24241343c020695926e6ff03b9351613a863e10683069500ce32d36ae9cbc143

Analysis

max time kernel
149s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 03:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_0fe78bf5ac58f9cc326f9d6afae06350_amadey_elex_glassworm_icedid_vidar.exe
Size 1.5MB
Sample260820-drn2jsyfle
SHA256 24241343c020695926e6ff03b9351613a863e10683069500ce32d36ae9cbc143
MD5 0fe78bf5ac58f9cc326f9d6afae06350
SHA1 2c03f0ee37745b649ad8b8c8e953ec25384bd084
SHA512 35867480312dd0e08428d0bfc15ed186760ef2a6b2e30237f5d4ced2fdfb623c1eda29de8250fa3a1800474e4bd3a10ca80531f98c4da5b059f75d376987677c
SSDEEP 24576:m9+EM0q9+EM0JExqatgl8bl9+EM0v9+EM0gLD9+EM0v9+EM0k9+EM0v9+EM0VarI:U+ES+EWqatglu+E7+Ey9+E7+EE+E7+EP
TLSH
T125750809F94640B1D8260170498BD2BE8670B911CB134EEBE6498FEEFBF3BD16934675
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CAACABAAAACBAABACBAAACCACAABBBBBBBCCBABBCACBBAAAACBCBAC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CAACABAAAACBAABACBAAACCACAABBBBBBBCCBABBCACBBAAAACBCBAC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
244	svchost_CAACABAAAACBAABACBAAACCACAABBBBBBBCCBABBCACBBAAAACBCBAC.exe
5864	svchost_BABABCBBCBACBAACCABABBACCCBABCBCCCAABBAABBCAABACBABCAAA.exe
6012	svchost_CAACABAAAACBAABACBAAACCACAABBBBBBBCCBABBCACBBAAAACBCBAC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBBBAABBAACACACCACAABCCBCBCBACCABCBCCCCBAABBBABCAAACCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACABAAAACBAABACBAAACCACAABBBBBBBCCBABBCACBBAAAACBCBAC.exe"	2026-08-20_0fe78bf5ac58f9cc326f9d6afae06350_amadey_elex_glassworm_icedid_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABBAAABCBBCACCBAACBACABABBAAAAACABBCCACBBCBBCBCAACAAACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABABCBBCBACBAACCABABBACCCBABCBCCCAABBAABBCAABACBABCAAA.exe"	svchost_CAACABAAAACBAABACBAAACCACAABBBBBBBCCBABBCACBBAAAACBCBAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2972	sc.exe
3020	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4752	cmd.exe
5276	cmd.exe
4684	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_0fe78bf5ac58f9cc326f9d6afae06350_amadey_elex_glassworm_icedid_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACABAAAACBAABACBAAACCACAABBBBBBBCCBABBCACBBAAAACBCBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABABCBBCBACBAACCABABBACCCBABCBCCCAABBAABBCAABACBABCAAA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6032	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5020	2026-08-20_0fe78bf5ac58f9cc326f9d6afae06350_amadey_elex_glassworm_icedid_vidar.exe
5020	2026-08-20_0fe78bf5ac58f9cc326f9d6afae06350_amadey_elex_glassworm_icedid_vidar.exe
5020	2026-08-20_0fe78bf5ac58f9cc326f9d6afae06350_amadey_elex_glassworm_icedid_vidar.exe
5020	2026-08-20_0fe78bf5ac58f9cc326f9d6afae06350_amadey_elex_glassworm_icedid_vidar.exe
244	svchost_CAACABAAAACBAABACBAAACCACAABBBBBBBCCBABBCACBBAAAACBCBAC.exe
244	svchost_CAACABAAAACBAABACBAAACCACAABBBBBBBCCBABBCACBBAAAACBCBAC.exe
244	svchost_CAACABAAAACBAABACBAAACCACAABBBBBBBCCBABBCACBBAAAACBCBAC.exe
