD2389867C232E9717C154532937FCDE1F61EAF376A14D3D731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 603b87b5e8306280b502adf04211909cc3a8ba7128be95a609dfdcc1785fe6a4
MD5 b114c0cd659ce9f0df491103810f5703
SHA1 3d99e3274527e8cdefb659bf19d468c2ca8447a0
SHA512 16f580954e0c3cf8073938faa6080a7d82e5c6debd92b453a774bd15951edbdd25a76c3f86c2342422bee178295b485775ec0fe971757917e41cd911fd4e9d18
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 ed46814651909035143a2b4df443363f127c08241eb2fb6903d4c44cf9698d5b
MD5 caa30a7fe32f5254d9eb58406b9c1454
SHA1 37410351332573ab1d059f9bd140533da07d7583
SHA512 7ee5dad7a26f707b81bfaca7f421fae33b480703ea2c680e489abc6ac64c7ed0db1da62978f713bbb8d1dd56ec3ceaa20121f3837236c2da85c019f886a5eb6a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.AAD.BrokerPlugin_1000.19041.1023.0_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 0ed117d3ac738653386242d854a5eed2832cd12a31e730726580b3e691d30aad
MD5 bf5e6cca1bb0f52040182c46e4976d66
SHA1 5d5866e1b1b71b52f12b862a90e5314444362860
SHA512 04d23eef5d757306f0d8b034b681d5a67281bd1663a9970ff3115d7272cb2eaaee4a8bf9441622bf7a131530704954035303c36eaa97dd0b04b10b7793226e9b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 0601ccf47a13d37efae8e279f1c22ca568008958635d2cd1b8e724e3dfcb12d8
MD5 e2760e284094ac1987e94e8e473d3444
SHA1 7731f14ef3d8712bf31ce92bfcc1b0fb45c78dad
SHA512 d8c8cc16abe00534d2cf9db4b2760e1d4425ab344822d3bb4f5185ea00536c080f3878d76bdabfe001cf3f16e52f5e895197254853e7940c53d13242d0be63db
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}v56.64.8781\qap`g`v~dtlq
Size 10B
SHA256 4c1ced7b630c7bfb0eeb3abdc6e8cea49662f8f82074f25b79c30716e553e16a
MD5 23ce74e775e17c39eeff1fa80c21726a
SHA1 7a06fa8d5c6898032030c250e1b8e8f30c428487
SHA512 b0a33e43f566708f3e6011ded4b3d25fe09341cfc38afbc07c68222cc9da75be47e68fd2acb8f84ec94cd8c2f1896e7bc813cae16a3a95e2b2cd5c86305a35d0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 16419114872b09df4e43336bfa75318358e32615490bc5f3678d17edc72203b5
MD5 3cc312928e59adaeec7d5886169bb835
SHA1 789259bf4cd94bd36cb83508e79d81ae86c981cd
SHA512 a138d85b90df95ab2b729ec6dbc54c72b333c6082789a3fed955325316787b6dfbb116e07343ef47210934bc73c304d12b2362d764b109aebcea867d158bd07f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 411d6c664fc377514d2b00fa75488fb56b52adfd29b3152ab3f3dc587943fe09
MD5 07c1a228b4ee1cc8ed5f8f41d2ab871d
SHA1 34823c33f60629c57f0c533cc14b39993cc686fd
SHA512 8a36842beee67927deb068314873af4439f66b9ae85d39fc3dee621dcb7fe9c4bcff393dbfa51becacf578f49e5c94052ff23e1613186b0462c0de0c2c3f9cbb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.NarratorQuickStart_8wekyb3d8bbwe\AC\INetHistory\qap`g`v~dtlq
Size 10B
SHA256 b81c45fc0f54f4aabaa41917ebf633f4f443e3529ea0d338435e1ed07da8ed36
MD5 b81117a7e72695acc3ae7007b418bf43
SHA1 8a96dc4ac21473d0087f051391701a4ee89966a7
SHA512 57b83f78eb3bd79e26b55b188059d6d2bf6821b705be4b32c76ec6d5a34c1ec9b7e661b4f8e09aec107064f542eddaef3ddf0a99879bc78acd8cfdca4e2afd79
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 37fadbdb53a58ba16c6ae9914bdb1c9c568d0995323d06707e44c353ef701d78
MD5 b568de3ada18faca7f33ae7e6087cca0
SHA1 e692762bc41fb7a94a181fed96d7098d0bd2f233
SHA512 466a1ef91cf89c086625bab9f44ec692f2970b8620aefe702ac427e78e697338a7aabbfd7d861f4b6c69cb9ce714a0a8690e30d52db0e8fd1fb91f0393b1b3e6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 363edaed5fc6f9f7d01341fb871ec40e7cd384700d7d69a4610d3585de3c247f
MD5 75800428e12eeee49b91e2083b369683
SHA1 0da11d8b3aaccc49b592817127ba55c90f2b7b2a
SHA512 9cefcb03bcdc61a30e12ecc34abc7f6d97942d75eb2f431fad21675fd461608fcbfdac96259286ba1cb9c005e8c1e155b9634fd512982d72fd058f02c797086b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 77f4634aa73f7895806d80258c82e00d004f3896de6f1a17f10fc0eb22540a93
MD5 effdff8a5b0035a13537e8ce78a5908b
SHA1 1379e5c8a37fc2e99e4fc7aa43e25672a4d26814
SHA512 2d62aed00eb0838fbd038ba22f3ae4f260f339fe7c3e63b1be0ad12ffe5184e88bd25c9914755b0650ad2ca9fc595afde239510b3e50adbf333767c9724d62cc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 47409ef40073122349c54b404148d8760fd58dec2fb5bb28be2e29124a04547c
MD5 596c209e65dd44b37959e93bcaf1cba3
SHA1 f7007c55f9e582be5ebef9f7cd25aa59a121fbb4
SHA512 8a57093958606e73ada509aa2573d5a19630c7dbd9ecaef8ae9e25a279f5cc8affd5115c4d01887c52ed49fc66ec0229bc78a018c3bc78bfd2352064643546b8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b488b7ee5e6f1a898f755fafe2a46e1a4ea85898b803f8a5f2dc3504429e3581
MD5 f9475843b04e6d55f3fe088ba7c9aa67
SHA1 454f12bf93aad7f2ce59ca8a43add635235c3159
SHA512 cd35887ca92a2158690495c321aba50e56559441b8481cba6bc15b926a376a191b8743c7924908f54087a901e4183b5b73795af7333996fe45c4e6a3ebeb8e8d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 959cc8bdb03a56aed3aa88dcfd14890fce408889843fc2496b8f4cd396f47027
MD5 ca0bb155e452ba60b93db6b5c920e941
SHA1 a711c2ce7445144ad6b706be652fc37f9ddb8c91
SHA512 a1b4c44f83712f3b1e9bc67d117926a03787a4bbe9f2e72652d7b4ba66363f2834d71fe289489c01e456021552b4a12f2cd67133815d9e2ac0abd5194b715213
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 99ee22334d78bd75c7dbbfd63f0ef310500753c4ea61e73bac54eaa56da9f8d8
MD5 086987f400d2d6b3bfc98408bf78bc1e
SHA1 242573793868473fb2a44cf45523bf075edb8b87
SHA512 b6130247764d91c1b61d63624c080338ab05d1480a9ee44f024507228aa85c7e3b0e989d06542dd9c67985f7427da96517579af245123b6c10a19ca9938d398a
MD5 SHA1 SHA512

