6ca118b5866bdd09041940240a3739657a019e393fb3708de5a157ed00398eb2

Analysis

max time kernel
150s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_ecb43dd943335450c874c281f4427a8a_amadey_elex_glassworm_icedid_njrat_vidar.exe
Size 8.4MB
Sample260819-rr89daysdx
SHA256 6ca118b5866bdd09041940240a3739657a019e393fb3708de5a157ed00398eb2
MD5 ecb43dd943335450c874c281f4427a8a
SHA1 1aa734338385ba3063ce23650edbc8fb65030219
SHA512 2da6c315268bed4bb207e2f67bd24799825db4256b657791f787763a3596b6cce6c6405b1a94642e1d3969a1844c2206519b2169c9913b067da5819fb412c897
SSDEEP 49152:U+ES+ES+Ek6+ES+ES+EkUq+ES+ES+Ek6+ES+ES+EkUMozMlTzQ/7YGsTj1VrXcpu:O1MbQ9yDAD7KjjqkusjmqMhh
TLSH
T145967D2DEBA481E5F9ABD4389867C672FAB179110A33538BC9D1C21F6F336915C28731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBCBCAABCBBBBBABCBABACCABBCBBBCCBBCBBCACBBACCBCCCABCBAA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBCBCAABCBBBBBABCBABACCABBCBBBCCBBCBBCACBBACCBCCCABCBAA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBCBCAABCBBBBBABCBABACCABBCBBBCCBBCBBCACBBACCBCCCABCBAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBCBCAABCBBBBBABCBABACCABBCBBBCCBBCBBCACBBACCBCCCABCBAA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1564	svchost_CBCBCAABCBBBBBABCBABACCABBCBBBCCBBCBBCACBBACCBCCCABCBAA.exe
1352	svchost_ABBCCCCBCBCBBCCBCBCACCCCCCAABBCCAAACCAACCBABABBACCBAAAC.exe
2432	svchost_CBCBCAABCBBBBBABCBABACCABBCBBBCCBBCBBCACBBACCBCCCABCBAA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCCACBBBCCBABABACABCCCAACBBCACABCBBCCABABACCCCABCAACABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCBCAABCBBBBBABCBABACCABBCBBBCCBBCBBCACBBACCBCCCABCBAA.exe"	2026-08-19_ecb43dd943335450c874c281f4427a8a_amadey_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBCCBBABCCBAACCBCACCCCBCBCBCBACCABBBCCBBBACCBAACBAABABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBCCCCBCBCBBCCBCBCACCCCCCAABBCCAAACCAACCBABABBACCBAAAC.exe"	svchost_CBCBCAABCBBBBBABCBABACCABBCBBBCCBBCBBCACBBACCBCCCABCBAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4800	sc.exe
4576	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5172	cmd.exe
5196	cmd.exe
416	cmd.exe
5580	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBCCCCBCBCBBCCBCBCACCCCCCAABBCCAAACCAACCBABABBACCBAAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCBCAABCBBBBBABCBABACCABBCBBBCCBBCBBCACBBACCBCCCABCBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_ecb43dd943335450c874c281f4427a8a_amadey_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1260	schtasks.exe
3304	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1844	2026-08-19_ecb43dd943335450c874c281f4427a8a_amadey_elex_glassworm_icedid_njrat_vidar.exe
1844	2026-08-19_ecb43dd943335450c874c281f4427a8a_amadey_elex_glassworm_icedid_njrat_vidar.exe
1844	2026-08-19_ecb43dd943335450c874c281f4427a8a_amadey_elex_glassworm_icedid_njrat_vidar.exe
1844	2026-08-19_ecb43dd943335450c874c281f4427a8a_amadey_elex_glassworm_icedid_njrat_vidar.exe
1564	svchost_CBCBCAABCBBBBBABCBABACCABBCBBBCCBBCBBCACBBACCBCCCABCBAA.exe
1564	svchost_CBCBCAABCBBBBBABCBABACCABBCBBBCCBBCBBCACBBACCBCCCABCBAA.exe
1564	svchost_CBCBCAABCBBBBBABCBABACCABBCBBBCCBBCBBCACBBACCBCCCABCBAA.exe
1564	svchost_CBCBCAABCBBBBBABCBABACCABBCBBBCCBBCBBCACBBACCBCCCABCBAA.exe