244	svchost_CAACABAAAACBAABACBAAACCACAABBBBBBBCCBABBCACBBAAAACBCBAC.exe
5864	svchost_BABABCBBCBACBAACCABABBACCCBABCBCCCAABBAABBCAABACBABCAAA.exe
5864	svchost_BABABCBBCBACBAACCABABBACCCBABCBCCCAABBAABBCAABACBABCAAA.exe
6012	svchost_CAACABAAAACBAABACBAAACCACAABBBBBBBCCBABBCACBBAAAACBCBAC.exe
6012	svchost_CAACABAAAACBAABACBAAACCACAABBBBBBBCCBABBCACBBAAAACBCBAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5020	2026-08-20_0fe78bf5ac58f9cc326f9d6afae06350_amadey_elex_glassworm_icedid_vidar.exe
Token: SeDebugPrivilege	244	svchost_CAACABAAAACBAABACBAAACCACAABBBBBBBCCBABBCACBBAAAACBCBAC.exe
Token: SeDebugPrivilege	5864	svchost_BABABCBBCBACBAACCABABBACCCBABCBCCCAABBAABBCAABACBABCAAA.exe
Token: SeDebugPrivilege	6012	svchost_CAACABAAAACBAABACBAAACCACAABBBBBBBCCBABBCACBBAAAACBCBAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 4752	5020	2026-08-20_0fe78bf5ac58f9cc326f9d6afae06350_amadey_elex_glassworm_icedid_vidar.exe	92
PID 4752 wrote to memory of 6032	4752	cmd.exe	94
PID 244 wrote to memory of 3692	244	svchost_CAACABAAAACBAABACBAAACCACAABBBBBBBCCBABBCACBBAAAACBCBAC.exe	95
PID 5020 wrote to memory of 5276	5020	2026-08-20_0fe78bf5ac58f9cc326f9d6afae06350_amadey_elex_glassworm_icedid_vidar.exe	98
PID 5276 wrote to memory of 2972	5276	cmd.exe	100
PID 5020 wrote to memory of 4684	5020	2026-08-20_0fe78bf5ac58f9cc326f9d6afae06350_amadey_elex_glassworm_icedid_vidar.exe	101
PID 4684 wrote to memory of 3020	4684	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-20_0fe78bf5ac58f9cc326f9d6afae06350_amadey_elex_glassworm_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_0fe78bf5ac58f9cc326f9d6afae06350_amadey_elex_glassworm_icedid_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACACBAAABCBAAABCCAABCBAAACACCAACCBAAACAAABCBBAABACBBABBBBCCCACBCCCCCBCCAAACBABABABACBABABBAABACACCCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACABAAAACBAABACBAAACCACAABBBBBBBCCBABBCACBBAAAACBCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACACBAAABCBAAABCCAABCBAAACACCAACCBAAACAAABCBBAABACBBABBBBCCCACBCCCCCBCCAAACBABABABACBABABBAABACACCCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACABAAAACBAABACBAAACCACAABBBBBBBCCBABBCACBBAAAACBCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABACAAAAACBBAAABBAAABABAABBAACAACBBBBCBBACBABBCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACABAAAACBAABACBAAACCACAABBBBBBBCCBABBCACBBAAAACBCBAC.exe" start= auto displayName= "UserDataSvc_BABACAAAAACBBAAABBAAABABAABBAACAACBBBBCBBACBABBCCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5276
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABACAAAAACBBAAABBAAABABAABBAACAACBBBBCBBACBABBCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACABAAAACBAABACBAAACCACAABBBBBBBCCBABBCACBBAAAACBCBAC.exe" start= auto displayName= "UserDataSvc_BABACAAAAACBBAAABBAAABABAABBAACAACBBBBCBBACBABBCCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABACAAAAACBBAAABBAAABABAABBAACAACBBBBCBBACBABBCCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABACAAAAACBBAAABBAAABABAABBAACAACBBBBCBBACBABBCCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3020