Submit Download

svchost_BCACBBABCCCBACCCBAAABABBAAAACBBAAAACBBCCAACABBBBBBBAACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBBABCCCBACCCBAAABABBAAAACBBAAAACBBCCAACABBBBBBBAACA.exe
Size 26.5MB
SHA256 f8d946432cd1d63edac686d8cc4d46ea22767cfe4f884448a08b8d6e270ac91a
MD5 3b25f42dedc001bf81db3a1c35a85e34
SHA1 2c42b069513ceccc5fa1ce9fb9375143d9d4e06c
SHA512 276957d936b56cb468a46da76cf63e862dd71cd7d59c7aab44883f5447c88f5d497ac9f38e89db85801fa55a3ec04f2daf295c36173bc5f01f060a9df108f576
SSDEEP 98304:kFPdLbFPdLpFPdLbFPdLi1/tr37wbrU5h1MbQ9yDAD7KjjqkusjmqMhb:kFlfFlVFlfFl2v5h1tIDewjqkjiqMN
TLSH
T13657AE19AAA4C0E0E86AD2389867C272E9727C150532537FCDE1F61EAF376A14D3D731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 706c8cdfdd8b984d990bc6435d26c053cb391684df60da71008d12e22095b26f
MD5 d0b7c4aec04c1f8a3d6eae6aa5a57103
SHA1 5ec3a10eb1085a1f21556540d2013d357815787d
SHA512 0bc51fd4b598768465f4b2da3e5ac466b228d3e91026dc8c794541876ffe65ecbea5b06dba0f9b4645873d447069dc445923953496734a93b2d3ada95ad5ff60
TLSH
T16E21E6A1E4A5CC67F93268CB962D9BC38CA826AF9C5C9A10130DC308A789C71DD198D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 d26596b753a40c5e32445353d2b8f7c087e52ec8271f1786616aaf6636acac36
MD5 40e37aa0bc86b8a89114195e88223cf2
SHA1 429d8d03741a714267f4eb4b8d6f46a4041fe721
SHA512 1211b842c8b5ea6fa2078977b722a5ebf12d639575322610057ea95cbb71d5427fa372c7ed235dba66eb45580f1a4735a8f8cae6c2297a34d37093ba6cdb9e0e
TLSH
T14F112EA1D4A5DC67F93368CB962D9BC38CE8269F9C5C9A20130D8308F785C759D194E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2256-1411-0x00000000007A0000-0x00000000007C1000-memory.dmp

Download

memory/2708-36-0x00000000007A0000-0x00000000007C1000-memory.dmp

Download

memory/2800-6-0x0000000000730000-0x0000000000751000-memory.dmp

Download

memory/3144-71-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/3144-3008-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/3360-59-0x0000000004E90000-0x0000000004E91000-memory.dmp

Download