2432	svchost_CBCBCAABCBBBBBABCBABACCABBCBBBCCBBCBBCACBBACCBCCCABCBAA.exe
2432	svchost_CBCBCAABCBBBBBABCBABACCABBCBBBCCBBCBBCACBBACCBCCCABCBAA.exe
1352	svchost_ABBCCCCBCBCBBCCBCBCACCCCCCAABBCCAAACCAACCBABABBACCBAAAC.exe
1352	svchost_ABBCCCCBCBCBBCCBCBCACCCCCCAABBCCAAACCAACCBABABBACCBAAAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1844	2026-08-19_ecb43dd943335450c874c281f4427a8a_amadey_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	1564	svchost_CBCBCAABCBBBBBABCBABACCABBCBBBCCBBCBBCACBBACCBCCCABCBAA.exe
Token: SeDebugPrivilege	2432	svchost_CBCBCAABCBBBBBABCBABACCABBCBBBCCBBCBBCACBBACCBCCCABCBAA.exe
Token: SeDebugPrivilege	1352	svchost_ABBCCCCBCBCBBCCBCBCACCCCCCAABBCCAAACCAACCBABABBACCBAAAC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 5172	1844	2026-08-19_ecb43dd943335450c874c281f4427a8a_amadey_elex_glassworm_icedid_njrat_vidar.exe	92
PID 5172 wrote to memory of 1260	5172	cmd.exe	94
PID 1564 wrote to memory of 8	1564	svchost_CBCBCAABCBBBBBABCBABACCABBCBBBCCBBCBBCACBBACCBCCCABCBAA.exe	95
PID 1844 wrote to memory of 5196	1844	2026-08-19_ecb43dd943335450c874c281f4427a8a_amadey_elex_glassworm_icedid_njrat_vidar.exe	98
PID 5196 wrote to memory of 4800	5196	cmd.exe	100
PID 1844 wrote to memory of 416	1844	2026-08-19_ecb43dd943335450c874c281f4427a8a_amadey_elex_glassworm_icedid_njrat_vidar.exe	101
PID 416 wrote to memory of 4576	416	cmd.exe	103
PID 1564 wrote to memory of 5580	1564	svchost_CBCBCAABCBBBBBABCBABACCABBCBBBCCBBCBBCACBBACCBCCCABCBAA.exe	106
PID 5580 wrote to memory of 3304	5580	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-19_ecb43dd943335450c874c281f4427a8a_amadey_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_ecb43dd943335450c874c281f4427a8a_amadey_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBBCBBBCAACCAAABBCCAACABBACAACBBACCCACBBABCCCCCCACCBBCACCABAABBACBBBBBCCACCAACBBBAACACAAACCBCACBAABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCAABCBBBBBABCBABACCABBCBBBCCBBCBBCACBBACCBCCCABCBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5172
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBBCBBBCAACCAAABBCCAACABBACAACBBACCCACBBABCCCCCCACCBBCACCABAABBACBBBBBCCACCAACBBBAACACAAACCBCACBAABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCAABCBBBBBABCBABACCABBCBBBCCBBCBBCACBBACCBCCCABCBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCACBCAACABACCBBCACCBCCACCCACCBBBBABCBBBABBABACBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCAABCBBBBBABCBABACCABBCBBBCCBBCBBCACBBACCBCCCABCBAA.exe" start= auto displayName= "UserDataSvc_ACCACBCAACABACCBBCACCBCCACCCACCBBBBABCBBBABBABACBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5196
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCACBCAACABACCBBCACCBCCACCCACCBBBBABCBBBABBABACBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCAABCBBBBBABCBABACCABBCBBBCCBBCBBCACBBACCBCCCABCBAA.exe" start= auto displayName= "UserDataSvc_ACCACBCAACABACCBBCACCBCCACCCACCBBBBABCBBBABBABACBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCACBCAACABACCBBCACCBCCACCCACCBBBBABCBBBABBABACBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:416
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCACBCAACABACCBBCACCBCCACCCACCBBBBABCBBBABBABACBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4576