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACABAAAACBAABACBAAACCACAABBBBBBBCCBABBCACBBAAAACBCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACABAAAACBAABACBAAACCACAABBBBBBBCCBABBCACBBAAAACBCBAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:244
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3692

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCBBCBACBAACCABABBACCCBABCBCCCAABBAABBCAABACBABCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCBBCBACBAACCABABBACCCBABCBCCCAABBAABBCAABACBABCAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5864

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACABAAAACBAABACBAAACCACAABBBBBBBCCBABBCACBBAAAACBCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACABAAAACBAABACBAAACCACAABBBBBBBCCBABBCACBBAAAACBCBAC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 bab42002acf2427bddc53ede6f6891408231b26e051033b5d6e36ef79a1fad86
MD5 e31c7abaa23e793f4dd089ed84f55c91
SHA1 956e47f1614cd74c3b5cc5b9fc2762d4c841e4e8
SHA512 1698e878df491d0261c5bd6a42c966e8befc8ff2f876beb044a96a4c6376338706de5bb645cbee73937f3086d237421ed4f1e4cdd8e58e2c5449322404c3ef1d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Search\Data\qap`g`v~dtlq
Size 10B
SHA256 19c28aad8c1f04233859ace53aea8de6f1575c941e1a0ba52e67c3bc269ab7bb
MD5 ca8c95626f1f4b7f0757d6994d8a6ed3
SHA1 508dadbfb73cae1b7b63b8ab3bd1022af3bb6d1d
SHA512 5d3f0ef9be4c22a0e360a76d183cffb38c62e2dd82dc52aeb907dfe019aff85ce500c5d38c473dd18defa6445600d5ce046d92abcbbe12369d8802f0a4f4851c
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 2.1MB
SHA256 e385b0736bc7cfe00b040b2522ee44d80f857f13d10a1b1f4b2e7357404fea83
MD5 99521ab9e7f92ffa25b5bcdc81c4ecfe
SHA1 ea16ef6fefb789f7e60324de3137b5f7f3693c16
SHA512 73367bff0b9838d9bebb789d0ffaa1089b46fe3ecfe06c87e64feaab7090a205758d7ca798f52c9c921f5259d1b7dc038fb7e50311f889fc73e242b258c8366c
SSDEEP 49152:U+ES+EWqatglu+E7+Ey9+E7+EE+E7+EkUWgZ2HbbZt+jqpQ0CMm:yvWgZ2Hb9t+2xm
TLSH
T1AEA56D15F9424071D4660171488BD27E9B70BA24C7138EEBE3889EDEFFF26D16A36631
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\zh-TW\qap`g`v~dtlq
Size 10B
SHA256 bff3431fd1caf9aa5c7dbd36147194f5a6bb064071b2f81ffc247fbd0ad5b50c
MD5 cefd0258734f6f1ef71d295b3ce18428
SHA1 eb34d264eefc87bab2c371e7a1eb4b7c1e50eeb1
SHA512 42ab33f5fd22ff90aa9d8def80d6afc102bedad134775ef3123f41068d332d5a0963ce2d07500d656f4e78d66ed2447c72006d052729e2e3e83aeaea12b5f8fd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\qap`g`v~dtlq
Size 10B
SHA256 3420799db9f5b27d0c0c49e3b06a26d9671b52503542553e53cb5644268aa33a
MD5 263a497b240c3f89234da7f23e0a4a66
SHA1 0413e3cfee11986a1ed5110fc5156b1cbb54fcab
SHA512 dad4cd4c2d1811929bc7056b334a0cf72df22e926b9d2b73aa03803c69d6f7bdf91d03e9e52aac1d2abf470cb49a026c107c84122955ee4ac225c9685dbf926d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 256d29fd8a1e9afebdcfb9870507f636c475fa226f78c286a07b6dfde0a472d4
MD5 70746400212f318140ee56dc75f2e824
SHA1 025477219fb43faf9c2daa89b76cc85152325c20
SHA512 6cb4e8ef1fc5660dd17ad41e8e075822a9e5948fb940185c3360da450d7f5ac789f0ad6a6993c44e575eafdb5597e3f29791a60e1087269bf55febc4a3b5bac1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 af19c792435aa837543105ad61cbb25fc9bf18618c0f49e06bef0df0a617b83d
MD5 97661aca3c21d20bf2beec15f0c17b78
SHA1 1dca843e22f7a41d4b10c74f88fc22f7f42e6346
SHA512 dce365a2d0b11ef31003b507096cd75d130055c3a230b7b602c8641f197764e6f5713156d4a0bac6f73e8c21082064aeb9cef2d28b5b10e7239fc7d736106a1c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fde6d86ca13a45d6b24897f8752e4a1e4a9fc17850265d61bac2c633be5109e3
MD5 af1eb7907c04fe2ca2bab5a4e4a90ca9
SHA1 55eaece6b37facfe335f5050267465658f0a1237
SHA512 8ac48cd6a97b5659b512e0812aefd9afb184084587c4ec208fa0559bec3278d9bac14930be4e2ac68b438e749dd3ffa6cd52bc01a8ca0ad3294cff74b8fe1060
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ed96a6607a908b0364f721e1b2a89e017bd8b07067162c308f60e7d963254737
MD5 68ebdfe8495290c5ae86c9bf47a4c1f4
SHA1 9112183315c93c1c3727f5c2a1a55aa2115ecccb
SHA512 7d2d9be25910c4001be97da579f77ec3bb8c8485a99b0b729248f94b5aff3f07f93c74a3e137975db42d7dc6e06f9498e9117c5ff0b2b7e224d8c489857205b0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ba2cfce81b4576e136519ec15253c9ba47b16682adb44ff87dd186da70ced5eb
MD5 a2b625ac5eace78dc0acc26b1f7cf026
SHA1 566e6bdc11ea297cd025fb9ad0384c15de0b2172
SHA512 0bcd5826ee1cf11594f20dd03b050ffd2719592fcff7e437ddae7fbc180bf31bca03be3f6643f061b580feaf7b31b1e2f0d0f6ab818daba0f120c8b15ab8e52b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\qap`g`v~dtlq
Size 10B
SHA256 6b6fbc1ccfd52d2f629b8560557bf3ca2721096bd71dab4f1e946596d0134efe
MD5 d6af5796fdcb504ddbf57f6481b700d4
SHA1 651ba9e679fe729b06d716a52b86781e5ad5e20c
SHA512 0c94c17575a6437efcdc860db6433a51e95826e73aadf254713230d6521a31a843c09e87effa4070165a565d7565e84c5544329da2401865b1c11da01c5df3cb
MD5 SHA1 SHA512