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCAABCBBBBBABCBABACCABBCBBBCCBBCBBCACBBACCBCCCABCBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCAABCBBBBBABCBABACCABBCBBBCCBBCBBCACBBACCBCCCABCBAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:8
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABACACABBCABAACCBCCBACACBACCBCCCBCABBCCCACBCBACBABBABCBAACBAACBCCCACBBBCBBBBCCACBBBCACACABBCCCBBBCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCCCBCBCBBCCBCBCACCCCCCAABBCCAAACCAACCBABABBACCBAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5580
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABACACABBCABAACCBCCBACACBACCBCCCBCABBCCCACBCBACBABBABCBAACBAACBCCCACBBBCBBBBCCACBBBCACACABBCCCBBBCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCCCBCBCBBCCBCBCACCCCCCAABBCCAAACCAACCBABABBACCBAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3304

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCCCBCBCBBCCBCBCACCCCCCAABBCCAAACCAACCBABABBACCBAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCCCBCBCBBCCBCBCACCCCCCAABBCCAAACCAACCBABABBACCBAAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1352

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCAABCBBBBBABCBABACCABBCBBBCCBBCBBCACBBACCBCCCABCBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCAABCBBBBBABCBABACCABBCBBBCCBBCBBCACBBACCBCCCABCBAA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 af59c4a0d4a85f4f06e8a88c1668012653366507f782958903205a64735ea283
MD5 e55414bc259985c5b15e5f0c7ee24be8
SHA1 07b06feb5567b648a1e06fb8c2550c3c1bac1117
SHA512 33490b2092fa3147e4595013fcc5af129044a670e74d87c709a51665bd8094968a9a620d068e5e699815a5c9181ddae272f10369e1e9f184312d800a9e331d36
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 84d91bf79e3de0881a623529a8b36bfab6f8046d31f709a126f98f93d3a786b0
MD5 891238db52d15c7a4d005ca14d2ce277
SHA1 100045efcbefbf3545548a90e5f15c4851d5a2a5
SHA512 37f211ee24e9ceb7a5307d28bfd5c47b96d026c8d4f4565cb401ed2e17d1ad21b8e2754720e52f705446a7eed696a0f52ddb4564789e33145bf679bb5aef3617
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\UEV\qap`g`v~dtlq
Size 10B
SHA256 2b8b98dee5f24c86ec74cc64b86e365a2fb367d03647cbe357f0410b9875c8d4
MD5 49666bf3940274e6ca17150724aedca3
SHA1 da22f3e680c53212968d17ddff09a27792df2989
SHA512 5f5b555645181d6949dfa0bd13da6b86033c680f3c8a25dc1e24efb02e0b7c42c133541d9d97eed50fd172f6fa76676e19ae45a4ceeae79ed56e695036643462
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Cyber\qap`g`v~dtlq
Size 10B
SHA256 640b74f87c07a4d0c5ad0df851e21a61b4a4360967cb6ff2db7bcc54dde472db
MD5 fda1506fa9307f0c87609860e80e1fbb
SHA1 7753e3df74b4864090c79de1daccd4f423528901
SHA512 3c7d38e94cc615e2cf512a26586df565b750217b61530db5ceee02cc732a2079d201d29091a77cb8edc5950021bea6df18f57ae7a1872da20d1ac555574b198d
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 9.0MB
SHA256 1ef4ba71d88a872338db0b90967c716ff3c4b592e2319de8f73150eba5464093
MD5 b49b2770a240f8a7e865156a935d9721
SHA1 13189453a62dec88f946df05130c7793d8a27a33
SHA512 ae50d7272ddb691d018faab3bce4c86bd8a2634881f3e3f0f0a8583a1f5533d719583fff7ebeabfda345dc6cfa7586d345f19b8cfb543bc7e9ca2b178755082a
SSDEEP 98304:O1MbQ9yDAD7KjjqkusjmqMhAgZ2Hb9t+2xA:O1tIDewjqkjiqMKgZ2jA
TLSH
T18C968D2DEBA480E5F9ABD4389867C672FAB179100A33538BC9D1C61E6F336915D38731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 c152ee16fd2f70554d9a13e72c0be91af3f6d25441abf8550681fad612d06ed8
MD5 58be3185e67c112e6d95aea2521c88c9
SHA1 7fd70d88d737cf06f96cb6be512eeddbbbb2025e
SHA512 d766251631b73da660da36e7ba96e40f47ac8ddc1bc3c9381b952548702edddf6b222d66c0fb345f64bbfcff0ab035bdda71ffe3ea3432d41c4b88beea7bc730
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\no\qap`g`v~dtlq
Size 10B
SHA256 12191817668051ef394d978088bc49b9847abfd3791d7dae033116f0a9283a15
MD5 8ba9f58bd36e1888c977897c3a9cb9a7
SHA1 f66f886ad5124b0a0611f6cdbc1d0c76fb4a2f9b
SHA512 c5700a7b85c18897dca67c98e55d1b2dfd2a1a5afc5cbfc5a85f9de6614f0fc01f22a5688d94404580d07f8aa00a22b069c4dfbafd2bcfac4052331e4d0d4311
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\de\qap`g`v~dtlq
Size 10B
SHA256 d3d3ce416fe8b979152f85e69d02dcb801fdad4b51caa26338395e82e78f7fef
MD5 0e619d4d70171710999f1b2e042893ca
SHA1 652b45d9aaa91a464a2934ded300432730bdcd2d
SHA512 cb2de14c88792c29094f0b5b17e6e36e792e3afb19149bb075194f0bcf08143cf9dcef9bc3d92f7d4a9f41bc56dd06abc547efb9542cd2013b2fa12c14ddebd0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\qap`g`v~dtlq
Size 10B
SHA256 7ee9d77cd66211913e57c869bb8df9a9a058b3c71c424af76fd4e20abe7127fc
MD5 3bf2675b92a885bb0d03c599216fa117
SHA1 8ccdb5b24815819692fc69b3693683cec1fe17f8
SHA512 17b4fcb7907789fe2b93d5ea4554fbd4e97542550b2c67ca1376063775cb16ad79d609bf2e9e3a7579ff4f138d4512cef13a833e8e2a69faaff02001acb97eb9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\qap`g`v~dtlq
Size 10B
SHA256 f876e2a5e2008c733c095cb9adb77029b7b18c27654ab5994620363053093a16
MD5 70696397804e2e5b2e5645496f92cc6d
SHA1 13d333aa435514fa99de66fcfe7fa36bd466ac37
SHA512 8720c59c4a9b94dd5bf9b0624c3cf404c4dc94f05293d062dde5d2208b9845333fc126212178deeca94dfaef99473186ea576e7166e39b874e1f9edf86b1a4f3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2244414c9e4511defa0b38f29b01b5aa274d056475226785b2a55211854252b1
MD5 62c5ba6c967cf37decd5167804bb1b1f
SHA1 ba1c467a30433d5dc08122975cf647af30becad6
SHA512 ce4cb202c08da4ba40a3f7a60193cbd4d291611fcc025989bb2bb359a08ab54a9138ffee41640a61b8f3c92d761fcfcf6c9aa3126a1b29a62c1058705c7f31a2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fd08048f405442e9ea70efe8a0b8d3b4dc453f1b5c2c4f13af674287c9ecee97
MD5 904ab9d9e1e4ba6a64c2bf6518e10aa2
SHA1 739dd494c4dbbf0e8c092fa0d951ca7b615d7b73
SHA512 c4bee319487361dc4daea2744731023720503d2520a52b12831176955bf4d2c5e2afe19262958ce4d53360141aa89294c31ad0aacffabe2084ca8a453edb6888
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 233c9b2542c4aaa6de719073ab7f7729dee04f9abdfb33fd14d79f66564c17c9
MD5 74bdd4ab5a6db9873dae2f836fb68ab2
SHA1 67d37aed2d59e5685dfa26c0cbb7ab2802e07b03
SHA512 8a692ab56108d37f4e3bf0fea6c635c03152949d4d1ecf89bd7f16ace8a193564faef1c38e93c24d1dd9c02f8b9ccbd535a85eb4b530c7a515fe5d77e3e8dd1a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9e260788304b59997bf13908997c48c1601e017eed30580b5354a3003ec00977
MD5 8b4f998e569836071843983e8f2a2a32
SHA1 f4a45e81f8a41e85f1d37ed3dc97d70a7b1bedb8
SHA512 15c4dc2e5a4a5b56bd046d492069009f79e7dd9b6217b2cff39df4c11f6aba06df0926d9bae819784c6d3ed1fc730b6fb089ab98d321b90f4efd6f623d01f798
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 da60d3aa8a0729c8ff703e7ccb93ee420ac90d26ee0bc369adea51d0d08de5ff
MD5 5bebb6b9cdda462cf9df19d6855947dd
SHA1 b04aab8e18b97941888c5a9e861129c41a05c865
SHA512 31134f3f0c5d3cee96d4bfba984ea05b096253b4a3c8e4a8882bc5b685f8d3d228bee55745b61ac29b776da1d928deceaf4a04918c842d6de51a3ec275b09a8f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9b98c159afe5574cc1f31e9d565db888dbab5634d97a962e070f8bee8918b4e8
MD5 e96c07c38bce44de64dd9ceda9b8155f
SHA1 a349df385de982eb8e484d204153cb2a42087c31
SHA512 8f000e8afec4b87874cfe6944640fb3225212dcdac3121d70dd6ece0ff36144692b20584f1e5437162892c45efc134771b9e54b2eeef5f8d015dc32b776204ca
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 312860b500393e1d0a06088b9b11d765b67a1bb3a8db5df19c00cc763e6fcb28
MD5 20f08160a84db4a5011f5750eba3c716
SHA1 18f011cce36d3725fd8c373e19fa344b865cdf32
SHA512 f12d5884452a3dbbf6614acbbed745bdb8747631795e750ecd61ea4f6b7a29f992b478682f036297bb697d9fa3331801696e7385b3ca684c94eedfe778104daf
MD5 SHA1 SHA512