Submit Download

svchost_CAACABAAAACBAABACBAAACCACAABBBBBBBCCBABBCACBBAAAACBCBAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACABAAAACBAABACBAAACCACAABBBBBBBCCBABBCACBBAAAACBCBAC.exe
Size 1.5MB
SHA256 24241343c020695926e6ff03b9351613a863e10683069500ce32d36ae9cbc143
MD5 0fe78bf5ac58f9cc326f9d6afae06350
SHA1 2c03f0ee37745b649ad8b8c8e953ec25384bd084
SHA512 35867480312dd0e08428d0bfc15ed186760ef2a6b2e30237f5d4ced2fdfb623c1eda29de8250fa3a1800474e4bd3a10ca80531f98c4da5b059f75d376987677c
SSDEEP 24576:m9+EM0q9+EM0JExqatgl8bl9+EM0v9+EM0gLD9+EM0v9+EM0k9+EM0v9+EM0VarI:U+ES+EWqatglu+E7+Ey9+E7+EE+E7+EP
TLSH
T125750809F94640B1D8260170498BD2BE8670B911CB134EEBE6498FEEFBF3BD16934675
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 461af3ea0daa03a1a7b9a1683bbfc87ee4de1765924ec726dcbe157db367cc17
MD5 1d52a1afc1f92828308ccd6eae9806bb
SHA1 a584ca3de14acde18a1dd9cb533af519e810eed1
SHA512 b6c26eb4ad71812d4721cbbd7984f5d42146efce148eae7960a88719ca0058f8bc9d97887d14219467cf69f12244357b0ca0fb866e0521417fbde7ffbdc611f8
TLSH
T19B1127B155F9DC63ED3328CB5626CCE21CFC319A286C6A24130E8619B7D5C32CE994E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 1d839485b559b3b3e8946514e1f627440a911608f2bbb9f01339d013927081f9
MD5 998c8d59200601fd262cbc5987ea9324
SHA1 c5cdc6351ee9e447e16bbb1fa8e0236bd734639c
SHA512 e15dbeada21df9abf13d6dc9f7e67646dfcaa252c44b8d370143255ac899a156ceeb45938b017ced463d6b7101d6e87bde3b493e1017e1a7564a9c67b59b9e7e
TLSH
T1D82126B155F8DC53ED3328CB9626DDE21CFC359A682C6A24130E8618B7D5C32CE894E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/244-31-0x00000000002F0000-0x0000000000311000-memory.dmp

Download

memory/5020-0-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/5020-7-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/5864-78-0x0000000000F40000-0x0000000000F61000-memory.dmp

Download

memory/6012-1451-0x00000000002F0000-0x0000000000311000-memory.dmp

Download