Submit Download

svchost_CBCBCAABCBBBBBABCBABACCABBCBBBCCBBCBBCACBBACCBCCCABCBAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCAABCBBBBBABCBABACCABBCBBBCCBBCBBCACBBACCBCCCABCBAA.exe
Size 8.4MB
SHA256 6ca118b5866bdd09041940240a3739657a019e393fb3708de5a157ed00398eb2
MD5 ecb43dd943335450c874c281f4427a8a
SHA1 1aa734338385ba3063ce23650edbc8fb65030219
SHA512 2da6c315268bed4bb207e2f67bd24799825db4256b657791f787763a3596b6cce6c6405b1a94642e1d3969a1844c2206519b2169c9913b067da5819fb412c897
SSDEEP 49152:U+ES+ES+Ek6+ES+ES+EkUq+ES+ES+Ek6+ES+ES+EkUMozMlTzQ/7YGsTj1VrXcpu:O1MbQ9yDAD7KjjqkusjmqMhh
TLSH
T145967D2DEBA481E5F9ABD4389867C672FAB179110A33538BC9D1C21F6F336915C28731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 6cd0b5a3cd92abe2cca1c056724e87fcb79959e5ec30ff0a76e680b7169ea536
MD5 1b1de2f05c59b358f776c8570b9f0905
SHA1 32de8394edc577559b9f7fa7532d229b4329286e
SHA512 17c1df0a9c6f844c5d23affd6a8ea2901759b9c3d576a701f01eec459ead13d41e801070528c8f5897a36ea161c7e75768fd137e0d0b37d40d0d4d8646e10086
TLSH
T146216B90F4A6842BF8726CCF523ED9D298D833AFACACBE85130852186389D215D558D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 ee0b032f460f75eb6de4965da41342e1c23cc285c55e9253107a21e730ea15ca
MD5 689aa17f7ecfa7a63574236897217cba
SHA1 3241c3a0d761226d215e05bf47bc549dd553875a
SHA512 8501a7582a1408b5d643152feef733d38aff791df995eb05f47a94913eb2af21f980da387b239cf6070c5a9a9eb6259820cd3b5a279103478a87497ac217a60a
TLSH
T160216190F4A1C42BF872ACCF563DDAD2989833AF9C9CBA45130C920877D5D325D158D1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 2b65326c68371b4269227c630ab443b9ad1096cec5d44e8f34c9e70c30e21a79
MD5 a9222f6cf339eed256f39171143df095
SHA1 7bcb861be4bd8a517790c3ab237d0c0e6eb1c4de
SHA512 2dadbed7b56625ec74f7ec145d9a8c15cfe47e73bc37e9cf0a86a2707118eeb0b4fdd76a34535094bdc2a510a621e5b217d72505e79154b64a186ab723ab916d
TLSH
T1F4112790F4A6842BF8726CCF523EDAD298D833AF6CACBE85130952186789D225D554D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1352-67-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/1352-3967-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/1564-33-0x0000000000470000-0x0000000000491000-memory.dmp

Download

memory/1844-6-0x0000000000EB0000-0x0000000000ED1000-memory.dmp

Download

memory/2432-2516-0x0000000000470000-0x0000000000491000-memory.dmp

Download